pkg-release-reusable-workflow.yml

# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
# SPDX-License-Identifier: BSD-3-Clause
# =============================================================================
# Reusable RPM release workflow
# =============================================================================
# Called by pkg-rpm-* packaging repos to build and publish a released RPM to
# JFrog Artifactory. Mirrors the Ubuntu pkg-release-reusable-workflow.yml:
#   1. build   - reuses pkg-build-reusable-workflow.yml (release=true, so any
#                upstream-fetched source tarballs are cached back).
#   2. publish - gated by the `pkg-release-approval` environment; downloads the
#                build artifact and uploads the RPMs to Artifactory.
# =============================================================================
name: Reusable RPM Release

on:
  workflow_call:
    inputs:
      qcom-rpm-utils-ref:
        description: "Git ref of qcom-rpm-utils to pin the build tooling to"
        type: string
        required: false
        default: main
      builder-image:
        description: "Override the rpm-builder toolchain image (default: ghcr.io/<owner>/rpm-builder:centos10)"
        type: string
        required: false
        default: ""
      extra-repo:
        description: "Extra dnf repo URL to register for BuildRequires resolution"
        type: string
        required: false
        default: ""
      cache-base-url:
        description: "Base URL of the lookaside cache holding source tarballs"
        type: string
        required: true
      cache-path-template:
        description: "Lookaside path template appended to cache-base-url"
        type: string
        required: false
        default: "{filename}/{hashtype}/{hash}/{filename}"
      server-url:
        description: "Artifactory server URL"
        type: string
        required: false
        default: "https://qartifactory.pe.jfrog.io"
      target-repo:
        description: >
          Artifactory YUM/RPM repo to publish to.
        type: string
        required: false
        default: "qsc-rpm-releases-stage"
      distro:
        description: "Distribution name; first path segment under target-repo"
        type: string
        required: false
        default: "centos"
      distro-version:
        description: "Distribution major version"
        type: string
        required: false
        default: "10"
      channel:
        description: "Release channel directory (os, nightly)"
        type: string
        required: false
        default: "os"
    secrets:
      QSC_API_KEY:
        description: "QSC API key used to obtain an Artifactory access token. Takes precedence over ARTIFACTORY_ACCESS_TOKEN when both are set."
        required: false
      ARTIFACTORY_ACCESS_TOKEN:
        description: "Pre-generated Artifactory access token. Used when QSC_API_KEY is not set."
        required: false

permissions:
  contents: read
  packages: read

jobs:
  build:
    name: Build
    uses: ./.github/workflows/pkg-build-reusable-workflow.yml
    with:
      qcom-rpm-utils-ref: ${{ inputs.qcom-rpm-utils-ref }}
      builder-image: ${{ inputs.builder-image }}
      extra-repo: ${{ inputs.extra-repo }}
      release: true
      cache-base-url: ${{ inputs.cache-base-url }}
      cache-path-template: ${{ inputs.cache-path-template }}
      target-repo: ${{ inputs.target-repo }}
      server-url: ${{ inputs.server-url }}
    secrets:
      QSC_API_KEY: ${{ secrets.QSC_API_KEY }}
      ARTIFACTORY_ACCESS_TOKEN: ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}

  publish:
    name: Publish to Artifactory
    needs: build
    runs-on: [self-hosted, platform-prd-u2404-arm64-large-od-ephem]
    environment: pkg-release-approval
    steps:
      - name: Verify a publish credential is configured
        env:
          QSC_API_KEY: ${{ secrets.QSC_API_KEY }}
          ARTIFACTORY_ACCESS_TOKEN: ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}
        run: |
          set -euo pipefail
          if [[ -n "${QSC_API_KEY}" ]]; then
            echo "Publish credential: QSC_API_KEY (an Artifactory token will be minted on demand)."
          elif [[ -n "${ARTIFACTORY_ACCESS_TOKEN}" ]]; then
            echo "Publish credential: ARTIFACTORY_ACCESS_TOKEN (pre-generated)."
          else
            echo "::error::No publish credential. Set either the QSC_API_KEY or the" \
                 "ARTIFACTORY_ACCESS_TOKEN secret" \
            exit 1
          fi

      - name: Checkout tooling (qcom-rpm-utils)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          repository: qualcomm-linux/qcom-rpm-utils
          ref: ${{ inputs.qcom-rpm-utils-ref }}
          path: qcom-rpm-utils
          sparse-checkout: .github/actions

      - name: Download built RPMs
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ${{ needs.build.outputs.artifact-name }}
          path: output

      - name: Build provenance metadata
        id: prov
        env:
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          RUN_ID: ${{ github.run_id }}
          COMMIT_SHA: ${{ github.sha }}
          PKG_NAME: ${{ needs.build.outputs.pkg-name }}
          PKG_VERSION: ${{ needs.build.outputs.pkg-version }}
        run: |
          set -euo pipefail
          workflow_url="${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID}"
          jq -n \
            --arg commit "${COMMIT_SHA}" \
            --arg workflow "$workflow_url" \
            --arg pkg "${PKG_NAME}" \
            --arg version "${PKG_VERSION}" \
            '{commit:$commit, workflow:$workflow, pkg:$pkg, version:$version}' \
            > provenance.json
          {
            echo 'provenance<<EOF'
            cat provenance.json
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

      - name: Upload RPMs to Artifactory
        uses: ./qcom-rpm-utils/.github/actions/rpm-artifactory-upload
        with:
          server_url: ${{ inputs.server-url }}
          target_repo: ${{ inputs.target-repo }}
          distro: ${{ inputs.distro }}
          distro_version: ${{ inputs.distro-version }}
          channel: ${{ inputs.channel }}
          rpm_dir: output
          provenance_info: ${{ steps.prov.outputs.provenance }}
          qsc_api_key: ${{ secrets.QSC_API_KEY }}
          access_token: ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}

      - name: Job summary
        if: always()
        env:
          PKG_NAME: ${{ needs.build.outputs.pkg-name }}
          PKG_VERSION: ${{ needs.build.outputs.pkg-version }}
          TARGET_REPO: ${{ inputs.target-repo }}
          DISTRO: ${{ inputs.distro }}
          DISTRO_VERSION: ${{ inputs.distro-version }}
          CHANNEL: ${{ inputs.channel }}
        run: |
          set -euo pipefail
          base="${TARGET_REPO}/${DISTRO}/${DISTRO_VERSION}/${CHANNEL}"
          {
            echo "## Published RPMs"
            echo ""
            echo "- Package: \`${PKG_NAME}-${PKG_VERSION}\`"
            echo "- Binary RPMs: \`${base}/<arch>/Packages/\`"
            echo "- Source RPMs: \`${base}/SRPMS/Packages/\`"
          } >> "$GITHUB_STEP_SUMMARY"