stubs.yml

name: SMOL 3. Stubs

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Dry run (build only, no release)'
        type: boolean
        default: true
      force:
        description: 'Force rebuild (ignore cache)'
        type: boolean
        default: false
      debug:
        description: 'Debug (0|1|namespace[,...])'
        required: false
        default: '0'
        type: string
  push:
    tags:
      - 'stubs-v*'
    paths:
      - 'packages/stubs-builder/**'
      - 'packages/build-infra/make/**'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build-stubs:
    permissions:
      contents: write # Required to upload build artifacts
      id-token: write # OIDC authentication for Depot builds
    name: stub / ${{ matrix.platform == 'win32' && 'win' || matrix.platform }}-${{ matrix.arch }}${{ matrix.libc == 'musl' && '-musl' || '' }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS builds (native and cross-compile).
          # Use Depot runner for darwin: 8 vCPU M2, 24GB RAM.
          # Cross-compile x64 from ARM64 since Depot only offers ARM64 macOS.
          - runner: depot-macos-15
            platform: darwin
            arch: arm64
            os: macos
            makefile: Makefile.macos
          - runner: depot-macos-15
            platform: darwin
            arch: x64
            os: macos
            makefile: Makefile.macos
            cross_compile: true

          # Linux glibc builds.
          - runner: ubuntu-24.04
            platform: linux
            arch: x64
            os: linux
            libc: glibc
          - runner: ubuntu-24.04-arm
            platform: linux
            arch: arm64
            os: linux
            libc: glibc

          # Linux musl builds.
          - runner: ubuntu-24.04
            platform: linux
            arch: x64
            os: linux
            libc: musl
          - runner: ubuntu-24.04-arm
            platform: linux
            arch: arm64
            os: linux
            libc: musl

          # Windows builds.
          - runner: windows-2022
            platform: win32
            arch: x64
            os: windows
            makefile: Makefile.win
          - runner: windows-2022
            platform: win32
            arch: arm64
            os: windows
            makefile: Makefile.win
            cross_compile: true

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          # Don't clone all submodules - only needed ones are initialized below.
          submodules: false

      - name: Load cache version from centralized config
        id: cache-version
        shell: bash
        run: |
          STUBS_VERSION=$(jq -r '.versions["stubs"]' .github/cache-versions.json)
          CURL_VERSION=$(jq -r '.versions["curl"]' .github/cache-versions.json)
          if [ -z "$STUBS_VERSION" ] || [ "$STUBS_VERSION" = "null" ]; then
            echo "× Error: Cache version not found for stubs in .github/cache-versions.json"
            exit 1
          fi
          if [ -z "$CURL_VERSION" ] || [ "$CURL_VERSION" = "null" ]; then
            echo "× Error: Cache version not found for curl in .github/cache-versions.json"
            exit 1
          fi

          # Get curl and mbedtls submodule SHAs from git tree (works without submodule init).
          CURL_SHA=$(git ls-tree HEAD packages/curl-builder/upstream/curl 2>/dev/null | awk '{print $3}' || echo "none")
          MBEDTLS_SHA=$(git ls-tree HEAD packages/curl-builder/upstream/mbedtls 2>/dev/null | awk '{print $3}' || echo "none")

          # Compute curl cache key (same formula as curl.yml).
          CURL_CACHE_KEY="${CURL_VERSION}-${CURL_SHA:0:7}-${MBEDTLS_SHA:0:7}"

          # Detect hash command (prefer sha256sum, fall back to shasum).
          if command -v sha256sum &> /dev/null; then
            hash_cmd="sha256sum"
          elif command -v shasum &> /dev/null; then
            hash_cmd="shasum -a 256"
          else
            echo "× Error: No SHA-256 command found"
            exit 1
          fi

          # Helper function to hash files.
          hash_files() {
            local files=$(find "$@" 2>/dev/null)
            if [ -n "$files" ]; then
              echo "$files" | sort | xargs $hash_cmd 2>/dev/null | $hash_cmd | cut -d' ' -f1
            else
              echo ""
            fi
          }

          # Hash canonical source packages (source of truth for stubs).
          BUILD_INFRA_SRC=$(hash_files packages/build-infra/src/socketsecurity/build-infra -type f)
          BIN_INFRA_SRC=$(hash_files packages/bin-infra/src/socketsecurity/bin-infra -type f)
          STUBS_SRC=$(hash_files packages/stubs-builder/src -type f)

          # Stubs cache key = stubs version + curl cache key + source hashes.
          SOURCE_HASH=$(echo "${BUILD_INFRA_SRC}${BIN_INFRA_SRC}${STUBS_SRC}" | $hash_cmd | cut -d' ' -f1)
          COMBINED_VERSION="${STUBS_VERSION}-curl-${CURL_CACHE_KEY}-src-${SOURCE_HASH:0:7}"
          echo "version=$COMBINED_VERSION" >> $GITHUB_OUTPUT
          echo "stubs_version=$STUBS_VERSION" >> $GITHUB_OUTPUT
          echo "curl_cache_key=$CURL_CACHE_KEY" >> $GITHUB_OUTPUT
          echo "source_hash=${SOURCE_HASH:0:7}" >> $GITHUB_OUTPUT
          echo "Cache version: $COMBINED_VERSION"
          echo "  stubs: $STUBS_VERSION"
          echo "  curl cache key: $CURL_CACHE_KEY"
          echo "  source hash: ${SOURCE_HASH:0:7}"

      - name: Initialize LZFSE submodule
        run: |
          git submodule update --init packages/lief-builder/upstream/lzfse

      - name: Setup Depot CLI
        if: matrix.os == 'linux'
        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1
        with:
          oidc: true

      - name: Build stubs with Depot (Linux - offloads compute)
        if: matrix.os == 'linux'
        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
        with:
          project: 8fpj9495vw
          platforms: linux/${{ matrix.arch == 'x64' && 'amd64' || matrix.arch }}
          build-args: |
            BUILD_MODE=prod
            CACHE_VERSION=${{ steps.cache-version.outputs.version }}
            CURL_CACHE_VERSION=${{ steps.cache-version.outputs.curl_cache_key }}
            CACHE_BUSTER=${{ github.sha }}
          no-cache: ${{ inputs.force == true }}
          file: packages/stubs-builder/docker/Dockerfile.${{ matrix.libc || 'glibc' }}
          target: export
          outputs: type=local,dest=packages/stubs-builder/out
          context: .

      - name: Verify Depot build output (Linux)
        if: matrix.os == 'linux'
        shell: bash
        run: |
          echo "Verifying Depot build output structure..."
          ls -lah packages/stubs-builder/out/ || echo "Output directory not found"

          # Check for stub binary.
          if [ -f "packages/stubs-builder/out/smol_stub" ]; then
            echo "✅ smol_stub found"
            file packages/stubs-builder/out/smol_stub || true
          else
            echo "× smol_stub not found!"
            echo "Contents of output directory:"
            find packages/stubs-builder/ -type f 2>/dev/null || echo "No files found"
            exit 1
          fi

      - uses: SocketDev/socket-registry/.github/actions/setup@bab1dc8adc59a21c04fa73d3dd4a333c12e2ca9b # main
        if: matrix.os != 'linux'

      - uses: SocketDev/socket-registry/.github/actions/install@bab1dc8adc59a21c04fa73d3dd4a333c12e2ca9b # main
        if: matrix.os != 'linux'

      - name: Setup build environment (macOS)
        if: matrix.os == 'macos'
        run: |
          # macOS already has Xcode command line tools.
          echo "Build environment ready"

      - name: Setup build environment (Windows x64)
        if: matrix.os == 'windows' && matrix.arch == 'x64'
        shell: bash
        run: |
          # Install MinGW for Windows x64 builds.
          choco install mingw -y
          # Add MinGW to PATH.
          echo "C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin" >> $GITHUB_PATH

      - name: Setup build environment (Windows ARM64 cross-compile)
        if: matrix.os == 'windows' && matrix.arch == 'arm64'
        shell: bash
        run: |
          # Download and extract llvm-mingw for ARM64 cross-compilation.
          curl -fsSL -o llvm-mingw.zip "https://github.com/mstorsjo/llvm-mingw/releases/download/20250528/llvm-mingw-20250528-ucrt-x86_64.zip"
          7z x llvm-mingw.zip -o"C:/llvm-mingw"
          echo "C:/llvm-mingw/llvm-mingw-20250528-ucrt-x86_64/bin" >> $GITHUB_PATH

      - name: Build stub (macOS/Windows)
        if: matrix.os != 'linux'
        shell: bash
        working-directory: packages/stubs-builder
        env:
          TARGET_ARCH: ${{ matrix.arch }}
          CROSS_COMPILE: ${{ matrix.cross_compile && '1' || '0' }}
          DEBUG: ${{ inputs.debug && '1' || '' }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Build script handles curl dependency download and stub compilation.
          node scripts/build.mjs

      - name: Set platform-arch
        id: platform-arch
        env:
          PLATFORM: ${{ matrix.platform }}
          ARCH: ${{ matrix.arch }}
          LIBC: ${{ matrix.libc }}
        shell: bash
        run: |
          # Convert win32 -> win for file/folder names.
          if [ "${PLATFORM}" = "win32" ]; then
            RELEASE_PLATFORM="win"
          else
            RELEASE_PLATFORM="${PLATFORM}"
          fi
          PLATFORM_ARCH="${RELEASE_PLATFORM}-${ARCH}"
          if [ "${LIBC}" = "musl" ]; then
            PLATFORM_ARCH="${PLATFORM_ARCH}-musl"
          fi
          echo "platform_arch=${PLATFORM_ARCH}" >> $GITHUB_OUTPUT
          echo "Platform-arch: ${PLATFORM_ARCH}"

      - name: Verify stub binary
        shell: bash
        working-directory: packages/stubs-builder
        env:
          BUILD_MODE: prod
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
        run: |
          # Binary location differs between Docker (Linux) and native (macOS/Windows).
          if [ "${{ matrix.os }}" = "linux" ]; then
            # Docker export puts binary in out/ directory.
            STUB_FILE="out/smol_stub"
          elif [ "${{ matrix.os }}" = "windows" ]; then
            # Native build outputs to build/prod/${PLATFORM_ARCH}/out/Final/.
            STUB_FILE="build/${BUILD_MODE}/${PLATFORM_ARCH}/out/Final/smol_stub.exe"
          else
            STUB_FILE="build/${BUILD_MODE}/${PLATFORM_ARCH}/out/Final/smol_stub"
          fi

          if [ ! -f "$STUB_FILE" ]; then
            echo "Error: Stub binary not found: $STUB_FILE"
            exit 1
          fi

          # Show file info.
          ls -lh "$STUB_FILE"
          file "$STUB_FILE" || true

          # Check size is reasonable (< 100KB).
          SIZE=$(stat -c%s "$STUB_FILE" 2>/dev/null || stat -f%z "$STUB_FILE" 2>/dev/null || echo "0")
          if [ "$SIZE" -gt 102400 ]; then
            echo "Warning: Stub is larger than expected: ${SIZE} bytes"
          fi
          echo "Stub size: ${SIZE} bytes"

      - name: Create release artifact
        shell: bash
        env:
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
        run: |
          PLATFORM="${{ matrix.platform }}"
          ARCH="${{ matrix.arch }}"
          LIBC="${{ matrix.libc }}"

          # Transform win32 → win for consistency with other tools.
          if [ "$PLATFORM" = "win32" ]; then
            PLATFORM="win"
          fi

          # Construct artifact name (all hyphens, following lief convention).
          ARTIFACT_NAME="smol-stub-${PLATFORM}-${ARCH}"
          if [ "${LIBC}" = "musl" ]; then
            ARTIFACT_NAME="${ARTIFACT_NAME}-musl"
          fi

          # Determine stub file name and directory.
          if [ "${{ matrix.os }}" = "linux" ]; then
            # Docker export puts binary in out/ directory.
            STUB_DIR="packages/stubs-builder/out"
            STUB_FILE="smol_stub"
          elif [ "${{ matrix.os }}" = "windows" ]; then
            # Native build outputs to build/prod/${PLATFORM_ARCH}/out/Final/.
            STUB_DIR="packages/stubs-builder/build/prod/${PLATFORM_ARCH}/out/Final"
            STUB_FILE="smol_stub.exe"
          else
            STUB_DIR="packages/stubs-builder/build/prod/${PLATFORM_ARCH}/out/Final"
            STUB_FILE="smol_stub"
          fi

          # Create tarball (preserving just the binary name).
          OUTPUT_DIR="packages/stubs-builder"

          tar -czf "${OUTPUT_DIR}/${ARTIFACT_NAME}.tar.gz" -C "${STUB_DIR}" "$STUB_FILE"

          echo "Created artifact: ${ARTIFACT_NAME}.tar.gz"
          ls -lh "${OUTPUT_DIR}/${ARTIFACT_NAME}.tar.gz"

      - name: Set artifact name
        shell: bash
        run: |
          PLATFORM="${{ matrix.platform }}"
          ARCH="${{ matrix.arch }}"
          LIBC="${{ matrix.libc }}"

          # Transform win32 → win for consistency with other tools.
          if [ "$PLATFORM" = "win32" ]; then
            PLATFORM="win"
          fi

          ARTIFACT_NAME="smol-stub-${PLATFORM}-${ARCH}"
          if [ "${LIBC}" = "musl" ]; then
            ARTIFACT_NAME="${ARTIFACT_NAME}-musl"
          fi
          echo "ARTIFACT_NAME=${ARTIFACT_NAME}" >> $GITHUB_ENV

      - name: Upload artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: packages/stubs-builder/${{ env.ARTIFACT_NAME }}.tar.gz
          retention-days: 30

  release:
    name: Release stubs
    needs: build-stubs
    if: ${{ !inputs.dry_run }}
    environment: release
    permissions:
      contents: write # Required to create GitHub releases
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
            .github/scripts/generate-version.sh
          sparse-checkout-cone-mode: false

      - name: Download all artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: artifacts
          pattern: smol-stub-*
          merge-multiple: true

      - name: Verify downloaded artifacts
        shell: bash
        run: |
          echo "Checking for downloaded artifacts..."
          if [ -d "artifacts" ]; then
            echo "✅ Artifacts directory exists"
            echo "Contents:"
            ls -lah artifacts/
            if [ -n "$(ls -A artifacts/*.tar.gz 2>/dev/null)" ]; then
              echo "✅ Found $(ls artifacts/*.tar.gz 2>/dev/null | wc -l) tar.gz files"
            else
              echo "× No tar.gz files found in artifacts directory"
              exit 1
            fi
          else
            echo "× Artifacts directory does not exist"
            echo "This means no artifacts were uploaded by the build jobs."
            exit 1
          fi

      - name: Generate release tag
        id: tag
        shell: bash
        run: |
          source .github/scripts/generate-version.sh
          TAG="stubs-${VERSION}"
          echo "tag=${TAG}" >> $GITHUB_OUTPUT
          echo "Release tag: ${TAG}"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ steps.tag.outputs.tag }}
        shell: bash
        run: |
          # Move artifacts to release directory.
          mkdir -p release
          for file in artifacts/*.tar.gz; do
            if [ -f "$file" ]; then
              filename=$(basename "$file")
              mv "$file" "release/$filename"
              echo "Added to release: $filename"
            fi
          done

          # Verify we have artifacts to release.
          if [ -z "$(ls -A release/*.tar.gz 2>/dev/null)" ]; then
            echo "Error: No .tar.gz files found in release directory after moving from artifacts"
            exit 1
          fi

          echo "Found $(ls release/*.tar.gz | wc -l) archives to release"

          # Generate checksums.
          cd release
          if command -v shasum &> /dev/null; then
            shasum -a 256 *.tar.gz > checksums.txt
          elif command -v sha256sum &> /dev/null; then
            sha256sum *.tar.gz > checksums.txt
          else
            echo "Error: No SHA-256 command found"
            exit 1
          fi
          cat checksums.txt
          cd ..

          # Create release.
          TITLE_SUFFIX="${RELEASE_TAG#stubs-}"
          gh release create "${RELEASE_TAG}" \
            --title "stubs ${TITLE_SUFFIX}" \
            --notes "SMOL decompression stub binaries for all platforms.

          ## Platforms
          - darwin-arm64
          - darwin-x64
          - linux-arm64
          - linux-x64
          - linux-arm64-musl
          - linux-x64-musl
          - win-arm64
          - win-x64

          ## Files
          Each platform archive contains a small stub binary used by \`binpress\` to create self-extracting executables.
          - \`checksums.txt\` - SHA256 checksums

          ## Usage
          Download the appropriate stub for your platform and extract:
          \`\`\`bash
          tar -xzf smol-stub-<platform>-<arch>[-<libc>].tar.gz
          \`\`\`" \
            release/*.tar.gz \
            release/checksums.txt

  update-checksums:
    needs: release
    if: ${{ !inputs.dry_run }}
    permissions:
      contents: write
    uses: ./.github/workflows/update-checksums.yml
    secrets:
      BOT_GPG_PRIVATE_KEY: ${{ secrets.BOT_GPG_PRIVATE_KEY }}