build.yaml

name: Branch Build and Test
on:
  workflow_dispatch:
  push:
    branches:
      - main
      - release/**
env:
  # Set once from repo variable or override here for testing
  STEP_SECURITY_EGRESS_POLICY: ${{ vars.STEP_SECURITY_EGRESS_POLICY || 'audit' }}

# Default to least permissions and then we can add as needed for each job.
# This is a secure by default approach and also makes it easier to reason
# about permissions for each job since they are not implicit from the workflow
permissions: read-all

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false
jobs:
  get-meta:
    name: Get meta information required for the build
    uses: ./.github/workflows/call-get-metadata.yaml
    permissions:
      contents: read
    with:
      get-version-from-tag: false
      use-full-linux-targets: false
      ref: ${{ github.ref }}
  build-image:
    uses: ./.github/workflows/call-build-containers.yaml
    needs:
      - get-meta
    permissions:
      contents: read
      packages: write
      id-token: write
    with:
      version: ${{ needs.get-meta.outputs.version }}
      ref: ${{ github.ref }}
      nightly-build-info: ${{ needs.get-meta.outputs.date }}
      dockerhub-username: ${{ vars.DOCKERHUB_USERNAME }}
    secrets:
      dockerhub-token: ${{ secrets.DOCKERHUB_PUBLIC_READ_TOKEN }}
      cosign_private_key: ${{ secrets.COSIGN_PRIVATE_KEY }}
      cosign_private_key_password: ${{ secrets.COSIGN_PASSWORD }}

  build-linux:
    uses: ./.github/workflows/call-build-linux-packages.yaml
    needs:
      - get-meta
    permissions:
      contents: read
      packages: read
    with:
      version: ${{ needs.get-meta.outputs.version }}
      ref: ${{ github.ref }}
      target-matrix: ${{ needs.get-meta.outputs.linux-targets }}
      nightly-build-info: ${{ needs.get-meta.outputs.date }}
      dockerhub-username: ${{ vars.DOCKERHUB_USERNAME }}
    secrets:
      dockerhub-token: ${{ secrets.DOCKERHUB_PUBLIC_READ_TOKEN }}

  build-windows:
    uses: ./.github/workflows/call-build-windows-packages.yaml
    needs:
      - get-meta
    permissions:
      contents: read
    with:
      version: ${{ needs.get-meta.outputs.version }}
      ref: ${{ github.ref }}
      nightly-build-info: ${{ needs.get-meta.outputs.date }}

  build-macos:
    uses: ./.github/workflows/call-build-macos-packages.yaml
    needs:
      - get-meta
    permissions:
      contents: read
    with:
      version: ${{ needs.get-meta.outputs.version }}
      ref: ${{ github.ref }}
      nightly-build-info: ${{ needs.get-meta.outputs.date }}

  test-containers:
    name: Test container images
    uses: ./.github/workflows/call-test-containers.yaml
    with:
      image: ${{ matrix.image-base }}
      image-tag: ${{ needs.build-image.outputs.version }}
      ref: ${{ github.ref }}
    secrets:
      github-token: ${{ secrets.GITHUB_TOKEN }}
    needs:
      - get-meta
      - build-image
    permissions:
      packages: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        image-base:
          - ${{ needs.get-meta.outputs.ubi-image-base }}
          - ${{ needs.get-meta.outputs.debian-image-base }}

  test-packages:
    name: Test packages
    needs:
      - get-meta
      - build-linux
    uses: ./.github/workflows/call-test-packages.yaml
    permissions:
      contents: read
      packages: read
    with:
      build-matrix: ${{ needs.get-meta.outputs.linux-targets }}
      version: ${{ needs.get-meta.outputs.version }}
      ref: ${{ github.ref }}
      dockerhub-username: ${{ vars.DOCKERHUB_USERNAME }}
    secrets:
      dockerhub-token: ${{ secrets.DOCKERHUB_PUBLIC_READ_TOKEN }}
      github-token: ${{ secrets.GITHUB_TOKEN }}

  # Staging upload: signs packages and uploads to GCS staging for every commit on main/release branches.
  # The actual GitHub release is only created for version tags (handled by release-build.yaml).
  staging-upload:
    name: Sign and upload staging artefacts
    needs:
      - get-meta
      - build-linux
      - build-windows
      - build-macos
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      id-token: write
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}

      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Authenticate with GCP
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: "projects/841522437311/locations/global/workloadIdentityPools/github-actions/providers/github-actions"
          service_account: "terraform-infra@infrastructure-464010.iam.gserviceaccount.com"

      - name: Sign packages
        # Ignore any failures so we upload anything we do have
        continue-on-error: true
        uses: ./.github/actions/sign-packages

      - name: Upload packages to Google Cloud Storage
        id: upload-packages
        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
        with:
          path: output/
          # We still use the old buckets from before our rename
          destination: fluentdo-agent-staging/${{ needs.get-meta.outputs.version }}/

  # Required to support our auto-release cron job that looks for the last successful build.
  # This job is required for the auto-release workflow to work as we search for its name.
  tests-complete:
    name: All tests complete
    # We use this to always run even if a previous job fails or is skipped (which we check for)
    if: always()
    needs:
      - build-linux
      - build-windows
      - build-macos
      - build-image
      - test-containers
      # TODO: remove once failures are resolved to ensure auto-release job still goes ahead with latest commit
      # https://github.com/telemetryforge/agent/issues/73
      # - test-packages
      # Add additional jobs here as required that must complete
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}

      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          # Add any jobs that can be skipped here to avoid failure of this job
          # allowed-skips: build-macos
          # Convert the needs object to JSON to pass it in
          jobs: ${{ toJSON(needs) }}
      - name: All tests complete
        run: echo "All tests complete"
        shell: bash