From 3868cf75b410a9ff7c1b54ca1faa7dcf6b446bf7 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 12 Jul 2026 00:27:39 +0000
Subject: [PATCH 1/2] Upgraded Hugo version to 0.164.0

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 2c2db9c..16c9447 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
 FROM node:26-alpine AS build
 ARG GITHUB_USERNAME_TOKEN
 WORKDIR /build-website
-ADD https://github.com/gohugoio/hugo/releases/download/v0.163.3/hugo_0.163.3_Linux-64bit.tar.gz hugo.tar.gz
-RUN echo "ec422258f9a4ffc241de8707297e32311cd86fcc9b2813632617ff4d44935d91  hugo.tar.gz" | sha256sum -c
+ADD https://github.com/gohugoio/hugo/releases/download/v0.164.0/hugo_0.164.0_Linux-64bit.tar.gz hugo.tar.gz
+RUN echo "d9c8b17285ea4ec004d9f814273ea910f2051ce02c284993fd1f91ba455ae50d  hugo.tar.gz" | sha256sum -c
 RUN tar -zxvf hugo.tar.gz
 COPY package-lock.json package.json ./
 RUN npm ci

From de232e2ed152b5b07606535659b3ff75657c1428 Mon Sep 17 00:00:00 2001
From: Nick Anderson <nick@cmdln.org>
Date: Thu, 16 Jul 2026 13:56:10 -0500
Subject: [PATCH 2/2] ci: migrate docker build/publish to multiplatform buildx

QA-1487 deprecated the build:docker and publish:image jobs in the shared
mendertesting template, so their scripts now exit 1. build-website only
overrode publish:image's rules, so the production pipeline fails at
publish and build.cfengine.com cannot be deployed (its js/modules.json
stays stale, blocking new module versions from reaching the site and
Mission Portal Build).

Opt into build:docker-multiplatform / publish:image-multiplatform and
disable the legacy and mender-specific jobs. Move the GITHUB_USERNAME_TOKEN
build arg (build.js uses it to avoid GitHub API rate limits) into
EXTRA_DOCKER_ARGS, which is the variable the buildx job reads. Build
amd64 only, since the Hugo binary in the Dockerfile is amd64-only.

Ticket: ENT-14308

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .gitlab-ci.yml | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 272716d..5cbc681 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,6 +1,12 @@
 variables:
   DOCKER_REPOSITORY: registry.mender.io/cfengine/cfbuild
   DOCKERFILE: Dockerfile
+  MULTIPLATFORM_BUILD: "true"
+  MULTIPLATFORM_PLATFORMS: "linux/amd64" # Hugo binary in the Dockerfile is amd64-only
+  # build.js authenticates to the GitHub API with this token to avoid rate limits.
+  # The multiplatform buildx job reads EXTRA_DOCKER_ARGS (not the legacy inline
+  # --build-arg), so pass the token through there.
+  EXTRA_DOCKER_ARGS: "--build-arg GITHUB_USERNAME_TOKEN"
   DOCKER_HOST:
     value: 'tcp://docker:2376'
     description: "Required to run dind inside k8s runners with TLS"
@@ -25,20 +31,21 @@ stages:
   - publish
   - sync
 
+# QA-1487 deprecated build:docker/publish:image (their scripts now exit 1). Opt
+# into the buildx multiplatform variants and disable the legacy and mender jobs.
 build:docker:
+  rules:
+    - when: never
+
+build:docker-multiplatform:
   rules:
     - if: '$CI_COMMIT_BRANCH =~ /^(master|production)$/'
-  script:
-    - echo "building ${CI_PROJECT_NAME} for ${DOCKER_BUILD_SERVICE_IMAGE}"
-    - docker build
-        --tag $DOCKER_BUILD_SERVICE_IMAGE
-        --file ${DOCKER_DIR:-.}/${DOCKERFILE:-Dockerfile}
-        --build-arg GIT_COMMIT_TAG="${DOCKER_PUBLISH_COMMIT_TAG}"
-        --build-arg GITHUB_USERNAME_TOKEN
-        ${DOCKER_DIR:-.}
-    - docker save $DOCKER_BUILD_SERVICE_IMAGE > image.tar
 
 publish:image:
+  rules:
+    - when: never
+
+publish:image-multiplatform:
   rules:
     - if: '$CI_COMMIT_BRANCH =~ /^(master|production)$/'
 
@@ -46,6 +53,10 @@ publish:image:mender:
   rules:
     - when: never
 
+publish:image-multiplatform:mender:
+  rules:
+    - when: never
+
 sync:image:
   rules:
     - if: '$CI_COMMIT_BRANCH == "production"'