ci: rearchitect and streamline CI

.ci/build-agent-bundle.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+main() {
+  export BYOH_DEB_VERSION=${BYOH_DEB_VERSION:-$(make tag)}
+
+  echo 'alias shasum="sha512sum"' >>~/.bashrc
+  # shellcheck disable=SC1090 # sourcing the user's own ~/.bashrc, not a repo file shellcheck can resolve
+  source ~/.bashrc
+
+  echo "removing build/ if already present"
+  rm -rf build/
+  echo "started building byoh-agent binary"
+  make build-host-agent-binary
+
+  echo "started building deb package for byoh-agent"
+  make build-host-agent-deb
+
+  echo "created deb package under build/pf9-byohost/debsrc/ "
+}
+
+main "$@"

.ci/build-controller-manager.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+
+# build-controller-manager.sh - CI script for building the byoh controller manager Docker image.
+#
+# Parameters:
+# - IMAGE_REGISTRY  Registry to tag the Docker image for. By default 'quay.io/platform9/cluster-api-provider-bringyourownhost' is used.
+# - IMAGE_NAME      Name to use for this image. By default 'controller-manager' is used.
+# - IMAGE_TAG       Tag to use for the image. By default the output of `make tag` (git describe) is used.
+# - CONTAINER_TAG   Location of the container_tag file (used as an artifact in TeamCity)
+#
+# Examples:
+# - `USE_SYSTEM_GO=1 IMAGE_REGISTRY=quay.io IMAGE_NAME=platform9/cluster-api-provider-bringyourownhost/controller-manager IMAGE_TAG=latest ./build-controller-manager.sh`: To test the script locally without gimme
+
+set -o nounset
+set -o errexit
+set -o pipefail
+
+project_root=$(realpath "$(dirname "$0")/..")
+build_dir=${project_root}/build
+CONTAINER_TAG=${CONTAINER_TAG:-${build_dir}/manager-container-tag}
+CONTAINER_FULL_TAG=${CONTAINER_FULL_TAG:-${build_dir}/manager-container-full-tag}
+GO_VERSION=${GO_VERSION:-1.22.5}
+
+IMAGE_REGISTRY=${IMAGE_REGISTRY:-"quay.io/platform9/cluster-api-provider-bringyourownhost"}
+IMAGE_NAME=${IMAGE_NAME:-"controller-manager"}
+IMAGE_TAG=${IMAGE_TAG:-$(make --no-print-directory -C "${project_root}" tag)}
+IMAGE_NAME_TAG=${IMAGE_NAME}:${IMAGE_TAG}
+IMAGE_REGISTRY_NAME_TAG=${IMAGE_REGISTRY}/${IMAGE_NAME_TAG}
+
+# make -C implicitly enables --print-directory on some GNU Make versions
+# (confirmed: not on this repo's dev-Mac Make 3.81, but yes on the Ubuntu
+# CI runner's newer Make) -- without --no-print-directory above, the
+# "Entering directory" chatter leaks into IMAGE_TAG via command
+# substitution and corrupts the docker -t argument. Fail loud if it ever
+# recurs instead of silently building/pushing a mistagged image.
+if [[ "${IMAGE_TAG}" =~ [[:space:]] ]]; then
+  echo "ERROR: IMAGE_TAG contains whitespace, likely make output leaked into the tag: '${IMAGE_TAG}'" >&2
+  exit 1
+fi
+
+main() {
+  # Move to the project directory
+  pushd "${project_root}"
+  trap on_exit EXIT
+
+  if [ -n "${BASH_DEBUG:-}" ]; then
+    set -x
+    PS4='${BASH_SOURCE}.${LINENO} '
+  fi
+
+  info "Verifying prerequisites"
+  #which aws > /dev/null || (echo "error: missing required command 'aws'" && exit 1)
+  which docker >/dev/null || (echo "error: missing required command 'docker'" && exit 1)
+  # note: go and/or gimme are checked in configure_go
+
+  info "Preparing build environment"
+  mkdir -p "${build_dir}"
+
+  info "Configure go"
+  configure_go
+
+  # ensure vendor directory is present
+  go mod vendor
+
+  info "Build Docker image"
+  # Do not build the image with the registry prefix, because docker will think it is part of the name.
+  make docker-build IMG="${IMAGE_REGISTRY_NAME_TAG}"
+
+  info "Publish artifacts"
+  mkdir -p "$(dirname "${CONTAINER_TAG}")" "$(dirname "${CONTAINER_FULL_TAG}")"
+  echo -n "${IMAGE_TAG}" >"${CONTAINER_TAG}"
+  echo -n "${IMAGE_REGISTRY_NAME_TAG}" >"${CONTAINER_FULL_TAG}"
+  echo "Stored image tag in ${CONTAINER_TAG}:"
+  cat "${CONTAINER_TAG}" && echo ""
+  echo "Stored image full tag in ${CONTAINER_FULL_TAG}:"
+  cat "${CONTAINER_FULL_TAG}" && echo ""
+}
+
+on_exit() {
+  ret=$?
+  info "-------cleanup--------"
+  if [ -z "${SKIP_CLEANUP:-}" ]; then
+    make docker-clean IMG="${IMAGE_REGISTRY_NAME_TAG}" || true
+  fi
+  popd
+  exit ${ret}
+}
+
+configure_go() {
+  if [ -n "${USE_SYSTEM_GO:-}" ]; then
+    echo "\$USE_SYSTEM_GO set, using system go instead of gimme"
+    return 0
+  else
+    which gimme >/dev/null || (echo "error: missing required command 'gimme'" && exit 1)
+    eval "$(GIMME_GO_VERSION=${GO_VERSION} gimme)"
+  fi
+  which go
+  go version
+}
+
+RED='\033[1;31m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+info() { echo -e "${YELLOW}[INFO] $*${NC}" >&2; }
+fatal() {
+  echo >&2 "${RED}[FATAL] $*${NC}"
+  exit 1
+}
+
+# shellcheck disable=SC2068
+main $@

.ci/wait-for-job.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+# wait-for-job.sh - polls a GitHub Actions workflow for a specific job's completion
+# on a given commit. GitHub Actions has no native way to block on a job in a
+# different, independently-triggered workflow file, so this fills that gap.
+#
+# Usage: wait-for-job.sh <workflow-file> <job-name> <sha>
+# Required env: GH_TOKEN, GITHUB_REPOSITORY
+# Optional env: MAX_ATTEMPTS (default 60), POLL_INTERVAL_SECONDS (default 30)
+# On success, appends "run_id=<id>" to $GITHUB_OUTPUT (if set) and exits 0.
+
+main() {
+  local workflow=$1
+  local job_name=$2
+  local sha=$3
+  local max_attempts=${MAX_ATTEMPTS:-60}
+  local poll_interval=${POLL_INTERVAL_SECONDS:-30}
+  local attempt=1
+
+  while ((attempt <= max_attempts)); do
+    local run_id
+    run_id=$(gh run list --repo "${GITHUB_REPOSITORY}" --workflow "${workflow}" --commit "${sha}" \
+      --json databaseId --jq '.[0].databaseId // empty')
+
+    if [[ -n "${run_id}" ]]; then
+      local job_conclusion
+      # shellcheck disable=SC2016 # single-quoted on purpose: $name is a jq var bound via --arg, not a shell expansion
+      job_conclusion=$(gh run view "${run_id}" --repo "${GITHUB_REPOSITORY}" --json jobs |
+        jq -r --arg name "${job_name}" '.jobs[] | select(.name == $name) | .conclusion // empty')
+
+      case "${job_conclusion}" in
+      success)
+        echo "${job_name} succeeded (run ${run_id})"
+        if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+          echo "run_id=${run_id}" >>"${GITHUB_OUTPUT}"
+        fi
+        return 0
+        ;;
+      failure | cancelled)
+        echo "${job_name} did not succeed: ${job_conclusion}" >&2
+        return 1
+        ;;
+      esac
+    fi
+
+    echo "waiting for ${job_name} on ${workflow} (attempt ${attempt}/${max_attempts})..."
+    sleep "${poll_interval}"
+    ((attempt++))
+  done
+
+  echo "timed out waiting for ${job_name} on ${workflow}" >&2
+  return 1
+}
+
+main "$@"