ci.yml

name: ci

on:
  push:
    branches:
      - 'main'
    tags:
      - 'v*'
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.ref }}
  cancel-in-progress: true

permissions: {}

env:
  VERSION: ${{ github.ref }}

jobs:
  prepare:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      platforms: ${{ steps.platforms.outputs.platforms }}
    steps:
      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: determine build platforms
        id: platforms
        run: |
          echo platforms=$(docker buildx bake binary-cross --print | jq -cr '.target."binary-cross".platforms') >> $GITHUB_OUTPUT

      - name: print platforms
        run: echo "$PLATFORMS"
        env:
          PLATFORMS: ${{ steps.platforms.outputs.platforms }}

  lint:
    runs-on: ubuntu-latest
    permissions:
      checks: write
      contents: read
      pull-requests: read
    steps:
      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: setup go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'

      - name: check dependencies
        run: |
          go mod tidy
          git diff --exit-code go.mod

      - name: lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0

  build:
    needs: prepare
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform: ${{fromJson(needs.prepare.outputs.platforms)}}
      fail-fast: false
    permissions:
      contents: read
    steps:
      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: set platform pair
        id: platform
        run: |
          echo "pair=${PLATFORM//\//-}" >> $GITHUB_OUTPUT
        env:
          PLATFORM: ${{ matrix.platform }}

      - name: setup qemu
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: setup buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: build binaries
        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          source: .
          targets: binary-cross
          set: |
            *.platform=${{ matrix.platform }}

      - name: list artifacts
        run: ls -alh ./build

      - name: upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wpm-${{ steps.platform.outputs.pair }}
          path: ./build/wpm-*
          if-no-files-found: error

      - name: s3 upload
        if: ${{ github.ref_type == 'branch' && github.actor != 'dependabot[bot]' }}
        run: aws s3 cp build/ "s3://wpm-cli-builds/${UPLOAD_PATH}/" --exclude "*" --include "wpm-*" --recursive --endpoint-url "$S3_ENDPOINT" --region auto --checksum-algorithm CRC32
        env:
          S3_ENDPOINT: ${{ secrets.S3_ENDPOINT_URL }}
          UPLOAD_PATH: ${{ github.event.number || 'latest' }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  pr-comment:
    needs: [prepare, build]
    runs-on: ubuntu-latest
    if: ${{ github.head_ref && github.head_ref != null && github.actor != 'dependabot[bot]' }}
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: prepare
        id: find-existing-comment
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
        with:
          script: |
            return (await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            })).data.find((comment) => comment.body.includes('wpm cli builds'))?.id || null

      - name: comment body
        id: comment-body
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
        env:
          PR_NUMBER: ${{ github.event.number }}
          PLATFORMS: ${{ needs.prepare.outputs.platforms }}
        with:
          script: |
            const platforms = JSON.parse(process.env.PLATFORMS)
            const builds = platforms.map((platform) => {
              const platformPair = platform.split('/')
              const buildPath = `wpm-${platformPair[0]}-${platformPair[1]}${platformPair[2] ? `-v${platformPair[2]}` : ''}`
              const buildUrl = `https://pub-bea4f3d05c4f49e0b54ccf1dad0da103.r2.dev/${process.env.PR_NUMBER}/${buildPath}${platformPair[0] === 'windows' ? '.exe' : ''}`
              const spec = `${platformPair[0]}/${platformPair[1]}${platformPair[2] ? `/${platformPair[2]}` : ''}`
              return `- \`${spec}\` - [\`build\`](${buildUrl})`
            }).join('\n')
            return `:package: wpm cli builds :package:\n${builds}\n`

      - name: create comment
        if: ${{ steps.find-existing-comment.outputs.result == 'null' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
        env:
          COMMENT_BODY: ${{ steps.comment-body.outputs.result }}
        with:
          script: |
            github.rest.issues.createComment({
              repo: context.repo.repo,
              owner: context.repo.owner,
              issue_number: context.issue.number,
              body: JSON.parse(process.env.COMMENT_BODY),
            });

      - name: update comment
        if: ${{ steps.find-existing-comment.outputs.result != 'null' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
        env:
          COMMENT_ID: ${{ steps.find-existing-comment.outputs.result }}
          COMMENT_BODY: ${{ steps.comment-body.outputs.result }}
        with:
          script: |
            github.rest.issues.updateComment({
              repo: context.repo.repo,
              owner: context.repo.owner,
              body: JSON.parse(process.env.COMMENT_BODY),
              comment_id: JSON.parse(process.env.COMMENT_ID),
            });

  release:
    needs: [prepare, build]
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: setup qemu
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: docker login
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: setup builder
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c #v4.2.0
        with:
          driver: cloud
          endpoint: ${{ github.repository_owner }}/builder

      - name: generate image meta
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
          bake-target: meta-helper

      - name: build and push images
        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          push: true
          source: .
          files: |
            ./docker-bake.hcl
            cwd://${{ steps.meta.outputs.bake-file }}
          targets: image-cross

      - name: download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          path: ./build
          pattern: wpm-*
          merge-multiple: true

      - name: generate checksums
        working-directory: ./build
        run: |
          find . -type f -print0 | sort -z | xargs -r0 shasum -a 256 -b | sed 's# \*\./# *#' > $RUNNER_TEMP/checksums.txt
          shasum -a 256 -U -c $RUNNER_TEMP/checksums.txt
          mv $RUNNER_TEMP/checksums.txt .
          cat checksums.txt | while read sum file; do
              echo "$sum $file" > ${file#\*}.sha256
          done

      - name: draft release
        id: draft-release
        uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: upload release assets
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
        env:
          UPLOAD_URL: ${{ steps.draft-release.outputs.upload_url }}
        with:
          script: |
            const fs = require('fs');
            let uploadUrl = process.env.UPLOAD_URL;
            const templateMarkerPos = uploadUrl.indexOf("{");
            if (templateMarkerPos !== -1) {
              uploadUrl = uploadUrl.substring(0, templateMarkerPos);
            }
            const files = fs.readdirSync('./build').map((file) => `./build/${file}`)
            for (const file of files) {
              const name = file.replace('./build/', '')
              const response = await github.request({
                method: 'POST',
                url: uploadUrl + `?name=${name}`,
                headers: {
                  'content-length': fs.statSync(file).size,
                  'authorization': `token ${process.env.GITHUB_TOKEN}`,
                  'content-type': name.endsWith('.txt') || name.endsWith('.sha256') ? 'text/plain' : 'application/octet-stream',
                },
                name,
                data: fs.readFileSync(file),
              });

              if (response.status !== 201) {
                throw new Error(`failed to upload ${name}`)
              }

              core.info(`uploaded ${name}`)
            }