CI.yml

name: CI

env:
  DEBUG: napi:*
  APP_NAME: python-node
  MACOSX_DEPLOYMENT_TARGET: '10.13'
  CARGO_NET_GIT_FETCH_WITH_CLI: 'true'

permissions:
  contents: write
  id-token: write

on:
  push:
    branches:
      - main
    tags-ignore:
      - '**'
    paths-ignore:
      - '**/*.md'
      - LICENSE
      - '**/*.gitignore'
      - .editorconfig
      - docs/**
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-ci
  cancel-in-progress: true

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: macos-latest
            target: x86_64-apple-darwin
            build: pnpm run build --target x86_64-apple-darwin
          - host: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian
            build: pnpm run build --target x86_64-unknown-linux-gnu
          - host: macos-latest
            target: aarch64-apple-darwin
            build: pnpm run build --target aarch64-apple-darwin
    name: stable - ${{ matrix.settings.target }} - node@20
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@v4
      - uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: |
            ${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}
            ${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - uses: actions/setup-node@v4
        if: ${{ !matrix.settings.docker }}
        with:
          node-version: 20
      - name: Install
        uses: dtolnay/rust-toolchain@stable
        if: ${{ !matrix.settings.docker }}
        with:
          toolchain: stable
          targets: ${{ matrix.settings.target }}
      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            .cargo-cache
            target/
          key: ${{ matrix.settings.target }}-cargo-${{ matrix.settings.host }}
      - uses: goto-bus-stop/setup-zig@v2
        if: ${{ matrix.settings.target == 'armv7-unknown-linux-gnueabihf' || matrix.settings.target == 'armv7-unknown-linux-musleabihf' }}
        with:
          version: 0.13.0
      - name: Setup toolchain
        run: ${{ matrix.settings.setup }}
        if: ${{ matrix.settings.setup }}
        shell: bash
      - name: Install dependencies
        run: pnpm install
      - name: Build in docker
        uses: addnab/docker-run-action@v3
        if: ${{ matrix.settings.docker }}
        with:
          image: ${{ matrix.settings.docker }}
          options: '--user 0:0 -v ${{ github.workspace }}/.cargo-cache/git/db:/usr/local/cargo/git/db -v ${{ github.workspace }}/.cargo/registry/cache:/usr/local/cargo/registry/cache -v ${{ github.workspace }}/.cargo/registry/index:/usr/local/cargo/registry/index -v ${{ github.workspace }}:/build -w /build'
          run: |
            set -x

            export CARGO_NET_GIT_FETCH_WITH_CLI=true

            # Install apt dependencies
            apt-get update -y
            apt-get install -y openssh-client

            # Setup pnpm
            corepack disable
            npm i -gf pnpm

            # Set up SSH keys (to checkout private repos with cargo)
            mkdir -p ~/.ssh
            chmod 700 ~/.ssh

            # Save SSH keys to files
            echo "${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_handler_key
            echo "${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_rewriter_key
            chmod 600 ~/.ssh/http_handler_key
            chmod 600 ~/.ssh/http_rewriter_key

            # Add GitHub to known hosts (for all aliases)
            ssh-keyscan -H github.com >> ~/.ssh/known_hosts

            # Create SSH config with host aliases
            cat > ~/.ssh/config <<'EOF'
            Host github.com-http-handler
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_handler_key
              IdentitiesOnly yes
              
            Host github.com-http-rewriter
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_rewriter_key
              IdentitiesOnly yes
            EOF
            chmod 600 ~/.ssh/config

            # Configure git to rewrite URLs to use the correct host alias
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler".insteadOf "ssh://git@github.com/platformatic/http-handler"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter".insteadOf "ssh://git@github.com/platformatic/http-rewriter"
            
            # Also handle variations without .git suffix
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler.git".insteadOf "ssh://git@github.com/platformatic/http-handler.git"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter.git".insteadOf "ssh://git@github.com/platformatic/http-rewriter.git"

            ${{ matrix.settings.build }}
      - name: Build
        run: ${{ matrix.settings.build }}
        if: ${{ !matrix.settings.docker }}
        shell: bash
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: bindings-${{ matrix.settings.target }}
          path: |
            ${{ env.APP_NAME }}.*.node
            index.d.ts
            index.js
          if-no-files-found: error

  test-macOS-windows-binding:
    name: Test bindings on ${{ matrix.settings.target }} - node@${{ matrix.node }}
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: macos-latest
            target: x86_64-apple-darwin
        node:
          - '18'
          - '20'
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@v4
      - uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: |
            ${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}
            ${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm
          architecture: x64
      - run: pnpm install
      - uses: actions/download-artifact@v4
        with:
          name: bindings-${{ matrix.settings.target }}
          path: .
      - name: List packages
        run: ls -R .
        shell: bash
      - run: cargo test
      - run: pnpm test

  test-linux-binding:
    name: Test bindings on ${{ matrix.settings.target }} - node@${{ matrix.node }}
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
          # Not supported yet.
          # - host: ubuntu-22.04
          #   target: x86_64-unknown-linux-musl
          # Not supported yet, ubuntu-24.04-arm runner requires repo is public
          # - host: ubuntu-22.04-arm
          #   target: aarch64-unknown-linux-gnu
          # - host: ubuntu-22.04-arm
          #   target: aarch64-unknown-linux-musl
        node:
          - '18'
          - '20'
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm
      - name: Install dependencies
        run: pnpm install
      - uses: actions/download-artifact@v4
        with:
          name: bindings-${{ matrix.settings.target }}
          path: .
      - name: List packages
        run: ls -R .
        shell: bash
      - name: Output docker params
        id: docker
        run: |
          node -e "
            if ('${{ matrix.settings.target }}'.startsWith('aarch64')) {
              console.log('PLATFORM=linux/arm64')
            } else if ('${{ matrix.settings.target }}'.startsWith('armv7')) {
              console.log('PLATFORM=linux/arm/v7')
            } else {
              console.log('PLATFORM=linux/amd64')
            }
          " >> $GITHUB_OUTPUT
          node -e "
            if ('${{ matrix.settings.target }}'.endsWith('-musl')) {
              console.log('IMAGE=node:${{ matrix.node }}-alpine')
            } else {
              console.log('IMAGE=node:${{ matrix.node }}-slim')
            }
          " >> $GITHUB_OUTPUT
          echo "PNPM_STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
      - name: Test crates
        uses: addnab/docker-run-action@v3
        with:
          image: ${{ steps.docker.outputs.IMAGE }}
          options: -v ${{ github.workspace }}:${{ github.workspace }} -w ${{ github.workspace }} --platform ${{ steps.docker.outputs.PLATFORM }}
          run: |
            set -x

            export CARGO_NET_GIT_FETCH_WITH_CLI=true

            # Install apt dependencies
            apt-get update -y
            apt-get install -y openssh-client curl git

            # Install rust toolchain
            curl https://sh.rustup.rs -sSf | bash -s -- -y -t ${{ matrix.settings.target }}
            . "$HOME/.cargo/env"

            # Set up SSH keys (to checkout private repos with cargo)
            mkdir -p ~/.ssh
            chmod 700 ~/.ssh

            # Save SSH keys to files
            echo "${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_handler_key
            echo "${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_rewriter_key
            chmod 600 ~/.ssh/http_handler_key
            chmod 600 ~/.ssh/http_rewriter_key

            # Add GitHub to known hosts (for all aliases)
            ssh-keyscan -H github.com >> ~/.ssh/known_hosts

            # Create SSH config with host aliases
            cat > ~/.ssh/config <<'EOF'
            Host github.com-http-handler
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_handler_key
              IdentitiesOnly yes
              
            Host github.com-http-rewriter
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_rewriter_key
              IdentitiesOnly yes
            EOF
            chmod 600 ~/.ssh/config

            # Configure git to rewrite URLs to use the correct host alias
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler".insteadOf "ssh://git@github.com/platformatic/http-handler"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter".insteadOf "ssh://git@github.com/platformatic/http-rewriter"
            
            # Also handle variations without .git suffix
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler.git".insteadOf "ssh://git@github.com/platformatic/http-handler.git"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter.git".insteadOf "ssh://git@github.com/platformatic/http-rewriter.git"

            cargo test --target ${{ matrix.settings.target }}
      - name: Test bindings
        uses: addnab/docker-run-action@v3
        with:
          image: ${{ steps.docker.outputs.IMAGE }}
          options: -v ${{ steps.docker.outputs.PNPM_STORE_PATH }}:${{ steps.docker.outputs.PNPM_STORE_PATH }} -v ${{ github.workspace }}:${{ github.workspace }} -w ${{ github.workspace }} --platform ${{ steps.docker.outputs.PLATFORM }}
          run: |
            corepack disable
            npm i -gf pnpm
            pnpm test

  publish:
    name: Publish
    runs-on: ubuntu-latest
    needs:
      - test-macOS-windows-binding
      - test-linux-binding
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
      - name: Install dependencies
        run: pnpm install
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
      - name: Move artifacts
        run: pnpm artifacts
      - name: List packages
        run: ls -R ./npm
        shell: bash
      - name: Publish
        if: contains(github.ref, 'main')
        run: |
          npm config set //registry.npmjs.org/:_authToken=$NPM_TOKEN
          npm config set scope "@platformatic"
          # npm config set provenance true
          if git log -1 --pretty=%B | grep "^v\?[0-9]\+\.[0-9]\+\.[0-9]\+";
          then
            npm publish --access public --dry-run
          elif git log -1 --pretty=%B | grep "^v\?[0-9]\+\.[0-9]\+\.[0-9]\+-\.+";
          then
            npm publish --tag next --access public --dry-run
          else
            echo "Not a release, skipping publish"
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}