VAULT-34477: Add s390x multilib compiler to build-vault action (#29837)

Install and configure an s390x C toolchain when building Vault editions
that need CGO on s390x. x86_64 and aarch64 need no special handling as
it is assumed that those binaries are compiled on runners with matching
architecture.

Signed-off-by: Ryan Cragun <[email protected]>

Author: ryancragun

.github/actions/build-vault/action.yml

@@ -87,6 +87,16 @@ runs:
       with:
         github-token: ${{ inputs.github-token }}
     - uses: ./.github/actions/install-external-tools
+    - if: inputs.goarch == 's390x' && inputs.vault-edition == 'ent.hsm'
+      name: Configure CGO compiler for HSM edition on s390x
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y gcc-multilib-s390x-linux-gnu
+        {
+          echo "CC=s390x-linux-gnu-gcc"
+          echo "CC_FOR_TARGET=s390x-linux-gnu-gcc"
+        } | tee -a "$GITHUB_ENV"
     - if: inputs.vault-edition != 'ce'
       name: Configure Git
       shell: bash

scripts/ci-helper.sh

@@ -2,7 +2,6 @@
 # Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: BUSL-1.1
 
-
 # The ci-helper is used to determine build metadata, build Vault binaries,
 # package those binaries into artifacts, and execute tests with those artifacts.
 
@@ -92,7 +91,14 @@ function build() {
   : "${GO_TAGS:=""}"
   : "${REMOVE_SYMBOLS:=""}"
 
-  (unset GOOS; unset GOARCH; go generate ./...)
+  # Generate code but make sure we don't slurp in cross compilation env vars
+  (
+    unset GOOS
+    unset GOARCH
+    unset CC
+    unset CC_FOR_TARGET
+    go generate ./...
+  )
 
   # Build our ldflags
   msg="--> Building Vault revision $revision, built $build_date..."
@@ -155,43 +161,43 @@ function prepare_ce_legal() {
 # Package version converts a vault version string into a compatible representation for system
 # packages.
 function version_package() {
-  awk '{ gsub("-","~",$1); print $1 }' <<< "$VAULT_VERSION"
+  awk '{ gsub("-","~",$1); print $1 }' <<<"$VAULT_VERSION"
 }
 
 # Run the CI Helper
 function main() {
   case $1 in
   artifact-basename)
     artifact_basename
-  ;;
+    ;;
   build)
     build
-  ;;
+    ;;
   build-ui)
     build_ui
-  ;;
+    ;;
   bundle)
     bundle
-  ;;
+    ;;
   date)
     build_date
-  ;;
+    ;;
   prepare-ent-legal)
     prepare_ent_legal
-  ;;
+    ;;
   prepare-ce-legal)
     prepare_ce_legal
-  ;;
+    ;;
   revision)
     build_revision
-  ;;
+    ;;
   version-package)
     version_package
-  ;;
+    ;;
   *)
     echo "unknown sub-command" >&2
     exit 1
-  ;;
+    ;;
   esac
 }