ci.yml

name: CI
on:
  push:
    # Empty configuration means use default (ie. test all branches)
    branches-ignore:
      # Everything would have passed bors before going into devel
      - devel
      # Bors temporary branches
      - staging.tmp
      - trying.tmp
      - staging-squash-merge.tmp
      # Github Merge Queue temporary branches
      - gh-readonly-queue/**

  pull_request:
    # Only take PRs to devel
    branches:
      - devel

    # Type of events to run CI on
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review

  merge_group:
    # Test all additions to merge queue

# Run every script actions in bash
defaults:
  run:
    shell: bash

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  pre_run:
    name: Provide additional context for the workflow
    runs-on: ubuntu-latest
    outputs:
      skip: ${{ steps.skip_result.outputs.result }}
      target_matrix: ${{ steps.matrix.outputs.result }}
      shared_builder: ${{ steps.matrix.outputs.shared }}

    steps:
      - id: skip_result
        name: Whether to skip checks
        run: |
          if [[ $IS_DRAFT == true ]]; then
            echo "Pull request is in draft state, skipping"
            echo "result=true" >> $GITHUB_OUTPUT
          else
            echo "result=false" >> $GITHUB_OUTPUT
          fi
        env:
          IS_DRAFT: ${{ github.event.pull_request.draft }}

      - id: matrix
        name: Obtain build target matrix
        run: |
          # This matrix will be shared by the jobs following it.
          #
          # The schema is:
          # [
          #   {
          #     name: String,      ## The name of the target being tested
          #     runner: String,    ## The runner to use of this target
          #     batch-count?: Int, ## Number of parallel test batches
          #   }
          # ]
          cat << "EOF" > matrix.json
          [
            {
              "name": "Linux",
              "runner": "ubuntu-20.04"
            },
            {
              "name": "macOS",
              "runner": "macos-13"
            },
            {
              "name": "macOS (M1)",
              "runner": "macos-14"
            },
            {
              "name": "Windows",
              "runner": "windows-2022",
              "batch-count": 3
            }
          ]
          EOF

          # Use jq to compact the matrix into one line to be used as the result
          echo "result=$(jq -c . matrix.json)" >> $GITHUB_OUTPUT

  test:
    needs: [pre_run]
    if: needs.pre_run.outputs.skip != 'true'

    strategy:
      fail-fast: false

      matrix:
        target: ${{ fromJson(needs.pre_run.outputs.target_matrix) }}

    name: Build and test (${{ matrix.target.name }})
    uses: ./.github/workflows/build-and-test.yml
    with:
      runner: ${{ matrix.target.runner }}
      batch-count: ${{ matrix.target.batch-count || 1 }}

  source:
    needs: [pre_run]
    if: needs.pre_run.outputs.skip != 'true'

    name: Build source archive
    runs-on: ubuntu-20.04

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          filter: tree:0

      - name: Enable annotations
        run: echo "::add-matcher::.github/nim-problem-matcher.json"

      - name: Build compiler
        run: ./koch.py boot -d:danger

      - name: Generate csources
        run: ./koch.py csource -d:danger

      - id: archive
        name: Build release source
        run: |
          ./koch.py archive

          archive=build/archive/$(jq -r .name build/archive/archive.json)

          # Rename the archive manifest to avoid collision with manifest of
          # other archives
          mv build/archive/archive.json build/archive/source.json

          echo "archive=$archive" >> $GITHUB_OUTPUT
          echo "metadata=build/archive/source.json" >> $GITHUB_OUTPUT

      - name: Publish source archive to artifacts
        uses: actions/upload-artifact@v4
        with:
          name: source archive
          path: |
            ${{ steps.archive.outputs.archive }}
            ${{ steps.archive.outputs.metadata }}
          if-no-files-found: error

  package-git:
    needs: [pre_run]

    strategy:
      fail-fast: false

      matrix:
        target: ${{ fromJson(needs.pre_run.outputs.target_matrix) }}

    name: Package from Git (${{ matrix.target.name }})
    uses: ./.github/workflows/package.yml
    with:
      runner: ${{ matrix.target.runner }}
      output-name-format: release binaries {0} {1}

  package-source:
    needs: [pre_run, source]

    strategy:
      fail-fast: false

      matrix:
        target: ${{ fromJson(needs.pre_run.outputs.target_matrix) }}

    name: Package from archive (${{ matrix.target.name }})
    uses: ./.github/workflows/package.yml
    with:
      runner: ${{ matrix.target.runner }}
      source-archive: source archive
      output-name-format: binaries from source archive {0} {1}

  test-package:
    needs: [pre_run, package-git, package-source]

    name: Test release artifacts
    runs-on: ubuntu-20.04

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          filter: tree:0

      - name: Download binaries built from source archive
        uses: actions/download-artifact@v4
        with:
          pattern: binaries from source archive*
          path: binary-from-source
          merge-multiple: true

      - name: Download release package
        uses: actions/download-artifact@v4
        with:
          # Download all release binaries to the same folder
          pattern: release binaries*
          path: release-binary
          merge-multiple: true

      - name: Download release source archive
        uses: actions/download-artifact@v4
        with:
          name: source archive
          path: source-archive

      - name: Binaries from git and source archive should be the same
        run: |
          podman run \
            --rm \
            --workdir /src \
            -v "$(pwd):/src" \
            --user 0:0 \
            registry.salsa.debian.org/reproducible-builds/diffoscope:latest \
            --progress \
            --html=build/diffoscope.html \
            --exclude-directory-metadata=yes \
            release-binary/ \
            binary-from-source/

      - name: Upload diffoscope output on failure
        id: diffoscope-output
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: differences between git and source binaries
          path: build/diffoscope.html

      - name: Write summary on failure
        if: failure() && steps.diffoscope-output.outputs.artifact-url != ''
        run: |
          cat <<EOF >> "$GITHUB_STEP_SUMMARY"
          ### Binaries from git and source archive are not the same!

          The report can be downloaded [here]($DIFFOSCOPE_OUTPUT_URL)
          EOF
        env:
          DIFFOSCOPE_OUTPUT_URL: ${{ steps.diffoscope-output.outputs.artifact-url }}

      - name: Enable annotations
        run: echo "::add-matcher::.github/nim-problem-matcher.json"

      - name: Build compiler
        run: ./koch.py boot -d:danger

      - name: Verify archive manifests
        run: |
          # Verify them by using the manifest builder tool to create a manifest
          # for the full bundle.
          bin/nim c tools/release_manifest.nim
          cd release-binary
          ../tools/release_manifest add ../source-archive/*.json *.json

          # Print the resulting manifest
          echo "Success! Generated manifest:"
          jq . manifest.json

      # This allow the publisher to run the tool directly without having to
      # clone the compiler.
      - name: Upload release manifest tool
        uses: actions/upload-artifact@v4
        with:
          name: release manifest tool
          path: tools/release_manifest

  passed:
    name: All check passed
    needs:
      - test
      - test-package
    if: cancelled() || failure()
    runs-on: ubuntu-latest

    steps:
      - name: Raise failure
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "::error::There are failing required jobs"
          exit 1