vantage-agent/.gitea/workflows/agent-release.yml

name: Agent Release

# The tag stays "agent/v*" rather than becoming a bare "v*", even though this
# repository is only the agent now. The tag is not a private detail: it is the
# release the fleet downloads by, it is what UpdateAgentCmd carries, and the
# control plane finds the newest one by grepping tag names for that exact
# prefix. Renaming it would be a second breaking change stacked on the
# repository move.
on:
    push:
        tags:
            - "agent/v*"

jobs:
    build:
        runs-on: ubuntu-docker
        container: node:26
        env:
            GOPRIVATE: gitea.hostxtra.co.uk/*
        steps:
            - name: Checkout
              uses: actions/checkout@v4

            # vantage-shared is a private module, so the Go builds below cannot
            # resolve it without a credential.
            - name: Write the module fetch credential
              run: |
                  umask 077
                  printf 'machine gitea.hostxtra.co.uk\nlogin %s\npassword %s\n' \
                    "${{ secrets.REGISTRY_USER }}" "${{ secrets.RELEASE_TOKEN }}" \
                    > "$HOME/.netrc"

            - name: Set up Go
              uses: actions/setup-go@v5
              with:
                  go-version: "1.26"
                  cache: true
                  cache-dependency-path: go.sum

            - name: Extract version
              id: version
              run: echo "VERSION=${GITHUB_REF_NAME#agent/}" >> $GITHUB_OUTPUT

            - name: Build
              env:
                  VERSION: ${{ steps.version.outputs.VERSION }}
              run: |
                  mkdir -p dist
                  GOOS=linux GOARCH=amd64 go build \
                    -ldflags="-s -w -X main.Version=${VERSION}" \
                    -o dist/vantage-agent-linux-amd64 ./cmd
                  GOOS=linux GOARCH=arm64 go build \
                    -ldflags="-s -w -X main.Version=${VERSION}" \
                    -o dist/vantage-agent-linux-arm64 ./cmd
                  GOOS=windows GOARCH=amd64 go build \
                    -ldflags="-s -w -X main.Version=${VERSION}" \
                    -o dist/vantage-agent-windows-amd64.exe ./cmd

            - name: Checksums
              working-directory: dist
              run: sha256sum vantage-agent-linux-amd64 vantage-agent-linux-arm64 vantage-agent-windows-amd64.exe > checksums.txt

            - name: Create release
              uses: https://gitea.com/actions/gitea-release-action@v1
              with:
                  token: ${{ secrets.RELEASE_TOKEN }}
                  files: |
                      dist/vantage-agent-linux-amd64
                      dist/vantage-agent-linux-arm64
                      dist/vantage-agent-windows-amd64.exe
                      dist/checksums.txt

    msi:
        needs: build
        runs-on: windows-2022
        env:
            GOPRIVATE: gitea.hostxtra.co.uk/*
        steps:
            - name: Checkout
              uses: actions/checkout@v4

            # Same private-module credential as the build job, in the file
            # Windows Go looks for: _netrc in the profile directory, not .netrc.
            - name: Write the module fetch credential
              shell: pwsh
              run: |
                  "machine gitea.hostxtra.co.uk`nlogin ${{ secrets.REGISTRY_USER }}`npassword ${{ secrets.RELEASE_TOKEN }}" |
                    Out-File -Encoding ascii "$env:USERPROFILE\_netrc"

            - name: Set up Go
              uses: actions/setup-go@v5
              with:
                  go-version: "1.26"
                  cache: true
                  cache-dependency-path: go.sum

            - name: Extract version
              id: version
              shell: pwsh
              run: |
                  $v = "${{ github.ref_name }}" -replace '^agent/v', ''
                  "VERSION=$v" | Out-File -Append $env:GITHUB_OUTPUT
                  # MSI ProductVersion must be numeric x.x.x.x
                  "MSIVERSION=$v.0" | Out-File -Append $env:GITHUB_OUTPUT

            - name: Build agent exe
              shell: pwsh
              env:
                  VERSION: ${{ steps.version.outputs.VERSION }}
              run: |
                  $env:GOOS = "windows"; $env:GOARCH = "amd64"
                  go build -ldflags="-s -w -X main.Version=$env:VERSION" -o installer/vantage-agent-windows-amd64.exe ./cmd

            - name: Install WiX
              shell: pwsh
              run: dotnet tool install --global wix --version 5.*

            - name: Build MSI
              working-directory: installer
              shell: pwsh
              run: |
                  $env:PATH = "$env:PATH;$env:USERPROFILE\.dotnet\tools"
                  wix build vantage-agent.wxs -d Version=${{ steps.version.outputs.MSIVERSION }} -o vantage-agent.msi
                  (Get-FileHash vantage-agent.msi -Algorithm SHA256).Hash.ToLower() + "  vantage-agent.msi" | Out-File -Encoding ascii checksums-msi.txt

            - name: Attach MSI to release
              working-directory: installer
              shell: pwsh
              env:
                  TOKEN: ${{ secrets.RELEASE_TOKEN }}
              run: |
                  $api = "${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
                  $tag = [uri]::EscapeDataString("${{ github.ref_name }}")
                  $headers = @{ Authorization = "token $env:TOKEN" }
                  # gitea-release-action can't find a slashed tag, so append via the API directly
                  $rel = Invoke-RestMethod -Headers $headers -Uri "$api/releases/tags/$tag"
                  foreach ($f in "vantage-agent.msi", "checksums-msi.txt") {
                      $name = [uri]::EscapeDataString($f)
                      Invoke-RestMethod -Headers $headers -Method Post -InFile $f `
                        -ContentType "application/octet-stream" `
                        -Uri "$api/releases/$($rel.id)/assets?name=$name"
                  }