pipeline.yml

env:
  DRY_RUN: false # set to true to disable publishing releases
  AGENT_RUNNERS_LINUX_QUEUE: "${AGENT_RUNNERS_LINUX_QUEUE:-agent-runners-linux-amd64}"
  AGENT_RUNNERS_LINUX_ARM64_QUEUE: "${AGENT_RUNNERS_LINUX_ARM64_QUEUE:-agent-runners-linux-arm64}"
  AGENT_RUNNERS_WINDOWS_QUEUE: "${AGENT_RUNNERS_WINDOWS_QUEUE:-agent-runners-windows-amd64}"
  AGENT_BUILDERS_QUEUE: "${AGENT_BUILDERS_QUEUE:-elastic-builders}"
  AGENT_BUILDERS_ARM64_QUEUE: "${AGENT_BUILDERS_QUEUE:-elastic-builders}"

agents:
  queue: "$AGENT_RUNNERS_LINUX_QUEUE"

steps:
  - name: ":go::robot_face: Lint"
    key: check-code-committed
    command: .buildkite/steps/check-code-committed.sh
    if_changed:
      - go.{mod,sum}
      - "**.go"
      - .buildkite/steps/check-code-committed.sh
    plugins:
      - docker-compose#v4.14.0:
          config: .buildkite/docker-compose.yml
          cli-version: 2
          mount-buildkite-agent: true
          run: lint

  - name: ":go::robot_face: Check protobuf generation"
    key: check-protobuf-genreation
    command: .buildkite/steps/check-protobuf-generation.sh
    if_changed:
      - api/proto/**
      - .buildkite/steps/check-protobuf-generation.sh
    plugins:
    - docker-compose#v4.14.0:
        config: .buildkite/docker-compose.yml
        cli-version: 2
        mount-buildkite-agent: true
        run: lint

  - group: ":go::scientist: Tests and Coverage"
    if_changed:
      - go.{mod,sum}
      - "**.go"
      - "**/fixtures/**"
      - .buildkite/steps/{tests,test-coverage-report}.sh
    steps:
    - name: ":linux: Linux AMD64 Tests"
      key: test-linux-amd64
      command: ".buildkite/steps/tests.sh"
      parallelism: 2
      artifact_paths:
        - junit-*.xml
        - "coverage-*/**"
      plugins:
        - docker-compose#v4.14.0:
            config: .buildkite/docker-compose.yml
            cli-version: 2
            propagate-environment: true
            run: agent
        - test-collector#v1.11.0:
            files: "junit-*.xml"
            format: "junit"
            tags:
              - "os=linux"
              - "arch=amd64"
              - "race=false"

    - name: ":linux: Linux ARM64 Tests"
      key: test-linux-arm64
      command: ".buildkite/steps/tests.sh"
      parallelism: 2
      artifact_paths:
        - junit-*.xml
        - "coverage-*/**"
      agents:
        queue: $AGENT_RUNNERS_LINUX_ARM64_QUEUE
      plugins:
        - docker-compose#v4.14.0:
            config: .buildkite/docker-compose.yml
            cli-version: 2
            propagate-environment: true
            run: agent
        - test-collector#v1.11.0:
            files: "junit-*.xml"
            format: "junit"
            tags:
              - "os=linux"
              - "arch=arm64"
              - "race=false"

    - name: ":windows: Windows AMD64 Tests"
      key: test-windows
      command: "bash .buildkite\\steps\\tests.sh"
      parallelism: 2
      artifact_paths:
        - junit-*.xml
        - "coverage-*/**"
      agents:
        queue: $AGENT_RUNNERS_WINDOWS_QUEUE
      plugins:
        - test-collector#v1.11.0:
            files: "junit-*.xml"
            format: "junit"
            tags:
              - "os=windows"
              - "arch=arm64"
              - "race=false"

    - name: ":satellite: Detect Data Races"
      key: test-race-linux-arm64
      command: ".buildkite/steps/tests.sh -race"
      # Extra parallelism because this data race test is slow
      parallelism: 3
      artifact_paths:
        - junit-*.xml
        - "coverage-*/**"
      agents:
        queue: $AGENT_RUNNERS_LINUX_ARM64_QUEUE
      plugins:
        - docker-compose#v4.14.0:
            config: .buildkite/docker-compose.yml
            cli-version: 2
            propagate-environment: true
            run: agent
        - test-collector#v1.11.0:
            files: "junit-*.xml"
            format: "junit"
            tags:
              - "os=linux"
              - "arch=arm64"
              - "race=true"

    - name: ":coverage: Test coverage report Linux ARM64"
      key: test-coverage-linux-arm64
      command: ".buildkite/steps/test-coverage-report.sh coverage-linux-arm64"
      artifact_paths:
        - "cover.html"
        - "cover.out"
      depends_on:
        - test-linux-arm64
      plugins:
        - docker-compose#v4.14.0:
            config: .buildkite/docker-compose.yml
            cli-version: 2
            run: agent
        - artifacts#v1.9.4:
            download: "coverage-linux-arm64/**"

    - name: ":coverage: Test coverage report Linux AMD64"
      key: test-coverage-linux-amd64
      command: ".buildkite/steps/test-coverage-report.sh coverage-linux-amd64"
      artifact_paths:
        - "cover.html"
        - "cover.out"
      depends_on:
        - test-linux-amd64
      plugins:
        - docker-compose#v4.14.0:
            config: .buildkite/docker-compose.yml
            cli-version: 2
            run: agent
        - artifacts#v1.9.4:
            download: "coverage-linux-amd64/**"

    - name: ":coverage: Test coverage report Linux ARM64 Race"
      key: test-coverage-linux-arm64-race
      command: ".buildkite/steps/test-coverage-report.sh coverage-linux-arm64-race"
      artifact_paths:
        - "cover.html"
        - "cover.out"
      depends_on:
        - test-race-linux-arm64
      plugins:
        - docker-compose#v4.14.0:
            config: .buildkite/docker-compose.yml
            cli-version: 2
            run: agent
        - artifacts#v1.9.4:
            download: "coverage-linux-arm64-race/**"

    - label: ":writing_hand: Annotate with Test Failures"
      depends_on:
        - test-linux-amd64
        - test-race-linux-arm64
        - test-linux-arm64
        - test-windows
      allow_dependency_failure: true
      plugins:
        - junit-annotate#v1.6.0:
            artifacts: junit-*.xml

  # --- end Tests and Coverage ---

  - group: ":hammer_and_wrench: Binary builds"
    steps:
      - name: ":{{matrix.os}}: Build {{matrix.os}} {{matrix.arch}} binary"
        command: ".buildkite/steps/build-binary.sh {{matrix.os}} {{matrix.arch}}"
        key: build-binary
        depends_on:
          # don't wait for slower windows tests
          - test-linux-amd64
          - test-linux-arm64
        artifact_paths: "pkg/*"
        plugins:
          - docker-compose#v4.14.0:
              config: .buildkite/docker-compose.yml
              cli-version: 2
              run: agent
          - generate-provenance-attestation#v1.1.0:
              artifacts: "pkg/*"
              attestation_name: "buildkite-agent-{{matrix.os}}-{{matrix.arch}}.build-attestation.json"
        matrix:
          setup:
            os:
              - darwin
              - freebsd
              - linux
              - openbsd
              - windows
            arch:
              - "386"
              - amd64
              - arm64
          adjustments:
            - with: { os: darwin, arch: "386" }
              skip: "macOS no longer supports x86 binaries"

            - with: { os: dragonflybsd, arch: amd64 }

            - with: { os: freebsd, arch: arm64 }
              skip: "arm64 FreeBSD is not currently supported"

            - with: { os: linux, arch: arm }
            - with: { os: linux, arch: armhf }
            - with: { os: linux, arch: ppc64 }
            - with: { os: linux, arch: ppc64le }
            - with: { os: linux, arch: mips64le }
            - with: { os: linux, arch: s390x }
            - with: { os: linux, arch: riscv64 }

            - with: { os: netbsd, arch: amd64 }

            - with: { os: openbsd, arch: arm64 }
              skip: "arm64 OpenBSD is not currently supported"

  # --- end Binary builds ---

  - label: ":end::two::end: E2E Testing"
    key: e2e-tests
    depends_on: build-binary
    trigger: agent-e2e-tests
    async: false
    build:
      message: "${BUILDKITE_MESSAGE}"
      commit: "${BUILDKITE_COMMIT}"
      branch: "${BUILDKITE_BRANCH}"
      env:
        BUILDKITE_PULL_REQUEST: "${BUILDKITE_PULL_REQUEST}"
        BUILDKITE_PULL_REQUEST_BASE_BRANCH: "${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"
        BUILDKITE_PULL_REQUEST_REPO: "${BUILDKITE_PULL_REQUEST_REPO}"

  - label: ":bathtub: Check version string is clean"
    key: check-version-string
    depends_on: build-binary
    command: .buildkite/steps/check-version-string.sh

  - name: ":technologist: Test bk cli + Agent cli"
    key: test-bk-cli
    depends_on: build-binary
    command: ".buildkite/steps/test-bk.sh"
    plugins:
      - docker-compose#v4.14.0:
          config: .buildkite/docker-compose.yml
          cli-version: 2
          run: agent
          env:
            - BUILDKITE_AGENT_ACCESS_TOKEN
            - BUILDKITE_BUILD_ID
            - BUILDKITE_JOB_ID
          volumes:
            - "/usr/bin/buildkite-agent:/usr/bin/buildkite-agent"

  - name: ":mag: Extract Agent Version Metadata"
    key: set-metadata
    command: ".buildkite/steps/extract-agent-version-metadata.sh"

  - group: ":docker: Docker Image Builds"
    steps:
      - name: ":docker: {{matrix}} image build"
        key: build-docker
        plugins:
          - aws-assume-role-with-web-identity#v1.4.0:
              role_arn: "arn:aws:iam::${BUILD_AWS_ACCOUNT_ID}:role/${BUILD_AWS_ROLE_NAME}"
              session-tags:
                - organization_slug
                - organization_id
                - pipeline_slug
          - ecr#v2.9.0:
              login: true
              account_ids: "${BUILD_AWS_ACCOUNT_ID}"
              region: "us-east-1"
        agents:
          queue: $AGENT_BUILDERS_QUEUE
        depends_on:
          - build-binary
          - set-metadata
        command: ".buildkite/steps/build-docker-image.sh {{matrix}}"
        matrix:
          setup:
            - "alpine"
            - "alpine-k8s"
            - "ubuntu-20.04"
            - "ubuntu-22.04"
            - "ubuntu-24.04"
            - "sidecar"

  - group: ":docker: Docker Image Tests"
    steps:
      - name: ":docker: {{matrix.variant}} amd64 image test"
        key: test-docker-amd64
        agents:
          queue: $AGENT_BUILDERS_QUEUE
        depends_on:
          - build-docker
        command: .buildkite/steps/test-docker-image.sh {{matrix.variant}}
        plugins:
          - aws-assume-role-with-web-identity#v1.4.0:
              role_arn: "arn:aws:iam::${BUILD_AWS_ACCOUNT_ID}:role/${BUILD_AWS_ROLE_NAME}"
              session-tags:
                - organization_slug
                - organization_id
                - pipeline_slug
          - ecr#v2.9.0:
              login: true
              account_ids: "${BUILD_AWS_ACCOUNT_ID}"
              region: "us-east-1"
        matrix:
          setup:
            variant:
              - alpine
              - alpine-k8s
              - ubuntu-20.04
              - ubuntu-22.04
              - ubuntu-24.04
              - sidecar

      - name: ":docker: {{matrix.variant}} arm64 image test"
        plugins:
          - aws-assume-role-with-web-identity#v1.4.0:
              role_arn: "arn:aws:iam::${BUILD_AWS_ACCOUNT_ID}:role/${BUILD_AWS_ROLE_NAME}"
              session-tags:
                - organization_slug
                - organization_id
                - pipeline_slug
          - ecr#v2.9.0:
              login: true
              account_ids: "${BUILD_AWS_ACCOUNT_ID}"
              region: "us-east-1"
        key: test-docker-arm64
        agents:
          queue: $AGENT_BUILDERS_ARM64_QUEUE
        depends_on:
          - build-docker
        command: .buildkite/steps/test-docker-image.sh {{matrix.variant}}
        matrix:
          setup:
            variant:
              - alpine
              - alpine-k8s
              - ubuntu-20.04
              - ubuntu-22.04
              - ubuntu-24.04
              - sidecar

  # --- end Docker Image tests ---

  - name: ":debian: Debian package build"
    key: build-debian-packages
    depends_on:
      - build-binary
      - set-metadata
    command: ".buildkite/steps/build-debian-packages.sh"
    artifact_paths: "deb/**/*"
    plugins:
      - generate-provenance-attestation#v1.1.0:
          artifacts: "deb/*"
          attestation_name: "buildkite-agent-debian-packages.package-attestation.json"

  - name: ":redhat: RPM Package build"
    key: build-rpm-packages
    depends_on:
      - build-binary
      - set-metadata
    command: ".buildkite/steps/build-rpm-packages.sh"
    artifact_paths: "rpm/**/*"
    plugins:
      - generate-provenance-attestation#v1.1.0:
          artifacts: "rpm/*"
          attestation_name: "buildkite-agent-rpm-packages.package-attestation.json"

  - name: ":github: Build Github Release"
    key: build-github-release
    depends_on:
      - build-binary
      - set-metadata
    command: ".buildkite/steps/build-github-release.sh"
    artifact_paths: "releases/**/*"
    plugins:
      - docker-compose#v4.14.0:
          config: .buildkite/docker-compose.release.yml
          run: github-release
      - generate-provenance-attestation#v1.1.0:
          artifacts: "releases/*.tar.gz;releases/*.zip"
          attestation_name: "buildkite-agent-github-releases.attestation.json"

  - name: ":memo: Trigger docs draft"
    if: build.branch == "main"
    soft_fail: true
    command: .buildkite/steps/trigger-docs-draft.sh

  - name: ":pipeline: Upload Release Pipeline"
    key: upload-release-steps
    depends_on:
      - check-code-committed
      - check-version-string
      - test-windows
      - test-bk-cli
      - test-docker-amd64
      - test-docker-arm64
      - build-rpm-packages
      - build-debian-packages
      - build-github-release
    command: ".buildkite/steps/upload-release-steps.sh"
    if: build.env("DRY_RUN") == "true" || build.branch =~ /^(main|.*-.*-stable)$$/