use ziti-builder:v1 to generate GH release builds (#1015)

link release binaries with glibc 2.2.7

.github/actions/build/action.yml

@@ -30,29 +30,47 @@ runs:
       shell: bash
 
     - name: install contemporary cmake
+      if: runner.os != 'Linux'
       uses: lukka/get-cmake@v3.27.7 # pin version to avoid failed glibc dependency on ubuntu 20 runners. go back to @latest when ubuntu 22+ is adopted for runner os.
 
     - uses: lukka/run-vcpkg@v11
+      if: runner.os != 'Linux'
       with:
         # get baseline from vcpkg
         vcpkgJsonGlob: './vcpkg.json'
 
     - uses: actions/cache@v4
       with:
         key: deps-${{ inputs.preset }}-${{ hashFiles('./vcpkg.json') }}
-        path: './vcpkg/packages'
+        path: |
+          ./vcpkg/packages
+          ./build/vcpkg_installed
 
     - uses: lukka/run-cmake@v10.6 # pin version to avoid failed glibc dependency on ubuntu 20 runners. go back to @latest when ubuntu 22+ is adopted for runner os.
+      if: runner.os != 'Linux'
       name: Configure CMake
       with:
         configurePreset: ci-${{ inputs.preset }}
         configurePresetAdditionalArgs: "[ `-B`, `./build` ]"
 
-    - name: build ziti-edge-tunnel
+    - name: build ziti-edge-tunnel (non-linux)
+      if: runner.os != 'Linux'
       shell: bash
       run: |
         cmake \
           --build ./build \
           --config ${{ inputs.config }} \
           --target ${{ inputs.target }} \
           --verbose
+
+    - name: configure build action for github release binaries
+      shell: bash
+      run: |
+        mv -v ./.github/actions/openziti-tunnel-build-action/gh-release/* ./.github/actions/openziti-tunnel-build-action/
+
+    - name: build ziti-edge-tunnel (linux)
+      if: runner.os == 'Linux'
+      uses: ./.github/actions/openziti-tunnel-build-action
+      with:
+        arch: ci-${{ inputs.preset }}
+        config: ${{ inputs.config }}

.github/actions/openziti-tunnel-build-action/gh-release/Dockerfile

@@ -0,0 +1,6 @@
+# use ziti-builder:v1 (basded on ubuntu focal) for older glibc (2.27)
+FROM openziti/ziti-builder:v1
+
+COPY ./entrypoint.sh /root/
+RUN chmod +x /root/entrypoint.sh
+ENTRYPOINT [ "/root/entrypoint.sh" ]

.github/actions/openziti-tunnel-build-action/gh-release/entrypoint.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+#
+# Copyright 2024 NetFoundry Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+set -euo pipefail
+
+# these commands must be in the entrypoint so they are run after workspace is mounted on Docker workdir
+echo "INFO: GIT_DISCOVERY_ACROSS_FILESYSTEM=${GIT_DISCOVERY_ACROSS_FILESYSTEM}"
+echo "INFO: WORKDIR=${PWD}"
+echo "INFO: $(git --version)"
+
+# if first positional is an expected arch string then set cmake preset,
+# else use ci-linux-x64 (which actually just uses native/host tools - e.g. not cross compile)
+if [ ${#} -ge 1 ]; then
+    cmake_preset="${1}"
+else
+    cmake_preset="ci-linux-x64"
+fi
+
+if [ ${#} -ge 2 ]; then
+    cmake_config="${2}"
+else
+    cmake_config="RelWithDebInfo"
+fi
+
+# workspace dir for each build env is added to "safe" dirs in global config e.g.
+# ~/.gitconfig so both runner and builder containers trust these dirs
+# owned by different UIDs from that of Git's EUID. This is made necessary
+# by newly-enforced directory boundaries in Git v2.35.2
+# ref: https://lore.kernel.org/git/xmqqv8veb5i6.fsf@gitster.g/
+for SAFE in \
+    /github/workspace \
+    /__w/ziti-tunnel-sdk-c/ziti-tunnel-sdk-c \
+    /mnt ; do
+        git config --global --add safe.directory ${SAFE}
+done
+
+export VCPKG_ROOT="${PWD}/vcpkg"
+# ${VCPKG_ROOT}/packages  will have been populated from outside of the container, by a different user. tell git it's ok.
+git config --global --add safe.directory "${VCPKG_ROOT}"
+
+if [ ! -d "${VCPKG_ROOT}/ports" ]; then
+    # the packages/ directory may have been populated from cache by now
+    # but git clone refuses to clone into a non-empty directory, so get
+    # vcpkg without using clone
+    git init "${VCPKG_ROOT}"
+    (cd "${VCPKG_ROOT}"; git remote add -f origin https://github.com/microsoft/vcpkg; git checkout master)
+    "${VCPKG_ROOT}/bootstrap-vcpkg.sh" -disableMetrics
+fi
+
+cmake -E make_directory ./build
+cmake \
+  --preset "${cmake_preset}" \
+  -DCMAKE_BUILD_TYPE="${cmake_config}" \
+  -S . \
+  -B ./build
+cmake \
+  --build ./build \
+  --config "${cmake_config}" \
+  --target bundle \
+  --verbose

.github/workflows/cmake.yml

@@ -19,7 +19,6 @@ concurrency:
 jobs:
   build:
     runs-on: ${{ matrix.os }}
-    container: ${{ matrix.container }}
     name: build ${{ matrix.preset }}
     env: {}
 
@@ -44,17 +43,14 @@ jobs:
             preset: windows-arm64-vs2022
 
           - os: ubuntu-20.04
-            container: openziti/ziti-builder:v2
             name: Linux x86_64
             preset: linux-x64-static-libssl
 
           - os: ubuntu-20.04
-            container: openziti/ziti-builder:v2
             name: Linux arm
             preset: linux-arm-static-libssl
 
           - os: ubuntu-20.04
-            container: openziti/ziti-builder:v2
             name: Linux arm64
             preset: linux-arm64-static-libssl