From d6fad3c2685de00df8274661e81d9b632e5a775a Mon Sep 17 00:00:00 2001
From: Ibrahim Halatci <ihalatci@microsoft.com>
Date: Fri, 10 Jul 2026 12:22:00 +0300
Subject: [PATCH] ci: add gated arm64 (.deb) leg to citus community nightlies

Adds an optional arm64 build+publish leg to the community-nightlies
workflow, gated behind the DEB_BUILD_MULTI_ARCH repo variable (default
OFF, so the existing amd64 pipeline is byte-for-byte unchanged). This
unblocks ARM64 Debian Citus Docker images (citusdata/citus#8612), which
install Citus from the packagecloud citusdata/community(-nightlies) apt
repos whose arm64 index is currently empty.

- arm64 legs run on native ubuntu-24.04-arm runners; el/8 (RPM) excluded
- builder (citus/packaging-test:<distro>-all) and signer
  (citusdata/packaging:debsigner) images are built natively in-job since
  only amd64 variants are published to Docker Hub today; docker run has
  no --platform and prefers local images, so citus_package uses them
- no changes to the amd64 path, shared scripts, or the build engine

Deb-only; arm64 release legs, published multi-arch images, and RPM
arm64 parity are follow-ups.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../build-citus-community-nightlies.yml       | 26 ++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-citus-community-nightlies.yml b/.github/workflows/build-citus-community-nightlies.yml
index 1dbbf8b0..760b789a 100644
--- a/.github/workflows/build-citus-community-nightlies.yml
+++ b/.github/workflows/build-citus-community-nightlies.yml
@@ -24,7 +24,8 @@ concurrency:
 jobs:
   build_package:
     name: Build package
-    runs-on: ubuntu-latest
+    # arm64 legs run on native ARM64 runners; amd64 stays on ubuntu-latest.
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix:
@@ -35,6 +36,13 @@ jobs:
           - debian/trixie
           - ubuntu/jammy
           - ubuntu/noble
+        # arm64 debs are gated behind the DEB_BUILD_MULTI_ARCH repo variable
+        # (default OFF -> amd64 only, so the existing pipeline is unchanged).
+        arch: ${{ fromJSON(vars.DEB_BUILD_MULTI_ARCH == 'true' && '["amd64", "arm64"]' || '["amd64"]') }}
+        exclude:
+          # el/8 is an RPM target; arm64 RPM parity is out of scope here.
+          - platform: el/8
+            arch: arm64
 
     steps:
       - name: Checkout repository
@@ -74,6 +82,22 @@ jobs:
       - name: Install python requirements
         run: python -m pip install -r tools/packaging_automation/requirements.txt
 
+      # The arm64 builder/signer images are not published to Docker Hub yet, so
+      # build them natively in-job. "docker run" prefers a local image, so
+      # citus_package picks these up automatically; amd64 keeps pulling from Docker Hub.
+      - name: Build arm64 builder image
+        if: matrix.arch == 'arm64'
+        run: |
+          export TEST=true
+          export TARGET_PLATFORM="${PLATFORM/\//,}"
+          ./update_image
+        env:
+          PLATFORM: ${{ matrix.platform }}
+
+      - name: Build arm64 debsigner image
+        if: matrix.arch == 'arm64'
+        run: docker build -t citusdata/packaging:debsigner -f dockerfiles/debsigner/Dockerfile .
+
       - name: Build packages
         run: |
           python -m  tools.packaging_automation.citus_package \