CI.yml

name: CI

env:
  DEBUG: napi:*
  APP_NAME: python-node
  MACOSX_DEPLOYMENT_TARGET: '10.13'
  CARGO_NET_GIT_FETCH_WITH_CLI: 'true'

permissions:
  contents: write
  id-token: write

on:
  push:
    branches:
      - main
    tags-ignore:
      - '**'
    paths-ignore:
      - '**/*.md'
      - LICENSE
      - '**/*.gitignore'
      - .editorconfig
      - docs/**
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-ci
  cancel-in-progress: true

jobs:
  build-wasm:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          sparse-checkout: |
            fix-python-soname
          sparse-checkout-cone-mode: false
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-wasip1
      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            .cargo-cache
            target/
          key: wasm-cargo-cache-${{ hashFiles('**/Cargo.lock') }}
      - name: Build WASM
        working-directory: fix-python-soname
        run: |
          cargo build --target wasm32-wasip1 --release
          cp target/wasm32-wasip1/release/fix-python-soname.wasm ../fix-python-soname.wasm
      - name: Upload WASM artifacts
        uses: actions/upload-artifact@v4
        with:
          name: wasm-bindings
          path: fix-python-soname.wasm

  build:
    needs: build-wasm
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: macos-latest
            target: x86_64-apple-darwin
            build: pnpm run build --target x86_64-apple-darwin
          - host: macos-latest
            target: aarch64-apple-darwin
            build: pnpm run build --target aarch64-apple-darwin
          - host: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian
            build: pnpm run build --target x86_64-unknown-linux-gnu
          # Need to deal with this build failure before we can enable arm64 Linux builds.
          # Probably also should be public first so we can use the arm runners to test it anyway.
          #   error: PYO3_CROSS_PYTHON_VERSION or an abi3-py3* feature must be specified when cross-compiling and PYO3_CROSS_LIB_DIR is not set.
          #   help: see the PyO3 user guide for more information: https://pyo3.rs/v0.25.1/building-and-distribution.html#cross-compiling
          #
          # - host: ubuntu-latest
          #   target: aarch64-unknown-linux-gnu
          #   docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian-aarch64
          #   build: pnpm run build --target aarch64-unknown-linux-gnu
    name: stable - ${{ matrix.settings.target }} - node@20
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@v4
      - name: Download WASM artifacts
        uses: actions/download-artifact@v4
        with:
          name: wasm-bindings
          path: .
      - uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: |
            ${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}
            ${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - uses: actions/setup-node@v4
        if: ${{ !matrix.settings.docker }}
        with:
          node-version: 24
      - uses: dtolnay/rust-toolchain@stable
        if: ${{ !matrix.settings.docker }}
        with:
          toolchain: stable
          targets: ${{ matrix.settings.target }}
      - uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            .cargo-cache
            target/
          key: ${{ matrix.settings.target }}-cargo-${{ matrix.settings.host }}
      - uses: goto-bus-stop/setup-zig@v2
        if: ${{ matrix.settings.target == 'armv7-unknown-linux-gnueabihf' || matrix.settings.target == 'armv7-unknown-linux-musleabihf' }}
        with:
          version: 0.13.0
      - name: Setup toolchain
        run: ${{ matrix.settings.setup }}
        if: ${{ matrix.settings.setup }}
        shell: bash
      - name: Install dependencies
        run: pnpm install
      - name: Build in docker
        uses: addnab/docker-run-action@v3
        if: ${{ matrix.settings.docker }}
        with:
          image: ${{ matrix.settings.docker }}
          options: '--user 0:0 -v ${{ github.workspace }}/.cargo-cache/git/db:/usr/local/cargo/git/db -v ${{ github.workspace }}/.cargo/registry/cache:/usr/local/cargo/registry/cache -v ${{ github.workspace }}/.cargo/registry/index:/usr/local/cargo/registry/index -v ${{ github.workspace }}:/build -w /build'
          run: |
            set -x

            export CARGO_NET_GIT_FETCH_WITH_CLI=true

            # Install apt dependencies
            apt-get update -y
            apt-get install -y openssh-client python3 python3-dev

            # Setup pnpm
            corepack disable
            npm i -gf pnpm

            # Set up SSH keys (to checkout private repos with cargo)
            mkdir -p ~/.ssh
            chmod 700 ~/.ssh

            # Save SSH keys to files
            echo "${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_handler_key
            echo "${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_rewriter_key
            chmod 600 ~/.ssh/http_handler_key
            chmod 600 ~/.ssh/http_rewriter_key

            # Add GitHub to known hosts (for all aliases)
            ssh-keyscan -H github.com >> ~/.ssh/known_hosts

            # Create SSH config with host aliases
            cat > ~/.ssh/config <<'EOF'
            Host github.com-http-handler
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_handler_key
              IdentitiesOnly yes

            Host github.com-http-rewriter
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_rewriter_key
              IdentitiesOnly yes
            EOF
            chmod 600 ~/.ssh/config

            # Configure git to rewrite URLs to use the correct host alias
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler".insteadOf "ssh://git@github.com/platformatic/http-handler"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter".insteadOf "ssh://git@github.com/platformatic/http-rewriter"

            # Also handle variations without .git suffix
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler.git".insteadOf "ssh://git@github.com/platformatic/http-handler.git"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter.git".insteadOf "ssh://git@github.com/platformatic/http-rewriter.git"

            ${{ matrix.settings.build }}
      - name: Build
        run: ${{ matrix.settings.build }}
        if: ${{ !matrix.settings.docker }}
        shell: bash
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: bindings-${{ matrix.settings.target }}
          path: |
            ${{ env.APP_NAME }}.*.node
            index.d.ts
            index.js
            fix-python-soname.wasm
            fix-python-soname.js
          if-no-files-found: error

  test-macOS-windows-binding:
    name: Test ${{ matrix.settings.target }} - node@${{ matrix.node }} + python@${{ matrix.python }}
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: macos-13
            target: x86_64-apple-darwin
            architecture: x64
          - host: macos-latest
            target: aarch64-apple-darwin
            architecture: arm64
        node:
          - '20'
          - '22'
          - '24'
        python:
          - '3.8'
          - '3.9'
          - '3.10'
          - '3.11'
          - '3.12'
          - '3.13'
          # - '3.14-rc'
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@v4
      - uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: |
            ${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}
            ${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          architecture: ${{ matrix.settings.architecture }}
          cache: pnpm
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python }}
          architecture: ${{ matrix.settings.architecture }}
      - run: pnpm install
      - uses: actions/download-artifact@v4
        with:
          name: bindings-${{ matrix.settings.target }}
          path: .
      - name: List packages
        run: ls -R .
        shell: bash
      - name: Check test directory
        run: |
          echo "Current directory: $(pwd)"
          echo "Test directory contents:"
          ls -la test/ || echo "test/ directory not found"
          echo "Looking for test files:"
          find . -name "*.test.mjs" -type f || echo "No test files found"
        shell: bash
      - run: cargo test
      - run: pnpm test

  test-linux-binding:
    name: Test ${{ matrix.settings.target }} - node@${{ matrix.node }} + python@${{ matrix.python }}
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            architecture: x64
          # Not supported yet.
          # - host: ubuntu-22.04
          #   target: x86_64-unknown-linux-musl
          # Not supported yet, ubuntu-24.04-arm runner requires repo is public
          # - host: ubuntu-22.04-arm
          #   target: aarch64-unknown-linux-gnu
          # - host: ubuntu-22.04-arm
          #   target: aarch64-unknown-linux-musl
        node:
          - '20'
          - '22'
          - '24'
        python:
          - '3.8'
          - '3.9'
          - '3.10'
          - '3.11'
          - '3.12'
          - '3.13'
          # - '3.14-rc'
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          architecture: ${{ matrix.settings.architecture }}
          cache: pnpm
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python }}
          architecture: ${{ matrix.settings.architecture }}
      - name: Install dependencies
        run: pnpm install
      - uses: actions/download-artifact@v4
        with:
          name: bindings-${{ matrix.settings.target }}
          path: .
      - name: List packages
        run: ls -R .
        shell: bash
      - name: Output docker params
        id: docker
        run: |
          node -e "
            if ('${{ matrix.settings.target }}'.startsWith('aarch64')) {
              console.log('PLATFORM=linux/arm64')
            } else if ('${{ matrix.settings.target }}'.startsWith('armv7')) {
              console.log('PLATFORM=linux/arm/v7')
            } else {
              console.log('PLATFORM=linux/amd64')
            }
          " >> $GITHUB_OUTPUT
          node -e "
            if ('${{ matrix.settings.target }}'.endsWith('-musl')) {
              console.log('IMAGE=node:${{ matrix.node }}-alpine')
            } else {
              console.log('IMAGE=node:${{ matrix.node }}-slim')
            }
          " >> $GITHUB_OUTPUT
          echo "PNPM_STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
      - name: Test crates
        uses: addnab/docker-run-action@v3
        with:
          image: ${{ steps.docker.outputs.IMAGE }}
          options: -v ${{ github.workspace }}:${{ github.workspace }} -w ${{ github.workspace }} --platform ${{ steps.docker.outputs.PLATFORM }}
          run: |
            set -x

            export CARGO_NET_GIT_FETCH_WITH_CLI=true

            # Install apt dependencies
            apt-get update -y
            apt-get install -y openssh-client curl git build-essential python3 python3-dev

            # Install rust toolchain
            curl https://sh.rustup.rs -sSf | bash -s -- -y -t ${{ matrix.settings.target }}
            . "$HOME/.cargo/env"

            # Set up SSH keys (to checkout private repos with cargo)
            mkdir -p ~/.ssh
            chmod 700 ~/.ssh

            # Save SSH keys to files
            echo "${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_handler_key
            echo "${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}" | tr -d '\r' > ~/.ssh/http_rewriter_key
            chmod 600 ~/.ssh/http_handler_key
            chmod 600 ~/.ssh/http_rewriter_key

            # Add GitHub to known hosts (for all aliases)
            ssh-keyscan -H github.com >> ~/.ssh/known_hosts

            # Create SSH config with host aliases
            cat > ~/.ssh/config <<'EOF'
            Host github.com-http-handler
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_handler_key
              IdentitiesOnly yes

            Host github.com-http-rewriter
              HostName github.com
              User git
              IdentityFile ~/.ssh/http_rewriter_key
              IdentitiesOnly yes
            EOF
            chmod 600 ~/.ssh/config

            # Configure git to rewrite URLs to use the correct host alias
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler".insteadOf "ssh://git@github.com/platformatic/http-handler"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter".insteadOf "ssh://git@github.com/platformatic/http-rewriter"

            # Also handle variations without .git suffix
            git config --global url."ssh://git@github.com-http-handler/platformatic/http-handler.git".insteadOf "ssh://git@github.com/platformatic/http-handler.git"
            git config --global url."ssh://git@github.com-http-rewriter/platformatic/http-rewriter.git".insteadOf "ssh://git@github.com/platformatic/http-rewriter.git"

            cargo test --target ${{ matrix.settings.target }}
      - name: Test bindings
        uses: addnab/docker-run-action@v3
        with:
          image: ${{ steps.docker.outputs.IMAGE }}
          options: -v ${{ steps.docker.outputs.PNPM_STORE_PATH }}:${{ steps.docker.outputs.PNPM_STORE_PATH }} -v ${{ github.workspace }}:${{ github.workspace }} -w ${{ github.workspace }} --platform ${{ steps.docker.outputs.PLATFORM }} -e CI=true -e GITHUB_ACTIONS=true
          run: |
            # Install Python 3.x
            apt-get update -y
            apt-get install -y python3 python3-dev patchelf

            corepack disable
            npm i -gf pnpm
            node fix-python-soname.js
            pnpm install --prefer-offline
            pnpm test

  publish:
    name: Publish
    runs-on: ubuntu-latest
    environment: npm
    permissions:
      contents: write
      id-token: write
    if: contains(github.ref, 'main')
    needs:
      - test-macOS-windows-binding
      - test-linux-binding
    steps:
      - uses: actions/checkout@v4
      - uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: |
            ${{ secrets.HTTP_HANDLER_ACCESS_TOKEN }}
            ${{ secrets.HTTP_REWRITER_ACCESS_TOKEN }}
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: 'https://registry.npmjs.org'
          cache: pnpm
      - name: Install dependencies
        run: pnpm install
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
      - name: Move artifacts
        run: pnpm artifacts
      - name: Restore entrypoints
        run: |
          INDEX_JS=$(find artifacts -name "index.js" | head -n 1)
          INDEX_D_TS=$(find artifacts -name "index.d.ts" | head -n 1)

          if [ -n "$INDEX_JS" ] && [ -n "$INDEX_D_TS" ]; then
            echo "Found index.js: $INDEX_JS"
            echo "Found index.d.ts: $INDEX_D_TS"

            echo "Copying entrypoints to project root"
            cp "$INDEX_JS" index.js
            cp "$INDEX_D_TS" index.d.ts
          else
            echo "Error: entrypoints not found in artifacts" >&2
            exit 1
          fi
        shell: bash
      - name: Copy fix-python-soname files to Linux and macOS packages
        run: |
          # Find the WASM and JS files from Linux artifacts
          WASM_FILE=$(find artifacts -name "fix-python-soname.wasm" | head -n 1)
          JS_FILE=$(find artifacts -name "fix-python-soname.js" | head -n 1)

          if [ -n "$WASM_FILE" ] && [ -n "$JS_FILE" ]; then
            echo "Found WASM file: $WASM_FILE"
            echo "Found JS file: $JS_FILE"

            # Copy to all Linux and macOS npm directories
            for dir in npm/*/; do
              if [[ "$dir" == *"linux"* ]] || [[ "$dir" == *"darwin"* ]]; then
                echo "Copying files to $dir"
                cp "$WASM_FILE" "$dir"
                cp "$JS_FILE" "$dir"
              fi
            done
          else
            echo "Error: fix-python-soname files not found in artifacts" >&2
            exit 1
          fi
      - name: List project files
        run: ls -R .
        shell: bash
      - name: Update npm
        run: npm install -g npm@latest
      - name: Publish
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          if git log -1 --pretty=%B | grep "^v\?[0-9]\+\.[0-9]\+\.[0-9]\+";
          then
            npm publish
          elif git log -1 --pretty=%B | grep "^v\?[0-9]\+\.[0-9]\+\.[0-9]\+-\.+";
          then
            npm publish
          else
            echo "Not a release, skipping publish"
          fi
      - name: Collect npm logs
        if: always()
        run: |
          mkdir -p npm-logs
          if [ -d "$HOME/.npm/_logs" ]; then
            cp -a "$HOME/.npm/_logs/." npm-logs/
          fi
      - name: Upload npm logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: npm-logs
          path: npm-logs
          if-no-files-found: ignore