From bab00142202c6b5eeb1d22c66d1cd86881b9505b Mon Sep 17 00:00:00 2001
From: Roger Hu <roger.hu@gmail.com>
Date: Tue, 3 Sep 2024 10:11:43 -0700
Subject: [PATCH 1/2] If reauth is required, show the full command-line path of
 the binary (#47)

The error message that gets printed out tells me to login again.
However, it doesn't show the full path of the binary that was used to
run the credential helper.
---
 internal/autherr/coded_error.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/internal/autherr/coded_error.go b/internal/autherr/coded_error.go
index 456fa25..507c75e 100644
--- a/internal/autherr/coded_error.go
+++ b/internal/autherr/coded_error.go
@@ -17,6 +17,8 @@ package autherr
 import (
 	"errors"
 	"fmt"
+	"os"
+	"path/filepath"
 )
 
 const (
@@ -56,6 +58,7 @@ func CodedErrorf(code int, format string, args ...any) error {
 func ReauthRequired(cluster string) error {
 	const reauthMessage = "Missing/invalid/expired credentials for cluster: %s\n" +
 		"Please refresh credentials by running:\n\n\t" +
-		"engflow_auth login %s\n"
-	return CodedErrorf(CodeReauthRequired, reauthMessage, cluster, cluster)
+		"%s login %s\n"
+	cmdPath := filepath.ToSlash(os.Args[0])
+	return CodedErrorf(CodeReauthRequired, reauthMessage, cluster, cmdPath, cluster)
 }

From cd40f052e55f7a4983d379fe3b48cef85bab5057 Mon Sep 17 00:00:00 2001
From: Jay Conrod <jayconrod@gmail.com>
Date: Wed, 4 Sep 2024 08:46:06 -0700
Subject: [PATCH 2/2] CUS-356: release: add linux/arm64 binary (#46)

Also, allow prerelease versions outside release branches so we can
manually test changes to this script.
---
 BUILD                  |  1 +
 cmd/engflow_auth/BUILD |  7 +++++++
 infra/release.sh       | 23 ++++++++++++++++-------
 3 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/BUILD b/BUILD
index 416d93e..9f2ef82 100644
--- a/BUILD
+++ b/BUILD
@@ -6,6 +6,7 @@ gazelle(name = "gazelle")
 filegroup(
     name = "release_artifacts",
     srcs = [
+        "//cmd/engflow_auth:engflow_auth_linux_arm64",
         "//cmd/engflow_auth:engflow_auth_linux_x64",
         "//cmd/engflow_auth:engflow_auth_macos_arm64",
         "//cmd/engflow_auth:engflow_auth_macos_x64",
diff --git a/cmd/engflow_auth/BUILD b/cmd/engflow_auth/BUILD
index 5b41b23..363e7e0 100644
--- a/cmd/engflow_auth/BUILD
+++ b/cmd/engflow_auth/BUILD
@@ -66,3 +66,10 @@ go_cross_binary(
     target = ":engflow_auth",
     visibility = RELEASE_ARTIFACT,
 )
+
+go_cross_binary(
+    name = "engflow_auth_linux_arm64",
+    platform = "@rules_go//go/toolchain:linux_arm64_cgo",
+    target = ":engflow_auth",
+    visibility = RELEASE_ARTIFACT,
+)
diff --git a/infra/release.sh b/infra/release.sh
index e003ffa..cd8d7fa 100755
--- a/infra/release.sh
+++ b/infra/release.sh
@@ -65,14 +65,18 @@ if [[ "${GH_CLI_ACTUAL_SHA256}" != "${GH_CLI_EXPECTED_SHA256}" ]]; then
 fi
 echo "[FINISH] Downloading gh CLI"
 
+# If this is a release version (not a prerelease), the commit must be on main or
+# the correct release branch (e.g., release/v1.2). This constraint doesn't apply
+# to prereleases so we can test this workflow.
 echo "[START]  Release branch checks"
-# Current commit must be on either `main` or the corresponding release branch
-readonly EXPECTED_RELEASE_BRANCH="$(sed --regexp-extended 's|(^v[0-9]+\.[0-9]+)\..*$|release/\1|' <<<${RELEASE_VERSION})"
-if ! git branch \
-  --contains "$(git rev-parse HEAD)" \
-  | grep --quiet --extended-regexp "main|${EXPECTED_RELEASE_BRANCH}"; then
-    echo "Commit $(git rev-parse HEAD) is not on main or release branch ${EXPECTED_RELEASE_BRANCH}; exiting"
-    exit 1
+if [[ "${RELEASE_VERSION}" != *-* ]]; then
+  readonly EXPECTED_RELEASE_BRANCH="$(sed --regexp-extended 's|(^v[0-9]+\.[0-9]+)\..*$|release/\1|' <<<${RELEASE_VERSION})"
+  if ! git branch \
+    --contains "$(git rev-parse HEAD)" \
+    | grep --quiet --extended-regexp "main|${EXPECTED_RELEASE_BRANCH}"; then
+      echo "Commit $(git rev-parse HEAD) is not on main or release branch ${EXPECTED_RELEASE_BRANCH}; exiting"
+      exit 1
+  fi
 fi
 echo "[FINISH] Release branch checks"
 
@@ -97,6 +101,10 @@ echo "[FINISH] Building artifacts"
 # resolution, we may be able to drop this staging step and the corresponding
 # temp dir.
 echo "[START]  Staging artifacts"
+cp \
+  bazel-out/k8-fastbuild-ST-*/bin/cmd/engflow_auth/engflow_auth_linux_arm64 \
+  "${ARTIFACTS_DIR}/engflow_auth_linux_arm64"
+
 cp \
   bazel-out/k8-fastbuild-ST-*/bin/cmd/engflow_auth/engflow_auth_linux_x64 \
   "${ARTIFACTS_DIR}/engflow_auth_linux_x64"
@@ -119,6 +127,7 @@ echo "[START]  Creating release"
 ${GH_CLI} release create \
     "${RELEASE_VERSION}" \
     --generate-notes \
+    "${ARTIFACTS_DIR}/engflow_auth_linux_arm64#engflow_auth (Linux, arm64)" \
     "${ARTIFACTS_DIR}/engflow_auth_linux_x64#engflow_auth (Linux, x64)" \
     "${ARTIFACTS_DIR}/engflow_auth_macos_arm64#engflow_auth (macOS, arm64)" \
     "${ARTIFACTS_DIR}/engflow_auth_macos_x64#engflow_auth (macOS, x64)" \