ci.yml

name: CI

on:
  push:
  pull_request:
    types:
      - opened
      - synchronize
  release:
    types:
      - published

env:
  DEBIAN_FRONTEND: noninteractive

  CONST_RANDOM_SEED: ${{ secrets.CONST_RANDOM_SEED }}

jobs:
  static-analysis:
    name: Static analysis

    runs-on: ubuntu-latest
    timeout-minutes: 15

    # Exclude in-repo PRs from running this job
    if: github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name

    steps:
      - name: 📥 Checkout source
        uses: actions/checkout@v3

      # Necessary due to Tauri macro expectations. See: https://github.com/tauri-apps/tauri/issues/3142
      - name: 📁 Create GUI package frontend dist directory
        run: mkdir packages/packsquash_gui/dist

      - name: 🧰 Install development packages
        run: |
          sudo apt-get update
          sudo apt-get install desktop-file-utils libwebkit2gtk-4.0-dev

      - name: 🧰 Install Rust toolchain
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt, clippy

      - name: 🔍 Clippy check
        uses: giraffate/clippy-action@v1
        if: github.event_name != 'release'
        with:
          clippy_flags: --all-targets
          reporter: github-check
          fail_on_error: true

      - name: 🔍 ESLint check
        working-directory: packages/packsquash_gui
        run: |
          npm ci
          npm run lint

      - name: 🔍 Cargo deny check
        uses: EmbarkStudios/cargo-deny-action@v1

      - name: 🔍 Check PackSquash Linux desktop entries correctness
        run: bash -ce 'shopt -s globstar; desktop-file-validate **/*.desktop'

      - name: 🔍 Check Rust source code format
        run: cargo fmt --all --check

      - name: 🔍 Check TypeScript source code format
        working-directory: packages/packsquash_gui
        run: npm run format

  build:
    name: Build

    strategy:
      fail-fast: false
      matrix:
        target:
          - x86_64-unknown-linux-gnu
          - x86_64-unknown-linux-musl
          - x86_64-pc-windows-gnu
          - aarch64-unknown-linux-gnu
          - aarch64-unknown-linux-musl
          - x86_64-apple-darwin
          - aarch64-apple-darwin

        include:
          - target: x86_64-unknown-linux-gnu
            host-target: x86_64-unknown-linux-gnu
            rust-toolchain-targets: x86_64-unknown-linux-gnu
            appimage-arch: x86_64
            runner: ubuntu-latest
            container: node:16-bullseye-slim
            excluded-workspace-packages: none
            apt-arch: amd64

          - target: x86_64-unknown-linux-musl
            host-target: x86_64-unknown-linux-gnu
            rust-toolchain-targets: x86_64-unknown-linux-musl
            runner: ubuntu-latest
            container: debian:sid-slim
            # The GUI dynamically links to system webview components,
            # so building it statically does not make sense
            excluded-workspace-packages: packsquash_gui
            apt-arch: amd64

          - target: aarch64-unknown-linux-gnu
            host-target: x86_64-unknown-linux-gnu
            rust-toolchain-targets: aarch64-unknown-linux-gnu
            appimage-arch: aarch64
            runner: ubuntu-latest
            container: node:16-bullseye-slim
            pkg-config-path: /usr/lib/aarch64-linux-gnu/pkgconfig
            excluded-workspace-packages: none
            apt-arch: arm64

          - target: aarch64-unknown-linux-musl
            host-target: x86_64-unknown-linux-gnu
            rust-toolchain-targets: aarch64-unknown-linux-musl
            runner: ubuntu-latest
            container: debian:sid-slim
            excluded-workspace-packages: packsquash_gui
            apt-arch: arm64

          - target: x86_64-unknown-linux-musl
            host-target: x86_64-unknown-linux-gnu
            runner: ubuntu-latest
            container: debian:sid-slim
            apt-arch: amd64

          - target: aarch64-unknown-linux-gnu
            host-target: x86_64-unknown-linux-gnu
            rust-toolchain-targets: aarch64-unknown-linux-gnu
            runner: ubuntu-latest
            container: node:16-bullseye-slim
            pkg-config-path: /usr/lib/aarch64-linux-gnu/pkgconfig
            apt-arch: arm64
            appimage-arch: aarch64

          - target: aarch64-unknown-linux-musl
            host-target: x86_64-unknown-linux-gnu
            runner: ubuntu-latest
            container: debian:sid-slim
            apt-arch: arm64

          - target: x86_64-pc-windows-gnu
            host-target: x86_64-pc-windows-gnu
            runner: windows-latest
            excluded-workspace-packages: none
            executable-extension: .exe

          - target: x86_64-apple-darwin
            host-target: x86_64-apple-darwin
            rust-toolchain-targets: aarch64-apple-darwin
            tauri-target: universal-apple-darwin
            runner: macos-latest
            excluded-workspace-packages: none

          - target: aarch64-apple-darwin
            host-target: x86_64-apple-darwin
            rust-toolchain-targets: aarch64-apple-darwin
            runner: macos-latest
            excluded-workspace-packages: none

    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60

    container: ${{ matrix.container }}

    env:
      CARGO_BUILD_TARGET: ${{ matrix.target }}
      RUSTUP_TOOLCHAIN: nightly-${{ matrix.host-target }}
      TARGET_APPIMAGE_ARCH: ${{ matrix.appimage-arch }}
      TARGET_APPIMAGE_APT_ARCH: ${{ matrix.apt-arch }}
      PKG_CONFIG_ALLOW_CROSS: 1
      PKG_CONFIG_PATH: ${{ matrix.pkg-config-path }}

    # Exclude in-repo PRs from running this job
    if: github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name

    steps:
      - name: 🧰 Install Linux toolchain packages
        if: contains(matrix.target, '-linux-')
        run: |
          apt-get update
          # curl is required by rustup and Tauri.
          # markdown and html2text are required to generate the Debian package only.
          # The third line contains packages necessary for appimage-builder only.
          # The fourth line contains packages necessary for Tauri.
          # The fifth line contains packages necessary for build-time JSON Schema generation
          # and the packsquash package build script
          apt-get install -yq build-essential musl-tools git curl \
                              markdown html2text \
                              python3-venv file zsync desktop-file-utils gtk-update-icon-cache fakeroot squashfs-tools gstreamer1.0-tools \
                              libwebkit2gtk-4.0-dev:${{ matrix.apt-arch }} \
                              jq zlib1g-dev

      # The GitHub Windows and macOS images already have jq, git and the build-essential equivalents installed,
      # so we don't need to install them explicitly. However, that may not be the case in different environments

      - name: 🧰 Install Linux ARM64 cross-compilation toolchain
        if: startsWith(matrix.target, 'aarch64-unknown-linux')
        run: |
          dpkg --add-architecture arm64
          apt-get update
          # libgcc-s1:arm64 is a dependency of libc6:arm64 that Aptitude
          # installs as usual, but for some reason the latest sid-slim image
          # as of 2023-06-13 refers to broken repositories or packages where
          # apt-get install fails
          apt-get install -yq gcc-aarch64-linux-gnu qemu-user libc6:arm64 libgcc-s1:arm64

      # As of 2023-05-24, only the Debian unstable musl-dev ARM64 package ships with an
      # aarch64-linux-musl-gcc script that wraps the aarch64-linux-gnu-gcc cross-compiler
      # provided by the gcc-aarch64-linux-gnu package to link against musl
      - name: 🧰 Install Linux ARM64 cross-compilation musl development files
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: apt-get install -yq musl-dev:arm64

      - name: 🧰 Install Rust toolchain
        uses: dtolnay/rust-toolchain@nightly
        with:
          toolchain: nightly-${{ matrix.host-target }}
          targets: ${{ env.CARGO_BUILD_TARGET }}
          components: rust-src

      - name: 💨 Cache Rust artifacts
        uses: Swatinem/rust-cache@v2

      - name: 🧰 Install nextest
        if: startsWith(matrix.target, 'x86_64-') || contains(matrix.target, '-linux-')
        uses: taiki-e/install-action@v2
        with:
          tool: nextest

      - name: 🧰 Install cargo-deb
        if: endsWith(matrix.target, '-linux-gnu')
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-deb

      - name: 🧰 Install tauri-cli
        if: matrix.tauri-target != ''
        uses: taiki-e/install-action@v2
        with:
          crate: tauri-cli

      # Debian Bullseye distributes a too old Node.js version, so set up a more modern one externally
      - name: 🧰 Install Node.js
        if: endsWith(matrix.target, '-linux-gnu')
        uses: actions/setup-node@v3
        with:
          node-version: latest
          cache: npm
          cache-dependency-path: packages/packsquash_gui/package-lock.json

      - name: 📥 Checkout source
        uses: actions/checkout@v3
        with:
          fetch-depth: 0  # Keep the commit history for proper version information

      # Necessary for steps that invoke Git commands to work properly on workflows run on containers.
      # See: https://github.com/actions/checkout/issues/766
      - name: 📥 Set source ownership to current user
        if: startsWith(matrix.runner, 'ubuntu')
        run: chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE"

      # Necessary due to Tauri macro expectations. See: https://github.com/tauri-apps/tauri/issues/3142
      - name: 📁 Create GUI package frontend dist directory
        run: mkdir packages/packsquash_gui/dist

      # Our build container is minimal, and it doesn't contain any systemd package.
      # systemd is responsible for setting up the machine ID files we use for
      # testing the system ID retrieval code, so copy a dummy one
      - name: 📏 Set up a dummy D-Bus machine ID for tests
        if: startsWith(matrix.runner, 'ubuntu')
        run: cat /proc/sys/kernel/random/uuid | tr -d '-' > /run/machine-id

      # The default npm cache directory resides at the home directory. Because our Linux
      # jobs run on containers, that directory is bind-mounted from the host runner, which
      # is owned by an unprivileged user. Change the cache directory to be within the container
      # to avoid permission issues
      - name: 📏 Change npm cache directory to one with appropriate permissions
        if: startsWith(matrix.runner, 'ubuntu') && !endsWith(matrix.target, '-musl')
        run: npm config --global set cache /tmp/.npm

      - name: 📥 Checkout source
        uses: actions/checkout@v3
        with:
          fetch-depth: 0  # Keep the commit history for proper version information

      # Necessary due to Tauri macro expectations. See: https://github.com/tauri-apps/tauri/issues/3142
      - name: 📁 Create GUI package frontend dist directory
        run: mkdir packages/packsquash_gui/dist

      # We can only run tests if the target architecture matches the host architecture,
      # or if the target (and therefore host) OS is Linux, as we can leverage QEMU there
      - name: ✔️ Run tests
        if: startsWith(matrix.target, 'x86_64-') || contains(matrix.target, '-linux-')
        run: |
          cargo nextest run --release --workspace --exclude '${{ matrix.excluded-workspace-packages }}'
          cargo test --doc --release --workspace --exclude '${{ matrix.excluded-workspace-packages }}'

      - name: 🔨 Build with optimized standard library
        run: cargo rbuild --target ${{ matrix.target }} --workspace --exclude '${{ matrix.excluded-workspace-packages }}'

      - name: 🔨 Build GUI frontend
        if: matrix.tauri-target == '' && !endsWith(matrix.target, '-musl')
        working-directory: packages/packsquash_gui
        run: |
          npm ci
          npm run build

      - name: 🔨 Build GUI frontend, installers and updater artifacts
        if: matrix.tauri-target != ''
        working-directory: packages/packsquash_gui
        env:
          TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
        run: |
          npm ci
          cargo tauri build --target ${{ matrix.tauri-target }} -- -Z build-std=std,panic_abort -Z build-std-features=panic_immediate_abort

      - name: 🔨 Generate CLI Debian package
        if: endsWith(matrix.target, '-linux-gnu')
        run: packages/packsquash_cli/bundles/deb/build.sh --target ${{ env.CARGO_BUILD_TARGET }}

      - name: 🔨 Generate GUI Debian package
        if: endsWith(matrix.target, '-linux-gnu')
        run: packages/packsquash_gui/src-tauri/bundles/deb/build.sh --target ${{ env.CARGO_BUILD_TARGET }}

      - name: 🔨 Generate GUI AppImage
        if: endsWith(matrix.target, '-linux-gnu')
        run: packages/packsquash_gui/src-tauri/bundles/appimage/build.sh

      - name: 🔨 Generate multilingual GUI MSI installer
        if: startsWith(matrix.runner, 'windows')
        run: packages/packsquash_gui/src-tauri/bundles/wix/build_multilingual_installer.ps1

      - name: 📤 Upload CLI binary
        if: ${{ !contains(matrix.target, '-linux-') || endsWith(matrix.target, '-linux-musl') }}
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash CLI executable (${{ matrix.target }})
          path: target/${{ env.CARGO_BUILD_TARGET }}/release/packsquash${{ matrix.executable-extension }}

      - name: 📤 Upload CLI Debian package
        if: endsWith(matrix.target, '-linux-gnu')
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash CLI Debian package (${{ matrix.apt-arch }})
          path: target/${{ env.CARGO_BUILD_TARGET }}/debian/packsquash_*.deb

      - name: 📤 Upload GUI Debian package
        if: endsWith(matrix.target, '-linux-gnu')
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash GUI Debian package (${{ matrix.apt-arch }})
          path: target/${{ env.CARGO_BUILD_TARGET }}/debian/packsquash-gui_*.deb

      - name: 📤 Upload GUI AppImage
        if: endsWith(matrix.target, '-linux-gnu')
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash GUI AppImage (${{ matrix.appimage-arch }})
          path: target/appimage/PackSquash (GUI)-*-${{ matrix.appimage-arch }}.AppImage

      - name: 📤 Upload GUI AppImage update diff
        if: endsWith(matrix.target, '-linux-gnu')
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash GUI AppImage zsync (${{ matrix.appimage-arch }})
          path: target/appimage/PackSquash (GUI)-*-${{ matrix.appimage-arch }}.AppImage.zsync

      - name: 📤 Upload GUI MSI installer
        if: startsWith(matrix.runner, 'windows')
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash GUI MSI installer (${{ matrix.target }})
          path: target/${{ env.CARGO_BUILD_TARGET }}/release/bundle/msi/PackSquash_*_x64.msi

      - name: 📤 Upload GUI MSI update bundle
        if: startsWith(matrix.runner, 'windows')
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash GUI MSI update bundle (${{ matrix.target }})
          path: target/${{ env.CARGO_BUILD_TARGET }}/release/bundle/msi/PackSquash_*_x64_en-US.msi.zip

      - name: 📤 Upload GUI MSI update bundle signature
        if: startsWith(matrix.runner, 'windows')
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash GUI MSI update bundle signature (${{ matrix.target }})
          path: target/${{ env.CARGO_BUILD_TARGET }}/release/bundle/msi/PackSquash_*_x64_en-US.msi.zip.sig

      - name: 📤 Upload GUI Apple Disk Image
        if: startsWith(matrix.runner, 'macos') && matrix.tauri-target != ''
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash GUI Apple Disk Image (${{ matrix.tauri-target }})
          path: target/${{ matrix.tauri-target }}/release/bundle/dmg/PackSquash_*.dmg

      - name: 📤 Upload GUI macOS update bundle
        if: startsWith(matrix.runner, 'macos') && matrix.tauri-target != ''
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash GUI macOS update bundle (${{ matrix.tauri-target }})
          path: target/${{ matrix.tauri-target }}/release/bundle/macos/PackSquash.app.tar.gz

      - name: 📤 Upload GUI macOS update bundle signature
        if: startsWith(matrix.runner, 'macos') && matrix.tauri-target != ''
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash GUI macOS update bundle signature (${{ matrix.tauri-target }})
          path: target/${{ matrix.tauri-target }}/release/bundle/macos/PackSquash.app.tar.gz.sig

  build-universal-macos-binaries:
    name: Build universal macOS binaries

    runs-on: macos-latest

    needs: build

    steps:
      - name: 📥 Download PackSquash CLI x64 macOS executable
        uses: actions/download-artifact@v3
        with:
          name: PackSquash CLI executable (x86_64-apple-darwin)
          path: packsquash-x64

      - name: 📥 Download PackSquash CLI ARM64 macOS executable
        uses: actions/download-artifact@v3
        with:
          name: PackSquash CLI executable (aarch64-apple-darwin)
          path: packsquash-aarch64

      - name: 🔨 Generate universal CLI binary
        run: lipo -create -output packsquash packsquash-x64/packsquash packsquash-aarch64/packsquash

      - name: 📤 Upload universal CLI binary
        uses: actions/upload-artifact@v3
        with:
          name: PackSquash CLI executable (universal-apple-darwin)
          path: packsquash

  build-docker-images:
    name: Build Docker images

    runs-on: ubuntu-latest

    env:
      # Defaults to docker.io (Docker Hub)
      REGISTRY: ghcr.io
      # github.repository as <account>/<repo>
      IMAGE_NAME: ${{ github.repository }}

    needs: build

    steps:
      - name: 📥 Checkout source
        uses: actions/checkout@v3

      - name: 🧰 Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: ⚙️ Generate Docker image metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          # Tag the image as "edge" for every commit on master.
          # Tag the image by its ref for every commit on non-master branches.
          # Maintain the "latest", full and major and minor semver tags for each semver tag push
          tags: |
            type=edge,branch=master
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=ref,event=branch
          labels: |
            org.opencontainers.image.description=Docker image for PackSquash, the Minecraft resource and data pack optimizer.

      - name: 📥 Download PackSquash CLI x64 musl executable
        uses: actions/download-artifact@v3
        with:
          name: PackSquash CLI executable (x86_64-unknown-linux-musl)

      - name: 📁 Rename PackSquash CLI x64 musl executable
        run: mv packsquash packsquash-amd64

      - name: 📥 Download PackSquash CLI ARM64 musl executable
        uses: actions/download-artifact@v3
        with:
          name: PackSquash CLI executable (aarch64-unknown-linux-musl)

      - name: 📁 Rename PackSquash CLI ARM64 musl executable
        run: mv packsquash packsquash-arm64

      - name: 🔍 Check workflow package write permission
        id: check_write_permission
        uses: assaferan/action-has-permission@3d96069159254de543039461dc5a9c20fadbd6e6
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # The GitHub token needs the package:write permission for the push to work.
      # This permission is not given to PRs from forked repositories.
      # See: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
      - name: ⚙️ Login to ${{ env.REGISTRY }}
        uses: docker/login-action@v2
        if: steps.check_write_permission.outputs.has-permission
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 🔨 Build and push Docker image
        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: ${{ steps.check_write_permission.outputs.has-permission == '1' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}