cli.yml

name: cli build & test

on:
  # Reusable build step for the CLI. Invoked by the monorepo shared build &
  # publish pipeline (pipeline.yml), which runs daily CI on push/PR and is
  # also called by release.yml for tagged releases.
  workflow_call:
    inputs:
      artifact_name:
        description: "The artifact name to build."
        type: string
        required: false
      ref:
        description: "The ref to build on (branch or tag). Defaults to the current ref."
        type: string
        required: false
      build_version:
        description: "Version to embed in binary (overrides computed version for ldflags only). Leading 'v' is stripped."
        type: string
        required: false
    outputs:
      artifact_name:
        description: "The artifact name that was built."
        value: ${{ jobs.build.outputs.artifact_name }}
      artifact_id:
        description: "The artifact id that was built."
        value: ${{ jobs.build.outputs.artifact_id }}
      version:
        description: "Version computed for this build."
        value: ${{ jobs.build.outputs.version }}

permissions:
  contents: read

env:
  LOCATION: "cli"                       # Folder containing the CLI source
  REGISTRY: ghcr.io                     # Target container registry
  # github.head_ref → branch name from the PR target (works only for pull_request events)
  # github.ref_name → branch or tag name for normal push/tag events
  # inputs.ref → overrides both for workflow_call
  REF: ${{ inputs.ref || github.head_ref || github.ref_name }}
  ARTIFACT_NAME: ${{ inputs.artifact_name || 'cli-artifacts' }}
  # Repository selection for checkout:
  # - pull_request: Use head repository (fork) for PR changes
  # - other events: Use current repository
  CHECKOUT_REPO: ${{ github.event.pull_request.head.repo.full_name || github.repository }}

jobs:
  build:
    name: Build CLI
    runs-on: ubuntu-24.04-arm
    outputs:
      artifact_name: ${{ env.ARTIFACT_NAME }}
      artifact_id: ${{ steps.upload-artifacts.outputs.artifact_id }}
      version: ${{ steps.version.outputs.version }}
    permissions:
      contents: read
      id-token: write         # Needed for provenance attestations
      attestations: write     # Allows storing build attestations
    steps:
      # Checkout only the CLI
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          repository: ${{ env.CHECKOUT_REPO }}
          sparse-checkout: |
            .github/scripts
            ${{ env.LOCATION }}
          persist-credentials: 'false'  # Disable automatic token persistence
          ref: ${{ env.REF }}

      - name: Setup Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: cli/go.mod
          cache-dependency-path: cli/go.sum  # Cache dependencies by go.sum

      - name: Install Task
        uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 3.x

      # Setup Docker Buildx for multi-arch and advanced image building
      - name: Setup docker/buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      # Compute VERSION from env.REF
      - name: Compute VERSION
        id: version
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        env:
          TAG_PREFIX: "v"
        with:
          script: |
            const script = await import('${{ github.workspace }}/.github/scripts/compute-version.js');
            await script.default({ core });

      # Generate and verify the Component Transport Format (CTF) resulting in all artifacts
      # use a version that includes the branch name to ensure uniqueness
      # make sure that the version doesn't contain invalid semver characters
      - name: Generate & Verify CTF
        run: |
          BUILD_VERSION="${BUILD_VERSION_OVERRIDE:-$VERSION}"
          BUILD_VERSION="${BUILD_VERSION#v}"
          task cli:generate/ctf VERSION="${VERSION}" BUILD_VERSION="${BUILD_VERSION}"
          task cli:verify/ctf
        env:
          BUILD_VERSION_OVERRIDE: ${{ inputs.build_version }}

      # Attest built binaries with provenance metadata, but only if we're not on a PR
      - name: Attest binaries
        if: ${{ github.event_name != 'pull_request' }}
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          subject-path: "${{ env.LOCATION }}/tmp/bin/ocm-*"

      # Upload CLI binaries and OCI layout as build artifacts
      - name: Upload Artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        id: upload-artifacts
        with:
          if-no-files-found: 'error'
          retention-days: 1
          name: ${{ env.ARTIFACT_NAME }}
          # Compiled CLI binaries
          # OCI layout files
          path: |
            ${{ env.LOCATION }}/tmp/bin/ocm-*    
            ${{ env.LOCATION }}/tmp/oci/*