feat: Add ARM64 (linux/arm64) build support

.github/workflows/go.yml

@@ -27,3 +27,12 @@ jobs:
       with:
         go-version-file: go.mod
     - run: go run github.com/onsi/ginkgo/v2/ginkgo run -r --keep-going --skip-package integration
+
+  cross-compile-linux-arm64: # <- name
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+    - uses: actions/setup-go@v7
+      with:
+        go-version-file: go.mod
+    - run: GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build ./...

bin/build-linux-arm64

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -eu -o pipefail
+
+ROOT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd )"
+
+export GOARCH=arm64
+export GOOS=linux
+
+"${ROOT_DIR}/bin/build"

ci/docker/Dockerfile

@@ -1,8 +1,15 @@
+ARG GOLANG_RELEASE_IMAGE
+FROM ${GOLANG_RELEASE_IMAGE} AS golang-release
+
 FROM ubuntu
 ARG BOSH_CLI_VERSION
 ARG CREDHUB_CLI_VERSION
 ARG JQ_VERSION
 
+# No default: a default would override the value BuildKit sets from the target
+# platform. Without BuildKit this is empty and the arch checks below fail.
+ARG TARGETARCH
+
 RUN \
   apt-get update \
   && apt-get -y upgrade \
@@ -18,17 +25,35 @@ RUN \
     shellcheck \
   && apt-get clean
 
-
-RUN wget -nv https://github.com/cloudfoundry/bosh-cli/releases/download/v${BOSH_CLI_VERSION}/bosh-cli-${BOSH_CLI_VERSION}-linux-amd64 \
+RUN wget -nv https://github.com/cloudfoundry/bosh-cli/releases/download/v${BOSH_CLI_VERSION}/bosh-cli-${BOSH_CLI_VERSION}-linux-${TARGETARCH} \
     -O /usr/local/bin/bosh && chmod +x /usr/local/bin/bosh
 
-RUN wget -nv https://github.com/stedolan/jq/releases/download/${JQ_VERSION}/jq-linux64 \
-    -O /usr/local/bin/jq && chmod +x /usr/local/bin/jq
+# stedolan/jq is archived and ships no arm64 asset, so arm64 uses jqlang/jq.
+RUN case "${TARGETARCH}" in \
+      amd64) wget -nv https://github.com/stedolan/jq/releases/download/${JQ_VERSION}/jq-linux64 \
+               -O /usr/local/bin/jq ;; \
+      arm64) wget -nv https://github.com/jqlang/jq/releases/download/${JQ_VERSION}/jq-linux-arm64 \
+               -O /usr/local/bin/jq ;; \
+      *)     echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac \
+    && chmod +x /usr/local/bin/jq
 
-RUN wget -nv https://github.com/cloudfoundry-incubator/credhub-cli/releases/download/${CREDHUB_CLI_VERSION}/credhub-linux-amd64-${CREDHUB_CLI_VERSION}.tgz -O - | \
-    tar -zx --directory=/usr/local/bin
-
-COPY --from=ghcr.io/cloudfoundry/bosh/golang-release /var/vcap/packages/golang-1-linux/ /usr/local/go
+COPY --from=golang-release /var/vcap/packages/golang-1-linux/ /usr/local/go
 ENV GOROOT=/usr/local/go PATH=/usr/local/go/bin:$PATH
 
+# credhub-cli publishes amd64 release binaries only, so arm64 builds from source.
+# The version linker flag matches the upstream Makefile.
+RUN case "${TARGETARCH}" in \
+      amd64) wget -nv https://github.com/cloudfoundry-incubator/credhub-cli/releases/download/${CREDHUB_CLI_VERSION}/credhub-linux-amd64-${CREDHUB_CLI_VERSION}.tgz -O - | \
+               tar -zx --directory=/usr/local/bin ;; \
+      arm64) git clone --depth 1 --branch "${CREDHUB_CLI_VERSION}" \
+               https://github.com/cloudfoundry/credhub-cli.git /tmp/credhub-cli \
+             && ( cd /tmp/credhub-cli && go build \
+                    -ldflags "-X code.cloudfoundry.org/credhub-cli/version.Version=${CREDHUB_CLI_VERSION}" \
+                    -o /usr/local/bin/credhub . ) \
+             && rm -rf /tmp/credhub-cli \
+             && go clean -cache -modcache ;; \
+      *)     echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac
+
 RUN useradd --create-home --shell /bin/bash bosh

ci/pipeline.yml

@@ -82,6 +82,13 @@ resources:
       owner: stedolan
       repository: jq
 
+  - name: jq-github-release-arm64
+    type: github-release
+    source:
+      access_token: ((github_public_repo_token))
+      owner: jqlang
+      repository: jq
+
   - name: bosh-ecosystem-concourse
     type: git
     source:
@@ -105,11 +112,41 @@ resources:
       username: ((github_read_write_packages.username))
       password: ((github_read_write_packages.password))
 
+  - name: bosh-agent-docker-image-arm64
+    type: registry-image
+    source:
+      repository: ghcr.io/cloudfoundry/bosh-agent
+      tag: latest-arm64
+      username: ((github_read_write_packages.username))
+      password: ((github_read_write_packages.password))
+
+  - name: bosh-agent-registry-image-arm64
+    type: registry-image
+    source:
+      repository: ghcr.io/cloudfoundry/bosh-agent
+      tag: latest-arm64
+      username: ((github_read_write_packages.username))
+      password: ((github_read_write_packages.password))
+
+  - name: ubuntu-image
+    type: registry-image
+    source:
+      repository: ubuntu
+      tag: noble
+      username: ((docker.username))
+      password: ((docker.password))
+
   - name: golang-release-image
     type: registry-image
     source:
       repository: ghcr.io/cloudfoundry/bosh/golang-release
 
+  - name: golang-release-image-arm64
+    type: registry-image
+    source:
+      repository: ghcr.io/cloudfoundry/bosh/golang-release
+      tag: latest-arm64
+
   - name: integration-postgres-15-image
     type: registry-image
     source:
@@ -323,13 +360,77 @@ jobs:
           params:
             CONTEXT: bosh-agent-ci/ci/docker
             BUILD_ARGS_FILE: docker-build-args/docker-build-args.yml
+            BUILD_ARG_GOLANG_RELEASE_IMAGE: ghcr.io/cloudfoundry/bosh/golang-release:latest
           run:
             path: build
       - put: bosh-agent-docker-image
         no_get: true
         params:
           image: image/image.tar
 
+  - name: build-docker-image-arm64
+    plan:
+      - in_parallel:
+          - get: bosh-agent
+            tags: [ arm64 ]
+          - get: bosh-agent-ci
+            tags: [ arm64 ]
+          - get: ubuntu-image
+            tags: [ arm64 ]
+          - get: bosh-cli-github-release
+            resource: bosh-cli
+            trigger: true
+            params:
+              globs:
+                - "no-files-needed"
+            tags: [ arm64 ]
+          - get: credhub-cli-github-release
+            trigger: true
+            params:
+              globs:
+                - "no-files-needed"
+            tags: [ arm64 ]
+          - get: jq-github-release
+            resource: jq-github-release-arm64
+            trigger: true
+            params:
+              globs:
+                - "no-files-needed"
+            tags: [ arm64 ]
+          - get: golang-release-image
+            resource: golang-release-image-arm64
+            trigger: true
+            tags: [ arm64 ]
+      - task: build-docker-args
+        file: bosh-agent-ci/ci/docker/build-args.yml
+        image: ubuntu-image
+        tags: [ arm64 ]
+      - task: build-image
+        privileged: true
+        tags: [ arm64 ]
+        config:
+          platform: linux
+          image_resource:
+            type: registry-image
+            source:
+              repository: concourse/oci-build-task
+          inputs:
+            - name: bosh-agent-ci
+            - name: docker-build-args
+          outputs:
+            - name: image
+          params:
+            CONTEXT: bosh-agent-ci/ci/docker
+            BUILD_ARGS_FILE: docker-build-args/docker-build-args.yml
+            BUILD_ARG_GOLANG_RELEASE_IMAGE: ghcr.io/cloudfoundry/bosh/golang-release:latest-arm64
+          run:
+            path: build
+      - put: bosh-agent-docker-image-arm64
+        no_get: true
+        tags: [ arm64 ]
+        params:
+          image: image/image.tar
+
   - name: test-unit
     plan:
       - get: bosh-agent
@@ -341,6 +442,20 @@ jobs:
         image: bosh-agent-registry-image
         file: bosh-agent-ci/ci/tasks/test-unit.yml
 
+  - name: test-unit-arm64
+    plan:
+      - get: bosh-agent
+        trigger: true
+      - get: bosh-agent-ci
+      - get: bosh-agent-registry-image
+        resource: bosh-agent-registry-image-arm64
+        trigger: true
+        tags: [ arm64 ]
+      - task: test-unit
+        image: bosh-agent-registry-image
+        file: bosh-agent-ci/ci/tasks/test-unit.yml
+        tags: [ arm64 ]
+
   - name: test-unit-windows
     serial: true
     plan:
@@ -976,12 +1091,16 @@ jobs:
         - task: build-linux
           image: bosh-agent-registry-image
           file: bosh-agent-ci/ci/tasks/build-linux.yml
+        - task: build-linux-arm64
+          image: bosh-agent-registry-image
+          file: bosh-agent-ci/ci/tasks/build-linux-arm64.yml
         - task: build-windows
           image: bosh-agent-registry-image
           file: bosh-agent-ci/ci/tasks/build-windows.yml
       - put: bosh-agent-index
         params:
           files:
             - compiled-linux-amd64/*
+            - compiled-linux-arm64/*
             - compiled-windows-amd64/*
           version: version-semver/number

ci/tasks/build-linux-arm64.yml

@@ -0,0 +1,24 @@
+---
+platform: linux
+
+image_resource:
+  type: registry-image
+  source:
+    repository: bosh/agent
+    tag: latest
+
+inputs:
+- name: bosh-agent
+- name: bosh-agent-ci
+- name: version-semver
+
+outputs:
+- name: compiled-linux-arm64
+
+params:
+  OUTPUT_DIR: compiled-linux-arm64
+  GOARCH: arm64
+  GOOS:   linux
+
+run:
+  path: bosh-agent-ci/ci/tasks/build.sh