refresh-mex-binaries.yml

name: Refresh MEX Binaries

# Builds the full 7-way platform x runtime matrix (4 MATLAB + 3 Octave) on
# every push to main that touches MEX sources, and on manual dispatch.  The
# aggregator job collects all 7 artifacts, regenerates the .mex-version
# stamp, and opens/updates a PR on `chore/refresh-mex-binaries` refreshing
# the committed binaries.
#
# Non-retrigger invariant:
#   The auto-PR only touches binaries + .mex-version.  Neither of those are
#   in `paths`, so merging the PR does not loop.  Belt-and-braces: each job
#   ignores github-actions[bot] as actor.
#
# Source of truth for the stamp formula is libs/FastSense/private/mex_stamp.m.
# The aggregator mirrors its concatenation ordering: sorted *.c files in
# mex_src/, then sorted *.h files in mex_src/, then build_mex.m, then
# mksqlite.c.

on:
  push:
    branches: [main]
    paths:
      - 'libs/FastSense/private/mex_src/**'
      - 'libs/FastSense/build_mex.m'
      - 'libs/FastSense/mksqlite.c'
      # Defensive: refresh if the stamp formula itself changes. The formula
      # is reimplemented in bash inside the aggregator job; if mex_stamp.m
      # and the aggregator drift, stamps mismatch and binaries rebuild
      # without the committed stamp updating -- infinite rebuild loop.
      - 'libs/FastSense/mex_stamp.m'
  workflow_dispatch:

concurrency:
  group: refresh-mex-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write

jobs:
  build-matlab:
    name: MATLAB MEX ${{ matrix.label }}
    if: github.actor != 'github-actions[bot]'
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: macos-arm64
            os: macos-14
            release: R2023b
            mexext: mexmaca64
          - label: macos-x86_64
            os: macos-15-intel
            release: R2023b
            mexext: mexmaci64
          - label: linux-x86_64
            os: ubuntu-22.04
            release: R2020b
            mexext: mexa64
          - label: windows-x86_64
            os: windows-latest
            release: R2020b
            mexext: mexw64
            # Known broken: see "Compile via build_mex()" below.
            # Allowed to fail so the aggregator succeeds with 6 platforms.
            experimental: true
    runs-on: ${{ matrix.os }}
    continue-on-error: ${{ matrix.experimental || false }}
    steps:
      - name: Allow paths with colons (Windows NTFS)
        if: runner.os == 'Windows'
        run: git config --global core.protectNTFS false

      - uses: actions/checkout@v6
        with:
          sparse-checkout: |
            libs
            install.m
          sparse-checkout-cone-mode: false

      - uses: matlab-actions/setup-matlab@v3
        with:
          release: ${{ matrix.release }}
          cache: true

      - name: Delete stale binaries for this platform
        shell: bash
        run: |
          find libs -type f -name "*.${{ matrix.mexext }}" -delete || true

      - name: Verify mexext on runner
        uses: matlab-actions/run-command@v3
        with:
          command: "assert(strcmp(mexext(), '${{ matrix.mexext }}'), sprintf('Expected %s, got %s', '${{ matrix.mexext }}', mexext()));"

      # Compile via build_mex() (NOT install() — install() applies a
      # needs_build cache that's a user-facing convenience; CI should
      # compile unconditionally).
      #
      # We MUST use matlab-actions/run-command for licensing — calling
      # `matlab -batch` directly fails with "Activation cannot proceed"
      # because the just-in-time license is provided by the action.
      # Tradeoff: on Windows, run-command does not pipe MATLAB stdout
      # back to the workflow log. We work around that by writing a
      # diary file inside the workspace, then cat-ing it in a follow-up
      # `Show build log` step so the diagnostics + compile output are
      # visible regardless of platform.
      # KNOWN BROKEN ON WINDOWS — Windows MATLAB job is allowed to fail
      # via `continue-on-error` on the matrix entry above. Symptoms:
      #   - The "Compile" step exits in ~6 seconds with NO stdout and
      #     NO build_mex.log file, even though `diary()` is the first
      #     statement.
      #   - The prior "Verify mexext" step (single-statement assert)
      #     always works on the same runner.
      # Hypotheses ruled out: licensing (round-3, `matlab -batch`
      # broke activation), multi-line YAML block-scalar (round-5/6
      # collapsed to a single line — still no diary file), pwd issues
      # (workspace cwd works on Linux/macOS).
      # Remaining hypothesis: matlab-actions/run-command@v3 has a
      # Windows-specific bug in how it generates and invokes its
      # temp `command_<uuid>.m` file (encoding, line endings, or
      # parser-level failure that doesn't surface as an exit code).
      # Workaround for users on Windows MATLAB: run install.m
      # locally — it compiles fine outside CI.
      - name: Compile via build_mex()
        uses: matlab-actions/run-command@v3
        with:
          command: "diary(fullfile(pwd, 'build_mex.log')); fprintf('cwd=%s\\nmexext=%s\\narch=%s\\nisOctave=%d\\n', pwd, mexext(), computer('arch'), exist('OCTAVE_VERSION','builtin')); addpath(fullfile(pwd, 'libs', 'FastSense')); fprintf('build_mex_on_path=%s\\n', which('build_mex')); try; build_mex(); catch e; fprintf('BUILD_ERROR: %s\\n%s\\n', e.message, getReport(e, 'extended')); diary('off'); rethrow(e); end; diary('off');"

      - name: Show build log (workaround for missing stdout on Windows)
        if: always()
        shell: bash
        run: |
          if [ -f build_mex.log ]; then
            cat build_mex.log
          else
            echo "No build_mex.log produced — MATLAB likely exited before diary() ran."
          fi

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: mex-matlab-${{ matrix.label }}
          path: |
            libs/FastSense/private/*.${{ matrix.mexext }}
            libs/FastSense/mksqlite.${{ matrix.mexext }}
            libs/SensorThreshold/private/*.${{ matrix.mexext }}
          if-no-files-found: error
          retention-days: 3

  build-octave-linux:
    name: Octave MEX linux-x86_64
    if: github.actor != 'github-actions[bot]'
    timeout-minutes: 30
    runs-on: ubuntu-22.04
    container: gnuoctave/octave:11.1.0
    steps:
      - uses: actions/checkout@v6

      - name: Delete stale Octave binaries
        run: find libs -type f -name '*.mex' -delete || true

      - name: Compile via install()
        run: octave --eval "install();"

      - name: Verify subdir output
        run: |
          test -f libs/FastSense/private/octave-linux-x86_64/binary_search_mex.mex
          test -f libs/FastSense/octave-linux-x86_64/mksqlite.mex

      - uses: actions/upload-artifact@v7
        with:
          name: mex-octave-linux-x86_64
          path: |
            libs/FastSense/private/octave-linux-x86_64/*.mex
            libs/FastSense/octave-linux-x86_64/*.mex
            libs/SensorThreshold/private/octave-linux-x86_64/*.mex
          if-no-files-found: error
          retention-days: 3

  build-octave-macos:
    name: Octave MEX macos-arm64
    if: github.actor != 'github-actions[bot]'
    timeout-minutes: 30
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v6

      - name: Install Octave
        run: brew install octave

      - name: Delete stale Octave binaries
        run: find libs -type f -name '*.mex' -delete || true

      - name: Compile via install()
        run: octave --eval "install();"

      - name: Verify subdir output
        run: |
          test -f libs/FastSense/private/octave-macos-arm64/binary_search_mex.mex
          test -f libs/FastSense/octave-macos-arm64/mksqlite.mex

      - uses: actions/upload-artifact@v7
        with:
          name: mex-octave-macos-arm64
          path: |
            libs/FastSense/private/octave-macos-arm64/*.mex
            libs/FastSense/octave-macos-arm64/*.mex
            libs/SensorThreshold/private/octave-macos-arm64/*.mex
          if-no-files-found: error
          retention-days: 3

  build-octave-windows:
    name: Octave MEX windows-x86_64
    if: github.actor != 'github-actions[bot]'
    timeout-minutes: 45
    runs-on: windows-latest
    steps:
      - name: Allow paths with colons (wiki files)
        run: git config --global core.protectNTFS false

      - uses: actions/checkout@v6
        with:
          sparse-checkout: |
            libs
            install.m
          sparse-checkout-cone-mode: false

      - name: Install Octave
        shell: pwsh
        run: |
          # Try Chocolatey first
          choco install octave.portable --yes --version=9.2.0 --no-progress 2>$null
          $octExe = Get-ChildItem -Path "C:\ProgramData\chocolatey\lib\octave.portable\tools" -Recurse -Filter "octave-cli.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
          if ($octExe) {
            Write-Host "Octave installed via Chocolatey at: $($octExe.FullName)"
            echo "OCTAVE_EXE=$($octExe.FullName)" >> $env:GITHUB_ENV
            exit 0
          }
          # Fallback: direct download from mirror
          $LASTEXITCODE = 0
          $global:LASTEXITCODE = 0
          Write-Host "::warning::Chocolatey install failed (ftp.gnu.org may be down). Downloading from mirror..."
          $url = "https://mirrors.kernel.org/gnu/octave/windows/octave-9.2.0-w64.zip"
          $zip = "$env:TEMP\octave.zip"
          $dest = "C:\octave"
          Invoke-WebRequest -Uri $url -OutFile $zip -UseBasicParsing
          Expand-Archive -Path $zip -DestinationPath $dest -Force
          $octExe = Get-ChildItem -Path $dest -Recurse -Filter "octave-cli.exe" | Select-Object -First 1
          if (-not $octExe) {
            Write-Error "Failed to find octave-cli.exe after direct download"
            exit 1
          }
          Write-Host "Octave installed via direct download at: $($octExe.FullName)"
          echo "OCTAVE_EXE=$($octExe.FullName)" >> $env:GITHUB_ENV
        timeout-minutes: 15

      - name: Delete stale Octave binaries
        shell: pwsh
        run: Get-ChildItem -Recurse libs -Filter '*.mex' -ErrorAction SilentlyContinue | Remove-Item -Force

      - name: Compile via install()
        shell: pwsh
        run: |
          $octExe = $env:OCTAVE_EXE
          if (-not $octExe -or -not (Test-Path $octExe)) {
            Write-Error "OCTAVE_EXE not set or not found: $octExe"
            exit 1
          }
          & $octExe --no-window-system --eval "install();"

      - name: Verify subdir output
        shell: pwsh
        run: |
          if (-not (Test-Path 'libs/FastSense/private/octave-windows-x86_64/binary_search_mex.mex')) { throw "kernel missing under libs/FastSense/private/octave-windows-x86_64/" }
          if (-not (Test-Path 'libs/FastSense/octave-windows-x86_64/mksqlite.mex'))              { throw "mksqlite missing under libs/FastSense/octave-windows-x86_64/" }

      - uses: actions/upload-artifact@v7
        with:
          name: mex-octave-windows-x86_64
          path: |
            libs/FastSense/private/octave-windows-x86_64/*.mex
            libs/FastSense/octave-windows-x86_64/*.mex
            libs/SensorThreshold/private/octave-windows-x86_64/*.mex
          if-no-files-found: error
          retention-days: 3

  open-refresh-pr:
    name: Aggregate + Open PR
    needs:
      - build-matlab
      - build-octave-linux
      - build-octave-macos
      - build-octave-windows
    if: always() && !cancelled() && github.actor != 'github-actions[bot]'
    runs-on: ubuntu-22.04
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v6

      # Download ALL artifacts and overlay them onto libs/.
      # IMPORTANT: actions/upload-artifact trims the least-common-ancestor of
      # the supplied paths, so each artifact's internal root is `FastSense/`
      # (or `SensorThreshold/`) — NOT `libs/FastSense/`. We MUST set
      # `path: libs` here so merge-multiple extracts under libs/, not the
      # workspace root. Without `path: libs`, files land at workspace
      # `FastSense/.../*.mex*`, the aggregator's `find libs` step sees
      # nothing new, create-pull-request finds no diff, and the auto-PR
      # silently fails to open.
      - uses: actions/download-artifact@v8
        with:
          pattern: mex-*
          merge-multiple: true
          path: libs

      - name: Regenerate .mex-version stamp
        shell: bash
        run: |
          # Mirror libs/FastSense/private/mex_stamp.m: sorted *.c then sorted
          # *.h from mex_src (non-recursive), then build_mex.m, then mksqlite.c.
          set -euo pipefail
          src_dir="libs/FastSense/private/mex_src"
          mapfile -t c_files < <(find "$src_dir" -maxdepth 1 -name '*.c' | LC_ALL=C sort)
          mapfile -t h_files < <(find "$src_dir" -maxdepth 1 -name '*.h' | LC_ALL=C sort)
          tmp="$(mktemp)"
          for f in "${c_files[@]}" "${h_files[@]}" libs/FastSense/build_mex.m libs/FastSense/mksqlite.c; do
            cat "$f" >> "$tmp"
          done
          hex="$(sha256sum "$tmp" | awk '{print $1}')"
          rm -f "$tmp"
          printf 'sha256:%s\n' "$hex" > libs/FastSense/private/.mex-version
          echo "Stamp:"
          cat libs/FastSense/private/.mex-version

      - name: Show refreshed tree
        run: |
          find libs -type f \( \
            -name '*.mexmaca64' -o -name '*.mexmaci64' -o \
            -name '*.mexa64'    -o -name '*.mexw64'    -o \
            -name '*.mex' \
            \) | sort
          echo "--- stamp ---"
          cat libs/FastSense/private/.mex-version

      - uses: peter-evans/create-pull-request@v7
        with:
          branch: chore/refresh-mex-binaries
          delete-branch: true
          commit-message: "chore(mex): refresh prebuilt MEX binaries"
          title: "chore: refresh prebuilt MEX binaries"
          body: |
            Auto-generated by `.github/workflows/refresh-mex-binaries.yml`.

            Regenerates committed MEX binaries for all 7 platform x runtime
            combinations and updates `libs/FastSense/private/.mex-version`.

            Merging this PR does NOT retrigger the workflow (binaries and
            the stamp are excluded from the workflow's `paths` filter).
          # No `add-paths` filter: the prior nested-glob patterns
          # (e.g. `libs/FastSense/private/octave-*/**`) didn't match
          # reliably and resulted in "no changes added to commit"
          # followed by an opaque "Unexpected error" from the action.
          # The aggregator's working tree only contains the committed
          # repo plus extracted MEX artifacts and the regenerated stamp,
          # so staging all changes is correct here.