iocraft.yml

name: NAPI 1. iocraft

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Dry run (build only, no release)'
        type: boolean
        default: true
      force:
        description: 'Force rebuild (ignore cache)'
        type: boolean
        default: false
      build_mode:
        description: 'Build mode'
        type: choice
        options:
          - prod
          - dev
        default: prod
      debug:
        description: 'Debug (0|1|namespace[,...])'
        type: string
        default: '0'
  workflow_call:
    inputs:
      dry_run:
        type: boolean
        default: true
      force:
        type: boolean
        default: false
      build_mode:
        type: string
        default: prod
      debug:
        type: string
        default: '0'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    name: iocraft / ${{ matrix.os == 'win32' && 'win' || matrix.os }}-${{ matrix.arch }}${{ matrix.libc == 'musl' && '-musl' || '' }}
    permissions:
      contents: read
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux builds (glibc)
          - os: linux
            arch: x64
            runner: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
          - os: linux
            arch: arm64
            runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
          # Linux builds (musl)
          - os: linux
            arch: x64
            runner: ubuntu-24.04
            target: x86_64-unknown-linux-musl
            libc: musl
          - os: linux
            arch: arm64
            runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-musl
            libc: musl
          # macOS builds
          - os: darwin
            arch: x64
            runner: depot-macos-15
            target: x86_64-apple-darwin
          - os: darwin
            arch: arm64
            runner: depot-macos-15
            target: aarch64-apple-darwin
          # Windows builds
          - os: win32
            arch: x64
            runner: windows-2022
            target: x86_64-pc-windows-msvc
          - os: win32
            arch: arm64
            runner: windows-2022
            target: aarch64-pc-windows-msvc

    steps:
      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@85a2fc0d33af6304246620365de3e7f053035a8d # main

      - name: Enable debug logging
        uses: ./.github/actions/enable-debug-logging
        with:
          debug: ${{ inputs.debug }}

      - name: Load tool versions
        id: tool-versions
        run: |
          NODE_VERSION=$(cat .node-version | tr -d '\n')
          IOCRAFT_VERSION=$(jq -r '.sources.iocraft.version' packages/iocraft-builder/package.json)
          if [ -z "$IOCRAFT_VERSION" ] || [ "$IOCRAFT_VERSION" = "null" ]; then
            echo "error: packages/iocraft-builder/package.json missing .sources.iocraft.version" >&2
            exit 1
          fi
          echo "node-version=$NODE_VERSION" >> $GITHUB_OUTPUT
          echo "iocraft-version=$IOCRAFT_VERSION" >> $GITHUB_OUTPUT
          echo "Loaded Node.js: $NODE_VERSION, iocraft: $IOCRAFT_VERSION"
        shell: bash

      - name: Set build mode
        id: build-mode
        uses: ./.github/actions/set-build-mode
        with:
          build-mode: ${{ inputs.build_mode }}

      - name: Set platform-arch
        id: platform-arch
        uses: ./.github/actions/set-platform-arch
        with:
          platform: ${{ matrix.os }}
          arch: ${{ matrix.arch }}
          libc: ${{ matrix.libc }}

      # Hoist canonical iocraft paths into step outputs. Mirrors the
      # iocraft-builder layout (Rust → .node bundle). 1 path, 1 reference.
      - name: Compute iocraft paths
        id: paths
        env:
          BUILD_MODE: ${{ steps.build-mode.outputs.mode }}
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
        run: |
          PACKAGE_DIR="packages/iocraft-builder"
          PLATFORM_BUILD_DIR="${PACKAGE_DIR}/build/${BUILD_MODE}/${PLATFORM_ARCH}"
          OUT_DIR="${PLATFORM_BUILD_DIR}/out"
          FINAL_DIR="${OUT_DIR}/Final"
          NATIVE_OUTPUT="${OUT_DIR}/${PLATFORM_ARCH}/iocraft.node"
          FINAL_OUTPUT="${FINAL_DIR}/iocraft.node"
          {
            echo "package_dir=${PACKAGE_DIR}"
            echo "platform_build_dir=${PLATFORM_BUILD_DIR}"
            echo "out_dir=${OUT_DIR}"
            echo "final_dir=${FINAL_DIR}"
            echo "native_output=${NATIVE_OUTPUT}"
            echo "final_output=${FINAL_OUTPUT}"
          } >> "$GITHUB_OUTPUT"

      - name: Load cache version from centralized config
        id: cache-version
        uses: ./.github/actions/load-cache-version
        with:
          package-name: iocraft

      - name: Generate iocraft cache key
        id: cache-key
        env:
          CACHE_VERSION: ${{ steps.cache-version.outputs.version }}
        run: |
          # Cross-platform hash function.
          if command -v shasum &> /dev/null; then
            hash_cmd="shasum -a 256"
          elif command -v sha256sum &> /dev/null; then
            hash_cmd="sha256sum"
          else
            echo "Error: No SHA-256 command found"
            exit 1
          fi

          hash_tree() {
            local dir="$1"
            if [ -d "$dir" ]; then
              # LC_COLLATE=C pins sort order to byte-level instead of the
              # runner's locale — avoids silent cache-key divergence when
              # a locale change (en_US vs POSIX vs accented names)
              # reorders the file list. setup-checkpoints/action.yml
              # pins this for its own path; hash_tree should match.
              find "$dir" -type f 2>/dev/null | LC_COLLATE=C sort | xargs $hash_cmd 2>/dev/null | $hash_cmd | cut -d' ' -f1
            else
              echo ""
            fi
          }

          # Hash all inputs that affect the build:
          # - packages/iocraft-builder/src/     (all Rust sources, not just lib.rs)
          # - packages/iocraft-builder/scripts/ (build scripts)
          # - packages/iocraft-builder/patches/ (applied to upstream iocraft)
          # - Cargo.toml, package.json, build.rs
          # - iocraft upstream submodule SHA
          SRC_HASH=$(hash_tree packages/iocraft-builder/src)
          SCRIPTS_HASH=$(hash_tree packages/iocraft-builder/scripts)
          PATCHES_HASH=$(hash_tree packages/iocraft-builder/patches)
          CARGO_TOML=$($hash_cmd packages/iocraft-builder/Cargo.toml | cut -d' ' -f1)
          PACKAGE_JSON=$($hash_cmd packages/iocraft-builder/package.json | cut -d' ' -f1)
          BUILD_RS=$($hash_cmd packages/iocraft-builder/build.rs | cut -d' ' -f1)
          IOCRAFT_SHA=$(git ls-tree HEAD packages/iocraft-builder/upstream/iocraft 2>/dev/null | awk '{print $3}' || echo "none")
          # Include .node-version so a Node bump invalidates the cache —
          # the built .node addon is loaded by the host Node.js and must
          # match its ABI.
          NODE_VERSION_HASH=$($hash_cmd .node-version | cut -d' ' -f1)
          # Shared TS helpers consumed by iocraft-builder scripts +
          # pnpm-lock so dep bumps invalidate the cache too.
          BUILD_INFRA_LIB=$(hash_tree packages/build-infra/lib)
          BIN_INFRA_LIB=$(hash_tree packages/bin-infra/lib)
          # Foundational toolchain pins + cross-package build scripts. Per
          # validate-cache-versions CASCADE_RULES these are ALL_DOWNSTREAM —
          # a bump must invalidate every builder's cache. Mirrors the stubs/
          # curl coverage added in R29.
          BUILD_INFRA_EXTERNAL_TOOLS=$($hash_cmd packages/build-infra/external-tools.json 2>/dev/null | cut -d' ' -f1)
          BUILD_INFRA_SCRIPTS=$(hash_tree packages/build-infra/scripts)
          PNPM_LOCK_HASH=$($hash_cmd pnpm-lock.yaml 2>/dev/null | cut -d' ' -f1)
          # external-tools.json pins the rust toolchain version read by
          # pinned-versions.mts. Cargo.lock is .gitignore'd (no CI value
          # in hashing), so external-tools.json is the only source of
          # truth for the toolchain pin. Mirror opentui.yml's pattern.
          EXTERNAL_TOOLS_ROOT=$($hash_cmd packages/iocraft-builder/external-tools.json 2>/dev/null | cut -d' ' -f1)
          # iocraft Dockerfile COPYs root package.json + pnpm-workspace.yaml
          # (catalog versions, overrides, trustPolicy, minimumReleaseAge).
          # Edits there change what pnpm install resolves inside the
          # Docker build. Unhashed before R24.
          ROOT_PACKAGE_JSON=$($hash_cmd package.json 2>/dev/null | cut -d' ' -f1)
          PNPM_WORKSPACE=$($hash_cmd pnpm-workspace.yaml 2>/dev/null | cut -d' ' -f1)
          # Socket-registry propagation SHA — extracted from THIS
          # workflow's own YAML at runtime, not via a catalog lookup.
          # A registry cascade bump (which edits the @<sha> pin in
          # this file) flows through to a cache-key change here, so
          # the checkpoint cache invalidates whenever the registry
          # provisions a new pnpm version / zizmor build / etc. That
          # makes .build-context/registry-tools.json — whose contents
          # are materialized per-run from SOCKET_TOOL_CHECKSUMS_FILE
          # — implicitly part of the cache key.
          WORKFLOW_FILE="${GITHUB_WORKFLOW_REF%@*}"
          WORKFLOW_FILE="${WORKFLOW_FILE#${GITHUB_REPOSITORY}/}"
          SOCKET_REGISTRY_SHA=$(grep -ohE 'SocketDev/socket-registry/[^@]+@[0-9a-f]{40}' "$WORKFLOW_FILE" 2>/dev/null | head -1 | grep -oE '[0-9a-f]{40}$' || echo "")

          FINAL_HASH=$(echo "${CACHE_VERSION}${SRC_HASH}${SCRIPTS_HASH}${PATCHES_HASH}${CARGO_TOML}${PACKAGE_JSON}${BUILD_RS}${IOCRAFT_SHA}${NODE_VERSION_HASH}${EXTERNAL_TOOLS_ROOT}${BUILD_INFRA_LIB}${BIN_INFRA_LIB}${BUILD_INFRA_EXTERNAL_TOOLS}${BUILD_INFRA_SCRIPTS}${PNPM_LOCK_HASH}${ROOT_PACKAGE_JSON}${PNPM_WORKSPACE}${SOCKET_REGISTRY_SHA}" | $hash_cmd | cut -d' ' -f1)

          echo "cache_version=${CACHE_VERSION}" >> $GITHUB_OUTPUT
          echo "final_hash=${FINAL_HASH}" >> $GITHUB_OUTPUT
        shell: bash

      - name: Restore iocraft checkpoint cache
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: iocraft-checkpoint-cache
        if: ${{ !inputs.force }}
        with:
          # Cache the Final output so cache-hit runs skip build+validate entirely.
          path: |
            packages/iocraft-builder/build/${{ steps.build-mode.outputs.mode }}/${{ steps.platform-arch.outputs.platform_arch }}/out/Final
          key: iocraft-checkpoints-${{ steps.cache-key.outputs.cache_version }}-v${{ steps.tool-versions.outputs.iocraft-version }}-${{ steps.platform-arch.outputs.platform_arch }}-${{ steps.build-mode.outputs.mode }}-${{ steps.cache-key.outputs.final_hash }}

      - name: Initialize iocraft submodule
        # Gated on cache-miss: cache key uses `git ls-tree HEAD` so no
        # submodule checkout is required to compute it. Skipping the
        # ~30s clone on cache-hit saves up to ~4 min across the 8-entry
        # matrix on fully-cached runs.
        if: steps.iocraft-checkpoint-cache.outputs.cache-hit != 'true' || inputs.force
        uses: ./.github/actions/init-submodules
        with:
          submodules: packages/iocraft-builder/upstream/iocraft

      - name: Add Rust target
        # GitHub runners already ship rustup + stable toolchain, so we just
        # install the matrix target here (mirrors dtolnay/rust-toolchain's
        # 'targets:' input without pulling in a third-party action).
        if: steps.iocraft-checkpoint-cache.outputs.cache-hit != 'true' || inputs.force
        env:
          TARGET: ${{ matrix.target }}
        shell: bash
        run: |
          rustup show active-toolchain || rustup default stable
          rustup target add "$TARGET"

      - name: Verify Rust installation
        if: steps.iocraft-checkpoint-cache.outputs.cache-hit != 'true' || inputs.force
        shell: bash
        run: |
          # Use CARGO_HOME to find the real cargo, bypassing SFW shim
          REAL_CARGO="${CARGO_HOME:-$HOME/.cargo}/bin/cargo"
          if [ -f "$REAL_CARGO" ]; then
            echo "Cargo: $("$REAL_CARGO" --version)"
          else
            echo "Cargo: $(cargo --version)"
          fi
          rustc --version

      - name: Setup Rust cache
        if: steps.iocraft-checkpoint-cache.outputs.cache-hit != 'true' || inputs.force
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          workspaces: packages/iocraft-builder -> target
          prefix-key: iocraft-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.libc && format('-{0}', matrix.libc) || '' }}

      - name: Install musl cross-compilation tools
        if: matrix.libc == 'musl' && (steps.iocraft-checkpoint-cache.outputs.cache-hit != 'true' || inputs.force)
        shell: bash
        env:
          MATRIX_ARCH: ${{ matrix.arch }}
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

          # For ARM64 musl builds on glibc runners (libc cross-compilation)
          if [ "$MATRIX_ARCH" = "arm64" ]; then
            sudo apt-get install -y gcc-aarch64-linux-gnu
          fi

      - name: Build iocraft native module
        id: build
        if: steps.iocraft-checkpoint-cache.outputs.cache-hit != 'true' || inputs.force
        env:
          BUILD_MODE: ${{ steps.build-mode.outputs.mode }}
          TARGET: ${{ matrix.target }}
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
          TARGET_ARCH: ${{ matrix.arch }}
          LIBC: ${{ matrix.libc }}
          # Disable static CRT linking for musl to allow cdylib (dynamic library)
          RUSTFLAGS: ${{ matrix.libc == 'musl' && '-C target-feature=-crt-static' || '' }}
        run: |
          # Run build directly (not through pnpm shim) to avoid SFW intercepting
          # Cargo's HTTPS dependency fetches with SSL errors.
          # The build script resolves the real cargo binary from CARGO_HOME,
          # bypassing the SFW shim that causes crashes on Windows.
          if [ "$BUILD_MODE" = "prod" ]; then
            node packages/iocraft-builder/scripts/build.mts --prod
          else
            node packages/iocraft-builder/scripts/build.mts --dev
          fi

          echo "Build complete"
          ls -lh packages/iocraft-builder/build/$BUILD_MODE/$PLATFORM_ARCH/out/ || true
        shell: bash

      - name: Validate build output
        if: steps.iocraft-checkpoint-cache.outputs.cache-hit != 'true' || inputs.force
        env:
          OUTPUT_PATH: ${{ steps.paths.outputs.native_output }}
          FINAL_DIR: ${{ steps.paths.outputs.final_dir }}
          FINAL_OUTPUT: ${{ steps.paths.outputs.final_output }}
        run: |
          echo "Validating iocraft build output..."

          if [ ! -f "$OUTPUT_PATH" ]; then
            echo "× Build failed: Native module missing"
            echo "Expected path: $OUTPUT_PATH"
            # Show what was actually created
            find packages/iocraft-builder/build -name "*.node" -o -name "*.so" -o -name "*.dll" -o -name "*.dylib" 2>/dev/null || true
            exit 1
          fi

          NODE_SIZE=$(stat -c%s "$OUTPUT_PATH" 2>/dev/null || stat -f%z "$OUTPUT_PATH")
          if [ "$NODE_SIZE" -lt 10000 ]; then
            echo "× Build failed: Native module too small ($NODE_SIZE bytes)"
            exit 1
          fi

          # Copy to Final directory for artifact upload compatibility
          mkdir -p "$FINAL_DIR"
          cp "$OUTPUT_PATH" "$FINAL_OUTPUT"

          echo "✅ Build validation passed"
          ls -lh "$FINAL_DIR/"
        shell: bash

      - name: Upload iocraft artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: iocraft-${{ steps.platform-arch.outputs.platform_arch }}
          path: packages/iocraft-builder/build/${{ steps.build-mode.outputs.mode }}/${{ steps.platform-arch.outputs.platform_arch }}/out/Final/
          retention-days: 30
          compression-level: 0  # Already-compressed binary artifact
          if-no-files-found: error

  release:
    name: Release iocraft
    needs: build
    if: github.event_name == 'workflow_dispatch' && !inputs.dry_run
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    environment: release # Dedicated environment for secret access with approval gates
    permissions:
      contents: write # Required to create GitHub releases

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
            packages/iocraft-builder/package.json
            .github/scripts/generate-version.sh
          sparse-checkout-cone-mode: false

      - name: Load iocraft version from package.json
        id: tool-versions
        run: |
          IOCRAFT_VERSION=$(jq -r '.sources.iocraft.version' packages/iocraft-builder/package.json)
          if [ -z "$IOCRAFT_VERSION" ] || [ "$IOCRAFT_VERSION" = "null" ]; then
            echo "error: packages/iocraft-builder/package.json missing .sources.iocraft.version" >&2
            exit 1
          fi
          echo "iocraft-version=$IOCRAFT_VERSION" >> $GITHUB_OUTPUT
          echo "Loaded iocraft: $IOCRAFT_VERSION"

      - name: Download all artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: artifacts/
          pattern: iocraft-*

      - name: Generate version
        id: version
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          source .github/scripts/generate-version.sh
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Version: $VERSION"
          TAG="iocraft-${VERSION}"
          if gh release view "$TAG" &>/dev/null; then
            echo "Release $TAG already exists, skipping."
            echo "skip=true" >> $GITHUB_OUTPUT
          else
            echo "skip=false" >> $GITHUB_OUTPUT
          fi

      - name: Prepare release assets
        if: steps.version.outputs.skip != 'true'
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          mkdir -p release

          # Rename artifacts with version and platform info
          for dir in artifacts/iocraft-*/; do
            PLATFORM=$(basename "$dir" | sed 's/iocraft-//')
            cp "$dir/iocraft.node" "release/iocraft-${VERSION}-${PLATFORM}.node"
          done

          ls -lh release/

      - name: Generate checksums
        if: steps.version.outputs.skip != 'true'
        run: |
          cd release
          $(command -v shasum &> /dev/null && echo "shasum -a 256" || echo "sha256sum") iocraft-*.node > checksums.txt
          cat checksums.txt

      - name: Import GPG key
        if: steps.version.outputs.skip != 'true'
        env:
          GPG_PRIVATE_KEY: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          if [ -n "$GPG_PRIVATE_KEY" ]; then
            echo "$GPG_PRIVATE_KEY" | gpg --batch --import
            echo "GPG key imported successfully"
          else
            echo "GPG_PRIVATE_KEY secret not set, skipping signature"
          fi

      - name: Sign checksums
        if: steps.version.outputs.skip != 'true'
        env:
          GPG_PRIVATE_KEY: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          if [ -n "$GPG_PRIVATE_KEY" ]; then
            cd release
            if [ -n "$GPG_PASSPHRASE" ]; then
              echo "$GPG_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 --detach-sign --armor checksums.txt
            else
              gpg --batch --yes --detach-sign --armor checksums.txt
            fi
            echo "[OK] Created checksums.txt.asc"
            ls -lh checksums.txt.asc
          fi

      - name: Create GitHub Release
        if: steps.version.outputs.skip != 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
          IOCRAFT_VERSION: ${{ steps.tool-versions.outputs.iocraft-version }}
        run: |
          VERSION="${STEPS_VERSION_OUTPUTS_VERSION}"
          RELEASE_NAME="iocraft"
          TAG="${RELEASE_NAME}-${VERSION}"

          echo "Creating new release $TAG..."
          # Extract date-hash from tag for title
          TITLE_SUFFIX="${TAG#iocraft-}"
          gh release create "$TAG" \
            --title "iocraft ${TITLE_SUFFIX}" \
            --notes "iocraft v${IOCRAFT_VERSION} native Node.js bindings via napi-rs.

          ## Files
          - \`iocraft-${VERSION}-linux-x64.node\` - Linux x64 glibc native module
          - \`iocraft-${VERSION}-linux-arm64.node\` - Linux ARM64 glibc native module
          - \`iocraft-${VERSION}-linux-x64-musl.node\` - Linux x64 musl native module
          - \`iocraft-${VERSION}-linux-arm64-musl.node\` - Linux ARM64 musl native module
          - \`iocraft-${VERSION}-darwin-x64.node\` - macOS Intel native module
          - \`iocraft-${VERSION}-darwin-arm64.node\` - macOS Apple Silicon native module
          - \`iocraft-${VERSION}-win-x64.node\` - Windows x64 native module
          - \`iocraft-${VERSION}-win-arm64.node\` - Windows ARM64 native module
          - \`checksums.txt\` - SHA256 checksums

          ## Usage
          Load the native module in your Node.js project:
          \`\`\`javascript
          const iocraft = require('./iocraft-${VERSION}-\${platform}-\${arch}.node');
          \`\`\`" \
            release/iocraft-*.node \
            release/checksums.txt \
            $([ -f release/checksums.txt.asc ] && echo "release/checksums.txt.asc" || echo "")

  update-checksums:
    needs: release
    if: github.event_name == 'workflow_dispatch' && !inputs.dry_run
    permissions:
      contents: write # release-assets.json commit after publishing GitHub release
    uses: ./.github/workflows/update-checksums.yml
    secrets:
      BOT_GPG_PRIVATE_KEY: ${{ secrets.BOT_GPG_PRIVATE_KEY }}