From 75ee0eea752c5d9f98256cc672c43d9f016bbfe5 Mon Sep 17 00:00:00 2001
From: Ibrahim Halatci <ihalatci@microsoft.com>
Date: Wed, 12 Aug 2026 15:16:00 +0300
Subject: [PATCH] ci: add gated arm64 (.deb) release leg to all-citus
 build-package

Add an arm64 leg to the release build+publish workflow, gated behind the
DEB_BUILD_MULTI_ARCH repo variable (default OFF), so amd64 release builds are
byte-for-byte unchanged until the gate is flipped.

- arch matrix dimension: ["amd64"] by default, ["amd64","arm64"] when the gate
  is on; arm64 is excluded for the RPM platforms (el/8, el/9, ol/8, ol/9).
- arm64 legs run on native ubuntu-24.04-arm runners.
- The arm64 builder + debsigner images are not published to Docker Hub yet, so
  build them in-job by cloning develop's tooling (this branch carries none):
  TEST=false ./update_image builds citus/packaging:<distro>-all, and debsigner
  is built from develop's Dockerfile. "docker run" has no --platform and prefers
  a local image, so citus_package picks up the native arm64 images automatically;
  amd64 keeps pulling the published images from Docker Hub.

Requires the develop jq fix (#1204) so the cloned deb builder images work on
arm64. Part of Track 2 of citusdata/citus#8612.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 0259dd2c-9208-48f9-a8c2-8031dca8ab75
---
 .github/workflows/build-package.yml | 42 ++++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-package.yml b/.github/workflows/build-package.yml
index 3102dc43..926f9af2 100644
--- a/.github/workflows/build-package.yml
+++ b/.github/workflows/build-package.yml
@@ -16,7 +16,8 @@ on:
 jobs:
   build_package:
     name: Build package
-    runs-on: ubuntu-latest
+    # arm64 legs run on native ARM64 runners; amd64 stays on ubuntu-latest.
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix:
@@ -30,6 +31,19 @@ jobs:
           - debian/trixie
           - ubuntu/noble
           - ubuntu/jammy
+        # arm64 debs are gated behind the DEB_BUILD_MULTI_ARCH repo variable
+        # (default OFF -> amd64 only, so the existing release pipeline is unchanged).
+        arch: ${{ fromJSON(vars.DEB_BUILD_MULTI_ARCH == 'true' && '["amd64", "arm64"]' || '["amd64"]') }}
+        exclude:
+          # el/*, ol/* are RPM targets; arm64 RPM parity is out of scope here.
+          - platform: el/8
+            arch: arm64
+          - platform: el/9
+            arch: arm64
+          - platform: ol/8
+            arch: arm64
+          - platform: ol/9
+            arch: arm64
 
     steps:
       - name: Checkout repository
@@ -57,6 +71,32 @@ jobs:
       - name: Install python requirements
         run: python -m pip install -r tools/packaging_automation/requirements.txt
 
+      # The arm64 builder/signer images are not published to Docker Hub yet, so
+      # build them natively in-job by cloning develop's tooling (this branch has
+      # none). "docker run" prefers a local image, so citus_package picks these up
+      # automatically; amd64 keeps pulling the published images from Docker Hub.
+      - name: Login to Docker Hub
+        if: matrix.arch == 'arm64'
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USER_NAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Build arm64 builder image
+        if: matrix.arch == 'arm64'
+        run: |
+          git clone -b develop --depth=1 https://github.com/citusdata/packaging.git tooling
+          cd tooling
+          export TEST=false
+          export TARGET_PLATFORM="${PLATFORM/\//,}"
+          ./update_image
+        env:
+          PLATFORM: ${{ matrix.platform }}
+
+      - name: Build arm64 debsigner image
+        if: matrix.arch == 'arm64'
+        run: docker build -t citusdata/packaging:debsigner -f tooling/dockerfiles/debsigner/Dockerfile tooling
+
       - name: Build packages
         run: |
           python -m  tools.packaging_automation.citus_package \