build-rust-injector.yml

name: Zarf Injector Rust Binaries

permissions:
  contents: read
  id-token: write

on:
  workflow_dispatch:
    inputs:
      versionTag:
        description: "Version tag"
        required: true

jobs:
  build-injector:
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout Repo"
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install tools
        uses: ./.github/actions/install-tools

      - name: "Build Rust Binary for x86_64 and arm64"
        run: |
          cd src/injector
          make install-cross
          make injector-linux
          cd target
          mkdir -p ../dist
          cp x86_64-unknown-linux-musl/release/zarf-injector ../dist/zarf-injector-amd64
          cp aarch64-unknown-linux-musl/release/zarf-injector ../dist/zarf-injector-arm64
          cd ../dist
          shasum zarf-injector-amd64 >> checksums.txt
          shasum zarf-injector-arm64 >> checksums.txt

      - name: Auth with AWS
        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
        with:
          role-to-assume: ${{ secrets.AWS_WRITE_ROLE }}
          role-session-name: ${{ github.job || github.event.client_payload.pull_request.head.sha || github.sha }}
          aws-region: us-east-2
          role-duration-seconds: 3600

      - name: Sync Artifacts to S3
        run: |
          aws s3 sync src/injector/dist/ s3://zarf-init/injector/${{ github.event.inputs.versionTag }}/