release-s390x.yaml

name: Release s390x

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version tag (e.g., v1.0.5)'
        required: true
        type: string

permissions:
  contents: write
  packages: write

concurrency:
  group: release-s390x-${{ github.event.inputs.version || github.ref }}
  cancel-in-progress: false

env:
  GHCR_IMAGE: ghcr.io/${{ github.repository }}
  UPSTREAM_IMAGE: docker.io/rancher/system-agent

jobs:
  build-binary:
    runs-on: self-hosted
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Determine version
        id: version
        run: |
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT
          else
            echo "version=${{ github.ref_name }}" >> $GITHUB_OUTPUT
          fi

      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.version.outputs.version }}

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Build s390x binary
        env:
          GOOS: linux
          GOARCH: s390x
          CGO_ENABLED: "0"
        run: |
          go build -ldflags "-s -w -X main.Version=${{ steps.version.outputs.version }}" \
            -o bin/rancher-system-agent ./

      - name: Upload binary artifact
        uses: actions/upload-artifact@v4
        with:
          name: binary-s390x
          path: bin/rancher-system-agent
          if-no-files-found: error

  github-release:
    runs-on: self-hosted
    needs: build-binary
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure Git
        run: |
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"

      - name: Download binary
        uses: actions/download-artifact@v4
        with:
          name: binary-s390x
          path: dist

      - name: Rename and generate checksums
        working-directory: dist
        run: |
          mv rancher-system-agent rancher-system-agent-s390x
          sha256sum rancher-system-agent-s390x > sha256sum-s390x.txt
          cat sha256sum-s390x.txt

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ needs.build-binary.outputs.version }}"

          # Check if release exists
          if gh release view "$VERSION" >/dev/null 2>&1; then
            echo "Release $VERSION exists, uploading s390x assets..."
            gh release upload "$VERSION" dist/* --clobber
          else
            echo "Creating release $VERSION..."
            gh release create "$VERSION" \
              --title "Release $VERSION" \
              --notes "s390x binary release synced from rancher/system-agent $VERSION" \
              dist/*
          fi

  build-push-s390x-image:
    runs-on: self-hosted
    needs: build-binary
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download binary
        uses: actions/download-artifact@v4
        with:
          name: binary-s390x
          path: bin

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push s390x image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: package/Dockerfile
          platforms: linux/s390x
          push: true
          tags: |
            ${{ env.GHCR_IMAGE }}:${{ needs.build-binary.outputs.version }}-s390x

  create-multiarch-manifest:
    runs-on: self-hosted
    needs: [build-binary, build-push-s390x-image]
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create multi-arch manifest
        env:
          VERSION: ${{ needs.build-binary.outputs.version }}
        run: |
          echo "Creating multi-arch manifest for $VERSION"

          # Upstream publishes single multi-arch manifest - extract platform digests
          AMD64_DIGEST=$(docker buildx imagetools inspect ${{ env.UPSTREAM_IMAGE }}:${VERSION} --raw | \
            jq -r '.manifests[] | select(.platform.architecture=="amd64" and .platform.os=="linux") | .digest')
          ARM64_DIGEST=$(docker buildx imagetools inspect ${{ env.UPSTREAM_IMAGE }}:${VERSION} --raw | \
            jq -r '.manifests[] | select(.platform.architecture=="arm64" and .platform.os=="linux") | .digest')

          echo "amd64 digest: $AMD64_DIGEST"
          echo "arm64 digest: $ARM64_DIGEST"

          if [ -z "$AMD64_DIGEST" ] || [ -z "$ARM64_DIGEST" ]; then
            echo "::error::Failed to extract upstream digests"
            exit 1
          fi

          # Combine upstream platform images with our s390x image
          docker buildx imagetools create \
            -t ${{ env.GHCR_IMAGE }}:${VERSION} \
            -t ${{ env.GHCR_IMAGE }}:latest \
            ${{ env.UPSTREAM_IMAGE }}@${AMD64_DIGEST} \
            ${{ env.UPSTREAM_IMAGE }}@${ARM64_DIGEST} \
            ${{ env.GHCR_IMAGE }}:${VERSION}-s390x

      - name: Inspect manifest
        env:
          VERSION: ${{ needs.build-binary.outputs.version }}
        run: |
          docker buildx imagetools inspect ${{ env.GHCR_IMAGE }}:${VERSION}