fleet/.github/workflows/generate-osqueryd-targets.yml

name: Generate osqueryd targets for Fleetd

on:
  push:
    branches:
      - main
    paths:
      # The workflow can be triggered by modifying OSQUERY_VERSION env.
      - '.github/workflows/generate-osqueryd-targets.yml'
  pull_request:
    paths:
      # The workflow can be triggered by modifying OSQUERY_VERSION env.
      - '.github/workflows/generate-osqueryd-targets.yml'
  workflow_dispatch:

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
  cancel-in-progress: true

defaults:
  run:
    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
    shell: bash

env:
  OSQUERY_VERSION: 5.22.1

permissions:
  id-token: write
  attestations: write

jobs:
  generate-macos:
    runs-on: macos-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Generate osqueryd.app.tar.gz
        run: |
          make osqueryd-app-tar-gz out-path=. version=$OSQUERY_VERSION          

      - name: Extract archive for attestation
        run: |
          mkdir -p extracted
          tar -xzf osqueryd.app.tar.gz -C extracted          

      - name: Attest binary
        continue-on-error: true
        uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
        with:
          subject-path: "extracted/osquery.app/Contents/MacOS/*"

      - name: Repackage archive
        run: |
          cd extracted
          tar -czf ../osqueryd.app.tar.gz ./*          

      - name: Upload osqueryd.app.tar.gz
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: osqueryd.app.tar.gz
          path: osqueryd.app.tar.gz

  generate-linux:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Download and extract osqueryd for linux
        run: |
          curl -L https://github.com/osquery/osquery/releases/download/${{ env.OSQUERY_VERSION }}/osquery_${{ env.OSQUERY_VERSION }}-1.linux_amd64.deb --output osquery.deb
          ar x osquery.deb
          tar xf data.tar.gz
          chmod +x ./opt/osquery/bin/osqueryd
          ./opt/osquery/bin/osqueryd --version          

      - name: Attest binary
        continue-on-error: true
        uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
        with:
          subject-path: "opt/osquery/bin/osqueryd"

      - name: Upload osqueryd for linux
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: osqueryd
          path: opt/osquery/bin/osqueryd

  generate-linux-arm64:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Install file
        run: |
          sudo apt-get install -y file          

      - name: Download and extract osqueryd for linux-arm64
        run: |
          curl -L https://github.com/osquery/osquery/releases/download/${{ env.OSQUERY_VERSION }}/osquery_${{ env.OSQUERY_VERSION }}-1.linux_arm64.deb --output osquery.deb
          ar x osquery.deb
          tar xf data.tar.gz
          chmod +x ./opt/osquery/bin/osqueryd
          file ./opt/osquery/bin/osqueryd | grep aarch64          

      - name: Attest binary
        continue-on-error: true
        uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
        with:
          subject-path: "opt/osquery/bin/osqueryd"

      - name: Upload osqueryd for linux-arm64
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: osqueryd-arm64
          path: opt/osquery/bin/osqueryd

  generate-windows:
    runs-on: windows-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Download osquery msi for Windows
        run: |
          curl -L https://github.com/osquery/osquery/releases/download/${{ env.OSQUERY_VERSION }}/osquery-${{ env.OSQUERY_VERSION }}.msi --output osquery-${{ env.OSQUERY_VERSION }}.msi          

      - name: Extract osqueryd.exe for Windows
        shell: cmd
        run: |
          msiexec /a osquery-${{ env.OSQUERY_VERSION }}.msi /qb TARGETDIR=C:\temp
          C:\temp\osquery\osqueryd\osqueryd.exe --version          

      - name: Attest binary
        continue-on-error: true
        uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
        with:
          subject-path: C:\temp\osquery\osqueryd\osqueryd.exe

      - name: Upload osqueryd for Windows
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: osqueryd.exe
          path: C:\temp\osquery\osqueryd\osqueryd.exe

  generate-windows-arm64:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Download osquery msi for Windows
        run: |
          curl -L https://github.com/osquery/osquery/releases/download/${{ env.OSQUERY_VERSION }}/osquery-${{ env.OSQUERY_VERSION }}.windows_arm64.zip --output osquery-${{ env.OSQUERY_VERSION }}.windows_arm64.zip          

      - name: Install file
        run: |
          sudo apt-get install -y unzip file          

      - name: Extract osqueryd.exe for Windows
        run: |
          unzip osquery-${{ env.OSQUERY_VERSION }}.windows_arm64.zip
          cp osquery-${{ env.OSQUERY_VERSION }}.windows_arm64/Program\ Files/osquery/osqueryd/osqueryd.exe .
          file ./osqueryd.exe | grep "PE32+ executable (console) Aarch64"          

      - name: Attest binary
        continue-on-error: true
        uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
        with:
          subject-path: osqueryd.exe

      - name: Upload osqueryd for Windows
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: osqueryd-arm64.exe
          path: osqueryd.exe