From 53fc1e4191411c476e18225bac32f501a543fded Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 18:17:31 +0100
Subject: [PATCH 01/39] github-actions: build docker images

---
 .github/workflows/ci.yml | 77 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..44266a09
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,77 @@
+---
+name: ci
+
+on:
+  push: ~
+
+permissions:
+  contents: read
+
+env:
+  DOCKER_REGISTRY: "docker.elastic.co"
+  STAGING_IMAGE: "docker.elastic.co/observability-ci"
+  GS_BUCKET_PATH: ingest-buildkite-ci
+
+jobs:
+  build-x86-64:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    strategy:
+      matrix:
+        makefile: [
+          "Makefile",
+          "Makefile.debian7",
+          "Makefile.debian8",
+          "Makefile.debian9",
+          "Makefile.debian10",
+          "Makefile.debian11",
+          "Makefile.debian12"
+        ]
+        fips: [ "false", "true" ]
+    env:
+      FIPS: "${{matrix.fips}}"
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          source .buildkite/scripts/common.sh
+          add_bin_path
+          with_mage
+          #google_cloud_auth
+          make -C go -f "${{matrix.makefile}}" build
+        env:
+          REPOSITORY: "docker.elastic.co/observability-ci"
+      - run: |
+          docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${STAGING_IMAGE}/golang-crossbuild"
+          docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${DOCKER_REGISTRY}/beats-dev/golang-crossbuild"
+
+
+  build-arm-64:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+      id-token: write
+    strategy:
+      matrix:
+        makefile: [
+          "Makefile.debian9"
+        ]
+        fips: [ "false", "true" ]
+    env:
+      FIPS: "${{matrix.fips}}"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: ".go-version"
+      - run: |
+          source .buildkite/scripts/common.sh
+          add_bin_path
+          with_mage
+          #google_cloud_auth
+          make -C go -f "${{matrix.makefile}}" build
+        env:
+          REPOSITORY: "docker.elastic.co/observability-ci"
+
+

From 8d4f068c53dcbf539e4504b14f50d0c955e9a6b7 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 18:26:27 +0100
Subject: [PATCH 02/39] fix

---
 .github/workflows/ci.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44266a09..97765d2e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,8 @@ permissions:
 env:
   DOCKER_REGISTRY: "docker.elastic.co"
   STAGING_IMAGE: "docker.elastic.co/observability-ci"
-  GS_BUCKET_PATH: ingest-buildkite-ci
+  #GS_BUCKET_PATH: ingest-buildkite-ci
+  GS_BUCKET_PATH: "golang-crossbuild-temporary"
 
 jobs:
   build-x86-64:
@@ -33,7 +34,11 @@ jobs:
     env:
       FIPS: "${{matrix.fips}}"
     steps:
+      - uses: elastic/oblt-actions/google/auth@v1
       - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: ".go-version"
       - run: |
           source .buildkite/scripts/common.sh
           add_bin_path
@@ -61,6 +66,7 @@ jobs:
     env:
       FIPS: "${{matrix.fips}}"
     steps:
+      - uses: elastic/oblt-actions/google/auth@v1
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:

From 76984c39e7a62c525109af4cb194314ef27e2cfd Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 18:28:31 +0100
Subject: [PATCH 03/39] run

---
 .github/workflows/ci.yml | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 97765d2e..065740c0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,7 @@ permissions:
 env:
   DOCKER_REGISTRY: "docker.elastic.co"
   STAGING_IMAGE: "docker.elastic.co/observability-ci"
+  REPOSITORY: "docker.elastic.co/observability-ci"
   #GS_BUCKET_PATH: ingest-buildkite-ci
   GS_BUCKET_PATH: "golang-crossbuild-temporary"
 
@@ -34,24 +35,22 @@ jobs:
     env:
       FIPS: "${{matrix.fips}}"
     steps:
-      - uses: elastic/oblt-actions/google/auth@v1
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version-file: ".go-version"
+      - uses: elastic/oblt-actions/google/auth@v1
       - run: |
           source .buildkite/scripts/common.sh
           add_bin_path
           with_mage
           #google_cloud_auth
           make -C go -f "${{matrix.makefile}}" build
-        env:
-          REPOSITORY: "docker.elastic.co/observability-ci"
+
       - run: |
           docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${STAGING_IMAGE}/golang-crossbuild"
           docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${DOCKER_REGISTRY}/beats-dev/golang-crossbuild"
 
-
   build-arm-64:
     runs-on: ubuntu-24.04-arm
     permissions:
@@ -66,18 +65,14 @@ jobs:
     env:
       FIPS: "${{matrix.fips}}"
     steps:
-      - uses: elastic/oblt-actions/google/auth@v1
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version-file: ".go-version"
+      - uses: elastic/oblt-actions/google/auth@v1
       - run: |
           source .buildkite/scripts/common.sh
           add_bin_path
           with_mage
           #google_cloud_auth
           make -C go -f "${{matrix.makefile}}" build
-        env:
-          REPOSITORY: "docker.elastic.co/observability-ci"
-
-

From 518fb0fdf499843489387fe8db837944bf9310f8 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 18:50:41 +0100
Subject: [PATCH 04/39] fix

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 065740c0..653c1bc9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,6 @@ env:
   STAGING_IMAGE: "docker.elastic.co/observability-ci"
   REPOSITORY: "docker.elastic.co/observability-ci"
   #GS_BUCKET_PATH: ingest-buildkite-ci
-  GS_BUCKET_PATH: "golang-crossbuild-temporary"
 
 jobs:
   build-x86-64:
@@ -45,7 +44,7 @@ jobs:
           add_bin_path
           with_mage
           #google_cloud_auth
-          make -C go -f "${{matrix.makefile}}" build
+          make -C go -f "${{matrix.makefile}}" build GS_BUCKET_PATH="golang-crossbuild-temporary"
 
       - run: |
           docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${STAGING_IMAGE}/golang-crossbuild"
@@ -76,3 +75,4 @@ jobs:
           with_mage
           #google_cloud_auth
           make -C go -f "${{matrix.makefile}}" build
+          make -C go -f "${{matrix.makefile}}" build GS_BUCKET_PATH="golang-crossbuild-temporary"

From abf5955fc2b7d937a69b63dede9f2da9b233d726 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 18:51:39 +0100
Subject: [PATCH 05/39] fail fast false

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 653c1bc9..86030411 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,6 +20,7 @@ jobs:
       contents: read
       id-token: write
     strategy:
+      fail-fast: false
       matrix:
         makefile: [
           "Makefile",
@@ -56,6 +57,7 @@ jobs:
       contents: read
       id-token: write
     strategy:
+      fail-fast: false
       matrix:
         makefile: [
           "Makefile.debian9"

From 618bacec134f963a56d2695e34d9a6ce68571032 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 18:53:04 +0100
Subject: [PATCH 06/39] debug

---
 Makefile.common | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Makefile.common b/Makefile.common
index 5e0dd98b..5e8417c6 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -19,6 +19,7 @@ endif
 # Requires login at google storage.
 copy-npcap:
 ifeq ($(CI),true)
+	@echo 'cp gs://$(GS_BUCKET_PATH)/private/$(NPCAP_FILE)'
 	@gsutil cp gs://$(GS_BUCKET_PATH)/private/$(NPCAP_FILE) ../npcap/lib/$(NPCAP_FILE)
 else
 	@echo 'Only available if running in the CI'

From fd4ba4508e7e743a945d872fcb33a018488f6729 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 19:02:41 +0100
Subject: [PATCH 07/39] avoid default

honour the env variable instead
---
 .github/workflows/ci.yml | 5 ++---
 Makefile.common          | 4 ++--
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 86030411..3227e717 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,7 +45,7 @@ jobs:
           add_bin_path
           with_mage
           #google_cloud_auth
-          make -C go -f "${{matrix.makefile}}" build GS_BUCKET_PATH="golang-crossbuild-temporary"
+          GS_BUCKET_PATH="golang-crossbuild-temporary" make -C go -f "${{matrix.makefile}}" build
 
       - run: |
           docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${STAGING_IMAGE}/golang-crossbuild"
@@ -76,5 +76,4 @@ jobs:
           add_bin_path
           with_mage
           #google_cloud_auth
-          make -C go -f "${{matrix.makefile}}" build
-          make -C go -f "${{matrix.makefile}}" build GS_BUCKET_PATH="golang-crossbuild-temporary"
+          GS_BUCKET_PATH="golang-crossbuild-temporary" make -C go -f "${{matrix.makefile}}" build-arm
diff --git a/Makefile.common b/Makefile.common
index 5e8417c6..b8d13d7d 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -7,7 +7,7 @@ NPCAP_VERSION := 1.80
 NPCAP_FILE    := npcap-$(NPCAP_VERSION)-oem.exe
 SUFFIX_NPCAP_VERSION := -npcap-$(NPCAP_VERSION)
 NPCAP_REPOSITORY := docker.elastic.co/observability-ci
-GS_BUCKET_PATH ?= ingest-buildkite-ci
+GS_BUCKET_PATH ?=
 
 
 ifeq ($(BUILDX),1)
@@ -18,8 +18,8 @@ endif
 
 # Requires login at google storage.
 copy-npcap:
-ifeq ($(CI),true)
 	@echo 'cp gs://$(GS_BUCKET_PATH)/private/$(NPCAP_FILE)'
+ifeq ($(CI),true)
 	@gsutil cp gs://$(GS_BUCKET_PATH)/private/$(NPCAP_FILE) ../npcap/lib/$(NPCAP_FILE)
 else
 	@echo 'Only available if running in the CI'

From f58ea5ce23f81d8701988b1093581cc76a1a605b Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 19:05:30 +0100
Subject: [PATCH 08/39] honour the variable

---
 Makefile.common | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Makefile.common b/Makefile.common
index b8d13d7d..901e1ac9 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -27,8 +27,9 @@ endif
 
 # Requires login at google storage.
 copy-sdks:
+	@echo 'cp gs://$(GS_BUCKET_PATH)/sdks'
 ifeq ($(CI),true)
-	@gcloud storage cp gs://ingest-buildkite-ci/sdks . --recursive
+	@gcloud storage cp gs://$(GS_BUCKET_PATH)/sdks . --recursive
 else
 	@echo 'Only available if running in the CI'
 endif

From bd67b6b3b162c9f2e839cd368d65e5b96cd8981d Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 19:24:08 +0100
Subject: [PATCH 09/39] use a different google bucket

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3227e717..163385e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,7 +45,7 @@ jobs:
           add_bin_path
           with_mage
           #google_cloud_auth
-          GS_BUCKET_PATH="golang-crossbuild-temporary" make -C go -f "${{matrix.makefile}}" build
+          GS_BUCKET_PATH="golang-crossbuild-tmp" make -C go -f "${{matrix.makefile}}" build
 
       - run: |
           docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${STAGING_IMAGE}/golang-crossbuild"
@@ -76,4 +76,4 @@ jobs:
           add_bin_path
           with_mage
           #google_cloud_auth
-          GS_BUCKET_PATH="golang-crossbuild-temporary" make -C go -f "${{matrix.makefile}}" build-arm
+          GS_BUCKET_PATH="golang-crossbuild-tmp" make -C go -f "${{matrix.makefile}}" build-arm

From ed7d7be149101d2cfed901b03d4f0f72e5db0f0a Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 19:38:19 +0100
Subject: [PATCH 10/39] debug

---
 .github/workflows/ci.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 163385e2..47a6acf8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,11 +24,11 @@ jobs:
       matrix:
         makefile: [
           "Makefile",
-          "Makefile.debian7",
-          "Makefile.debian8",
-          "Makefile.debian9",
-          "Makefile.debian10",
-          "Makefile.debian11",
+          #"Makefile.debian7",
+          #"Makefile.debian8",
+          #"Makefile.debian9",
+          #"Makefile.debian10",
+          #"Makefile.debian11",
           "Makefile.debian12"
         ]
         fips: [ "false", "true" ]
@@ -40,11 +40,16 @@ jobs:
         with:
           go-version-file: ".go-version"
       - uses: elastic/oblt-actions/google/auth@v1
+      - name: 'Use gcloud CLI'
+        run: |
+          gcloud info || true
+          gsutil list -lra gs://golang-crossbuild-tmp/private || true
+          gcloud auth list --filter=status:ACTIVE --format="value(account)" || true
+
       - run: |
           source .buildkite/scripts/common.sh
           add_bin_path
           with_mage
-          #google_cloud_auth
           GS_BUCKET_PATH="golang-crossbuild-tmp" make -C go -f "${{matrix.makefile}}" build
 
       - run: |
@@ -75,5 +80,4 @@ jobs:
           source .buildkite/scripts/common.sh
           add_bin_path
           with_mage
-          #google_cloud_auth
           GS_BUCKET_PATH="golang-crossbuild-tmp" make -C go -f "${{matrix.makefile}}" build-arm

From b49cbc36eba11fb7058df67ae337b3062b690d53 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 20:32:29 +0100
Subject: [PATCH 11/39] test

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 47a6acf8..33086e5a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,8 @@ env:
   STAGING_IMAGE: "docker.elastic.co/observability-ci"
   REPOSITORY: "docker.elastic.co/observability-ci"
   #GS_BUCKET_PATH: ingest-buildkite-ci
+  # bypass access to the google bucket for now
+  CI: "false"
 
 jobs:
   build-x86-64:

From 5e0fbc8b7a47c6a19b27cf21b197de6a0807b133 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 20:37:04 +0100
Subject: [PATCH 12/39] use what Ivan did in
 https://github.com/kuisathaverat/golang-crossbuild/commit/88214c190d2927c5986fda60a9a74efca1d57bf9

---
 .github/workflows/ci.yml | 10 +++++-----
 Makefile.common          |  5 +++++
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 33086e5a..64bc4b7e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,11 +26,11 @@ jobs:
       matrix:
         makefile: [
           "Makefile",
-          #"Makefile.debian7",
-          #"Makefile.debian8",
-          #"Makefile.debian9",
-          #"Makefile.debian10",
-          #"Makefile.debian11",
+          "Makefile.debian7",
+          "Makefile.debian8",
+          "Makefile.debian9",
+          "Makefile.debian10",
+          "Makefile.debian11",
           "Makefile.debian12"
         ]
         fips: [ "false", "true" ]
diff --git a/Makefile.common b/Makefile.common
index 901e1ac9..8a91267d 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -23,6 +23,11 @@ ifeq ($(CI),true)
 	@gsutil cp gs://$(GS_BUCKET_PATH)/private/$(NPCAP_FILE) ../npcap/lib/$(NPCAP_FILE)
 else
 	@echo 'Only available if running in the CI'
+	mkdir -p $(CURDIR)/sdks/ $(CURDIR)/lib/
+	gh api https://github.com/the-tcpdump-group/tcpdump-htdocs/raw/refs/heads/master/release/libpcap-1.8.1.tar.gz -H "Accept: application/vnd.github.raw" > $(CURDIR)/sdks/libpcap-1.8.1.tar.gz
+	curl -sSfL -o $(CURDIR)/sdks/MacOSX11.3.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.3/MacOSX11.3.sdk.tar.xz
+	curl -sSfL -o $(CURDIR)/sdks/WpdPack_4_1_2.zip https://www.winpcap.org/install/bin/WpdPack_4_1_2.zip
+	touch $(CURDIR)/lib/npcap-1.80-oem.exe
 endif
 
 # Requires login at google storage.

From 74813f1387aa33b06701d56d1881e10ee16a2a03 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 20:42:55 +0100
Subject: [PATCH 13/39] fix

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64bc4b7e..2f72e68c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,7 @@ env:
   #GS_BUCKET_PATH: ingest-buildkite-ci
   # bypass access to the google bucket for now
   CI: "false"
+  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
   build-x86-64:

From 33ad71ffb4fc8c2063f9b85b3eff30a0e6f249e4 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 20:53:16 +0100
Subject: [PATCH 14/39] fix

---
 Makefile.common | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Makefile.common b/Makefile.common
index 8a91267d..256b5996 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -23,11 +23,11 @@ ifeq ($(CI),true)
 	@gsutil cp gs://$(GS_BUCKET_PATH)/private/$(NPCAP_FILE) ../npcap/lib/$(NPCAP_FILE)
 else
 	@echo 'Only available if running in the CI'
-	mkdir -p $(CURDIR)/sdks/ $(CURDIR)/lib/
-	gh api https://github.com/the-tcpdump-group/tcpdump-htdocs/raw/refs/heads/master/release/libpcap-1.8.1.tar.gz -H "Accept: application/vnd.github.raw" > $(CURDIR)/sdks/libpcap-1.8.1.tar.gz
-	curl -sSfL -o $(CURDIR)/sdks/MacOSX11.3.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.3/MacOSX11.3.sdk.tar.xz
-	curl -sSfL -o $(CURDIR)/sdks/WpdPack_4_1_2.zip https://www.winpcap.org/install/bin/WpdPack_4_1_2.zip
-	touch $(CURDIR)/lib/npcap-1.80-oem.exe
+	mkdir -p ../sdks/ ../npcap/lib/
+	gh api https://github.com/the-tcpdump-group/tcpdump-htdocs/raw/refs/heads/master/release/libpcap-1.8.1.tar.gz -H "Accept: application/vnd.github.raw" > ../sdks/libpcap-1.8.1.tar.gz
+	curl -sSfL -o ../sdks/MacOSX11.3.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.3/MacOSX11.3.sdk.tar.xz
+	curl -sSfL -o ../sdks/WpdPack_4_1_2.zip https://www.winpcap.org/install/bin/WpdPack_4_1_2.zip
+	touch ../npcap/lib/npcap-1.80-oem.exe
 endif
 
 # Requires login at google storage.

From 850f5c51a702deaa28ad586a35eebf2e76503981 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 20:56:27 +0100
Subject: [PATCH 15/39] split

---
 Makefile.common | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/Makefile.common b/Makefile.common
index 256b5996..f5894058 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -23,10 +23,7 @@ ifeq ($(CI),true)
 	@gsutil cp gs://$(GS_BUCKET_PATH)/private/$(NPCAP_FILE) ../npcap/lib/$(NPCAP_FILE)
 else
 	@echo 'Only available if running in the CI'
-	mkdir -p ../sdks/ ../npcap/lib/
-	gh api https://github.com/the-tcpdump-group/tcpdump-htdocs/raw/refs/heads/master/release/libpcap-1.8.1.tar.gz -H "Accept: application/vnd.github.raw" > ../sdks/libpcap-1.8.1.tar.gz
-	curl -sSfL -o ../sdks/MacOSX11.3.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.3/MacOSX11.3.sdk.tar.xz
-	curl -sSfL -o ../sdks/WpdPack_4_1_2.zip https://www.winpcap.org/install/bin/WpdPack_4_1_2.zip
+	mkdir -p ../npcap/lib/
 	touch ../npcap/lib/npcap-1.80-oem.exe
 endif
 
@@ -37,6 +34,10 @@ ifeq ($(CI),true)
 	@gcloud storage cp gs://$(GS_BUCKET_PATH)/sdks . --recursive
 else
 	@echo 'Only available if running in the CI'
+	mkdir -p sdks/
+	gh api https://github.com/the-tcpdump-group/tcpdump-htdocs/raw/refs/heads/master/release/libpcap-1.8.1.tar.gz -H "Accept: application/vnd.github.raw" > sdks/libpcap-1.8.1.tar.gz
+	curl -sSfL -o sdks/MacOSX11.3.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.3/MacOSX11.3.sdk.tar.xz
+	curl -sSfL -o sdks/WpdPack_4_1_2.zip https://www.winpcap.org/install/bin/WpdPack_4_1_2.zip
 endif
 
 push:

From 1fa60e0abbeed28f8dbf831019bce6268f6e6238 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 21:02:05 +0100
Subject: [PATCH 16/39] fix

---
 Makefile.common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile.common b/Makefile.common
index f5894058..153c714a 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -36,7 +36,7 @@ else
 	@echo 'Only available if running in the CI'
 	mkdir -p sdks/
 	gh api https://github.com/the-tcpdump-group/tcpdump-htdocs/raw/refs/heads/master/release/libpcap-1.8.1.tar.gz -H "Accept: application/vnd.github.raw" > sdks/libpcap-1.8.1.tar.gz
-	curl -sSfL -o sdks/MacOSX11.3.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.3/MacOSX11.3.sdk.tar.xz
+	curl -sSfL -o sdks/MacOSX11.1.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.0-11.1/MacOSX10.11.sdk.tar.xz
 	curl -sSfL -o sdks/WpdPack_4_1_2.zip https://www.winpcap.org/install/bin/WpdPack_4_1_2.zip
 endif
 

From 9acdc2ff01cb97fa270fcbc49305e6a69ec9e57a Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 21:06:44 +0100
Subject: [PATCH 17/39] fix

---
 Makefile.common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile.common b/Makefile.common
index 153c714a..75eba1dd 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -36,7 +36,7 @@ else
 	@echo 'Only available if running in the CI'
 	mkdir -p sdks/
 	gh api https://github.com/the-tcpdump-group/tcpdump-htdocs/raw/refs/heads/master/release/libpcap-1.8.1.tar.gz -H "Accept: application/vnd.github.raw" > sdks/libpcap-1.8.1.tar.gz
-	curl -sSfL -o sdks/MacOSX11.1.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.0-11.1/MacOSX10.11.sdk.tar.xz
+	curl -sSfL -o sdks/MacOSX10.11.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.0-11.1/MacOSX10.11.sdk.tar.xz
 	curl -sSfL -o sdks/WpdPack_4_1_2.zip https://www.winpcap.org/install/bin/WpdPack_4_1_2.zip
 endif
 

From e91477946146106ffe144fed67b637e2c6d68e35 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 21:10:00 +0100
Subject: [PATCH 18/39] docker login

---
 .github/workflows/ci.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f72e68c..48f02997 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,6 +42,14 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version-file: ".go-version"
+
+      - name: Log in to the Elastic Container registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
+          username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
+          password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
+
       - uses: elastic/oblt-actions/google/auth@v1
       - name: 'Use gcloud CLI'
         run: |
@@ -78,6 +86,12 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version-file: ".go-version"
+      - name: Log in to the Elastic Container registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
+          username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
+          password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
       - uses: elastic/oblt-actions/google/auth@v1
       - run: |
           source .buildkite/scripts/common.sh

From 7f3eb06bff693ac283bc3c9ab138722a36ebb436 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 21:25:17 +0100
Subject: [PATCH 19/39] see
 https://github.com/elastic/golang-crossbuild/issues/6

---
 Makefile.common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile.common b/Makefile.common
index 75eba1dd..ef48b672 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -36,7 +36,7 @@ else
 	@echo 'Only available if running in the CI'
 	mkdir -p sdks/
 	gh api https://github.com/the-tcpdump-group/tcpdump-htdocs/raw/refs/heads/master/release/libpcap-1.8.1.tar.gz -H "Accept: application/vnd.github.raw" > sdks/libpcap-1.8.1.tar.gz
-	curl -sSfL -o sdks/MacOSX10.11.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.0-11.1/MacOSX10.11.sdk.tar.xz
+	curl -sSfL -o sdks/MacOSX10.11.sdk.tar.xz https://s3.amazonaws.com/beats-files/deps/MacOSX10.11.sdk.tar.xz
 	curl -sSfL -o sdks/WpdPack_4_1_2.zip https://www.winpcap.org/install/bin/WpdPack_4_1_2.zip
 endif
 

From ef58cd76178318d5a59dc3b87c1be1459dcad579 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 21:41:03 +0100
Subject: [PATCH 20/39] refactor

---
 .github/workflows/ci.yml | 67 +++++++++++++++++-----------------------
 1 file changed, 28 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 48f02997..b8b4ba56 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,20 +11,21 @@ env:
   DOCKER_REGISTRY: "docker.elastic.co"
   STAGING_IMAGE: "docker.elastic.co/observability-ci"
   REPOSITORY: "docker.elastic.co/observability-ci"
-  #GS_BUCKET_PATH: ingest-buildkite-ci
-  # bypass access to the google bucket for now
+  # TODO: use the google bucket instead
+  GS_BUCKET_PATH: "golang-crossbuild-tmp"
+  # TODO: bypass access to the google bucket for now
   CI: "false"
   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
-  build-x86-64:
-    runs-on: ubuntu-latest
+  build-push:
     permissions:
       contents: read
       id-token: write
     strategy:
       fail-fast: false
       matrix:
+        os: [ "ubuntu-24.04", "ubuntu-24.04-arm" ]
         makefile: [
           "Makefile",
           "Makefile.debian7",
@@ -35,8 +36,26 @@ jobs:
           "Makefile.debian12"
         ]
         fips: [ "false", "true" ]
+        # NOTE:
+        # exclude arm64 builds for all but debian9
+        exclude:
+          - makefile: "Makefile"
+            os: "ubuntu-24.04-arm"
+          - makefile: "Makefile.debian7"
+            os: "ubuntu-24.04-arm"
+          - makefile: "Makefile.debian8"
+            os: "ubuntu-24.04-arm"
+          - makefile: "Makefile.debian10"
+            os: "ubuntu-24.04-arm"
+          - makefile: "Makefile.debian11"
+            os: "ubuntu-24.04-arm"
+          - makefile: "Makefile.debian12"
+            os: "ubuntu-24.04-arm"
+    runs-on: ${{ matrix.os }}
     env:
       FIPS: "${{matrix.fips}}"
+      # NOTE: arm builds are suffixed with '-arm' in their make goals
+      GOAL_SUFFIX: ${{ contains(matrix.os, 'arm') && '-arm' || '' }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -57,44 +76,14 @@ jobs:
           gsutil list -lra gs://golang-crossbuild-tmp/private || true
           gcloud auth list --filter=status:ACTIVE --format="value(account)" || true
 
-      - run: |
+      - name: build and push
+        run: |
           source .buildkite/scripts/common.sh
           add_bin_path
           with_mage
-          GS_BUCKET_PATH="golang-crossbuild-tmp" make -C go -f "${{matrix.makefile}}" build
+          make -C go -f "${{matrix.makefile}}" build${{env.GOAL_SUFFIX}} publish${{env.GOAL_SUFFIX}}
 
-      - run: |
+      - name: List docker images
+        run: |
           docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${STAGING_IMAGE}/golang-crossbuild"
           docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${DOCKER_REGISTRY}/beats-dev/golang-crossbuild"
-
-  build-arm-64:
-    runs-on: ubuntu-24.04-arm
-    permissions:
-      contents: read
-      id-token: write
-    strategy:
-      fail-fast: false
-      matrix:
-        makefile: [
-          "Makefile.debian9"
-        ]
-        fips: [ "false", "true" ]
-    env:
-      FIPS: "${{matrix.fips}}"
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: ".go-version"
-      - name: Log in to the Elastic Container registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
-          username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
-          password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
-      - uses: elastic/oblt-actions/google/auth@v1
-      - run: |
-          source .buildkite/scripts/common.sh
-          add_bin_path
-          with_mage
-          GS_BUCKET_PATH="golang-crossbuild-tmp" make -C go -f "${{matrix.makefile}}" build-arm

From 6c19cf620a1dcfafec3a977d920c241513752fb0 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 21:44:53 +0100
Subject: [PATCH 21/39] fix

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b8b4ba56..19a58428 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -81,7 +81,7 @@ jobs:
           source .buildkite/scripts/common.sh
           add_bin_path
           with_mage
-          make -C go -f "${{matrix.makefile}}" build${{env.GOAL_SUFFIX}} publish${{env.GOAL_SUFFIX}}
+          make -C go -f "${{matrix.makefile}}" build${{env.GOAL_SUFFIX}} push${{env.GOAL_SUFFIX}}
 
       - name: List docker images
         run: |

From b754340f7e07d3a0e7d27c45557a212e88492c95 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 21:55:25 +0100
Subject: [PATCH 22/39] support staging and production

---
 .github/workflows/ci.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 19a58428..a386c93b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,8 +9,8 @@ permissions:
 
 env:
   DOCKER_REGISTRY: "docker.elastic.co"
-  STAGING_IMAGE: "docker.elastic.co/observability-ci"
-  REPOSITORY: "docker.elastic.co/observability-ci"
+  STAGING_REPOSITORY: "docker.elastic.co/observability-ci"
+  PRODUCTION_REPOSITORY: "docker.elastic.co/beats-dev"
   # TODO: use the google bucket instead
   GS_BUCKET_PATH: "golang-crossbuild-tmp"
   # TODO: bypass access to the google bucket for now
@@ -82,8 +82,11 @@ jobs:
           add_bin_path
           with_mage
           make -C go -f "${{matrix.makefile}}" build${{env.GOAL_SUFFIX}} push${{env.GOAL_SUFFIX}}
+        env:
+          # TODO: support for other release branches with the format [0-9]+.[0-9]+
+          REPOSITORY: "${{ startsWith(github.head_ref, 'main') && env.PRODUCTION_REPOSITORY || env.STAGING_REPOSITORY }}"
 
       - name: List docker images
         run: |
-          docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${STAGING_IMAGE}/golang-crossbuild"
-          docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${DOCKER_REGISTRY}/beats-dev/golang-crossbuild"
+          docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${STAGING_REPOSITORY}/golang-crossbuild"
+          docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${PRODUCTION_REPOSITORY}/beats-dev/golang-crossbuild"

From 9e95525d2d20e4ff468aa7cc7004545a982cfb8d Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:02:17 +0100
Subject: [PATCH 23/39] refactor

---
 .github/workflows/ci.yml | 42 ++++++++++++++++------------------------
 1 file changed, 17 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a386c93b..e8b51c54 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,8 +9,8 @@ permissions:
 
 env:
   DOCKER_REGISTRY: "docker.elastic.co"
-  STAGING_REPOSITORY: "docker.elastic.co/observability-ci"
-  PRODUCTION_REPOSITORY: "docker.elastic.co/beats-dev"
+  # TODO: support for other release branches with the format [0-9]+.[0-9]+
+  REPOSITORY: "${{ startsWith(github.head_ref, 'main') && 'docker.elastic.co/beats-dev' || 'docker.elastic.co/observability-ci' }}"
   # TODO: use the google bucket instead
   GS_BUCKET_PATH: "golang-crossbuild-tmp"
   # TODO: bypass access to the google bucket for now
@@ -58,35 +58,27 @@ jobs:
       GOAL_SUFFIX: ${{ contains(matrix.os, 'arm') && '-arm' || '' }}
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: ".go-version"
 
-      - name: Log in to the Elastic Container registry
+      - uses: elastic/oblt-actions/google/auth@v1
+
+      - name: Debug gcloud CLI
+        run: |
+          gcloud info || true
+          gsutil list -lra gs://golang-crossbuild-tmp/private || true
+          gcloud auth list --filter=status:ACTIVE --format="value(account)" || true
+
+      - name: Docker login
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
           username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
           password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
 
-      - uses: elastic/oblt-actions/google/auth@v1
-      - name: 'Use gcloud CLI'
-        run: |
-          gcloud info || true
-          gsutil list -lra gs://golang-crossbuild-tmp/private || true
-          gcloud auth list --filter=status:ACTIVE --format="value(account)" || true
+      - name: Docker build
+        run: make -C go -f "${{matrix.makefile}}" build${{env.GOAL_SUFFIX}}
 
-      - name: build and push
-        run: |
-          source .buildkite/scripts/common.sh
-          add_bin_path
-          with_mage
-          make -C go -f "${{matrix.makefile}}" build${{env.GOAL_SUFFIX}} push${{env.GOAL_SUFFIX}}
-        env:
-          # TODO: support for other release branches with the format [0-9]+.[0-9]+
-          REPOSITORY: "${{ startsWith(github.head_ref, 'main') && env.PRODUCTION_REPOSITORY || env.STAGING_REPOSITORY }}"
+      - name: Docker push
+        run: make -C go -f "${{matrix.makefile}}" push${{env.GOAL_SUFFIX}}
 
-      - name: List docker images
-        run: |
-          docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${STAGING_REPOSITORY}/golang-crossbuild"
-          docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" --filter=reference="${PRODUCTION_REPOSITORY}/beats-dev/golang-crossbuild"
+      - name: Docker images
+        run: docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"

From b1f26074317d54072017030d6d07754856925d29 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:02:34 +0100
Subject: [PATCH 24/39] chore

---
 .github/workflows/ci.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e8b51c54..0b611ba2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -77,8 +77,9 @@ jobs:
       - name: Docker build
         run: make -C go -f "${{matrix.makefile}}" build${{env.GOAL_SUFFIX}}
 
-      - name: Docker push
-        run: make -C go -f "${{matrix.makefile}}" push${{env.GOAL_SUFFIX}}
+      # TODO: uncomment when ready to push
+      #- name: Docker push
+      #  run: make -C go -f "${{matrix.makefile}}" push${{env.GOAL_SUFFIX}}
 
       - name: Docker images
         run: docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"

From 38f0f7483087495f2229d048e123e0f39bade7d3 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:19:46 +0100
Subject: [PATCH 25/39] support fpm and llvm

---
 .github/workflows/ci-fpm.yml        | 37 +++++++++++++++++++++
 .github/workflows/ci-llvm-apple.yml | 51 +++++++++++++++++++++++++++++
 .github/workflows/ci.yml            |  5 +--
 3 files changed, 91 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/ci-fpm.yml
 create mode 100644 .github/workflows/ci-llvm-apple.yml

diff --git a/.github/workflows/ci-fpm.yml b/.github/workflows/ci-fpm.yml
new file mode 100644
index 00000000..37482238
--- /dev/null
+++ b/.github/workflows/ci-fpm.yml
@@ -0,0 +1,37 @@
+---
+name: ci-fpm
+
+on:
+  push:
+    paths:
+      - 'fpm/**'
+      - '.github/workflows/ci-fpm.yml'
+
+permissions:
+  contents: read
+
+env:
+  MAKE_DIR: 'fpm'
+
+jobs:
+  build-push:
+    runs-on: "ubuntu-24.04"
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Docker login
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
+          username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
+          password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
+
+      - name: Docker build
+        run: make -C ${{ env.MAKE_DIR }} build
+
+      # TODO: uncomment when ready to push
+      #- name: Docker push
+      #  run: make -C ${{ env.MAKE_DIR }} push
+
+      - name: Docker images
+        run: docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"
diff --git a/.github/workflows/ci-llvm-apple.yml b/.github/workflows/ci-llvm-apple.yml
new file mode 100644
index 00000000..09674d6d
--- /dev/null
+++ b/.github/workflows/ci-llvm-apple.yml
@@ -0,0 +1,51 @@
+---
+name: ci-llvm-apple
+
+on:
+  push:
+    paths:
+      - 'go/llvm-apple/**'
+      - '.github/workflows/ci-llvm-apple.yml'
+
+permissions:
+  contents: read
+
+env:
+  # NOTE: For some reason the repository is not production but staging.
+  REPOSITORY: 'docker.elastic.co/observability-ci' 
+  MAKE_DIR: 'go/llvm-apple'
+
+jobs:
+  build-push:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ "ubuntu-24.04", "ubuntu-24.04-arm" ]
+        debian-version: [
+          "10",
+          "11",
+          "12"
+        ]
+    runs-on: ${{ matrix.os }}
+    env:
+      TAG_EXTENSION: "-debian${{matrix.debian-version}}-${{ contains(matrix.os, 'arm') && 'arm64' || 'amd64' }}"
+      DEBIAN_VERSION: "${{matrix.debian-version}}"
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Docker login
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
+          username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
+          password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
+
+      - name: Docker build
+        run: make -C ${{ env.MAKE_DIR }} build
+
+      # TODO: uncomment when ready to push
+      #- name: Docker push
+      #  run: make -C ${{ env.MAKE_DIR }} push
+
+      - name: Docker images
+        run: docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0b611ba2..e5e27aeb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,7 @@ env:
   # TODO: bypass access to the google bucket for now
   CI: "false"
   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  MAKE_DIR: 'go'
 
 jobs:
   build-push:
@@ -75,11 +76,11 @@ jobs:
           password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
 
       - name: Docker build
-        run: make -C go -f "${{matrix.makefile}}" build${{env.GOAL_SUFFIX}}
+        run: make -C ${{ env.MAKE_DIR }} -f "${{matrix.makefile}}" build${{env.GOAL_SUFFIX}}
 
       # TODO: uncomment when ready to push
       #- name: Docker push
-      #  run: make -C go -f "${{matrix.makefile}}" push${{env.GOAL_SUFFIX}}
+      #  run: make -C ${{ env.MAKE_DIR }} -f "${{matrix.makefile}}" push${{env.GOAL_SUFFIX}}
 
       - name: Docker images
         run: docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"

From dc762f5273dd8ad4fd981f5ba1fcda72ce36de43 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:30:17 +0100
Subject: [PATCH 26/39] refactor

---
 .github/actions/build-push/action.yml | 50 +++++++++++++++++++++++++++
 .github/workflows/ci-fpm.yml          | 23 ++++--------
 .github/workflows/ci-llvm-apple.yml   | 28 +++++----------
 .github/workflows/ci.yml              | 40 ++++++++-------------
 4 files changed, 80 insertions(+), 61 deletions(-)
 create mode 100644 .github/actions/build-push/action.yml

diff --git a/.github/actions/build-push/action.yml b/.github/actions/build-push/action.yml
new file mode 100644
index 00000000..aad9b204
--- /dev/null
+++ b/.github/actions/build-push/action.yml
@@ -0,0 +1,50 @@
+---
+name: docker build and push
+inputs:
+  docker-registry:
+    description: 'The docker registry'
+    required: true
+  docker-username:
+    description: 'The docker username'
+    required: true
+  docker-password:
+    description: 'The docker password'
+    required: true
+  make-directory:
+    description: 'What directory to run make from'
+    required: true
+  make-file:
+    description: 'What Makefile'
+    required: true
+  make-goal-suffix:
+    description: 'What make goal suffix'
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Docker login
+      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+      with:
+        registry: ${{ inputs.docker-registry }}
+        username: ${{ inputs.docker-username }}
+        password: ${{ inputs.docker-password }}
+
+    - name: Docker build
+      run: make -C ${{ env.MAKE_DIR }} -f $${{ env.MAKEFILE}} build${{env.MAKE_GOAL_SUFFIX}}
+      env:
+        MAKE_DIR: ${{ inputs.make-directory }}
+        MAKEFILE: ${{ inputs.make-file }}
+        MAKE_GOAL_SUFFIX: ${{ inputs.make-goal-suffix }}
+      shell: bash
+
+    - name: Docker build
+      run: echo "make -C ${{ env.MAKE_DIR }} -f ${{ env.MAKEFILE}} push${{env.MAKE_GOAL_SUFFIX}}"
+      env:
+        MAKE_DIR: ${{ inputs.make-directory }}
+        MAKEFILE: ${{ inputs.make-file }}
+        MAKE_GOAL_SUFFIX: ${{ inputs.make-goal-suffix }}
+      shell: bash
+
+    - name: Docker images
+      run: docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"
+      shell: bash
diff --git a/.github/workflows/ci-fpm.yml b/.github/workflows/ci-fpm.yml
index 37482238..04924d4c 100644
--- a/.github/workflows/ci-fpm.yml
+++ b/.github/workflows/ci-fpm.yml
@@ -10,9 +10,6 @@ on:
 permissions:
   contents: read
 
-env:
-  MAKE_DIR: 'fpm'
-
 jobs:
   build-push:
     runs-on: "ubuntu-24.04"
@@ -20,18 +17,10 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Docker login
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: ./.github/actions/build-push
         with:
-          registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
-          username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
-          password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
-
-      - name: Docker build
-        run: make -C ${{ env.MAKE_DIR }} build
-
-      # TODO: uncomment when ready to push
-      #- name: Docker push
-      #  run: make -C ${{ env.MAKE_DIR }} push
-
-      - name: Docker images
-        run: docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"
+          docker-registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
+          docker-username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
+          docker-password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
+          make-directory: 'fpm'
+          make-file: 'Makefile'
diff --git a/.github/workflows/ci-llvm-apple.yml b/.github/workflows/ci-llvm-apple.yml
index 09674d6d..87bb219b 100644
--- a/.github/workflows/ci-llvm-apple.yml
+++ b/.github/workflows/ci-llvm-apple.yml
@@ -10,11 +10,6 @@ on:
 permissions:
   contents: read
 
-env:
-  # NOTE: For some reason the repository is not production but staging.
-  REPOSITORY: 'docker.elastic.co/observability-ci' 
-  MAKE_DIR: 'go/llvm-apple'
-
 jobs:
   build-push:
     strategy:
@@ -34,18 +29,13 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Docker login
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: ./.github/actions/build-push
         with:
-          registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
-          username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
-          password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
-
-      - name: Docker build
-        run: make -C ${{ env.MAKE_DIR }} build
-
-      # TODO: uncomment when ready to push
-      #- name: Docker push
-      #  run: make -C ${{ env.MAKE_DIR }} push
-
-      - name: Docker images
-        run: docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"
+          docker-registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
+          docker-username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
+          docker-password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
+          make-directory: 'go/llvm-apple'
+          make-file: 'Makefile'
+        env:
+          # NOTE: For some reason the repository is not production but staging.
+          REPOSITORY: 'docker.elastic.co/observability-ci'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e5e27aeb..a2d991e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,17 +7,6 @@ on:
 permissions:
   contents: read
 
-env:
-  DOCKER_REGISTRY: "docker.elastic.co"
-  # TODO: support for other release branches with the format [0-9]+.[0-9]+
-  REPOSITORY: "${{ startsWith(github.head_ref, 'main') && 'docker.elastic.co/beats-dev' || 'docker.elastic.co/observability-ci' }}"
-  # TODO: use the google bucket instead
-  GS_BUCKET_PATH: "golang-crossbuild-tmp"
-  # TODO: bypass access to the google bucket for now
-  CI: "false"
-  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  MAKE_DIR: 'go'
-
 jobs:
   build-push:
     permissions:
@@ -69,18 +58,19 @@ jobs:
           gcloud auth list --filter=status:ACTIVE --format="value(account)" || true
 
       - name: Docker login
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: ./.github/actions/build-push
         with:
-          registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
-          username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
-          password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
-
-      - name: Docker build
-        run: make -C ${{ env.MAKE_DIR }} -f "${{matrix.makefile}}" build${{env.GOAL_SUFFIX}}
-
-      # TODO: uncomment when ready to push
-      #- name: Docker push
-      #  run: make -C ${{ env.MAKE_DIR }} -f "${{matrix.makefile}}" push${{env.GOAL_SUFFIX}}
-
-      - name: Docker images
-        run: docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"
+          docker-registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
+          docker-username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
+          docker-password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
+          make-directory: 'go'
+          make-file: ${{matrix.makefile}}
+          make-goal-suffix: ${{ env.GOAL_SUFFIX }}
+        env:
+          # TODO: support for other release branches with the format [0-9]+.[0-9]+
+          REPOSITORY: "${{ startsWith(github.head_ref, 'main') && 'docker.elastic.co/beats-dev' || 'docker.elastic.co/observability-ci' }}"
+          # TODO: use the google bucket instead
+          GS_BUCKET_PATH: "golang-crossbuild-tmp"
+          # TODO: bypass access to the google bucket for now
+          CI: "false"
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 436b4f6ef0d854a2510a3f8bfe0d0dfae1300a33 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:35:19 +0100
Subject: [PATCH 27/39] chore

---
 .github/actions/build-push/action.yml | 4 ++--
 .github/workflows/ci-fpm.yml          | 3 ++-
 .github/workflows/ci-llvm-apple.yml   | 3 ++-
 .github/workflows/ci.yml              | 2 +-
 4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/actions/build-push/action.yml b/.github/actions/build-push/action.yml
index aad9b204..233395ef 100644
--- a/.github/actions/build-push/action.yml
+++ b/.github/actions/build-push/action.yml
@@ -30,7 +30,7 @@ runs:
         password: ${{ inputs.docker-password }}
 
     - name: Docker build
-      run: make -C ${{ env.MAKE_DIR }} -f $${{ env.MAKEFILE}} build${{env.MAKE_GOAL_SUFFIX}}
+      run: make -C "${MAKE_DIR}" -f "${MAKEFILE}" build${MAKE_GOAL_SUFFIX}}
       env:
         MAKE_DIR: ${{ inputs.make-directory }}
         MAKEFILE: ${{ inputs.make-file }}
@@ -38,7 +38,7 @@ runs:
       shell: bash
 
     - name: Docker build
-      run: echo "make -C ${{ env.MAKE_DIR }} -f ${{ env.MAKEFILE}} push${{env.MAKE_GOAL_SUFFIX}}"
+      run: echo "make -C "${MAKE_DIR}" -f "${MAKEFILE}" push${MAKE_GOAL_SUFFIX}"
       env:
         MAKE_DIR: ${{ inputs.make-directory }}
         MAKEFILE: ${{ inputs.make-file }}
diff --git a/.github/workflows/ci-fpm.yml b/.github/workflows/ci-fpm.yml
index 04924d4c..dc64049c 100644
--- a/.github/workflows/ci-fpm.yml
+++ b/.github/workflows/ci-fpm.yml
@@ -6,6 +6,7 @@ on:
     paths:
       - 'fpm/**'
       - '.github/workflows/ci-fpm.yml'
+      - '.github/actions/build-push/**'
 
 permissions:
   contents: read
@@ -16,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Docker login
+      - name: Docker build and push
         uses: ./.github/actions/build-push
         with:
           docker-registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
diff --git a/.github/workflows/ci-llvm-apple.yml b/.github/workflows/ci-llvm-apple.yml
index 87bb219b..8e6c667f 100644
--- a/.github/workflows/ci-llvm-apple.yml
+++ b/.github/workflows/ci-llvm-apple.yml
@@ -6,6 +6,7 @@ on:
     paths:
       - 'go/llvm-apple/**'
       - '.github/workflows/ci-llvm-apple.yml'
+      - '.github/actions/build-push/**'
 
 permissions:
   contents: read
@@ -28,7 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Docker login
+      - name: Docker build and push
         uses: ./.github/actions/build-push
         with:
           docker-registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a2d991e2..b4e9dbee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,7 +57,7 @@ jobs:
           gsutil list -lra gs://golang-crossbuild-tmp/private || true
           gcloud auth list --filter=status:ACTIVE --format="value(account)" || true
 
-      - name: Docker login
+      - name: Docker build and push
         uses: ./.github/actions/build-push
         with:
           docker-registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}

From 99fb8088678d68aab289a45cb080b13afe00056d Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:37:52 +0100
Subject: [PATCH 28/39] fix

---
 .github/actions/build-push/action.yml | 2 +-
 .github/workflows/ci.yml              | 7 +++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/actions/build-push/action.yml b/.github/actions/build-push/action.yml
index 233395ef..a53f940f 100644
--- a/.github/actions/build-push/action.yml
+++ b/.github/actions/build-push/action.yml
@@ -30,7 +30,7 @@ runs:
         password: ${{ inputs.docker-password }}
 
     - name: Docker build
-      run: make -C "${MAKE_DIR}" -f "${MAKEFILE}" build${MAKE_GOAL_SUFFIX}}
+      run: make -C "${MAKE_DIR}" -f "${MAKEFILE}" build${MAKE_GOAL_SUFFIX}
       env:
         MAKE_DIR: ${{ inputs.make-directory }}
         MAKEFILE: ${{ inputs.make-file }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b4e9dbee..54dd1c53 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,8 +44,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     env:
       FIPS: "${{matrix.fips}}"
-      # NOTE: arm builds are suffixed with '-arm' in their make goals
-      GOAL_SUFFIX: ${{ contains(matrix.os, 'arm') && '-arm' || '' }}
     steps:
       - uses: actions/checkout@v4
 
@@ -64,8 +62,9 @@ jobs:
           docker-username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
           docker-password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
           make-directory: 'go'
-          make-file: ${{matrix.makefile}}
-          make-goal-suffix: ${{ env.GOAL_SUFFIX }}
+          make-file: "${{matrix.makefile}}"
+          # NOTE: arm builds are suffixed with '-arm' in their make goals
+          make-goal-suffix: "${{ contains(matrix.os, 'arm') && '-arm' || '' }}"
         env:
           # TODO: support for other release branches with the format [0-9]+.[0-9]+
           REPOSITORY: "${{ startsWith(github.head_ref, 'main') && 'docker.elastic.co/beats-dev' || 'docker.elastic.co/observability-ci' }}"

From c85523577afb527840df95ffb3b22e3e9acecc0d Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:43:59 +0100
Subject: [PATCH 29/39] set missing variables

---
 .github/workflows/ci-llvm-apple.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci-llvm-apple.yml b/.github/workflows/ci-llvm-apple.yml
index 8e6c667f..c37dfcab 100644
--- a/.github/workflows/ci-llvm-apple.yml
+++ b/.github/workflows/ci-llvm-apple.yml
@@ -40,3 +40,7 @@ jobs:
         env:
           # NOTE: For some reason the repository is not production but staging.
           REPOSITORY: 'docker.elastic.co/observability-ci'
+          # TODO: use the google bucket instead
+          GS_BUCKET_PATH: "golang-crossbuild-tmp"
+          # TODO: bypass access to the google bucket for now
+          CI: "false"

From a4221afc0ce624f07eaffd050924d2ab4baeb0ec Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:45:26 +0100
Subject: [PATCH 30/39] run

---
 .github/actions/build-push/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/build-push/action.yml b/.github/actions/build-push/action.yml
index a53f940f..07ec66cf 100644
--- a/.github/actions/build-push/action.yml
+++ b/.github/actions/build-push/action.yml
@@ -38,7 +38,7 @@ runs:
       shell: bash
 
     - name: Docker build
-      run: echo "make -C "${MAKE_DIR}" -f "${MAKEFILE}" push${MAKE_GOAL_SUFFIX}"
+      run: make -C "${MAKE_DIR}" -f "${MAKEFILE}" push${MAKE_GOAL_SUFFIX}
       env:
         MAKE_DIR: ${{ inputs.make-directory }}
         MAKEFILE: ${{ inputs.make-file }}

From a44fd79aebe5648d7e7e59243b4cd35cf19caded Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:50:09 +0100
Subject: [PATCH 31/39] fix

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 54dd1c53..673586cb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,4 +72,5 @@ jobs:
           GS_BUCKET_PATH: "golang-crossbuild-tmp"
           # TODO: bypass access to the google bucket for now
           CI: "false"
+          # NOTE: as long as we don't use the google bucket but downloading from github
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From e8972276323a43df6b92d18fec865e927da0e37e Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:54:04 +0100
Subject: [PATCH 32/39] simplify matrix

---
 .github/workflows/ci-llvm-apple.yml |  2 +
 .github/workflows/ci.yml            | 67 +++++++++++++++++------------
 2 files changed, 41 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/ci-llvm-apple.yml b/.github/workflows/ci-llvm-apple.yml
index c37dfcab..f069656a 100644
--- a/.github/workflows/ci-llvm-apple.yml
+++ b/.github/workflows/ci-llvm-apple.yml
@@ -44,3 +44,5 @@ jobs:
           GS_BUCKET_PATH: "golang-crossbuild-tmp"
           # TODO: bypass access to the google bucket for now
           CI: "false"
+          # NOTE: as long as we don't use the google bucket but downloading from github
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 673586cb..edc55506 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,16 @@ on:
 permissions:
   contents: read
 
+env:
+  # TODO: support for other release branches with the format [0-9]+.[0-9]+
+  REPOSITORY: "${{ startsWith(github.head_ref, 'main') && 'docker.elastic.co/beats-dev' || 'docker.elastic.co/observability-ci' }}"
+  # TODO: use the google bucket instead
+  GS_BUCKET_PATH: "golang-crossbuild-tmp"
+  # TODO: bypass access to the google bucket for now
+  CI: "false"
+  # NOTE: as long as we don't use the google bucket but downloading from github
+  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
 jobs:
   build-push:
     permissions:
@@ -15,7 +25,6 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ "ubuntu-24.04", "ubuntu-24.04-arm" ]
         makefile: [
           "Makefile",
           "Makefile.debian7",
@@ -26,27 +35,13 @@ jobs:
           "Makefile.debian12"
         ]
         fips: [ "false", "true" ]
-        # NOTE:
-        # exclude arm64 builds for all but debian9
-        exclude:
-          - makefile: "Makefile"
-            os: "ubuntu-24.04-arm"
-          - makefile: "Makefile.debian7"
-            os: "ubuntu-24.04-arm"
-          - makefile: "Makefile.debian8"
-            os: "ubuntu-24.04-arm"
-          - makefile: "Makefile.debian10"
-            os: "ubuntu-24.04-arm"
-          - makefile: "Makefile.debian11"
-            os: "ubuntu-24.04-arm"
-          - makefile: "Makefile.debian12"
-            os: "ubuntu-24.04-arm"
-    runs-on: ${{ matrix.os }}
+    runs-on: "ubuntu-24.04"
     env:
       FIPS: "${{matrix.fips}}"
     steps:
       - uses: actions/checkout@v4
 
+      # TODO: move to the build-push composite action
       - uses: elastic/oblt-actions/google/auth@v1
 
       - name: Debug gcloud CLI
@@ -63,14 +58,30 @@ jobs:
           docker-password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
           make-directory: 'go'
           make-file: "${{matrix.makefile}}"
-          # NOTE: arm builds are suffixed with '-arm' in their make goals
-          make-goal-suffix: "${{ contains(matrix.os, 'arm') && '-arm' || '' }}"
-        env:
-          # TODO: support for other release branches with the format [0-9]+.[0-9]+
-          REPOSITORY: "${{ startsWith(github.head_ref, 'main') && 'docker.elastic.co/beats-dev' || 'docker.elastic.co/observability-ci' }}"
-          # TODO: use the google bucket instead
-          GS_BUCKET_PATH: "golang-crossbuild-tmp"
-          # TODO: bypass access to the google bucket for now
-          CI: "false"
-          # NOTE: as long as we don't use the google bucket but downloading from github
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build-push-arm:
+    permissions:
+      contents: read
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        fips: [ "false", "true" ]
+    runs-on: "ubuntu-24.04-arm"
+    env:
+      FIPS: "${{matrix.fips}}"
+    steps:
+      - uses: actions/checkout@v4
+
+      # TODO: move to the build-push composite action
+      - uses: elastic/oblt-actions/google/auth@v1
+
+      - name: Docker build and push
+        uses: ./.github/actions/build-push
+        with:
+          docker-registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
+          docker-username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
+          docker-password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
+          make-directory: 'go'
+          make-file: 'Makefile.debian9'
+          make-goal-suffix: '-arm'

From 8b94fe2ba11e085c051077c2facbfe5938c3954d Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:56:14 +0100
Subject: [PATCH 33/39] add

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index edc55506..4ce0eb73 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,6 +42,7 @@ jobs:
       - uses: actions/checkout@v4
 
       # TODO: move to the build-push composite action
+      #       then need to enable the support ci-fpm ane ci-llvm-apple
       - uses: elastic/oblt-actions/google/auth@v1
 
       - name: Debug gcloud CLI

From 1e06629b3070f17736b6b72b27719dfb3f32196b Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 22:56:51 +0100
Subject: [PATCH 34/39] chore

---
 .github/actions/build-push/action.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/actions/build-push/action.yml b/.github/actions/build-push/action.yml
index 07ec66cf..5db65a3a 100644
--- a/.github/actions/build-push/action.yml
+++ b/.github/actions/build-push/action.yml
@@ -32,17 +32,17 @@ runs:
     - name: Docker build
       run: make -C "${MAKE_DIR}" -f "${MAKEFILE}" build${MAKE_GOAL_SUFFIX}
       env:
-        MAKE_DIR: ${{ inputs.make-directory }}
-        MAKEFILE: ${{ inputs.make-file }}
-        MAKE_GOAL_SUFFIX: ${{ inputs.make-goal-suffix }}
+        MAKE_DIR: "${{ inputs.make-directory }}"
+        MAKEFILE: "${{ inputs.make-file }}"
+        MAKE_GOAL_SUFFIX: "${{ inputs.make-goal-suffix }}"
       shell: bash
 
     - name: Docker build
       run: make -C "${MAKE_DIR}" -f "${MAKEFILE}" push${MAKE_GOAL_SUFFIX}
       env:
-        MAKE_DIR: ${{ inputs.make-directory }}
-        MAKEFILE: ${{ inputs.make-file }}
-        MAKE_GOAL_SUFFIX: ${{ inputs.make-goal-suffix }}
+        MAKE_DIR: "${{ inputs.make-directory }}"
+        MAKEFILE: "${{ inputs.make-file }}"
+        MAKE_GOAL_SUFFIX: "${{ inputs.make-goal-suffix }}"
       shell: bash
 
     - name: Docker images

From 0a7e4a641b64481d394f40cf78add7ec5b01f65b Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 23:07:15 +0100
Subject: [PATCH 35/39] trying to solve this

---
 Makefile.common | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Makefile.common b/Makefile.common
index ef48b672..be7dc8dd 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -38,6 +38,8 @@ else
 	gh api https://github.com/the-tcpdump-group/tcpdump-htdocs/raw/refs/heads/master/release/libpcap-1.8.1.tar.gz -H "Accept: application/vnd.github.raw" > sdks/libpcap-1.8.1.tar.gz
 	curl -sSfL -o sdks/MacOSX10.11.sdk.tar.xz https://s3.amazonaws.com/beats-files/deps/MacOSX10.11.sdk.tar.xz
 	curl -sSfL -o sdks/WpdPack_4_1_2.zip https://www.winpcap.org/install/bin/WpdPack_4_1_2.zip
+# see https://github.com/elastic/golang-crossbuild/pull/454/files#diff-36b826ca106e191815b93280143b7cfd13c583e4adc3e27442a5057ac7294586L54
+	curl -sSfL -o sdks/MacOSX11.3.sdk.tar.xz https://github.com/phracker/MacOSX-SDKs/releases/download/11.3/MacOSX11.3.sdk.tar.xz
 endif
 
 push:

From 43b1d9579601c055b14501b6a1d412e05bf6d1d3 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Mon, 10 Feb 2025 23:13:36 +0100
Subject: [PATCH 36/39] run

---
 .github/actions/build-push/action.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/actions/build-push/action.yml b/.github/actions/build-push/action.yml
index 5db65a3a..4b947345 100644
--- a/.github/actions/build-push/action.yml
+++ b/.github/actions/build-push/action.yml
@@ -19,9 +19,11 @@ inputs:
   make-goal-suffix:
     description: 'What make goal suffix'
     required: true
+
 runs:
   using: "composite"
   steps:
+    # TODO: use google auth action
     - name: Docker login
       uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
       with:

From 29e9e6555d2c417ee77d925a64dfc9257deaae1d Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Tue, 11 Feb 2025 09:27:29 +0100
Subject: [PATCH 37/39] disable jobs for now

---
 .github/workflows/ci-fpm.yml        | 12 +++++++-----
 .github/workflows/ci-llvm-apple.yml | 12 +++++++-----
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci-fpm.yml b/.github/workflows/ci-fpm.yml
index dc64049c..255db410 100644
--- a/.github/workflows/ci-fpm.yml
+++ b/.github/workflows/ci-fpm.yml
@@ -2,11 +2,13 @@
 name: ci-fpm
 
 on:
-  push:
-    paths:
-      - 'fpm/**'
-      - '.github/workflows/ci-fpm.yml'
-      - '.github/actions/build-push/**'
+  # disable for now unless it runs manually
+  workflow_dispatch:
+#  push:
+#    paths:
+#      - 'fpm/**'
+#      - '.github/workflows/ci-fpm.yml'
+#      - '.github/actions/build-push/**'
 
 permissions:
   contents: read
diff --git a/.github/workflows/ci-llvm-apple.yml b/.github/workflows/ci-llvm-apple.yml
index f069656a..f4fbf26f 100644
--- a/.github/workflows/ci-llvm-apple.yml
+++ b/.github/workflows/ci-llvm-apple.yml
@@ -2,11 +2,13 @@
 name: ci-llvm-apple
 
 on:
-  push:
-    paths:
-      - 'go/llvm-apple/**'
-      - '.github/workflows/ci-llvm-apple.yml'
-      - '.github/actions/build-push/**'
+  # disable for now unless it runs manually
+  workflow_dispatch:
+  #push:
+  #  paths:
+  #    - 'go/llvm-apple/**'
+  #    - '.github/workflows/ci-llvm-apple.yml'
+  #    - '.github/actions/build-push/**'
 
 permissions:
   contents: read

From 219e9b0084c7c09000a51c8661c1475edb7fa6c1 Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Tue, 11 Feb 2025 20:58:16 +0100
Subject: [PATCH 38/39] remove debian 7 and 8

---
 .github/workflows/ci.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4ce0eb73..344beeac 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,8 +27,6 @@ jobs:
       matrix:
         makefile: [
           "Makefile",
-          "Makefile.debian7",
-          "Makefile.debian8",
           "Makefile.debian9",
           "Makefile.debian10",
           "Makefile.debian11",

From 90a0c6ca55169e653782938fb08b3663faef56da Mon Sep 17 00:00:00 2001
From: Victor Martinez <VictorMartinezRubio@gmail.com>
Date: Tue, 11 Feb 2025 21:01:09 +0100
Subject: [PATCH 39/39] remove ci-fpm and ci-llvm-apple

to be supported in the future
---
 .github/workflows/ci-fpm.yml        | 29 -----------------
 .github/workflows/ci-llvm-apple.yml | 50 -----------------------------
 2 files changed, 79 deletions(-)
 delete mode 100644 .github/workflows/ci-fpm.yml
 delete mode 100644 .github/workflows/ci-llvm-apple.yml

diff --git a/.github/workflows/ci-fpm.yml b/.github/workflows/ci-fpm.yml
deleted file mode 100644
index 255db410..00000000
--- a/.github/workflows/ci-fpm.yml
+++ /dev/null
@@ -1,29 +0,0 @@
----
-name: ci-fpm
-
-on:
-  # disable for now unless it runs manually
-  workflow_dispatch:
-#  push:
-#    paths:
-#      - 'fpm/**'
-#      - '.github/workflows/ci-fpm.yml'
-#      - '.github/actions/build-push/**'
-
-permissions:
-  contents: read
-
-jobs:
-  build-push:
-    runs-on: "ubuntu-24.04"
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Docker build and push
-        uses: ./.github/actions/build-push
-        with:
-          docker-registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
-          docker-username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
-          docker-password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
-          make-directory: 'fpm'
-          make-file: 'Makefile'
diff --git a/.github/workflows/ci-llvm-apple.yml b/.github/workflows/ci-llvm-apple.yml
deleted file mode 100644
index f4fbf26f..00000000
--- a/.github/workflows/ci-llvm-apple.yml
+++ /dev/null
@@ -1,50 +0,0 @@
----
-name: ci-llvm-apple
-
-on:
-  # disable for now unless it runs manually
-  workflow_dispatch:
-  #push:
-  #  paths:
-  #    - 'go/llvm-apple/**'
-  #    - '.github/workflows/ci-llvm-apple.yml'
-  #    - '.github/actions/build-push/**'
-
-permissions:
-  contents: read
-
-jobs:
-  build-push:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ "ubuntu-24.04", "ubuntu-24.04-arm" ]
-        debian-version: [
-          "10",
-          "11",
-          "12"
-        ]
-    runs-on: ${{ matrix.os }}
-    env:
-      TAG_EXTENSION: "-debian${{matrix.debian-version}}-${{ contains(matrix.os, 'arm') && 'arm64' || 'amd64' }}"
-      DEBIAN_VERSION: "${{matrix.debian-version}}"
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Docker build and push
-        uses: ./.github/actions/build-push
-        with:
-          docker-registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
-          docker-username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
-          docker-password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
-          make-directory: 'go/llvm-apple'
-          make-file: 'Makefile'
-        env:
-          # NOTE: For some reason the repository is not production but staging.
-          REPOSITORY: 'docker.elastic.co/observability-ci'
-          # TODO: use the google bucket instead
-          GS_BUCKET_PATH: "golang-crossbuild-tmp"
-          # TODO: bypass access to the google bucket for now
-          CI: "false"
-          # NOTE: as long as we don't use the google bucket but downloading from github
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}