build-agent.yml

name: Build Agent

on:
  push:
    branches: [ master ]
    tags:
      - v*
    paths:
    - 'agent/**'
    - '.github/workflows/build-agent.yml'

  pull_request:
    branches: [ master ]
    paths:
    - 'agent/**'
    - '.github/workflows/build-agent.yml'

jobs:
  build:
    runs-on: ubuntu-24.04

    steps:
      - name: checkout code
        uses: actions/checkout@v6

      - name: login to docker hub
        if: "github.event_name != 'pull_request'"
        run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set github reference env
        run: echo RELEASE_VERSION=${GITHUB_REF#refs/*/} >> $GITHUB_ENV

      - name: Set image tag
        run: |
          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
            echo "IMAGE_TAG=${{ env.RELEASE_VERSION }},latest" >> $GITHUB_ENV
            echo "BUILD_ARGS=--build-arg SHELLHUB_VERSION=${{ env.RELEASE_VERSION }}" >> $GITHUB_ENV
          else
            echo "IMAGE_TAG=${{ github.sha }}" >> $GITHUB_ENV
            echo "BUILD_ARGS=" >> $GITHUB_ENV
          fi

      - name: Build and push multiarch image
        run: |
          TAGS=""
          IFS=',' read -ra TAG_ARRAY <<< "${{ env.IMAGE_TAG }}"
          for tag in "${TAG_ARRAY[@]}"; do
            TAGS="$TAGS --tag shellhubio/agent:$tag"
          done

          docker buildx build \
            --platform linux/amd64,linux/arm64/v8,linux/arm/v7,linux/arm/v6,linux/386 \
            --file agent/Dockerfile \
            $TAGS \
            ${{ env.BUILD_ARGS }} \
            ${{ github.event_name != 'pull_request' && '--push' || '' }} \
            --provenance=false \
            .

      - name: Export architecture-specific rootfs
        if: "contains(github.ref, 'refs/tags/v')"
        run: |
          mkdir -p rootfs
          for arch in amd64 arm64v8 armv7 armv6 i386; do
            case $arch in
              amd64) platform="linux/amd64" ;;
              arm64v8) platform="linux/arm64/v8" ;;
              armv7) platform="linux/arm/v7" ;;
              armv6) platform="linux/arm/v6" ;;
              i386) platform="linux/386" ;;
            esac

            # Build single architecture image for export
            docker buildx build \
              --platform $platform \
              --file agent/Dockerfile \
              --tag shellhubio/agent:${{ env.RELEASE_VERSION }}-$arch \
              ${{ env.BUILD_ARGS }} \
              --load \
              --provenance=false \
              .

            # Export rootfs
            docker export $(docker create shellhubio/agent:${{ env.RELEASE_VERSION }}-$arch) | gzip > rootfs/rootfs-$arch.tar.gz
          done

      - name: Upload rootfs artifacts
        if: "contains(github.ref, 'refs/tags/v')"
        uses: actions/upload-artifact@v5
        with:
          name: rootfs-artifacts
          path: rootfs/*.tar.gz


  build-binaries:
    if: "contains(github.ref, 'refs/tags/v')"
    needs: build
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: linux
            goarch: arm
            goarm: 7
          - goos: linux
            goarch: arm
            goarm: 6
          - goos: linux
            goarch: 386
    steps:
      - name: checkout code
        uses: actions/checkout@v6

      - name: setup go
        uses: actions/setup-go@v6
        with:
          go-version: '1.24.9'

      - name: Set release version
        run: echo RELEASE_VERSION=${GITHUB_REF#refs/*/} >> $GITHUB_ENV

      - name: build agent binary
        env:
          CGO_ENABLED: 0
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          GOARM: ${{ matrix.goarm }}
        run: |
          cd agent
          BINARY_NAME="shellhub-agent-${{ matrix.goos }}-${{ matrix.goarch }}"
          if [ -n "${{ matrix.goarm }}" ]; then
            BINARY_NAME="${BINARY_NAME}v${{ matrix.goarm }}"
          fi
          go build -ldflags "-s -w -X main.AgentVersion=${{ env.RELEASE_VERSION }}" -o "$BINARY_NAME" .
          gzip "$BINARY_NAME"

      - name: upload binary artifact
        uses: actions/upload-artifact@v5
        with:
          name: agent-binary-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.goarm && format('v{0}', matrix.goarm) || '' }}
          path: agent/shellhub-agent-*.gz

  vendored-tarball:
    if: "contains(github.ref, 'refs/tags/v')"
    needs: build
    runs-on: ubuntu-24.04
    steps:
      - name: checkout code
        uses: actions/checkout@v6

      - name: export agent tarball
        run: |
          cd ./agent && go mod vendor && cd .. && tar czf shellhub-agent.tar.gz agent

      - name: upload agent tarball artifact
        uses: actions/upload-artifact@v5
        with:
          name: shellhub-agent
          path: shellhub-agent.tar.gz

  draft:
    if: "contains(github.ref, 'refs/tags/v')"
    needs: [build-binaries, vendored-tarball]
    runs-on: ubuntu-latest
    steps:
      - name: download rootfs artifacts
        uses: actions/download-artifact@v6
        with:
          name: rootfs-artifacts
      - name: download agent binaries
        uses: actions/download-artifact@v6
        with:
          pattern: agent-binary-*
          merge-multiple: true
      - name: download vendored tarball
        uses: actions/download-artifact@v6
        with:
          name: shellhub-agent
      - name: release draft
        uses: softprops/action-gh-release@v2
        with:
          draft: true
          generate_release_notes: true
          files: |
            rootfs-*.tar.gz
            shellhub-agent-*.gz
            shellhub-agent.tar.gz