_rust-binary.yml

name: Rust Binary Release

on:
  workflow_call:
    inputs:
      ref:
        description: 'Git ref to build (the tag being released). Empty checks out the calling workflow ref, which on a manual dispatch is the branch it was started from, not the tag.'
        required: false
        type: string
        default: ''
      bin_name:
        description: 'Binary name (e.g., image-resize)'
        required: true
        type: string
      manifest_path:
        description: 'Path to Cargo.toml (e.g., image-resize/Cargo.toml)'
        required: true
        type: string
      tag_name:
        description: 'Git tag for the GitHub Release (e.g., image-resize/v1.0.0)'
        required: true
        type: string
      is_prerelease:
        description: 'Mark as pre-release'
        required: false
        type: boolean
        default: false
      skip_create_release:
        description: 'Skip GH release creation (assumes release already exists for the tag)'
        required: false
        type: boolean
        default: false
      dry_run:
        description: 'Build binaries without uploading or creating releases'
        required: false
        type: boolean
        default: false
      targets:
        description: 'Optional comma-separated subset of build targets (default: all). Use to mark a worker as unix-only, host-only, etc.'
        required: false
        type: string
        default: ''
      version_override:
        description: 'When set, rewrite [package].version in manifest_path to this value before building. Used by the harness bundle to force coordinated versions across deps.'
        required: false
        type: string
        default: ''
      web_bundle:
        description: "Pre-build the SPA in <worker>/web/ (Node + pnpm) and ship the dist artifact to every matrix shard before `cargo build`. Required when the worker's build.rs embeds a Vite-built bundle (e.g. console)."
        required: false
        type: boolean
        default: false

env:
  CARGO_TERM_COLOR: always
  CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
  CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER: arm-linux-gnueabihf-gcc

jobs:
  pre-build:
    name: Pre-build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
        if: inputs.skip_create_release != true && inputs.dry_run != true
        with:
          ref: ${{ inputs.ref }}

      - name: Create GitHub Release
        if: inputs.skip_create_release != true && inputs.dry_run != true
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ inputs.tag_name }}
          name: ${{ inputs.bin_name }} ${{ inputs.tag_name }}
          draft: false
          prerelease: ${{ inputs.is_prerelease }}
          generate_release_notes: true

  matrix:
    name: Compute build matrix
    runs-on: ubuntu-latest
    outputs:
      include: ${{ steps.compute.outputs.include }}
    steps:
      - name: Compute matrix
        id: compute
        env:
          TARGETS: ${{ inputs.targets }}
        run: |
          python3 - <<'PY'
          import json, os, sys
          all_targets = [
              {"target": "x86_64-apple-darwin",            "os": "macos-latest"},
              {"target": "aarch64-apple-darwin",           "os": "macos-latest"},
              {"target": "x86_64-pc-windows-msvc",         "os": "windows-latest"},
              {"target": "i686-pc-windows-msvc",           "os": "windows-latest"},
              {"target": "aarch64-pc-windows-msvc",        "os": "windows-latest"},
              {"target": "x86_64-unknown-linux-gnu",       "os": "ubuntu-22.04"},
              {"target": "x86_64-unknown-linux-musl",      "os": "ubuntu-latest"},
              {"target": "aarch64-unknown-linux-gnu",      "os": "ubuntu-22.04"},
              {"target": "armv7-unknown-linux-gnueabihf",  "os": "ubuntu-22.04"},
          ]
          raw = (os.environ.get("TARGETS") or "").strip()
          if raw:
              wanted = [t.strip() for t in raw.split(",") if t.strip()]
              known = {t["target"] for t in all_targets}
              unknown = [t for t in wanted if t not in known]
              if unknown:
                  print(f"::error::unknown targets requested: {unknown}; known={sorted(known)}")
                  sys.exit(1)
              include = [t for t in all_targets if t["target"] in set(wanted)]
              if not include:
                  print("::error::targets filter resolved to empty set")
                  sys.exit(1)
          else:
              include = all_targets
          out = open(os.environ["GITHUB_OUTPUT"], "a")
          out.write(f"include={json.dumps(include)}\n")
          out.close()
          print(f"::notice::building {len(include)} target(s): {[t['target'] for t in include]}")
          PY

  # Some workers embed more than one frontend bundle. `console`, for
  # example, ships its SPA from `web/dist/` and its own injectable UI from
  # `ui/dist/`. Build every present frontend once on Linux, then make those
  # immutable outputs available to every cross-compile shard. The matrix
  # runners only need Rust; they must never need a Node/pnpm toolchain.
  web-build:
    name: Pre-build SPA bundle
    needs: [matrix]
    if: inputs.web_bundle
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.ref }}

      - name: Resolve worker dir
        id: dirs
        env:
          MANIFEST: ${{ inputs.manifest_path }}
        run: |
          set -euo pipefail
          worker=$(dirname "$MANIFEST")
          if [[ -z "$worker" || "$worker" == "." ]]; then
            echo "::error::could not derive worker dir from manifest_path=$MANIFEST"
            exit 1
          fi
          # A worker can have a web/ embedded SPA, a ui/ injected bundle, or
          # both. Keep the relative paths so the download step can restore
          # them exactly where each build.rs expects them.
          frontends=()
          if [[ -f "$worker/web/package.json" ]]; then
            frontends+=(web)
          fi
          if [[ -f "$worker/ui/package.json" ]]; then
            frontends+=(ui)
          fi
          if [[ ${#frontends[@]} -eq 0 ]]; then
            echo "::error::$worker has neither web/package.json nor ui/package.json; web_bundle=true requires one"
            exit 1
          fi
          frontend_csv=$(IFS=,; echo "${frontends[*]}")
          echo "worker=$worker" >> "$GITHUB_OUTPUT"
          echo "frontends=$frontend_csv" >> "$GITHUB_OUTPUT"
          echo "::notice::pre-building frontend bundle(s) in $worker/$frontend_csv"

      # `pnpm/action-setup` must run before `setup-node` so that
      # `setup-node`'s `cache: 'pnpm'` finds the binary on PATH. The pnpm
      # version comes from the repo-root package.json `packageManager`
      # field (the UI pnpm workspace root).
      - uses: pnpm/action-setup@v5

      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: 'pnpm'
          # The console SPA is a member of the repo-root pnpm workspace, so
          # its lockfile is the root pnpm-lock.yaml; the glob also covers
          # any standalone <worker>/web lockfile.
          cache-dependency-path: '**/pnpm-lock.yaml'

      - name: Build frontend bundles
        env:
          WORKER: ${{ steps.dirs.outputs.worker }}
          FRONTENDS: ${{ steps.dirs.outputs.frontends }}
        run: |
          set -euo pipefail
          IFS=, read -ra frontends <<< "$FRONTENDS"
          for frontend in "${frontends[@]}"; do
            (
              cd "$WORKER/$frontend"
              pnpm install --frozen-lockfile
              pnpm build
            )
          done

      - name: Stage frontend bundles
        env:
          WORKER: ${{ steps.dirs.outputs.worker }}
          FRONTENDS: ${{ steps.dirs.outputs.frontends }}
        run: |
          set -euo pipefail
          IFS=, read -ra frontends <<< "$FRONTENDS"
          stage=".release-frontend-bundle/$WORKER"
          for frontend in "${frontends[@]}"; do
            test -d "$WORKER/$frontend/dist"
            mkdir -p "$stage/$frontend"
            cp -a "$WORKER/$frontend/dist" "$stage/$frontend/"
          done

      - name: Upload frontend bundles
        uses: actions/upload-artifact@v6
        with:
          name: frontend-bundles
          path: .release-frontend-bundle/${{ steps.dirs.outputs.worker }}/
          if-no-files-found: error
          retention-days: 1

  build:
    name: Build ${{ matrix.target }}
    needs: [pre-build, matrix, web-build]
    # `web-build` is gated on `inputs.web_bundle`, so it is skipped for any
    # worker without a `web/package.json` (database, shell, mcp, …). GitHub
    # Actions' default `success()` gate treats a skipped need as "not
    # succeeded", which would cascade-skip every matrix shard and leak
    # downstream as an empty GitHub Release — see #66 (database/v0.1.0).
    if: ${{ !failure() && !cancelled() }}
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.matrix.outputs.include) }}

    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.ref }}

      - name: Rewrite SSH to HTTPS for public deps
        run: git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"

      - name: Install cross-compilation tools
        if: runner.os == 'Linux'
        env:
          BUILD_TARGET: ${{ matrix.target }}
        run: |
          sudo apt-get update
          case "$BUILD_TARGET" in
            x86_64-unknown-linux-musl)
              sudo apt-get install -y musl-tools
              ;;
            aarch64-unknown-linux-gnu)
              sudo apt-get install -y gcc-aarch64-linux-gnu libc6-dev-arm64-cross
              ;;
            armv7-unknown-linux-gnueabihf)
              sudo apt-get install -y gcc-arm-linux-gnueabihf libc6-dev-armhf-cross
              ;;
          esac

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # Workers live in subdirectories (no Cargo.toml at the repo root). Derive
      # the worker's directory from manifest_path so rust-cache runs its
      # `cargo metadata` there instead of the root.
      - name: Resolve worker directory for cache
        id: cache_workdir
        shell: bash
        run: printf 'dir=%s\n' "$(dirname '${{ inputs.manifest_path }}')" >> "$GITHUB_OUTPUT"

      - name: Cache cargo registry & build
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ inputs.bin_name }}-${{ matrix.target }}
          # Without this, rust-cache defaults to the repo root, where there is no
          # Cargo.toml — its `cargo metadata` exits 101 and the cache is never
          # found or saved, so every build of every target ships cold.
          workspaces: ${{ steps.cache_workdir.outputs.dir }}

      - name: Rewrite [package].version (bundle coordinated release)
        if: inputs.version_override != ''
        shell: bash
        env:
          MANIFEST: ${{ inputs.manifest_path }}
          VERSION: ${{ inputs.version_override }}
        run: |
          python3 - <<'PY'
          import os, pathlib, re, sys
          path = pathlib.Path(os.environ["MANIFEST"])
          version = os.environ["VERSION"]
          if not path.is_file():
              print(f"::error::manifest not found: {path}")
              sys.exit(1)
          lines = path.read_text().splitlines(keepends=True)
          out, in_package, rewrote = [], False, False
          for line in lines:
              stripped = line.strip()
              if stripped.startswith("["):
                  in_package = stripped == "[package]"
                  out.append(line)
                  continue
              if in_package and not rewrote:
                  m = re.match(r'(\s*version\s*=\s*)"[^"]*"(.*)', line)
                  if m:
                      out.append(f'{m.group(1)}"{version}"{m.group(2)}\n')
                      rewrote = True
                      continue
              out.append(line)
          if not rewrote:
              print(f"::error::[package].version not found in {path}")
              sys.exit(1)
          path.write_text("".join(out))
          print(f"::notice::set [package].version to {version} in {path}")
          PY

      # When `web_bundle: true`, every frontend bundle was built by the
      # `web-build` job. Restore their original web/dist and ui/dist paths,
      # then signal build.rs to skip its own pnpm invocation.
      - name: Resolve worker dir
        if: inputs.web_bundle
        id: dirs
        shell: bash
        env:
          MANIFEST: ${{ inputs.manifest_path }}
        run: |
          set -euo pipefail
          worker=$(dirname "$MANIFEST")
          echo "worker=$worker" >> "$GITHUB_OUTPUT"

      - name: Download frontend bundles
        if: inputs.web_bundle
        uses: actions/download-artifact@v7
        with:
          name: frontend-bundles
          path: ${{ steps.dirs.outputs.worker }}/

      - name: Build and upload binary
        uses: taiki-e/upload-rust-binary-action@v1
        env:
          # Honored by the worker's build.rs: when set, the script trusts
          # the dist/ already on disk and never invokes pnpm. The dist comes
          # from the `web-build` job's artifact above. `SKIP_WEB_BUILD` is
          # console/build.rs (embedded SPA under web/); `SKIP_UI_BUILD` is
          # state/build.rs (injected console UI under ui/) — setting both is
          # harmless, each build.rs reads only its own.
          SKIP_WEB_BUILD: ${{ inputs.web_bundle && '1' || '' }}
          SKIP_UI_BUILD: ${{ inputs.web_bundle && '1' || '' }}
        with:
          bin: ${{ inputs.bin_name }}
          target: ${{ matrix.target }}
          ref: refs/tags/${{ inputs.tag_name }}
          tar: unix
          zip: windows
          checksum: sha256
          manifest-path: ${{ inputs.manifest_path }}
          token: ${{ github.token }}
          dry-run: ${{ inputs.dry_run }}