call-build-linux-packages.yaml

---
name: Generate Linux packages
on:
  workflow_call:
    inputs:
      target-matrix:
        description: The build matrix of targets as a JSON build matrix.
        required: true
        type: string
      version:
        description: The version we are building for (as a numeric value 1.2.3).
        required: true
        type: string
      ref:
        description: The commit, SHA or branch to use in this repository.
        required: false
        type: string
        default: main
      nightly-build-info:
        description: Any special information to add to the nightly build information string.
        required: false
        type: string
        default: ""
      dockerhub-username:
        description: The Dockerhub username to use for authenticated pulls.
        required: false
        type: string
        default: ""
    secrets:
      gpg_private_key:
        description: The optional GPG key to use for signing the packages.
        required: false
      gpg_private_key_password:
        description: If the GPG key requires a password then specify here, otherwise not required.
        required: false
      dockerhub-token:
        description: The Dockerhub token to use for authenticated pulls (not pushes).
        required: false

env:
  # Set once from repo variable or override here for testing
  STEP_SECURITY_EGRESS_POLICY: ${{ vars.STEP_SECURITY_EGRESS_POLICY || 'audit' }}

permissions:
  contents: read

jobs:
  build-packages:
    name: agent - ${{ matrix.distro }} package build and upload
    # Pick runner based on distro - override via repo variables to switch runner pools without workflow changes, otherwise defaults are used
    runs-on: ${{ (contains(matrix.distro, 'arm') && (vars.LINUX_ARM_RUNNER || 'namespace-profile-ubuntu-latest-arm')) || (contains(matrix.distro, 'centos/6') && (vars.LINUX_AMD_LARGE_RUNNER || 'namespace-profile-ubuntu-latest-4cpu-16gb')) || (vars.LINUX_AMD_RUNNER || 'namespace-profile-ubuntu-latest') }}
    timeout-minutes: 60
    permissions:
      contents: read
      packages: read
    strategy:
      fail-fast: false
      matrix:
        distro: ${{ fromJson(inputs.target-matrix) }}
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}

      - name: Checkout ${{ inputs.ref }} code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.ref }}
          repository: telemetryforge/agent

      - name: Ensure we apply specific version from tag
        run: ./scripts/setup-code.sh
        shell: bash
        env:
          TELEMETRY_FORGE_AGENT_VERSION: ${{ inputs.version }}
          # Support legacy version variable for backwards compatibility
          FLUENTDO_AGENT_VERSION: ${{ inputs.version }}

      - name: Deltas
        run: git diff
        shell: bash

      # Must be removed on Namespace runners
      - name: Set up QEMU
        if: ${{ !contains( runner.name, 'nsc-' ) }}
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Set up Docker Buildx
        if: ${{ !contains( runner.name, 'nsc-' ) }}
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Get package name
        uses: ./.github/actions/get-package-name
        id: get_package_name
        with:
          distro: "${{ matrix.distro }}"

      - name: Log in to docker.io for authorised pulls
        if: inputs.dockerhub-username != ''
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ inputs.dockerhub-username }}
          password: ${{ secrets.dockerhub-token }}

      - name: Log in to the GHCR registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Use the upstream packaging script to keep consistent and up-to-date
      - name: ${{ matrix.distro }} artefacts
        run: |
          rm -rf source/packaging/packages/${{ matrix.distro }}/agent/
          set
          chmod +x ./build.sh
          ./build.sh
        env:
          FLB_DISTRO: ${{ matrix.distro }}
          FLB_OUT_DIR: agent
          FLB_NIGHTLY_BUILD: ${{ inputs.nightly-build-info }}
          # Optionally use separate caches for PRs to mainline
          # CACHE_ID: ${{ github.event_name != 'pull_request' && 'main' || 'pr' }}
        working-directory: source/packaging
        shell: bash

      # Create a workflow artefact using the contents of the distribution directory.
      # package-centos-7
      #
      # We also want this package to be the root directory so remove any extra nesting:
      # e.g. for centos/7 + standard we include everything from 'source/packaging/packages/centos/7/'
      - name: Upload the ${{ matrix.distro }} artefacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ steps.get_package_name.outputs.package-name }}
          path: |
            source/packaging/packages/${{ matrix.distro }}/agent
          if-no-files-found: error

      - name: List packages
        continue-on-error: true
        run: ls -lR source/packaging/packages/${{ matrix.distro }}/agent
        shell: bash

      - name: Debug package structure
        continue-on-error: true
        run: |
          find source/packaging/packages/ -type f -name '*.deb' -exec sh -c 'i="$1";echo "$i";dpkg -c "$i"' shell {} \;
          find source/packaging/packages/ -type f -name '*.rpm' -exec sh -c 'i="$1";echo "$i";docker run --rm -t -v "$PWD/$i":/test.rpm:ro registry.access.redhat.com/ubi9:9.5 rpm -qlp /test.rpm' shell {} \;
        shell: bash

      - name: List DEB package dependencies
        continue-on-error: true
        run: find source/packaging/packages/ -type f -name '*.deb' -exec sh -c 'i="$1";echo "$i";dpkg -I "$i"' shell {} \;
        shell: bash

      - name: List RPM package dependencies
        continue-on-error: true
        run: find source/packaging/packages/ -type f -name '*.rpm' -exec sh -c 'i="$1";echo "$i";docker run --rm -t -v "$PWD/$i":/test.rpm:ro registry.access.redhat.com/ubi9:9.5 yum -q deplist /test.rpm' shell {} \;
        shell: bash

      - name: CentOS 6 checks
        if: matrix.distro == 'centos/6'
        run: /bin/bash ./scripts/centos6-init-check.sh
        shell: bash