From 59d0bcb1c8e0efd1182ce96ff811f9334d97b4f8 Mon Sep 17 00:00:00 2001 From: Sachin Jain Date: Thu, 16 Jul 2026 12:25:27 +0530 Subject: [PATCH 1/2] Add darwin (macOS aarch64) to Habitat release CI pipeline Add aarch64-darwin as a build target in .bldr.toml and update the Buildkite pre-command hook to support macOS workers by retrieving HAB_AUTH_TOKEN from Vault instead of AWS SSM when the build label indicates a macOS/darwin platform. Changes: - .bldr.toml: Add new file with build_targets including aarch64-darwin - .buildkite/hooks/pre-command: Detect macOS build labels and use vault-util-init + Vault KV to fetch the Habitat auth token, falling back to the existing AWS SSM path for Linux/Windows workers Signed-off-by: Sachin Jain --- .bldr.toml | 7 +++++++ .buildkite/hooks/pre-command | 14 +++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 .bldr.toml diff --git a/.bldr.toml b/.bldr.toml new file mode 100644 index 00000000..31812b2a --- /dev/null +++ b/.bldr.toml @@ -0,0 +1,7 @@ +[knife] +build_targets = [ + "x86_64-linux", + "aarch64-linux", + "x86_64-windows", + "aarch64-darwin" +] diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command index d86d1e89..dbb9f7b0 100644 --- a/.buildkite/hooks/pre-command +++ b/.buildkite/hooks/pre-command @@ -6,4 +6,16 @@ elif [[ $BUILDKITE_ORGANIZATION_SLUG = 'chef' ]] || [[ $BUILDKITE_ORGANIZATION_S AWS_REGION='us-west-2' fi -export HAB_AUTH_TOKEN=$(aws ssm get-parameter --name 'habitat-prod-auth-token' --with-decryption --query Parameter.Value --output text --region ${AWS_REGION}) +if [[ "$BUILDKITE_LABEL" =~ [Mm]ac[Oo][Ss]|mac_os_x|darwin ]]; then + if ! command -v vault-util-init &>/dev/null; then + echo "ERROR: vault-util-init not found on macOS worker" >&2 + exit 1 + fi + export VAULT_ADDR="https://vault.ps.chef.co" + export VAULT_TOKEN="${VAULT_TOKEN:-$(cat ~/.vault-token 2>/dev/null || true)}" + . vault-util-init + HAB_AUTH_TOKEN=$(vault kv get -field auth_token account/static/habitat/chef-ci) + export HAB_AUTH_TOKEN +else + export HAB_AUTH_TOKEN=$(aws ssm get-parameter --name 'habitat-prod-auth-token' --with-decryption --query Parameter.Value --output text --region ${AWS_REGION}) +fi \ No newline at end of file From 8ab4d253cc7b3dd5ddf34df1cc744cc35bcf7b92 Mon Sep 17 00:00:00 2001 From: Sachin Jain Date: Fri, 17 Jul 2026 13:25:50 +0530 Subject: [PATCH 2/2] CHEF-34748: fix final newline for CI check Signed-off-by: Sachin Jain --- .buildkite/hooks/pre-command | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command index dbb9f7b0..f744ec83 100644 --- a/.buildkite/hooks/pre-command +++ b/.buildkite/hooks/pre-command @@ -18,4 +18,4 @@ if [[ "$BUILDKITE_LABEL" =~ [Mm]ac[Oo][Ss]|mac_os_x|darwin ]]; then export HAB_AUTH_TOKEN else export HAB_AUTH_TOKEN=$(aws ssm get-parameter --name 'habitat-prod-auth-token' --with-decryption --query Parameter.Value --output text --region ${AWS_REGION}) -fi \ No newline at end of file +fi