build-pkg.yaml

name: build-pkg
on:
  workflow_call:
    inputs:
      os:
        type: string
        required: true
      arch:
        type: string
        required: true
      output_arch:
        type: string
        required: true
      version:
        type: string
        required: true
      tag:
        type: string
        required: true

permissions:
  # This is required for configure-aws-credentials to request an OIDC JWT ID token to access AWS resources later on.
  # More info: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
  id-token: write
  # This is required for actions/checkout
  contents: read

env:
  GO_VERSION: '1.22.9'

jobs:
  build:
    runs-on:
      [
        self-hosted,
        release,
        '${{ inputs.os }}',
        '${{ inputs.arch }}',
        '${{ inputs.version }}',
      ]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.tag }}
          fetch-depth: 0
          persist-credentials: false
          submodules: true
      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false
      - name: Build for macOS ${{ inputs.version }} (${{ inputs.output_arch }})
        run: |
          brew install lz4 automake autoconf libtool yq llvm
          git status
          git clean -f -d
          make clean
          make download-licenses 
          make FINCH_OS_IMAGE_LOCATION_ROOT=/Applications/Finch
        shell: zsh {0}

      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: ${{ secrets.ROLE }}
          role-session-name: dependency-upload-session
          aws-region: ${{ secrets.REGION }}

      - id: final
        name: generate pkg
        run: |
          ./installer-builder/tools/release-installer.sh \
            ${{ inputs.output_arch }} \
            ${{ inputs.tag }} \
            ${{ secrets.INSTALLER_PRIVATE_BUCKET_NAME }} \
            ${{ secrets.EXECUTABLE_BUCKET }} \
            ${{ secrets.PKG_BUCKET }} \
            ${{ secrets.NOTARIZATION_ACCOUNT }} \
            ${{ secrets.NOTARIZATION_CREDENTIAL }}
        shell: zsh {0}