binary-build.yml

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

name: Build binary and container for single arch

permissions: {}

on:
  workflow_call:
    inputs:
      publishType:
        required: true
        type: string
      arch:
        required: true
        type: string
    outputs:
      isLatestRelease:
        value: ${{ jobs.build.outputs.isLatestRelease }}

env:
  EXPECTED_GO_VERSION: "1.25.0"

jobs:
  build:
    name: go build and validate
    runs-on: ${{ inputs.arch == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
    permissions:
      contents: read
    outputs:
      isLatestRelease: ${{ steps.build.outputs.isLatestRelease }}
    steps:
    - name: checkout
      uses: actions/checkout@v6
      with:
        path: repo
        # Patch releases need the full history to find the latest tag.
        fetch-depth: ${{ inputs.publishType == 'patch' && '0' || '1' }}
        persist-credentials: false

    - name: setup go 1.x
      uses: actions/setup-go@v6
      with:
        go-version: "~${{ env.EXPECTED_GO_VERSION }}"
      id: go

    - name: check active go version
      run: |
        go version && which go

    - name: check go.mod
      run: |
        set -x

        if grep -q "go $EXPECTED_GO_VERSION" ./repo/go.mod; then
          echo "go.mod has correct version ($EXPECTED_GO_VERSION)"
        else
          actual_version="$(grep -E '^go [0-9]+\.[0-9]+' ./repo/go.mod)"
          echo "go.mod has bad version expected:$EXPECTED_GO_VERSION, found: $actual_version"
          exit 1
        fi

    - name: Check for bad go formatting
      run: |
        set -x

        pushd repo/toolkit
        sudo env "PATH=$PATH" make go-fmt-all
        changes=$(git diff *.go)
        if [ -n "$changes" ]; then
          echo Unformatted go files!
          git diff *.go
          exit 1
        fi

    - name: check for out-of-date go modules
      run: |
        set -x

        pushd repo/toolkit
        sudo env "PATH=$PATH" make go-mod-tidy
        modchanges=$(git diff ../go.mod)
        sumchanges=$(git diff ../go.sum)
        if [ -n "$modchanges$sumchanges" ]; then
          echo Module files out of date!
          git diff ../go.mod
          git diff ../go.sum
          exit 1
        fi

    - name: check schema.json is up-to-date
      run: |
        set -x

        pushd repo
        make -C toolkit/tools/imagecustomizerschemacli/

        # Use git diff to check if the schema has changed
        schema_changes=$(git diff toolkit/tools/imagecustomizerapi/schema.json)
        if [ -n "$schema_changes" ]; then
          echo "Schema has changed. Please update the schema using `make -C toolkit/tools/imagecustomizerschemacli/` before committing."
          exit 1
        else
          echo "Schema is up-to-date!"
        fi

    - name: check vmtests types and formatting
      run: |
        set -eux

        sudo apt -y update

        # qemu-utils (qemu-img) is required to run tests later during the build
        sudo apt -y install libvirt-dev qemu-utils

        pushd repo/test/vmtests

        make create-venv
        make check

    - name: Check workflows
      if: inputs.arch == 'amd64'
      run: |
        set -eux

        sudo ./repo/.github/workflows/scripts/retry.sh 5 5 \
          curl -sSLo zizmor-x86_64-unknown-linux-gnu.tar.gz \
            https://github.com/zizmorcore/zizmor/releases/download/v1.12.1/zizmor-x86_64-unknown-linux-gnu.tar.gz

        tarHash="$(sha256sum zizmor-x86_64-unknown-linux-gnu.tar.gz | cut -d ' ' -f 1)"
        if [ "$tarHash" != "d73cd379078cae18d5439ce1f8716d30de5a4d2d29cac62cfbe01e6a8251fe0e" ]; then
          echo "Bad zizmor tarball"
          exit 1
        fi

        tar -xf zizmor-x86_64-unknown-linux-gnu.tar.gz
        ./zizmor --gh-token "$GITHUB_TOKEN" ./repo/
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Build binary
      id: build
      run: |
        set -x

        IS_LATEST_RELEASE=false

        # Create version suffix.
        case "$PUBLISH_TYPE" in
          "official")
            PRERELEASE_PARAM="IMAGE_CUSTOMIZER_VERSION_PREVIEW="
            IS_LATEST_RELEASE="true"
            ;;
          "patch")
            PATCH_VERSION="$(python3 ./repo/.github/workflows/scripts/next_patch_version.py)"
            PRERELEASE_PARAM="IMAGE_CUSTOMIZER_VERSION_PREVIEW= IMAGE_CUSTOMIZER_VERSION=$PATCH_VERSION"
            IS_LATEST_RELEASE="$(python3 ./repo/.github/workflows/scripts/is_latest_release.py "v${PATCH_VERSION}")"
            ;;
          "preview")
            PRERELEASE_PARAM="IMAGE_CUSTOMIZER_VERSION_PREVIEW=-preview.${{github.run_id}}"
            ;;
          "main")
            PRERELEASE_PARAM="IMAGE_CUSTOMIZER_VERSION_PREVIEW=-main.${{github.run_id}}"
            ;;
          *)
            PRERELEASE_PARAM="IMAGE_CUSTOMIZER_VERSION_PREVIEW=-dev.${{github.run_id}}"
            ;;
        esac

        echo "isLatestRelease=$IS_LATEST_RELEASE" >> "$GITHUB_OUTPUT"

        pushd repo/toolkit

        # Build binary.
        sudo env "PATH=$PATH" make imagecustomizer-targz go-osmodifier $PRERELEASE_PARAM

        # Write version to file.
        PACKAGE_VERSION="$(make --silent printvar-image_customizer_full_version $PRERELEASE_PARAM)"

        popd

        echo "$PACKAGE_VERSION" > "version.txt"

        # Print version.
        echo "Version: $PACKAGE_VERSION"
      env:
        PUBLISH_TYPE: ${{ inputs.publishType }}

    - name: Setup Notation CLI
      uses: notaryproject/notation-action/setup@b6fee73110795d6793253c673bd723f12bcf9bbb # v1.2.2

    - name: Build container
      run: |
        set -x

        ./repo/toolkit/tools/imagecustomizer/container/notation/notation-setup.sh

        CONTAINER_TAG="imagecustomizer:build"
        ./repo/toolkit/tools/imagecustomizer/container/build-container.sh -t "$CONTAINER_TAG" -a "$ARCH" -b

        docker image save "$CONTAINER_TAG" | gzip > "imagecustomizer.tar.gz"
      env:
        ARCH: ${{ inputs.arch }}

    - name: Run imagecustomizerapi tests
      run: |
        set -euxo pipefail

        pushd repo/toolkit/tools

        TEST_RESULTS_DIR="out/testResults/api"
        mkdir -p "$TEST_RESULTS_DIR"

        go test -v \
          -coverprofile="$TEST_RESULTS_DIR/api.cov" -covermode count \
          ./imagecustomizerapi \
          2>&1 \
          | tee "$TEST_RESULTS_DIR/api.txt"

    - uses: actions/upload-artifact@v7
      if: ${{ !cancelled() }}
      with:
        name: tests-results-api-${{ inputs.arch }}
        path: "$TEST_RESULTS_DIR"

    - name: Upload version artifact
      if: inputs.arch == 'amd64'
      uses: actions/upload-artifact@v7
      with:
        name: version
        path: version.txt

    - name: Upload binary artifact
      uses: actions/upload-artifact@v7
      with:
        name: binary-${{ inputs.arch }}
        path: repo/toolkit/out/imagecustomizer.tar.gz

    - name: Upload container artifact
      uses: actions/upload-artifact@v7
      with:
        name: container-${{ inputs.arch }}
        path: imagecustomizer.tar.gz

    - name: Upload osmodifier artifact
      uses: actions/upload-artifact@v7
      with:
        name: osmodifier-${{ inputs.arch }}
        path: repo/toolkit/out/tools/osmodifier