CI.yml

name: CI

env:
  DEBUG: napi:*
  APP_NAME: python-node
  MACOSX_DEPLOYMENT_TARGET: '10.13'
  CARGO_NET_GIT_FETCH_WITH_CLI: 'true'

permissions:
  contents: write
  id-token: write

on:
  push:
    branches:
      - main
    tags-ignore:
      - '**'
    paths-ignore:
      - '**/*.md'
      - LICENSE
      - '**/*.gitignore'
      - .editorconfig
      - docs/**
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-ci
  cancel-in-progress: true

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: macos-latest
            target: x86_64-apple-darwin
            build: pnpm run build --target x86_64-apple-darwin
          - host: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian
            build: pnpm run build --target x86_64-unknown-linux-gnu
          - host: macos-latest
            target: aarch64-apple-darwin
            build: pnpm run build --target aarch64-apple-darwin
    name: stable - ${{ matrix.settings.target }} - node@20
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@v4
      - uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: |
            ${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}
            ${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - uses: actions/setup-node@v4
        if: ${{ !matrix.settings.docker }}
        with:
          node-version: 20
      - name: Install
        uses: dtolnay/rust-toolchain@stable
        if: ${{ !matrix.settings.docker }}
        with:
          toolchain: stable
          targets: ${{ matrix.settings.target }}
      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            .cargo-cache
            target/
          key: ${{ matrix.settings.target }}-cargo-${{ matrix.settings.host }}
      - uses: goto-bus-stop/setup-zig@v2
        if: ${{ matrix.settings.target == 'armv7-unknown-linux-gnueabihf' || matrix.settings.target == 'armv7-unknown-linux-musleabihf' }}
        with:
          version: 0.13.0
      - name: Setup toolchain
        run: ${{ matrix.settings.setup }}
        if: ${{ matrix.settings.setup }}
        shell: bash
      - name: Install dependencies
        run: pnpm install
      - name: Build in docker
        uses: addnab/docker-run-action@v3
        if: ${{ matrix.settings.docker }}
        with:
          image: ${{ matrix.settings.docker }}
          options: '--user 0:0 -v ${{ github.workspace }}/.cargo-cache/git/db:/usr/local/cargo/git/db -v ${{ github.workspace }}/.cargo/registry/cache:/usr/local/cargo/registry/cache -v ${{ github.workspace }}/.cargo/registry/index:/usr/local/cargo/registry/index -v ${{ github.workspace }}:/build -w /build'
          run: |
            set -x

            export CARGO_NET_GIT_FETCH_WITH_CLI=true

            # Install apt dependencies
            apt-get update -y
            apt-get install -y openssh-client python3 python3-dev

            # Setup pnpm
            corepack disable
            npm i -gf pnpm

            # Set up SSH keys (to checkout private repos with cargo)
            mkdir -p ~/.ssh
            chmod 700 ~/.ssh

            # Save SSH keys to files
            echo "${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_handler_key
            echo "${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_rewriter_key
            chmod 600 ~/.ssh/http_handler_key
            chmod 600 ~/.ssh/http_rewriter_key

            # Add GitHub to known hosts (for all aliases)
            ssh-keyscan -H github.com >> ~/.ssh/known_hosts

            # Create SSH config with host aliases
            cat > ~/.ssh/config <<'EOF'
            Host github.com-http-handler
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_handler_key
              IdentitiesOnly yes

            Host github.com-http-rewriter
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_rewriter_key
              IdentitiesOnly yes
            EOF
            chmod 600 ~/.ssh/config

            # Configure git to rewrite URLs to use the correct host alias
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler".insteadOf "ssh://git@github.com/platformatic/http-handler"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter".insteadOf "ssh://git@github.com/platformatic/http-rewriter"

            # Also handle variations without .git suffix
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler.git".insteadOf "ssh://git@github.com/platformatic/http-handler.git"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter.git".insteadOf "ssh://git@github.com/platformatic/http-rewriter.git"

            ${{ matrix.settings.build }}
      - name: Build
        run: ${{ matrix.settings.build }}
        if: ${{ !matrix.settings.docker }}
        shell: bash
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: bindings-${{ matrix.settings.target }}
          path: |
            ${{ env.APP_NAME }}.*.node
            index.d.ts
            index.js
          if-no-files-found: error

  test-macOS-windows-binding:
    name: Test bindings on ${{ matrix.settings.target }} - node@${{ matrix.node }}
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: macos-latest
            target: x86_64-apple-darwin
        node:
          - '18'
          - '20'
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@v4
      - uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: |
            ${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}
            ${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm
          architecture: x64
      - run: pnpm install
      - uses: actions/download-artifact@v4
        with:
          name: bindings-${{ matrix.settings.target }}
          path: .
      - name: List packages
        run: ls -R .
        shell: bash
      - name: Check test directory
        run: |
          echo "Current directory: $(pwd)"
          echo "Test directory contents:"
          ls -la test/ || echo "test/ directory not found"
          echo "Looking for test files:"
          find . -name "*.test.mjs" -type f || echo "No test files found"
        shell: bash
      - run: cargo test
      - run: pnpm test

  test-linux-binding:
    name: Test bindings on ${{ matrix.settings.target }} - node@${{ matrix.node }}
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
          # Not supported yet.
          # - host: ubuntu-22.04
          #   target: x86_64-unknown-linux-musl
          # Not supported yet, ubuntu-24.04-arm runner requires repo is public
          # - host: ubuntu-22.04-arm
          #   target: aarch64-unknown-linux-gnu
          # - host: ubuntu-22.04-arm
          #   target: aarch64-unknown-linux-musl
        node:
          - '18'
          - '20'
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm
      - name: Install dependencies
        run: pnpm install
      - uses: actions/download-artifact@v4
        with:
          name: bindings-${{ matrix.settings.target }}
          path: .
      - name: List packages
        run: ls -R .
        shell: bash
      - name: Output docker params
        id: docker
        run: |
          node -e "
            if ('${{ matrix.settings.target }}'.startsWith('aarch64')) {
              console.log('PLATFORM=linux/arm64')
            } else if ('${{ matrix.settings.target }}'.startsWith('armv7')) {
              console.log('PLATFORM=linux/arm/v7')
            } else {
              console.log('PLATFORM=linux/amd64')
            }
          " >> $GITHUB_OUTPUT
          node -e "
            if ('${{ matrix.settings.target }}'.endsWith('-musl')) {
              console.log('IMAGE=node:${{ matrix.node }}-alpine')
            } else {
              console.log('IMAGE=node:${{ matrix.node }}-slim')
            }
          " >> $GITHUB_OUTPUT
          echo "PNPM_STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
      - name: Test crates
        uses: addnab/docker-run-action@v3
        with:
          image: ${{ steps.docker.outputs.IMAGE }}
          options: -v ${{ github.workspace }}:${{ github.workspace }} -w ${{ github.workspace }} --platform ${{ steps.docker.outputs.PLATFORM }}
          run: |
            set -x

            export CARGO_NET_GIT_FETCH_WITH_CLI=true

            # Install apt dependencies
            apt-get update -y
            apt-get install -y openssh-client curl git build-essential python3 python3-dev

            # Install rust toolchain
            curl https://sh.rustup.rs -sSf | bash -s -- -y -t ${{ matrix.settings.target }}
            . "$HOME/.cargo/env"

            # Set up SSH keys (to checkout private repos with cargo)
            mkdir -p ~/.ssh
            chmod 700 ~/.ssh

            # Save SSH keys to files
            echo "${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_handler_key
            echo "${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_rewriter_key
            chmod 600 ~/.ssh/http_handler_key
            chmod 600 ~/.ssh/http_rewriter_key

            # Add GitHub to known hosts (for all aliases)
            ssh-keyscan -H github.com >> ~/.ssh/known_hosts

            # Create SSH config with host aliases
            cat > ~/.ssh/config <<'EOF'
            Host github.com-http-handler
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_handler_key
              IdentitiesOnly yes

            Host github.com-http-rewriter
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_rewriter_key
              IdentitiesOnly yes
            EOF
            chmod 600 ~/.ssh/config

            # Configure git to rewrite URLs to use the correct host alias
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler".insteadOf "ssh://git@github.com/platformatic/http-handler"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter".insteadOf "ssh://git@github.com/platformatic/http-rewriter"

            # Also handle variations without .git suffix
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler.git".insteadOf "ssh://git@github.com/platformatic/http-handler.git"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter.git".insteadOf "ssh://git@github.com/platformatic/http-rewriter.git"

            cargo test --target ${{ matrix.settings.target }}
      - name: Test bindings
        uses: addnab/docker-run-action@v3
        with:
          image: ${{ steps.docker.outputs.IMAGE }}
          options: -v ${{ steps.docker.outputs.PNPM_STORE_PATH }}:${{ steps.docker.outputs.PNPM_STORE_PATH }} -v ${{ github.workspace }}:${{ github.workspace }} -w ${{ github.workspace }} --platform ${{ steps.docker.outputs.PLATFORM }} -e CI=true -e GITHUB_ACTIONS=true
          run: |
            # Install Python 3.9+ (any version will work with abi3-py39)
            apt-get update -y
            apt-get install -y python3 python3-dev patchelf

            echo "=== Starting test setup ==="
            echo "Current directory: $(pwd)"
            echo "Python version: $(python3 --version)"
            echo "Patchelf version: $(patchelf --version)"
            echo "CI environment: CI=$CI, GITHUB_ACTIONS=$GITHUB_ACTIONS"

            # Check what .node files exist
            echo "=== Available .node files ==="
            ls -la *.node || echo "No .node files found"

            # Check what Python version the binary was built with and patch SONAME if needed
            echo "=== Checking .node file Python dependencies ==="
            for file in *.node; do
              if [ -f "$file" ]; then
                case "$file" in
                  *linux*)
                    echo "Checking $file..."
                    echo "Python dependencies before patching:"
                    ldd "$file" 2>/dev/null | grep python || echo "No Python dependencies found"

                    # Check if we need to patch SONAME
                    current_python_lib=$(ldd "$file" 2>/dev/null | grep "libpython" | head -1 | awk '{print $1}')
                    if [ -n "$current_python_lib" ]; then
                      echo "Current Python library: $current_python_lib"

                      # Find the actual Python library on the system
                      system_python_lib=$(find /usr/lib* -name "libpython3*.so.*" -type f 2>/dev/null | head -1)
                      if [ -n "$system_python_lib" ]; then
                        system_python_soname=$(basename "$system_python_lib")
                        echo "System Python library: $system_python_soname"

                        # Only patch if they're different
                        if [ "$current_python_lib" != "$system_python_soname" ]; then
                          echo "Patching SONAME from $current_python_lib to $system_python_soname"
                          patchelf --replace-needed "$current_python_lib" "$system_python_soname" "$file"
                          echo "SONAME patching completed"
                        else
                          echo "SONAME already matches system Python"
                        fi
                      else
                        echo "Warning: Could not find system Python library"
                      fi
                    else
                      echo "No Python library dependency found"
                    fi

                    echo "Python dependencies after patching:"
                    ldd "$file" 2>/dev/null | grep python || echo "No Python dependencies found"
                    echo "---"
                    ;;
                  *)
                    echo "Skipping non-Linux file: $file"
                    ;;
                esac
              fi
            done

            # Install pnpm and run tests
            echo "=== Installing pnpm ==="
            corepack disable
            npm i -gf pnpm

            echo "=== Running pnpm install ==="
            # Should be non-interactive in CI environment
            pnpm install --prefer-offline

            echo "=== Setting up Python library path ==="
            export LD_LIBRARY_PATH=/usr/lib/x86_64-linux-gnu:$LD_LIBRARY_PATH
            echo "LD_LIBRARY_PATH: $LD_LIBRARY_PATH"

            # Find and preload the Python library
            echo "=== Finding Python library to preload ==="
            PYTHON_LIB=$(find /usr/lib* -name "libpython3*.so.*" -type f 2>/dev/null | head -1)
            if [ -n "$PYTHON_LIB" ]; then
              echo "Found Python library: $PYTHON_LIB"
              export LD_PRELOAD=$PYTHON_LIB
              echo "LD_PRELOAD: $LD_PRELOAD"
            else
              echo "Warning: Could not find Python library to preload"
            fi

            echo "=== Running tests ==="
            pnpm test

  publish:
    name: Publish
    runs-on: ubuntu-latest
    needs:
      - test-macOS-windows-binding
      - test-linux-binding
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
      - name: Install dependencies
        run: pnpm install
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
      - name: Move artifacts
        run: pnpm artifacts
      - name: List packages
        run: ls -R ./npm
        shell: bash
      - name: Publish
        if: contains(github.ref, 'main')
        run: |
          npm config set //registry.npmjs.org/:_authToken=$NPM_TOKEN
          npm config set scope "@platformatic"
          # npm config set provenance true
          if git log -1 --pretty=%B | grep "^v\?[0-9]\+\.[0-9]\+\.[0-9]\+";
          then
            npm publish --access public --dry-run
          elif git log -1 --pretty=%B | grep "^v\?[0-9]\+\.[0-9]\+\.[0-9]\+-\.+";
          then
            npm publish --tag next --access public --dry-run
          else
            echo "Not a release, skipping publish"
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}