Repository: confluentinc/cli
Pull request #3088: Upgrade CLI Semaphore Agent to Ubuntu 24
Author: login: danielayaz
Created: 2025-05-01T19:03:24Z | Merged: 2025-05-01T21:27:25Z

Release Notes
-------------
<!--
If this PR introduces any user-facing changes, please document them below. Please delete any unused section titles and placeholders.
Please match the style of previous release notes: https://docs.confluent.io/confluent-cli/current/release-notes.html
-->

Breaking Changes
- PLACEHOLDER

New Features
- PLACEHOLDER

Bug Fixes
- PLACEHOLDER

Checklist
---------
<!-- 
Check each item below to ensure high-quality CLI development practices are followed. PR approval will not be granted until the checklist is fully reviewed.
For detailed instructions, please refer to this Confluence page: https://confluentinc.atlassian.net/wiki/spaces/AEGI/pages/3949592874/
-->
- [ ] I have successfully built and used a custom CLI binary, without linter issues from this PR.
- [ ] I have clearly specified in the `What` section below whether this PR applies to Confluent Cloud, Confluent Platform, or both. 
- [ ] I have verified this PR in Confluent Cloud pre-prod or production environment, if applicable.
- [ ] I have verified this PR in Confluent Platform on-premises environment, if applicable.
- [ ] I have attached manual CLI verification results or screenshots in the `Test & Review` section below.
- [ ] I have added appropriate CLI integration or unit tests for any new or updated commands and functionality.
- [ ] I confirm that this PR introduces no breaking changes or backward compatibility issues.
- [ ] I have indicated the potential customer impact if something goes wrong in the `Blast Radius` section below.
- [ ] I have put checkmarks below confirming that the feature associated with this PR is enabled in:
  - [ ] Confluent Cloud prod
  - [ ] Confluent Cloud stag
  - [ ] Confluent Platform
  - [ ] Check this box if the feature is enabled for certain organizations only

What
----
<!--
Briefly describe **what** you have changed and **why** these changes are necessary.
Optionally include: 
- The problem being solved or the feature being added. 
- The implementation strategy or approach taken. 
- Key technical details, design decisions, or any additional context reviewers should be aware of.
-->
This upgrades our semaphore agent to Ubuntu 24 to comply with DevProd's deprecation of Ubuntu 20.

Blast Radius
----
<!--
The Blast Radius section should include information on what will be the customer(s) impact if something goes wrong or unexpectedly, 
adding this section will trigger the PR author to think about the impact from product perspective, examples can be:
- Confluent Cloud customers who are using confluent kafka topic any subcommand will be blocked.
- Confluent Cloud customers who are using confluent kafka topic list commands will be blocked.
- Confluent Platform customers who are using --schema flag will be impacted.
- All customers who are using SSO to login will be impacted.
-->

References
----------
<!-- Include links to relevant resources for this PR, such as: 
- Related GitHub issues 
- Tickets (JIRA, etc.) 
- Internal documentation or design specs 
- Other related PRs 
Copy and paste the links below for easy reference.
-->

Test & Review
-------------
<!-- Has this PR been tested? If so, explain **how** it was tested. Include: 
- Steps taken to verify the changes. 
- Links to manual verification documents, logs, or screenshots to save reviewers' time. 
- Any additional notes on testing (e.g., environments used, edge cases tested). 
- Screenshot showing successful resource creation, updates etc.
Example: - [Manual Verification Document](https://docs.google.com/document/d/1GwXz9hNOkub_Br-2nssoYWCf6elZBvwo7TMhCNYinwE/edit?tab=t.0#heading=h.dvbi09ntxjw6)
-->



Diff:
diff --git a/.semaphore/semaphore.yml b/.semaphore/semaphore.yml
index 6eec085b1a..f6dd657373 100644
--- a/.semaphore/semaphore.yml
+++ b/.semaphore/semaphore.yml
@@ -3,7 +3,7 @@ name: Confluent CLI
 
 agent:
   machine:
-    type: s1-prod-ubuntu20-04-amd64-1
+    type: s1-prod-ubuntu24-04-amd64-1
 
 auto_cancel:
   running:
@@ -37,10 +37,7 @@ blocks:
         - name: "Build linux/amd64 (Alpine)"
           commands:
             - checkout
-            - sem-version go $(cat .go-version)
-            - export PATH=$(go env GOPATH)/bin:$PATH
-            - sudo apt install musl-tools --yes
-            - CC=musl-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 GOEXPERIMENT=boringcrypto go build -tags musl -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" ./cmd/confluent
+            - docker build . --file docker/Dockerfile_alpine_amd64 --tag test-build
       epilogue:
         always:
           commands:
@@ -51,7 +48,7 @@ blocks:
     task:
       agent:
         machine:
-          type: s1-prod-ubuntu20-04-arm64-1
+          type: s1-prod-ubuntu24-04-arm64-1
       jobs:
 # Temporarily disable these builds until rate limiting is resolved
 #        - name: "Build linux/arm64 (GLIBC)"
@@ -61,10 +58,7 @@ blocks:
         - name: "Build linux/arm64 (Alpine)"
           commands:
             - checkout
-            - sem-version go $(cat .go-version)
-            - export PATH=$(go env GOPATH)/bin:$PATH
-            - sudo apt install musl-tools --yes
-            - CC=musl-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 GOEXPERIMENT=boringcrypto go build -tags musl -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" ./cmd/confluent
+            - docker build . --file docker/Dockerfile_alpine_arm64 --tag test-build
 
   - name: darwin
     dependencies: []
diff --git a/docker/Dockerfile_alpine_amd64 b/docker/Dockerfile_alpine_amd64
new file mode 100644
index 0000000000..951d5abd3f
--- /dev/null
+++ b/docker/Dockerfile_alpine_amd64
@@ -0,0 +1,22 @@
+FROM --platform=linux/amd64 ubuntu:20.04
+
+SHELL ["/bin/bash", "-c"]
+
+RUN apt -y update
+
+RUN apt -y install make git wget musl-tools curl
+
+RUN curl -O -L "https://github.com/sigstore/cosign/releases/download/v2.2.4/cosign_2.2.4_amd64.deb"
+
+RUN dpkg -i cosign_2.2.4_amd64.deb
+
+COPY . /cli/
+
+RUN export GO_VERSION=$(cat /cli/.go-version) && \
+    wget "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" && \
+    tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
+
+ENV PATH=${PATH}:/usr/local/go/bin:/root/go/bin
+
+RUN cd /cli/ && \
+    CC=musl-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 GOEXPERIMENT=boringcrypto go build -tags musl -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" ./cmd/confluent
diff --git a/docker/Dockerfile_alpine_arm64 b/docker/Dockerfile_alpine_arm64
new file mode 100644
index 0000000000..2096612d0d
--- /dev/null
+++ b/docker/Dockerfile_alpine_arm64
@@ -0,0 +1,22 @@
+FROM --platform=linux/arm64/v8 ubuntu:20.04
+
+SHELL ["/bin/bash", "-c"]
+
+RUN apt -y update
+
+RUN apt -y install make git wget musl-tools curl
+
+RUN curl -O -L "https://github.com/sigstore/cosign/releases/download/v2.2.4/cosign_2.2.4_arm64.deb"
+
+RUN dpkg -i cosign_2.2.4_arm64.deb
+
+COPY . /cli/
+
+RUN export GO_VERSION=$(cat /cli/.go-version) && \
+    wget "https://go.dev/dl/go${GO_VERSION}.linux-arm64.tar.gz" && \
+    tar -C /usr/local -xzf "go${GO_VERSION}.linux-arm64.tar.gz"
+
+ENV PATH=${PATH}:/usr/local/go/bin:/root/go/bin
+
+RUN cd /cli/ && \
+    CC=musl-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 GOEXPERIMENT=boringcrypto go build -tags musl -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" ./cmd/confluent
diff --git a/docker/Dockerfile_build_linux_amd64 b/docker/Dockerfile_build_linux_amd64
index fb550ebf9e..ce9b52adeb 100644
--- a/docker/Dockerfile_build_linux_amd64
+++ b/docker/Dockerfile_build_linux_amd64
@@ -1,12 +1,11 @@
+# AlmaLinux 8.10 chosen for current GLIBC requirement of 2.28
 FROM --platform=linux/amd64 almalinux:8.10
 
 SHELL ["/bin/bash", "-c"]
 
 RUN yum -y update
 
-RUN yum -y install make sudo
-
-RUN sudo yum -y install git wget gcc-toolset-9
+RUN yum -y install make git wget gcc-toolset-9
 
 RUN scl enable gcc-toolset-9 bash
 
@@ -14,7 +13,7 @@ COPY . /cli/
 
 RUN export GO_VERSION=$(cat /cli/.go-version) && \
     wget "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" && \
-    sudo tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
+    tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
 
 ENV PATH=${PATH}:/usr/local/go/bin:/root/go/bin
 
diff --git a/docker/Dockerfile_build_linux_arm64 b/docker/Dockerfile_build_linux_arm64
index 0a80f0f8ca..3ef61e4c1f 100644
--- a/docker/Dockerfile_build_linux_arm64
+++ b/docker/Dockerfile_build_linux_arm64
@@ -1,12 +1,11 @@
+# AlmaLinux 8.10 chosen for current GLIBC requirement of 2.28
 FROM --platform=linux/arm64/v8 almalinux:8.10
 
 SHELL ["/bin/bash", "-c"]
 
 RUN yum -y update
 
-RUN yum -y install make sudo
-
-RUN sudo yum -y install git wget gcc-toolset-9
+RUN yum -y install make git wget gcc-toolset-9
 
 RUN scl enable gcc-toolset-9 bash
 
@@ -14,7 +13,7 @@ COPY . /cli/
 
 RUN export GO_VERSION=$(cat /cli/.go-version) && \
     wget "https://go.dev/dl/go${GO_VERSION}.linux-arm64.tar.gz" && \
-    sudo tar -C /usr/local -xzf "go${GO_VERSION}.linux-arm64.tar.gz"
+    tar -C /usr/local -xzf "go${GO_VERSION}.linux-arm64.tar.gz"
 
 ENV PATH=${PATH}:/usr/local/go/bin:/root/go/bin
 


Reviews:
user: login: sgagniere
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-05-01T20:08:33Z
user: login: sgagniere
state: APPROVED
author_association: MEMBER
submitted_at: 2025-05-01T21:13:31Z

Review comments:
diff_hunk: @@ -0,0 +1,23 @@
+FROM --platform=linux/amd64 ubuntu:24.04
+
+SHELL ["/bin/bash", "-c"]
+
+RUN apt -y update
+
+RUN apt -y install make git wget musl-tools curl
+
+RUN curl -O -L "https://github.com/sigstore/cosign/releases/download/v2.2.4/cosign_2.2.4_amd64.deb"
+
+RUN dpkg -i cosign_2.2.4_amd64.deb
+
+COPY . /cli-release/
path: docker/Dockerfile_alpine_amd64
user: login: sgagniere
body: ```suggestion
COPY . /cli/
```
created_at: 2025-05-01T20:06:00Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,23 @@
+FROM --platform=linux/amd64 ubuntu:24.04
+
+SHELL ["/bin/bash", "-c"]
+
+RUN apt -y update
+
+RUN apt -y install make git wget musl-tools curl
+
+RUN curl -O -L "https://github.com/sigstore/cosign/releases/download/v2.2.4/cosign_2.2.4_amd64.deb"
+
+RUN dpkg -i cosign_2.2.4_amd64.deb
+
+COPY . /cli-release/
+
+RUN export GO_VERSION=$(cat /cli-release/cli/.go-version) && \
+    wget "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" && \
+    tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
+
+ENV PATH=${PATH}:/usr/local/go/bin:/root/go/bin
+
+RUN cd /cli-release/cli/ && \
+    go install github.com/goreleaser/goreleaser/v2@v2.0.1 && \
+    goreleaser build --config ../.goreleaser-linux-alpine.yml --single-target
path: docker/Dockerfile_alpine_amd64
user: login: sgagniere
body: We'll want to replace this w/ 

```
CC=musl-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 GOEXPERIMENT=boringcrypto go build -tags musl -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" ./cmd/confluent
```

And then edit the `Build linux/amd64 (Alpine)` task in the semaphore file to call this dockerfile
created_at: 2025-05-01T20:07:34Z
author_association: MEMBER

PR comments:
user: login: confluent-cla-assistant[bot]
created_at: 2025-05-01T19:03:35Z
body: :tada: All Contributor License Agreements have been signed. Ready to merge. <br/><sub>Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.<sub>
author_association: NONE
user: login: sonarqube-confluent[bot]
created_at: 2025-05-01T19:41:13Z
body: ![Passed](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/checks/QualityGateBadge/passed.svg?sanitize=true)

# Analysis Details
## 0 Issues
- ![Bug](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/common/bug.svg?sanitize=true) 0 Bugs
- ![Vulnerability](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/common/vulnerability.svg?sanitize=true) 0 Vulnerabilities
- ![Code Smell](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/common/code_smell.svg?sanitize=true) 0 Code Smells

## Coverage and Duplications
- ![Coverage](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/checks/CoverageChart/NoCoverageInfo.svg?sanitize=true) No coverage information (76.70% Estimated after merge)
- ![Duplications](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/checks/Duplications/NoDuplicationInfo.svg?sanitize=true) No duplication information (0.00% Estimated after merge)

**Project ID:** cli

[View in SonarQube](https://sonarqube.dp.confluent.io/dashboard?id=cli&pullRequest=3088)


author_association: NONE
user: login: sonarqube-confluent[bot]
created_at: 2025-05-01T20:51:22Z
body: ![Passed](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/checks/QualityGateBadge/passed.svg?sanitize=true)

# Analysis Details
## 0 Issues
- ![Bug](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/common/bug.svg?sanitize=true) 0 Bugs
- ![Vulnerability](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/common/vulnerability.svg?sanitize=true) 0 Vulnerabilities
- ![Code Smell](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/common/code_smell.svg?sanitize=true) 0 Code Smells

## Coverage and Duplications
- ![Coverage](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/checks/CoverageChart/NoCoverageInfo.svg?sanitize=true) No coverage information (76.70% Estimated after merge)
- ![Duplications](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/checks/Duplications/NoDuplicationInfo.svg?sanitize=true) No duplication information (0.00% Estimated after merge)

**Project ID:** cli

[View in SonarQube](https://sonarqube.dp.confluent.io/dashboard?id=cli&pullRequest=3088)


author_association: NONE
user: login: sonarqube-confluent[bot]
created_at: 2025-05-01T21:29:09Z
body: ![Passed](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/checks/QualityGateBadge/passed.svg?sanitize=true)

# Analysis Details
## 0 Issues
- ![Bug](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/common/bug.svg?sanitize=true) 0 Bugs
- ![Vulnerability](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/common/vulnerability.svg?sanitize=true) 0 Vulnerabilities
- ![Code Smell](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/common/code_smell.svg?sanitize=true) 0 Code Smells

## Coverage and Duplications
- ![Coverage](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/checks/CoverageChart/NoCoverageInfo.svg?sanitize=true) No coverage information (76.70% Estimated after merge)
- ![Duplications](https://sonarqube.dp.confluent.io/static/communityBranchPlugin/checks/Duplications/NoDuplicationInfo.svg?sanitize=true) No duplication information (0.00% Estimated after merge)

**Project ID:** cli

[View in SonarQube](https://sonarqube.dp.confluent.io/dashboard?id=cli&pullRequest=3088)


author_association: NONE