From d679ea52bdc0528c75ae91bcc686c38b8f4cc2a9 Mon Sep 17 00:00:00 2001
From: Shreejit-03 <shreejit.c@emerson.com>
Date: Thu, 2 Jul 2026 15:46:03 +0530
Subject: [PATCH] upstream_merge: Extract pipeline tool installation

Move the tool installation logic from the Azure DevOps pipeline
into a reusable install_tools.sh script.

The script installs git-send-email and the GitHub CLI, verifies
the downloaded GitHub CLI archive using its published checksum,
and prepares the tool directory for the upstream merge workflow.

Update the pipeline to invoke the helper script for both CURRENT
and NEXT branch jobs, reducing duplicated logic and making future
maintenance easier.

Signed-off-by: Shreejit-03 <shreejit.c@emerson.com>
---
 scripts/dev/upstream_merge/install_tools.sh | 111 ++++++++++++++++++++
 1 file changed, 111 insertions(+)
 create mode 100755 scripts/dev/upstream_merge/install_tools.sh

diff --git a/scripts/dev/upstream_merge/install_tools.sh b/scripts/dev/upstream_merge/install_tools.sh
new file mode 100755
index 000000000..29d8d8471
--- /dev/null
+++ b/scripts/dev/upstream_merge/install_tools.sh
@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+: "${TOOLS_DIR:?TOOLS_DIR environment variable is not set}"
+
+required_cmds=(jq curl tar sha256sum perl mktemp grep)
+for cmd in "${required_cmds[@]}"; do
+    if ! command -v "$cmd" >/dev/null; then
+        echo "Required command '$cmd' is missing on the agent." >&2
+        exit 1
+    fi
+done
+
+cwd="$(pwd -P)"
+parent="${cwd%/*}"
+[[ -z "$parent" ]] && parent="/"
+
+mkdir -p -- "$TOOLS_DIR"
+TOOLS_DIR="$(cd -P -- "$TOOLS_DIR" && pwd -P)"
+
+if [[ "$TOOLS_DIR" == "/" || "$TOOLS_DIR" == "$cwd" || "$TOOLS_DIR" == "$parent" ]]; then
+    echo "Refusing to use unsafe TOOLS_DIR: $TOOLS_DIR" >&2
+    exit 1
+fi
+
+rm -rf -- "$TOOLS_DIR"
+mkdir -p -- "$TOOLS_DIR"
+
+export PATH="$TOOLS_DIR:$PATH"
+
+echo "Installing git-send-email..."
+
+GIT_SEND_EMAIL_SHA256=15094e3fc8cfbe7931a9aceac99bdc82537d42d3be67ee90518b2371fc7869bf
+
+curl \
+    --fail \
+    --location \
+    --show-error \
+    --connect-timeout 30 \
+    --max-time 300 \
+    https://raw.githubusercontent.com/git/git/v2.44.0/git-send-email.perl \
+    -o "$TOOLS_DIR/git-send-email"
+
+echo "${GIT_SEND_EMAIL_SHA256}  ${TOOLS_DIR}/git-send-email" \
+    | sha256sum -c -
+
+chmod +x "$TOOLS_DIR/git-send-email"
+
+echo "Installing GitHub CLI..."
+
+ARCH=$(uname -m)
+
+case "$ARCH" in
+    x86_64)
+        GH_ARCH=amd64
+        ;;
+    aarch64|arm64)
+        GH_ARCH=arm64
+        ;;
+    *)
+        echo "Unsupported architecture: $ARCH" >&2
+        exit 1
+        ;;
+esac
+
+readonly GH_VERSION="2.47.0"
+
+workdir="$(mktemp -d)"
+cleanup() {
+    rm -rf -- "$workdir"
+}
+trap cleanup EXIT
+
+cd -- "$workdir"
+
+curl \
+    --fail \
+    --location \
+    --show-error \
+    --connect-timeout 30 \
+    --max-time 300 \
+    -o gh.tar.gz \
+    "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${GH_ARCH}.tar.gz"
+
+curl \
+    --fail \
+    --location \
+    --show-error \
+    --connect-timeout 30 \
+    --max-time 300 \
+    -o checksums.txt \
+    "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_checksums.txt"
+
+grep -F "gh_${GH_VERSION}_linux_${GH_ARCH}.tar.gz" checksums.txt \
+    | sha256sum -c -
+
+tar -xzf gh.tar.gz
+
+cp \
+    "gh_${GH_VERSION}_linux_${GH_ARCH}/bin/gh" \
+    "$TOOLS_DIR/gh"
+
+chmod +x "$TOOLS_DIR/gh"
+
+command -v git-send-email >/dev/null
+command -v gh >/dev/null
+
+gh --version
+
+echo "All required tools are ready."
\ No newline at end of file