Merge branch 'main' into bump-s3-secrets-plugin-version

Author: lizrabuya

.buildkite/scripts/trigger-base-rebuild.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+set -euo pipefail
+
+timestamp=$(date -u +"%Y-%m-%d %H:%M:%S UTC")
+
+echo "# Last updated: ${timestamp}" >"packer/windows/.trigger-base-build"
+echo "# Last updated: ${timestamp}" >"packer/linux/.trigger-base-build"
+
+git add packer/windows/.trigger-base-build packer/linux/.trigger-base-build
+
+echo "Base AMI rebuild triggers updated"

.buildkite/steps/packer.sh

@@ -22,7 +22,13 @@ packer_files_sha=$(find Makefile "packer/${os}" plugins/ -type f -print0 | xargs
 internal_files_sha=$(find go.mod go.sum internal/ -type f -print0 | xargs -0 sha256sum | awk '{print $1}' | sort | sha256sum | awk '{print $1}')
 stable_agent_sha=$(curl -Lfs "https://download.buildkite.com/agent/stable/latest/${agent_binary}.sha256")
 unstable_agent_sha=$(curl -Lfs "https://download.buildkite.com/agent/unstable/latest/${agent_binary}.sha256")
-packer_hash=$(echo "$packer_files_sha" "$internal_files_sha" "$arch" "$stable_agent_sha" "$unstable_agent_sha" | sha256sum | awk '{print $1}')
+if [[ "${variant}" == "base" ]]; then
+  # Base AMI doesn't use Go dependencies
+  packer_hash=$(echo "$packer_files_sha" "$arch" "$stable_agent_sha" "$unstable_agent_sha" "$variant" | sha256sum | awk '{print $1}')
+else
+  # Full AMI includes Go dependencies for fix-perms binary
+  packer_hash=$(echo "$packer_files_sha" "$internal_files_sha" "$arch" "$stable_agent_sha" "$unstable_agent_sha" "$variant" | sha256sum | awk '{print $1}')
+fi
 
 # Include variant in the hash so base and full images don’t clash
 echo "Packer image hash for ${os}/${arch} (${variant}) is ${packer_hash}"
@@ -46,7 +52,8 @@ if [[ -n "${PACKER_REBUILD:-}" ]] || ! aws s3 cp "s3://${BUILDKITE_AWS_STACK_BUC
       echo "Base AMI ID not found in metadata, checking S3 for latest base image..."
 
       # Calculate hash for base image to find the S3 file
-      base_packer_hash=$(echo "$packer_files_sha" "$internal_files_sha" "$arch" "$stable_agent_sha" "$unstable_agent_sha" "base" | sha256sum | awk '{print $1}')
+      # Base AMI doesn't include Go dependencies, so exclude them from hash
+      base_packer_hash=$(echo "$packer_files_sha" "$arch" "$stable_agent_sha" "$unstable_agent_sha" "base" | sha256sum | awk '{print $1}')
       base_packer_file="packer-${base_packer_hash}-${os}-${arch}-base.output"
 
       # Try to download and extract AMI ID from the base image packer output

Makefile

@@ -10,7 +10,7 @@ PACKER_WINDOWS_FILES = $(exec find packer/windows)
 # Allow passing an existing golden base AMI into packer via `BASE_AMI_ID` env var
 override BASE_AMI_ID ?=
 
-GO_VERSION ?= 1.23.6
+GO_VERSION ?= 1.24.0
 
 FIXPERMS_FILES = go.mod go.sum $(exec find internal/fixperms)
 

go.mod

@@ -1,10 +1,10 @@
 module github.com/buildkite/elastic-ci-stack-for-aws/v6
 
-go 1.23.6
+go 1.24.0
 
 toolchain go1.24.5
 
 require (
 	github.com/google/go-cmp v0.7.0
-	golang.org/x/sys v0.35.0
+	golang.org/x/sys v0.36.0
 )

go.sum

@@ -1,4 +1,4 @@
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=

packer/linux/.trigger-base-build

@@ -0,0 +1 @@
+# Last updated: 2025-09-10 14:03:43 UTC

packer/linux/base.pkr.hcl

@@ -91,11 +91,6 @@ build {
     source      = "../../plugins"
   }
 
-  provisioner "file" {
-    destination = "/tmp/build"
-    source      = "../../build"
-  }
-
   # Essential utilities & updates
   provisioner "shell" {
     script = "scripts/install-utils.sh"

packer/windows/.trigger-base-build

@@ -0,0 +1 @@
+# Last updated: 2025-09-10 14:03:43 UTC