ci.yml

# SPDX-FileCopyrightText: 1996- European Centre for Medium-Range Weather Forecasts (ECMWF)
# SPDX-License-Identifier: Apache-2.0

name: CI

on:
  push:
    branches: [develop, master]
  pull_request:
    types: [opened, reopened, synchronize, labeled]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  ARTIFACT_POLL_INTERVAL: ${{ vars.ARTIFACT_POLL_INTERVAL || '60' }}
  ARTIFACT_S3_ENDPOINT: ${{ secrets.ARTIFACT_S3_ENDPOINT }}
  ARTIFACT_S3_BUCKET: ${{ secrets.ARTIFACT_S3_BUCKET }}
  SCCACHE_BUCKET: ${{ secrets.SCCACHE_BUCKET }}
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

permissions:
  contents: read

jobs:
  ci-approval:
    runs-on: ubuntu-slim
    permissions:
      pull-requests: write
    steps:
      - uses: ecmwf/ci-infrastructure/actions/require-ci-approval@main

  pre-commit:
    needs: ci-approval
    runs-on: ubuntu-slim
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
    steps:
      - uses: actions/checkout@v6
      - uses: ecmwf/ci-infrastructure/actions/pre-commit@main

  resolve:
    needs: [ci-approval, pre-commit]
    runs-on: arc-runner-normal
    container:
      image: eccr.ecmwf.int/public-ci-images/ubuntu24.04-base:latest
    outputs:
      build-matrix: ${{ steps.r.outputs.matrix-build }}
      build-hpc-matrix: ${{ steps.r.outputs.matrix-build-hpc }}
    steps:
      - name: Announce image
        uses: ecmwf/ci-infrastructure/actions/announce-image@main
      - id: mint
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.CI_PERMISSIONS_APP_CLIENT_ID }}
          private-key: ${{ secrets.CI_PERMISSIONS_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
      - uses: actions/checkout@v6
      - id: r
        uses: ecmwf/ci-infrastructure/actions/resolve-deps@main
        with:
          matrix: build,build-hpc
          token: ${{ steps.mint.outputs.token }}
          client-id: ${{ secrets.CI_PERMISSIONS_APP_CLIENT_ID }}
          app-private-key: ${{ secrets.CI_PERMISSIONS_APP_PRIVATE_KEY }}

  build:
    needs: [ci-approval, resolve]
    name: build+test (${{ matrix._resolved['job-name'] }})
    runs-on: ${{ matrix['runs-on'] }}
    container:
      image: ${{ matrix.container || '' }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.resolve.outputs.build-matrix) }}
    steps:
      - name: Announce image
        uses: ecmwf/ci-infrastructure/actions/announce-image@main
      - id: mint
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.CI_PERMISSIONS_APP_CLIENT_ID }}
          private-key: ${{ secrets.CI_PERMISSIONS_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
      - uses: actions/checkout@v6

      - name: Fetch resolved deps
        id: deps
        uses: ecmwf/ci-infrastructure/actions/fetch-deps@main
        with:
          deps-json: ${{ toJSON(matrix._resolved.deps) }}
          token: ${{ steps.mint.outputs.token }}

      - name: Build eckit
        id: build
        uses: ecmwf/ci-infrastructure/actions/run-job-script@main
        with:
          job-script: ${{ matrix.job-script }}
          matrix-leg: ${{ toJSON(matrix) }}
          package: eckit
          cmake-prefix-path: ${{ steps.deps.outputs.cmake-prefix-path }}

      - name: Publish eckit
        uses: ecmwf/ci-infrastructure/actions/publish-artifact@main
        with:
          install-path: ${{ steps.build.outputs.install-path }}
          artifact-name: ${{ matrix._resolved.own-artifact-name }}

      - name: Print dependency table
        if: always()
        uses: ecmwf/ci-infrastructure/actions/print-dep-table@main
        with:
          resolved: ${{ toJSON(matrix._resolved) }}

  build-hpc:
    needs: [ci-approval, resolve]
    name: build-hpc (${{ matrix._resolved['job-name'] }})
    runs-on: ${{ matrix['runs-on'] }}
    container:
      image: ${{ matrix.container }}
      credentials:
        username: ${{ secrets.ECCR_PULL_ROBOT_NAME }}
        password: ${{ secrets.ECCR_PULL_ROBOT_TOKEN }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.resolve.outputs.build-hpc-matrix) }}
    steps:
      - name: Announce image
        uses: ecmwf/ci-infrastructure/actions/announce-image@main
      - id: mint
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.CI_PERMISSIONS_APP_CLIENT_ID }}
          private-key: ${{ secrets.CI_PERMISSIONS_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
      - uses: actions/checkout@v6

      - name: Fetch resolved deps
        id: deps
        uses: ecmwf/ci-infrastructure/actions/fetch-deps@main
        with:
          deps-json: ${{ toJSON(matrix._resolved.deps) }}
          token: ${{ steps.mint.outputs.token }}
          # Stage the dep prefixes for shipment without installing anything
          # here: they are consumed on the compute node, not in this container.
          install-python-deps: 'false'

      - name: Build eckit on HPC
        id: build
        uses: ecmwf/ci-infrastructure/actions/build-on-hpc@main
        with:
          site: ${{ matrix.site }}
          job-script: ${{ matrix.job-script }}
          # The render context for the .j2 recipe: the toolchain this leg declares.
          matrix-leg: ${{ toJSON(matrix) }}
          artifact-name: ${{ matrix._resolved.own-artifact-name }}
          cmake-prefix-path: ${{ steps.deps.outputs.cmake-prefix-path }}
          work-dir: ${{ vars.HPC_CI_WORK_DIR }}
          remote-work-dir: ${{ vars.HPC_CI_REMOTE_WORK_DIR }}
          troika-user: ${{ secrets.HPC_CI_SSH_USER }}

      - name: Print dependency table
        if: always()
        uses: ecmwf/ci-infrastructure/actions/print-dep-table@main
        with:
          resolved: ${{ toJSON(matrix._resolved) }}
          own-source: ${{ steps.build.outputs.cache-hit == 'true' && 'artifact' || 'built' }}