job.cli.yml

#
# Copyright (c) 2024 Elide Technologies, Inc.
#
# Licensed under the MIT license (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# https://opensource.org/license/mit/
#
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
# an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations under the License.
#

name: CLI

"on":
  workflow_dispatch:
    inputs:
      ## Input: Enable Native Targets
      native:
        description: "Native"
        type: boolean
        default: false

      ## Input: Enable Release Targets
      release:
        description: "Release"
        type: boolean
        default: false

      ## Input: Enable macOS
      macos:
        description: "Enable macOS"
        type: boolean
        default: false

      ## Input: Enable Windows
      windows:
        description: "Enable Windows"
        type: boolean
        default: false

      ## Input: Runner
      runner:
        description: "Runner"
        type: string
        default: ubuntu-latest

      ## Input: Runner (Large)
      runner_large:
        description: "Runner (Large)"
        type: string
        default: ubuntu-latest-8-cores

      ## Input: Runner (Large, macOS)
      runner_large_macos:
        description: "Runner (Large, macOS)"
        type: string
        default: macos-13-xl

      ## Input: Runner (Large, Windows)
      runner_large_windows:
        description: "Runner (Large, Windows)"
        type: string
        default: windows-latest-8-cores

  workflow_call:
    inputs:
      native:
        description: "Native"
        type: boolean
        default: false
      release:
        description: "Release"
        type: boolean
        default: false
      macos:
        description: "Enable macOS"
        type: boolean
        default: false
      windows:
        description: "Enable Windows"
        type: boolean
        default: false
      runner:
        description: "Runner to use"
        type: string
        default: ubuntu-latest
      runner_large:
        description: "Runner (Large)"
        type: string
        default: ubuntu-latest-8-cores
      runner_large_macos:
        description: "Runner (Large, macOS)"
        type: string
        default: macos-13-xl
      runner_large_windows:
        description: "Runner (Large, Windows)"
        type: string
        default: windows-latest-8-cores

    secrets:
      BUILDLESS_APIKEY:
        required: false
        description: "Buildless API Key"
      BUILDBOT_SERVICE_ACCOUNT:
        required: false
        description: "GCP Service Account"
      GRADLE_CONFIGURATION_KEY:
        required: false
        description: "Gradle cache key"

env:
  BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}

permissions:
  contents: read

jobs:
  ##
  ## Job: CLI (Native Debug)
  ##
  cli-build-debug:
    name: "CLI: Native (Debug, ${{ matrix.os }}, ${{ matrix.arch || 'amd64' }})"
    runs-on: ${{ matrix.runner }}
    continue-on-error: true
    if: inputs.native
    #    if: |
    #      (
    #        github.ref == 'refs/heads/stable' ||
    #        startsWith(github.ref, 'release/') ||
    #        contains(github.event.pull_request.labels.*.name, 'ci:build-cli') ||
    #        contains(github.event.head_commit.message, 'ci:build-cli')
    #      )

    strategy:
      fail-fast: false
      matrix:
        os: ["Linux"]
        arch: ["amd64"]
        runner: ["${{ inputs.runner_large }}"]
        labs: [false]
        tag: [linux-amd64]
        include:
          - os: Linux
            runner: ${{ inputs.runner_large }}
            arch: amd64
            labs: false
            tag: linux-amd64
          - os: macOS
            runner: ${{ inputs.runner_large_macos }}
            arch: amd64
            labs: false
            tag: darwin-amd64

    steps:
      - name: "Setup: Harden Runner"
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          egress-policy: audit
      - name: "Setup: Checkout"
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          submodules: true
          persist-credentials: false
      - id: "auth"
        name: "Setup: Authorize Service Account"
        uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
        with:
          credentials_json: "${{ secrets.BUILDBOT_SERVICE_ACCOUNT }}"
          create_credentials_file: true
          export_environment_variables: true
          cleanup_credentials: true
      - name: "Setup: Buildless"
        if: contains(matrix.runner, 'macos') == false
        uses: buildless/setup@30e82389418c7f17046606183bc4c78b2c8913e0 # v1.0.2
      - name: "Setup: MSVC"
        if: contains(matrix.runner, 'windows')
        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
        with:
          arch: ${{ matrix.arch }}
          cache: "gradle"
      - name: "Setup: GraalVM (Java 23)"
        uses: graalvm/setup-graalvm@2911b2304bee2c2f59b9a67bf45f025a6b6de4b1 # v1.2.2
        with:
          distribution: "graalvm"
          java-version: "23"
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: "Setup: Bun"
        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2.0.1
        with:
          bun-version-file: .bun-version
      - name: "Setup: PNPM"
        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
        with:
          version: "9.2.0"
          run_install: |
            - recursive: true
              args: [--frozen-lockfile, --strict-peer-dependencies]
      - name: "Setup: Node"
        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
        with:
          node-version: 22
          cache: "pnpm"
      - name: "Setup: Yarn"
        run: pnpm install -g yarn@1.22.19
      - name: "Setup: Artifacts"
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        continue-on-error: true
        with:
          merge-multiple: true
      - name: "Build: CLI (Native/Debug)"
        uses: gradle/actions/setup-gradle@cc4fc85e6b35bafd578d5ffbc76a5518407e1af0 # v4.2.1
        env:
          CI: true
          BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
        with:
          cache-read-only: true
          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
          dependency-graph: disabled
      - name: "Build: CLI (Native/Debug)"
        run: |
          ./gradlew \
            :packages:cli:nativeCompile \
            -Prelease=false \
            -PbuildMode=dev \
            --scan \
            --no-daemon \
            --warning-mode=none \
            --dependency-verification=lenient \
            -Pelide.ci=true \
            -PbuildSamples=false \
            -PbuildDocs=false
      - name: "Post-process: Compress (xz)"
        if: success() && !contains(matrix.runner, 'windows')
        run: |
          pushd packages/cli/build/native/nativeCompile;
          xz -9kv elide.debug;
          popd;
          echo "Binary compressed.";
      - name: "Artifacts: Debug Binary (Unix)"
        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
        if: success() && !contains(matrix.runner, 'windows')
        with:
          name: cli-debug-${{ matrix.tag }}
          path: |
            ./packages/cli/build/native/nativeCompile/elide.debug.xz
      - name: "Artifacts: Debug Binary (Windows)"
        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
        if: success() && contains(matrix.runner, 'windows')
        with:
          name: cli-debug-${{ matrix.tag }}
          path: |
            ./packages/cli/build/native/nativeCompile/elide.debug
      - name: "Artifacts: Dashboard Dump"
        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
        if: success()
        with:
          name: cli-debug-report-${{ matrix.tag }}
          path: |
            ./packages/cli/build/native/nativeCompile/elide-tool.bgv

  ##
  ## Job: CLI (Native Release)
  ##
  cli-build-release:
    name: "CLI: Native (Release, ${{ matrix.os }}, ${{ matrix.arch || 'amd64' }})"
    runs-on: ${{ matrix.runner }}
    continue-on-error: true
    if: inputs.native && inputs.release
    #    if: |
    #      (
    #        github.ref == 'refs/heads/stable' ||
    #        contains(github.event.pull_request.labels.*.name, 'ci:build-cli') ||
    #        contains(github.event.head_commit.message, 'ci:build-cli')
    #      )

    strategy:
      fail-fast: false
      matrix:
        os: ["Linux"]
        arch: ["amd64"]
        runner:
          - ${{ inputs.runner_large }}
        labs: [false]
        tag: [linux-amd64]
        include:
          - os: Linux
            runner: ${{ inputs.runner_large }}
            arch: amd64
            labs: false
            tag: linux-amd64
          - os: macOS
            runner: ${{ inputs.runner_large_macos }}
            arch: amd64
            labs: false
            tag: darwin-amd64
          - os: Windows
            runner: ${{ inputs.runner_large_windows }}
            arch: amd64
            tag: windows-amd64
            labs: true

    steps:
      - name: "Setup: Harden Runner"
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          egress-policy: audit
      - name: "Setup: Checkout"
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          submodules: true
          persist-credentials: false
      - name: "Setup: Buildless"
        if: contains(matrix.runner, 'macos') == false
        uses: buildless/setup@30e82389418c7f17046606183bc4c78b2c8913e0 # v1.0.2
      - id: "auth"
        name: "Setup: Authorize Service Account"
        uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
        with:
          credentials_json: "${{ secrets.BUILDBOT_SERVICE_ACCOUNT }}"
          create_credentials_file: true
          export_environment_variables: true
          cleanup_credentials: true
      - name: "Setup: MSVC"
        if: contains(matrix.runner, 'windows')
        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
        with:
          arch: ${{ matrix.arch }}
      - name: "Setup: GraalVM (Java 23)"
        uses: graalvm/setup-graalvm@2911b2304bee2c2f59b9a67bf45f025a6b6de4b1 # v1.2.2
        with:
          distribution: "graalvm"
          java-version: "23"
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: "Setup: Node"
        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
        with:
          node-version: 22
      - name: "Setup: Bun"
        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2.0.1
        with:
          bun-version-file: .bun-version
      - name: "Setup: PNPM"
        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
        with:
          version: "9.2.0"
          run_install: |
            - recursive: true
              args: [--frozen-lockfile, --strict-peer-dependencies]
      - name: "Setup: Yarn"
        run: pnpm install -g yarn@1.22.19
      - name: "Setup: Artifacts"
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        continue-on-error: true
        with:
          merge-multiple: true
      - name: "Setup: Gradle"
        uses: gradle/actions/setup-gradle@cc4fc85e6b35bafd578d5ffbc76a5518407e1af0 # v4.2.1
        env:
          CI: true
          BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
        with:
          cache-read-only: true
          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
          dependency-graph: disabled
      - name: "Build: CLI (Native/Release)"
        run: |
          ./gradlew \
            :packages:cli:nativeOptimizedCompile \
            :packages:cli:dist \
            -Prelease=true \
            -PbuildMode=release \
            --scan \
            --no-daemon \
            --warning-mode=none \
            --dependency-verification=lenient \
            -Pelide.ci=true \
            -PbuildSamples=false \
            -PbuildDocs=false
      - name: "Artifacts: Release Binary"
        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
        if: success()
        with:
          name: cli-release-${{ matrix.tag }}
          path: |
            ./packages/cli/build/distributions/*