provide-artifacts.yaml

name: Provide monitor artifacts

on:
  pull_request:
    branches:
      - main
    paths:
      - qemu/**
      - solo5/**
      - firecracker/**
      - virtiofsd/**
  push:
    branches:
      - main
    paths:
      - qemu/**
      - solo5/**
      - firecracker/**
      - virtiofsd/**

jobs:
  get-versions:
    name: Get the versions of all artifacts from their respeective VERSION files
    runs-on: ubuntu-latest
    outputs:
      qemu_version: ${{ steps.versions.outputs.qemu_version }}
      solo5_version: ${{ steps.versions.outputs.solo5_version }}
      firecracker_version: ${{ steps.versions.outputs.firecracker_version }}
      virtiofsd_version: ${{ steps.versions.outputs.virtiofsd_version }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

      - name: Get versions to build
        id: versions
        run: |
          QEMU_VERSION="$(cat qemu/VERSION)"
          SOLO5_VERSION="$(cat solo5/VERSION)"
          FIRECRACKER_VERSION="$(cat firecracker/VERSION)"
          VIRTIOFSD_VERSION="$(cat virtiofsd/VERSION)"
          echo "qemu_version=$QEMU_VERSION" >> $GITHUB_OUTPUT
          echo "solo5_version=$SOLO5_VERSION" >> $GITHUB_OUTPUT
          echo "firecracker_version=$FIRECRACKER_VERSION" >> $GITHUB_OUTPUT
          echo "virtiofsd_version=$VIRTIOFSD_VERSION" >> $GITHUB_OUTPUT
          echo "$QEMU_VERSION"
          echo "$SOLO5_VERSION"
          echo "$FIRECRACKER_VERSION"
          echo "$VIRTIOFSD_VERSION"

  check-release-existence:
    name: Check if release already exists
    needs: [get-versions]
    runs-on: ubuntu-latest
    outputs: 
      release: ${{ steps.release.outputs.name }}
      qemu_hash: ${{ steps.name.outputs.hash }}
      exists: ${{ steps.check.outputs.exists }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

      - name: Generate Qemu artifact name
        id: name
        run: |
          QEMU_AMD64_CONFIG=$( sort qemu/amd64.config )
          QEMU_ARM64_CONFIG=$( sort qemu/arm64.config )
          QEMU_IGNORE_LIST=$( sort qemu/unnecessary_files.txt )
          QEMU_FILES_HASH=$( echo $QEMU_AMD64_CONFIG $QEMU_ARM64_CONFIG $QEMU_IGNORE_LIST | md5sum | cut -d ' ' -f 1)
          echo "hash=${QEMU_FILES_HASH}" >> $GITHUB_OUTPUT
          echo "full=qemu-amd64-${{ needs.get-versions.outputs.qemu_version }}-${QEMU_FILES_HASH}" >> $GITHUB_OUTPUT

      - name: Generate release name
        id: release
        run: |
          SHORT_HASH=$(echo ${{ steps.name.outputs.hash }} | cut -c1-5)
          echo "name=FC-${{ needs.get-versions.outputs.firecracker_version }}_S5-${{ needs.get-versions.outputs.solo5_version }}_VFS_-${{ needs.get-versions.outputs.virtiofsd_version }}_QM-${{ needs.get-versions.outputs.qemu_version }}-${SHORT_HASH}" >> $GITHUB_OUTPUT
          echo "qemu=${{ needs.get-versions.outputs.qemu_version }}-${SHORT_HASH}" >> $GITHUB_OUTPUT

      - name: Check if release exists
        id: check
        run: |
          RELEASES=$(curl -s -H "Accept: application/vnd.github.v3+json" \
                      -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
                      "https://api.github.com/repos/${{ github.repository }}/releases" \
                      | jq -r '.[].name')
          if echo "$RELEASES" | grep -q "${{ steps.release.outputs.name }}"
          then
            echo "Release already exists! Skipping creation."
            echo "exists=true" >> $GITHUB_OUTPUT
          else
            echo "Release does not exist! Let's create it."
            echo "exists=false" >> $GITHUB_OUTPUT
          fi

  tag-parent: 
    name: Tag Parent Repository
    needs: [check-release-existence]
    if: ${{ github.event_name == 'push' && 
            needs.check-release-existence.outputs.exists == 'false' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit

      - name: Tag Parent Repository
        uses: gntouts/tag-remote-repo-action@b3c9868dbb01f9ea3875289e783d1a2478b7ea88 # v1.0.0
        id: tag_parent
        with:
          repository: ${{ github.repository }}
          tag: ${{ needs.check-release-existence.outputs.release }}
          token: ${{ secrets.GITHUB_TOKEN }}
          skip_update: true

      - name: Log outputs
        env:
          REPOSITORY: ${{ github.repository }}
          VERSION: ${{steps.tag_parent.outputs.tag}}
          RESULT: ${{ steps.tag_parent.outputs.result }}
          MESSAGE: ${{ steps.tag_parent.outputs.message }}
          TAG: ${{ steps.tag_parent.outputs.tag }}
          COMMIT: ${{ steps.tag_parent.outputs.commit }}
        run: |
          echo "Repository: $REPOSITORY"
          echo "Version: $VERSION"
          echo "Result: $RESULT"
          echo "Message: $MESSAGE"
          echo "Tag: $TAG"
          echo "Commit: $COMMIT"

  build-Qemu-artifacts:
    name: Check and build missing Qemu artifacts
    needs: [get-versions]
    uses: ./.github/workflows/qemu_build.yaml
    with:
      qemu_version: ${{ needs.get-versions.outputs.qemu_version }}
      arch: '["amd64", "arm64"]'
    secrets: inherit

  build-Solo5-artifacts:
    name: Check and build missing Solo5 artifacts
    needs: [get-versions]
    uses: ./.github/workflows/solo5_build.yaml
    with:
      solo5_version: ${{ needs.get-versions.outputs.solo5_version }}
      arch: '["amd64", "arm64"]'
    secrets: inherit

  build-Virtiofsd-artifacts:
    name: Check and build missing Virtiofsd artifact
    needs: [get-versions]
    uses: ./.github/workflows/virtiofsd_build.yaml
    with:
      virtiofsd_version: ${{ needs.get-versions.outputs.virtiofsd_version }}
      arch: '["amd64", "arm64"]'
    secrets: inherit

  create-new-release:
    name: Create new release
    needs: [get-versions,check-release-existence,tag-parent,build-Qemu-artifacts,build-Solo5-artifacts,build-Virtiofsd-artifacts]
    if: ${{ github.event_name == 'push' && 
            needs.check-release-existence.outputs.exists == 'false' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:

      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit

      - name: Download Qemu amd64 artifacts
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: qemu-amd64-${{ needs.build-Qemu-artifacts.outputs.artifact_suffix }}
          path: /tmp/qemu_amd64
          run-id: ${{ needs.build-Qemu-artifacts.outputs.artifact_run_id }}
          merge-multiple: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Qemu arm64 artifacts
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: qemu-arm64-${{ needs.build-Qemu-artifacts.outputs.artifact_suffix }}
          path: /tmp/qemu_arm64
          run-id: ${{ needs.build-Qemu-artifacts.outputs.artifact_run_id }}
          merge-multiple: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Solo5 amd64 artifacts
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          pattern: solo5-*-amd64-${{ needs.build-Solo5-artifacts.outputs.artifact_suffix }}
          path: /tmp/solo5_amd64
          run-id: ${{ needs.build-Solo5-artifacts.outputs.artifact_run_id }}
          merge-multiple: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Solo5 arm64 artifacts
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          pattern: solo5-*-arm64-${{ needs.build-Solo5-artifacts.outputs.artifact_suffix }}
          path: /tmp/solo5_arm64
          run-id: ${{ needs.build-Solo5-artifacts.outputs.artifact_run_id }}
          merge-multiple: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Virtiofsd amd64 artifacts
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: virtiofsd-amd64-${{ needs.build-Virtiofsd-artifacts.outputs.artifact_suffix }}
          path: /tmp/virtiofsd_amd64
          run-id: ${{ needs.build-Virtiofsd-artifacts.outputs.artifact_run_id }}
          merge-multiple: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Virtiofsd arm64 artifacts
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: virtiofsd-arm64-${{ needs.build-Virtiofsd-artifacts.outputs.artifact_suffix }}
          path: /tmp/virtiofsd_arm64
          run-id: ${{ needs.build-Virtiofsd-artifacts.outputs.artifact_run_id }}
          merge-multiple: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Firecracker amd64 binary
        run: |
          FC_RELEASE_URL="https://github.com/firecracker-microvm/firecracker/releases"
          curl -L ${FC_RELEASE_URL}/download/${{ needs.get-versions.outputs.firecracker_version }}/firecracker-${{ needs.get-versions.outputs.firecracker_version }}-x86_64.tgz | tar -xz
          mkdir /tmp/fc_amd64
          mv release-${{ needs.get-versions.outputs.firecracker_version }}-x86_64/firecracker-${{ needs.get-versions.outputs.firecracker_version }}-x86_64 /tmp/fc_amd64/firecracker

      - name: Download Firecracker arm64 binary
        run: |
          FC_RELEASE_URL="https://github.com/firecracker-microvm/firecracker/releases"
          curl -L ${FC_RELEASE_URL}/download/${{ needs.get-versions.outputs.firecracker_version }}/firecracker-${{ needs.get-versions.outputs.firecracker_version }}-aarch64.tgz | tar -xz
          mkdir /tmp/fc_arm64
          mv release-${{ needs.get-versions.outputs.firecracker_version }}-aarch64/firecracker-${{ needs.get-versions.outputs.firecracker_version }}-aarch64 /tmp/fc_arm64/firecracker

      - name: Package all artifacts
        run: |
          chmod +x /tmp/fc_amd64/firecracker
          mv /tmp/fc_amd64/firecracker /tmp/qemu_amd64/opt/urunc/bin/
          chmod +x /tmp/solo5_amd64/solo5-hvt
          mv /tmp/solo5_amd64/solo5-hvt /tmp/qemu_amd64/opt/urunc/bin/
          chmod +x /tmp/solo5_amd64/solo5-spt
          mv /tmp/solo5_amd64/solo5-spt /tmp/qemu_amd64/opt/urunc/bin/
          chmod +x /tmp/virtiofsd_amd64/virtiofsd_static
          mv /tmp/virtiofsd_amd64/virtiofsd_static /tmp/qemu_amd64/opt/urunc/bin/virtiofsd
          chmod +x /tmp/qemu_amd64/opt/urunc/bin/qemu-system-x86_64
          tar -C /tmp/qemu_amd64/opt -czf release-amd64-${{ needs.check-release-existence.outputs.release }}.tar.gz .
          chmod +x /tmp/fc_arm64/firecracker
          mv /tmp/fc_arm64/firecracker /tmp/qemu_arm64/opt/urunc/bin/
          chmod +x /tmp/solo5_arm64/solo5-hvt
          mv /tmp/solo5_arm64/solo5-hvt /tmp/qemu_arm64/opt/urunc/bin/
          chmod +x /tmp/solo5_arm64/solo5-spt
          mv /tmp/solo5_arm64/solo5-spt /tmp/qemu_arm64/opt/urunc/bin/
          chmod +x /tmp/virtiofsd_arm64/virtiofsd_static
          mv /tmp/virtiofsd_arm64/virtiofsd_static /tmp/qemu_arm64/opt/urunc/bin/virtiofsd
          chmod +x /tmp/qemu_arm64/opt/urunc/bin/qemu-system-aarch64
          tar -C /tmp/qemu_arm64/opt -czf release-arm64-${{ needs.check-release-existence.outputs.release }}.tar.gz .
          echo "This release contains statically-built artifacts for both amd64 and arm64 of the following monitors and tools:" > release_notes.txt
          echo "- Qemu: ${{ needs.get-versions.outputs.firecracker_version }}" >> release_notes.txt
          echo "- Solo5(hvt and spt): ${{ needs.get-versions.outputs.solo5_version }}" >> release_notes.txt
          echo "- Firecracker: ${{ needs.get-versions.outputs.firecracker_version }}" >> release_notes.txt
          echo "- Virtiofsd: ${{ needs.get-versions.outputs.virtiofsd_version }}" >> release_notes.txt
          echo "" >> release_notes.txt
          echo "The hash of the Qemu files is: ${{ needs.check-release-existence.outputs.qemu_hash }}" >> release_notes.txt

      - name: Create release
        uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
        id: create_release
        with:
          files: |
            release-amd64-${{ needs.check-release-existence.outputs.release }}.tar.gz
            release-arm64-${{ needs.check-release-existence.outputs.release }}.tar.gz
          body_path: "release_notes.txt"
          name: ${{ needs.check-release-existence.outputs.release }}
          draft: false
          prerelease: true
          generate_release_notes: false
          tag_name: ${{ needs.check-release-existence.outputs.release }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  comment-artifact-links:
    name: Post links for artifacts
    needs: [get-versions,check-release-existence,build-Qemu-artifacts,build-Solo5-artifacts,build-Virtiofsd-artifacts]
    if: ${{ github.event_name == 'pull_request' && 
            needs.check-release-existence.outputs.exists == 'false' }}
    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write
    steps:

      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit

      - name: Set download links
        id: links
        run: |
          RUNS_URL="https://github.com/${{ github.repository }}/actions/runs"
          QEMU_LINK="${RUNS_URL}/${{ needs.build-Qemu-artifacts.outputs.artifact_run_id }}"
          SOLO5_LINK="${RUNS_URL}/${{ needs.build-Solo5-artifacts.outputs.artifact_run_id }}"
          VIRTIOFSD_LINK="${RUNS_URL}/${{ needs.build-Virtiofsd-artifacts.outputs.artifact_run_id }}"

          FC_RELEASE_URL="https://github.com/firecracker-microvm/firecracker/releases"
          FC_LINK="${FC_RELEASE_URL}/download/${{ needs.get-versions.outputs.firecracker_version }}"
          echo "qemu=${QEMU_LINK}" >> $GITHUB_OUTPUT
          echo "solo5=${SOLO5_LINK}" >> $GITHUB_OUTPUT
          echo "virtiofsd=${VIRTIOFSD_LINK}" >> $GITHUB_OUTPUT
          echo "firecracker=${FC_LINK}" >> $GITHUB_OUTPUT
          if ${{ needs.check-release-existence.outputs.exists == 'false' }}
          then
            echo "release=" >> $GITHUB_OUTPUT
          else
            echo "release=https://github.com/${{ github.repository }}/releases/tag/${{ needs.check-release-existence.outputs.release }}" >> $GITHUB_OUTPUT
          fi

      - name: Add ccomment
        uses: actions/github-script@v8
        env:
          QEMU_TEXT: "Qemu ${{ needs.build-Qemu-artifacts.outputs.artifact_suffix }}: ${{ steps.links.outputs.qemu }}"
          SOLO5_TEXT: "Solo5 ${{ needs.build-Solo5-artifacts.outputs.artifact_suffix }}: ${{ steps.links.outputs.solo5 }}"
          VFS_TEXT: "Virtiofsd ${{ needs.build-Virtiofsd-artifacts.outputs.artifact_suffix }}: ${{ steps.links.outputs.virtiofsd }}"
          FC_TEXT: "Firecracker ${{ needs.get-versions.outputs.firecracker_version }}: ${{ steps.links.outputs.firecracker }}"
        with:
          script: |
            const body = `
            Links to download artifacts for amd64 and aarch64 architectures:
            - ${process.env.QEMU_TEXT}
            - ${process.env.SOLO5_TEXT}
            - ${process.env.VFS_TEXT}
            - ${process.env.FC_TEXT}
            `;
            await github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body
            })