OpenShell/.github/workflows/rpm-package.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: RPM Package

on:
  workflow_call:
    inputs:
      checkout-ref:
        required: true
        type: string
      rpm-version:
        required: false
        type: string
        default: ""
      rpm-release:
        required: false
        type: string
        default: ""
      cargo-version:
        required: false
        type: string
        default: ""

permissions:
  contents: read

defaults:
  run:
    shell: bash

jobs:
  build-rpm-linux:
    name: Build RPM Package (Linux ${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
            artifact_arch: amd64
            runner: linux-amd64-cpu8
            cli_target: x86_64-unknown-linux-musl
            gnu_target: x86_64-unknown-linux-gnu
          - arch: aarch64
            artifact_arch: arm64
            runner: linux-arm64-cpu8
            cli_target: aarch64-unknown-linux-musl
            gnu_target: aarch64-unknown-linux-gnu
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    container:
      image: fedora:latest
    steps:
      - name: Install build dependencies
        run: |
          dnf install -y \
            packit rpm-build \
            rust cargo gcc gcc-c++ make cmake pkg-config \
            clang-devel z3-devel systemd-rpm-macros \
            pandoc python3-devel git-core \
            cargo-rpm-macros

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.checkout-ref }}
          fetch-depth: 0

      - name: Download CLI artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: cli-linux-${{ matrix.artifact_arch }}
          path: package-input/

      - name: Download gateway artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: gateway-binary-linux-${{ matrix.artifact_arch }}
          path: package-input/

      - name: Extract package inputs
        run: |
          set -euo pipefail
          mkdir -p package-binaries
          tar -xzf "package-input/openshell-${{ matrix.cli_target }}.tar.gz" -C package-binaries
          tar -xzf "package-input/openshell-gateway-${{ matrix.gnu_target }}.tar.gz" -C package-binaries
          ls -lah package-binaries

      - name: Mark workspace safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Fetch tags
        run: git fetch --tags --force

      - name: Build RPMs via Packit
        env:
          OPENSHELL_RPM_VERSION: ${{ inputs['rpm-version'] }}
          OPENSHELL_RPM_RELEASE: ${{ inputs['rpm-release'] }}
          OPENSHELL_CARGO_VERSION: ${{ inputs['cargo-version'] }}
          OPENSHELL_PREBUILT_BINARIES_DIR: ${{ github.workspace }}/package-binaries
        run: packit build locally

      - name: Collect RPM artifacts
        run: |
          set -euo pipefail
          mkdir -p artifacts
          mapfile -t rpms < <(find "$GITHUB_WORKSPACE" -maxdepth 3 -type f -name '*.rpm' ! -name '*.src.rpm' | sort)
          if [ "${#rpms[@]}" -eq 0 ]; then
            echo "::error::No RPM artifacts found under $GITHUB_WORKSPACE"
            find "$GITHUB_WORKSPACE" -maxdepth 3 -type f | sort
            exit 1
          fi
          cp "${rpms[@]}" artifacts/
          echo "=== Built RPMs ==="
          ls -lah artifacts/

      - name: Upload RPM artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: rpm-linux-${{ matrix.arch }}
          path: artifacts/*.rpm
          retention-days: 5