pkg-platform.yml

name: pkg for platform
run-name: pkging ${{ fromJSON(inputs.pkg).project }} (${{ inputs.name }})

on:
  workflow_call:
    inputs:
      name:
        description: brewkit platform unique ID
        type: string
      tinyname:
        description: >
          GitHub Actions has a non resizable sidebar so we need a shorter name
          or it’s much harder to differentiate the different jobs.
        type: string
        default: ${{ inputs.name }}
      os:
        type: string
      container:
        required: false
        type: string
      pkg:
        description: eg. `example.com@1.2.3`
        type: string
      dry-run:
        description: dry runs do not modify bottle storage
        type: boolean
        default: false
      test-os:
        description: a JSON array of runner-names
        type: string
      test-container:
        description: >
          A JSON array of docker image names or `[null]`.
          Indeed! You cannot leave this as `null` or undefined.
          Sorry, GHA is not flexible enough to efficiently work around this.
        type: string
      complain:
        type: boolean
        default: false
      invalidate-cloudfront:
        type: boolean
        default: true
    secrets:
      APPLE_CERTIFICATE_P12: { required: false }
      APPLE_CERTIFICATE_P12_PASSWORD: { required: false }
      APPLE_IDENTITY: { required: false }
      GPG_KEY_ID: { required: true }
      GPG_PRIVATE_KEY: { required: true }
      AWS_ACCESS_KEY_ID: { required: false }
      AWS_S3_BUCKET: { required: true }
      AWS_SECRET_ACCESS_KEY: { required: true }
      AWS_CF_DISTRIBUTION_ID: { required: true }
      IPFS_API_URL: { required: false }
      IPFS_API_TOKEN: { required: false }
      IPFS_CLUSTER_API_URL: { required: false }
      IPFS_CLUSTER_AUTH: { required: false }

env:
  BREWKIT_PKGJSON: ${{ inputs.pkg }}

jobs:
  build:
    name: build ${{inputs.tinyname}}
    runs-on: ${{ fromJSON(inputs.os) }}
    container: ${{ inputs.container }}
    permissions: {}
    outputs:
      project: ${{ steps.build.outputs.project }}
      version: ${{ steps.build.outputs.version }}
      platform: ${{ steps.build.outputs.platform }}
      arch: ${{ steps.build.outputs.arch }}
    env:
      PKGX_PANTRY_PATH: ${{ github.workspace }}
      PKGX_PANTRY_DIR: ${{ github.workspace }}
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/setup
        with:
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
          APPLE_IDENTITY: ${{ secrets.APPLE_IDENTITY }}

      - uses: pkgxdev/setup@v5
        with:
          PKGX_DIR: /opt

      - uses: pkgxdev/brewkit/build@v1
        with:
          pkg: ${{ inputs.pkg }}
        id: build
        env:
          APPLE_IDENTITY: ${{ secrets.APPLE_IDENTITY }}

      - uses: styfle/cancel-workflow-action@0.13.1
        if: steps.build.outputs.noop

      - uses: pkgxdev/brewkit/audit@v1
        with:
          pkg: ${{ inputs.pkg }}

      - uses: pkgxdev/brewkit/upload-build-artifact@v1

  test:
    name: test ${{inputs.tinyname}} ${{ matrix.container || ''}} ${{ matrix.container || '' }} ${{ join(matrix.os, '+') }}
    needs: build
    strategy:
      matrix:
        os: ${{ fromJSON(inputs.test-os) }}
        container: ${{ fromJSON(inputs.test-container) }}
    permissions: {}
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    env:
      PKGX_PANTRY_PATH: ${{ github.workspace }}
      PKGX_PANTRY_DIR: ${{ github.workspace }}
    steps:
      # pkgxdev/setup no longer seeds the base, and many tests
      # expect libc6-dev and possibly other base libraries.
      - run: apt-get -y update && apt-get -y install build-essential
        if: matrix.container == 'ubuntu'
      # need to update archlinux-keyring on run
      # https://bbs.archlinux.org/viewtopic.php?id=304755
      - run: |
          if command -v pacman; then
            pacman-key --init
            pacman-key --populate archlinux
            pacman -Sy --noconfirm --overwrite '*' archlinux-keyring
            pacman -Sy --noconfirm --overwrite '*' gcc libatomic_ops libxcrypt-compat
          fi

      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup
      - uses: pkgxdev/setup@v5

      - uses: pkgxdev/brewkit/download-build-artifact@v1
        with:
          pkg: ${{ inputs.pkg }}
      - uses: pkgxdev/brewkit/test@v1
        with:
          pkg: ${{ inputs.pkg }}

  bottle:
    name: bottle (${{inputs.tinyname}}.${{matrix.compression}})
    needs: [build, test]
    permissions: {}
    strategy:
      matrix:
        compression: [xz, gz]
    runs-on: ubuntu-latest
    env:
      AWS: ${{ inputs.dry-run && 'echo' || 'aws' }}
      PREFIX: ${{ needs.build.outputs.project }}/${{ needs.build.outputs.platform }}/${{ needs.build.outputs.arch }}/v${{ needs.build.outputs.version }}.tar.${{ matrix.compression }}
    steps:
      - uses: pkgxdev/setup@v5

      - uses: actions/checkout@v6

      - uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: import GPG key
        run: echo $GPG_PRIVATE_KEY |
          base64 -d |
          pkgx gpg --import --batch --yes
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

      - uses: pkgxdev/brewkit/download-build-artifact@v1
        id: dl
        with:
          pkg: ${{ inputs.pkg }}
          platform: ${{ inputs.name }}
          extract: false

      - uses: pkgxdev/brewkit/bottle@v1
        id: bottle
        with:
          file: ${{ steps.dl.outputs.filename }}
          compression: ${{ matrix.compression }}

      - name: gpg
        run: pkgx gpg
          --detach-sign
          --armor
          --output ${{ steps.bottle.outputs.filename }}.asc
          --local-user ${{ secrets.GPG_KEY_ID }}
          ${{ steps.bottle.outputs.filename }}

      - name: sha
        run: pkgx
          sha256sum
          ${{ steps.bottle.outputs.filename }} > ${{ steps.bottle.outputs.filename }}.sha256sum

      - name: ipfs
        id: ipfs
        uses: ./.github/actions/ipfs
        with:
          bottle-file: ${{ steps.bottle.outputs.filename }}
          dry-run: ${{ inputs.dry-run }}
          ipfs-api-url: ${{ secrets.IPFS_API_URL }}
          ipfs-api-token: ${{ secrets.IPFS_API_TOKEN }}
          ipfs-cluster-api-url: ${{ secrets.IPFS_CLUSTER_API_URL }}
          ipfs-cluster-auth: ${{ secrets.IPFS_CLUSTER_AUTH }}
          ipfs-gateway-url: ${{ secrets.IPFS_GATEWAY_URL }}

      - name: s3 put
        run: |
          $AWS s3 cp $FILENAME           $URL
          $AWS s3 cp $FILENAME.asc       $URL.asc
          $AWS s3 cp $FILENAME.sha256sum $URL.sha256sum

          if ! test -z "$CID"; then
            echo "$CID" >$FILENAME.cid
            $AWS s3 cp $FILENAME.cid     $URL.cid
            echo "cf-paths=/$PREFIX /$PREFIX.asc /$PREFIX.sha256sum /$PREFIX.cid" >> $GITHUB_OUTPUT
          else
            echo "cf-paths=/$PREFIX /$PREFIX.asc /$PREFIX.sha256sum" >> $GITHUB_OUTPUT
          fi

        env:
          FILENAME: ${{ steps.bottle.outputs.filename }}
          URL: s3://${{ secrets.AWS_S3_BUCKET }}/${{ env.PREFIX }}
          CID: ${{ steps.ipfs.outputs.cid }}
        id: put

      - name: s3 put file listing
        if: ${{ matrix.compression == 'gz' }}
        id: files
        run: |
          PREFIX=$(dirname $PREFIX)
          tar tf ${{ steps.bottle.outputs.filename }} \
            | grep -v '/$' \
            | grep -v '^venv/' \
            > $FILENAME
          $AWS s3 cp $FILENAME s3://${{ secrets.AWS_S3_BUCKET }}/$PREFIX/$FILENAME
          echo "cf-paths=/$PREFIX/$FILENAME" >> $GITHUB_OUTPUT
        env:
          FILENAME: v${{ needs.build.outputs.version }}.files.txt

      - name: invalidate cloudfront
        run: $AWS cloudfront create-invalidation
          --distribution-id ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
          --paths
          ${{ steps.put.outputs.cf-paths }} ${{ steps.files.outputs.cf-paths }}
        if: inputs.invalidate-cloudfront

  publish:
    name: publish ${{inputs.tinyname}} ${{ inputs.dry-run && '(dry-run)' }}
    runs-on: ubuntu-latest
    needs: [bottle, build]
    permissions: {}
    env:
      AWS: ${{ inputs.dry-run && 'echo' || 'aws' }}
      DIRNAME: ${{ needs.build.outputs.project }}/${{ needs.build.outputs.platform }}/${{ needs.build.outputs.arch }}
    steps:
      - uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - uses: pkgxdev/setup@v5

      - name: generate versions.txt
        run: |
          if ! aws s3 cp \
            s3://${{ secrets.AWS_S3_BUCKET }}/$DIRNAME/versions.txt \
            ./remote-versions.txt; then
            touch remote-versions.txt
          fi
          echo "$SCRIPT" > script.ts
          pkgx deno run -A script.ts ./remote-versions.txt ${{ needs.build.outputs.version }} > versions.txt
        env:
          # FIXME: revert to v0.18.1 since v0.19 changed deps.ts
          SCRIPT: |
            import SemVer, { compare } from "https://raw.githubusercontent.com/pkgxdev/libpkgx/v0.18.1/src/utils/semver.ts"
            const versions = new Set(Deno.readTextFileSync(Deno.args[0]).trim().split("\n").filter(x => x))
            versions.add(Deno.args[1])
            const out = [...versions].map(x => new SemVer(x)).sort(compare).join("\n")
            await Deno.stdout.write(new TextEncoder().encode(out.trim()))

      - name: s3 put
        run: $AWS s3 cp versions.txt s3://${{ secrets.AWS_S3_BUCKET }}/$DIRNAME/versions.txt

      - name: invalidate cloudfront
        run: $AWS cloudfront create-invalidation
          --distribution-id ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
          --paths
          /$DIRNAME/versions.txt
        if: inputs.invalidate-cloudfront

  complain:
    needs: bottle
    if: failure() && !inputs.dry-run && inputs.complain
    runs-on: ubuntu-latest
    permissions:
      issues: write
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/complain
        with:
          pkg: ${{ fromJSON(inputs.pkg).project }}=${{ fromJSON(inputs.pkg).version.value }}