publish.yml

name: Publish

permissions:
  contents: read

on:
  workflow_call:
    inputs:
      git_ref:
        type: string
        required: true
        # channel is the dir/namespace packages are organized into.
        # Options are release/nightly/custom.
      channel:
        type: string
        required: true

env:
  VERBOSE: true
  CI: true
  DISABLE_MOLD: true
  DEBIAN_FRONTEND: noninteractive
  CONTAINER_TOOL: docker
  CARGO_PROFILE_RELEASE_LTO: fat
  CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 1
  CHANNEL: ${{ inputs.channel }}

jobs:
  generate-publish-metadata:
    name: Generate Publish-related Metadata
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      vector_version: ${{ steps.generate-publish-metadata.outputs.vector_version }}
      vector_build_desc: ${{ steps.generate-publish-metadata.outputs.vector_build_desc }}
      vector_release_channel: ${{ steps.generate-publish-metadata.outputs.vector_release_channel }}
    steps:
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Generate publish metadata
        id: generate-publish-metadata
        run: make ci-generate-publish-metadata

  build-linux-packages:
    name: Build Vector for ${{ matrix.target }}
    runs-on: release-builder-linux
    timeout-minutes: 60
    needs: generate-publish-metadata
    env:
      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
      VECTOR_BUILD_DESC: ${{ needs.generate-publish-metadata.outputs.vector_build_desc }}
      CHANNEL: ${{ needs.generate-publish-metadata.outputs.vector_release_channel }}
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-musl       # .tar.gz
          - target: x86_64-unknown-linux-gnu        # .tar.gz, .deb, .rpm
          - target: aarch64-unknown-linux-musl      # .tar.gz
          - target: aarch64-unknown-linux-gnu       # .tar.gz, .deb, .rpm
          - target: armv7-unknown-linux-gnueabihf   # .tar.gz, .deb, .rpm
          - target: armv7-unknown-linux-musleabihf  # .tar.gz
          - target: arm-unknown-linux-gnueabi       # .tar.gz, .deb
          - target: arm-unknown-linux-musleabi      # .tar.gz
    steps:
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Bootstrap runner environment (Ubuntu-specific)
        run: sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh
      - name: Bootstrap runner environment (generic)
        run: bash scripts/environment/prepare.sh --modules=rustup,cross,cargo-deb
      - name: Build Vector
        run: make package-${{ matrix.target }}-all
      - name: Stage package artifacts for publish
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: vector-${{ env.VECTOR_VERSION }}-${{ matrix.target }}
          path: target/artifacts/vector*

  build-apple-darwin-packages:
    name: Build Vector for ${{ matrix.architecture }}-apple-darwin (.tar.gz)
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 90
    needs: generate-publish-metadata
    env:
      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
      VECTOR_BUILD_DESC: ${{ needs.generate-publish-metadata.outputs.vector_build_desc }}
      CHANNEL: ${{ needs.generate-publish-metadata.outputs.vector_release_channel }}
    strategy:
      matrix:
        include:
          # Refer to https://docs.github.com/en/actions/using-github-hosted-runners/using-larger-runners/about-larger-runners#about-macos-larger-runners.
          # and to https://github.com/actions/runner-images
          - architecture: arm64
            runner: macos-14-xlarge
    steps:
      - name: Verify Runner Architecture
        run: |
          ARCH=$(uname -m)
          echo "Detected architecture: $ARCH"
          if [ "$ARCH" != "${{ matrix.architecture }}" ]; then
            echo "Error: Expected ${{ matrix.architecture }} architecture, but got $ARCH!"
            exit 1
          fi
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Bootstrap runner environment (macOS-specific)
        run: |
          bash scripts/environment/bootstrap-macos.sh
          bash scripts/environment/prepare.sh --modules=rustup
      - name: Build Vector
        env:
          TARGET: "${{ matrix.architecture }}-apple-darwin"
          NATIVE_BUILD: true
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          make package
      - name: Stage package artifacts for publish
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: vector-${{ env.VECTOR_VERSION }}-${{ matrix.architecture }}-apple-darwin
          path: target/artifacts/vector*

  build-x86_64-pc-windows-msvc-packages:
    name: Build Vector for x86_64-pc-windows-msvc (.zip)
    runs-on: windows-2025-8core
    timeout-minutes: 90
    needs: generate-publish-metadata
    env:
      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
      VECTOR_BUILD_DESC: ${{ needs.generate-publish-metadata.outputs.vector_build_desc }}
      CHANNEL: ${{ needs.generate-publish-metadata.outputs.vector_release_channel }}
      RUSTFLAGS: "-D warnings -Ctarget-feature=+crt-static"
      RELEASE_BUILDER: "true"
    steps:
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Bootstrap runner environment (Windows-specific)
        run: .\scripts\environment\bootstrap-windows-2025.ps1
      - name: Install Wix
        shell: bash
        run: |
          mkdir -p /c/wix
          cd /c/wix
          curl -sSfL https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314-binaries.zip > wix-binaries.zip
          unzip -o wix-binaries.zip
          rm wix-binaries.zip
      - name: Build Vector
        shell: bash
        run: |
          export FEATURES="default-msvc"
          export ARCHIVE_TYPE="zip"
          export KEEP_SYMBOLS="true"
          export RUST_LTO=""
          export TARGET="x86_64-pc-windows-msvc"
          export NATIVE_BUILD="true"
          make package
      - name: Build MSI package
        shell: bash
        run: |
          export PATH="/c/wix:$PATH"
          ./scripts/package-msi.sh
      - name: Stage package artifacts for publish
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: vector-${{ env.VECTOR_VERSION }}-x86_64-pc-windows-msvc
          path: target/artifacts/vector*

  deb-verify:
    name: Verify DEB Packages
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    needs:
      - generate-publish-metadata
      - build-linux-packages
    env:
      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
      DD_PKG_VERSION: "latest"
    strategy:
      matrix:
        container:
          - ubuntu:20.04
          - ubuntu:22.04
          - ubuntu:24.04
          - debian:11
          - debian:12
          - debian:13
    container:
      image: ${{ matrix.container }}
    steps:
      - run: |
          apt-get update && \
          apt-get install -y \
          ca-certificates \
          curl \
          git \
          systemd \
          make
      - name: Install dd-pkg for linting
        run: |
          curl -sSL "https://dd-package-tools.s3.amazonaws.com/dd-pkg/${DD_PKG_VERSION}/dd-pkg_Linux_x86_64.tar.gz" | tar -xz -C /usr/local/bin dd-pkg
      - name: Fix Git safe directories issue when in containers (actions/checkout#760)
        run: git config --global --add safe.directory /__w/vector/vector
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Download staged package artifacts (x86_64-unknown-linux-gnu)
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          name: vector-${{ env.VECTOR_VERSION }}-x86_64-unknown-linux-gnu
          path: target/artifacts
      - name: Verify install of DEB package.
        run: |
          ./scripts/verify-install.sh target/artifacts/vector_${{ env.VECTOR_VERSION }}-1_amd64.deb

  rpm-verify:
    name: Verify RPM Packages
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    needs:
      - generate-publish-metadata
      - build-linux-packages
    env:
      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
      DD_PKG_VERSION: "latest"
    strategy:
      matrix:
        container:
          - "quay.io/centos/centos:stream9"
          - "amazonlinux:2023"
          - "fedora:39"
          - "fedora:40"
    container:
      image: ${{ matrix.container }}
    steps:
      - run: |
          yum update -y
          yum install -y \
          ca-certificates \
          git \
          systemd \
          tar \
          make
          # conflicts with curl-minimal on some distros and --allowerased is not
          # supported on some distros
          if ! command -v curl &> /dev/null ; then
            yum install -y curl
          fi
      - name: Install dd-pkg for linting
        run: |
          curl -sSL "https://dd-package-tools.s3.amazonaws.com/dd-pkg/${DD_PKG_VERSION}/dd-pkg_Linux_x86_64.tar.gz" | tar -xz -C /usr/local/bin dd-pkg
      - name: Fix Git safe directories issue when in containers (actions/checkout#760)
        run: git config --global --add safe.directory /__w/vector/vector
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Download staged package artifacts (x86_64-unknown-linux-gnu)
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          name: vector-${{ env.VECTOR_VERSION }}-x86_64-unknown-linux-gnu
          path: target/artifacts
      - name: Verify install of RPM package.
        run: |
          ./scripts/verify-install.sh target/artifacts/vector-${{ env.VECTOR_VERSION }}-1.x86_64.rpm

  macos-verify:
    name: Verify macOS Package
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 5
    needs:
      - generate-publish-metadata
      - build-apple-darwin-packages
    env:
      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
    strategy:
      matrix:
        include:
          # Refer to https://github.com/actions/runner-images
          - target: arm64-apple-darwin
            runner: macos-14
    steps:
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Download staged package artifacts (${{ matrix.target }})
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          name: vector-${{ env.VECTOR_VERSION }}-${{ matrix.target }}
          path: target/artifacts
      - name: Verify macOS package
        run: |
          tar -xvf target/artifacts/vector-${{ env.VECTOR_VERSION }}-${{ matrix.target }}.tar.gz \
            && vector-${{ matrix.target }}/bin/vector --version

  publish-docker:
    name: Publish to Docker
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    # Elevated permission required to push Docker images to GitHub Container Registry
    permissions:
      packages: write
    needs:
      - generate-publish-metadata
      - build-linux-packages
      - deb-verify
    env:
      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
      VECTOR_BUILD_DESC: ${{ needs.generate-publish-metadata.outputs.vector_build_desc }}
      CHANNEL: ${{ needs.generate-publish-metadata.outputs.vector_release_channel }}
    steps:
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Login to DockerHub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.CI_DOCKER_USERNAME }}
          password: ${{ secrets.CI_DOCKER_PASSWORD }}
      - name: Login to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
        with:
          platforms: all
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          version: latest
          install: true
      - name: Download all Linux package artifacts
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          pattern: vector-${{ env.VECTOR_VERSION }}-*-linux-*
          path: target/artifacts
          merge-multiple: true
      - name: Build and publish Docker images
        env:
          PLATFORM: "linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6"
          REPOS: "timberio/vector,ghcr.io/vectordotdev/vector"
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
          timeout_minutes: 15
          max_attempts: 3
          retry_wait_seconds: 60
          command: make release-docker

  publish-s3:
    name: Publish to S3
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    needs:
      - generate-publish-metadata
      - build-linux-packages
      - build-apple-darwin-packages
      - build-x86_64-pc-windows-msvc-packages
      - deb-verify
      - rpm-verify
      - macos-verify
    env:
      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
      CHANNEL: ${{ needs.generate-publish-metadata.outputs.vector_release_channel }}
    steps:
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Download all package artifacts
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          pattern: vector-${{ env.VECTOR_VERSION }}-*
          path: target/artifacts
          merge-multiple: true
      - name: Publish artifacts to S3
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.CI_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.CI_AWS_SECRET_ACCESS_KEY }}
        run: make release-s3

  publish-github:
    name: Publish release to GitHub
    # We only publish to GitHub for versioned releases, not nightlies.
    if: inputs.channel == 'release'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    # Elevated permission required to create GitHub releases and upload release assets
    permissions:
      contents: write
    needs:
      - generate-publish-metadata
      - build-linux-packages
      - build-apple-darwin-packages
      - build-x86_64-pc-windows-msvc-packages
      - deb-verify
      - rpm-verify
      - macos-verify
      - generate-sha256sum
    env:
      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
    steps:
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Download all package artifacts
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          pattern: vector-${{ env.VECTOR_VERSION }}-*
          path: target/artifacts
          merge-multiple: true
      - name: Publish release to GitHub
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: make release-github

  generate-sha256sum:
    name: Generate SHA256 checksums
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    needs:
      - generate-publish-metadata
      - build-linux-packages
      - build-apple-darwin-packages
      - build-x86_64-pc-windows-msvc-packages
    env:
      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
    steps:
      - name: Checkout Vector
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.git_ref }}
      - name: Download all package artifacts
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          pattern: vector-${{ env.VECTOR_VERSION }}-*
          path: target/artifacts
          merge-multiple: true
      - name: Generate SHA256 checksums for artifacts
        run: make sha256sum
      - name: Stage checksum for publish
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: vector-${{ env.VECTOR_VERSION }}-SHA256SUMS
          path: target/artifacts/vector-${{ env.VECTOR_VERSION }}-SHA256SUMS