CI.yml

name: CI

on:
  push:
    branches:
      - main
    paths-ignore:
      - '**/*.md'
      - LICENSE
      - '**/*.gitignore'
      - .editorconfig
  pull_request: null

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  test:
    name: Test
    runs-on: ${{ matrix.platform }}
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - '3.11'
          - '3.12'
          - '3.13'
          - '3.14'
        platform:
          - ubuntu-latest
          - windows-latest
          - macos-latest
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: false
      - name: Install maturin
        run: uv pip install maturin --system
      - uses: actions-rust-lang/setup-rust-toolchain@v1
      - name: Install
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - name: Install dependencies
        run: bun install
      - name: Build
        run: bun run build
      - name: Lint
        run: bun run lint
      - name: Test
        run: bun run test

  coverage-test:
    name: Coverage Test
    runs-on: ubuntu-latest
    permissions:
      contents: write
    container:
      image: xd009642/tarpaulin:develop-nightly
      options: --security-opt seccomp=unconfined
    steps:
      - uses: actions/checkout@v5
      - uses: actions-rust-lang/setup-rust-toolchain@v1
      - name: Install
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - name: Build
        run: cargo check
      - name: Lint
        run: cargo clippy --all-targets --all-features -- -D warnings
      - name: Test
        run: |
          # rust coverage issue
          echo 'max_width = 100000' > .rustfmt.toml
          echo 'tab_spaces = 4' >> .rustfmt.toml
          echo 'newline_style = "Unix"' >> .rustfmt.toml
          echo 'fn_call_width = 100000' >> .rustfmt.toml
          echo 'fn_params_layout = "Compressed"' >> .rustfmt.toml
          echo 'chain_width = 100000' >> .rustfmt.toml
          echo 'merge_derives = true' >> .rustfmt.toml
          echo 'use_small_heuristics = "Default"' >> .rustfmt.toml
          cargo fmt
          cargo tarpaulin --out Lcov Stdout --engine llvm
      - name: Upload to codecov.io
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          files: lcov.info
        if: github.ref == 'refs/heads/main'

  # publish
  changepacks:
    name: changepacks
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: write
    needs:
      - test
      - coverage-test
    steps:
      - uses: actions/checkout@v5
      - uses: changepacks/action@main
        id: changepacks
        with:
          publish: true
          publish_options: -l rust
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
    outputs:
      changepacks: ${{ steps.changepacks.outputs.changepacks }}
      release_assets_urls: ${{ steps.changepacks.outputs.release_assets_urls }}

  # node
  node-build:
    needs:
      - test
      - coverage-test
      - changepacks
    if: ${{ contains(needs.changepacks.outputs.changepacks, 'bridge/node/package.json') }}
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: macos-latest
            target: x86_64-apple-darwin
            build: bun run build --target x86_64-apple-darwin
          - host: windows-latest
            target: x86_64-pc-windows-msvc
            build: bun run build --target x86_64-pc-windows-msvc
          - host: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            build: bun run build --target x86_64-unknown-linux-gnu --use-napi-cross
          - host: macos-latest
            target: aarch64-apple-darwin
            build: bun run build --target aarch64-apple-darwin
    name: stable - ${{ matrix.settings.target }} - node@22
    runs-on: ${{ matrix.settings.host }}
    env:
      DEBUG: napi:*
      MACOSX_DEPLOYMENT_TARGET: '10.13'
      CARGO_INCREMENTAL: '1'
    steps:
      - uses: actions/checkout@v5
      - name: Setup node
        uses: actions/setup-node@v5
        with:
          node-version: 22
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - name: Install
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: ${{ matrix.settings.target }}
      - uses: mlugg/setup-zig@v2
        if: ${{ contains(matrix.settings.target, 'musl') }}
        with:
          version: 0.14.1
      - name: Install cargo-zigbuild
        uses: taiki-e/install-action@v2
        if: ${{ contains(matrix.settings.target, 'musl') }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          tool: cargo-zigbuild
      - name: Install dependencies
        run: bun install
      - name: Build
        run: ${{ matrix.settings.build }}
        shell: bash
        working-directory: bridge/node
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: bindings-${{ matrix.settings.target }}
          path: |
            bridge/node/dependency-check-updates.*.node
          if-no-files-found: error

  # python
  python-build:
    runs-on: ${{ matrix.runner }}
    if: ${{ contains(needs.changepacks.outputs.changepacks, 'bridge/python/pyproject.toml') }}
    needs:
      - test
      - coverage-test
      - changepacks
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux manylinux
          - runner: ubuntu-22.04
            target: x86_64
            manylinux: auto
            os: linux
          - runner: ubuntu-22.04
            target: x86
            manylinux: auto
            os: linux
          - runner: ubuntu-22.04
            target: aarch64
            manylinux: auto
            os: linux
          - runner: ubuntu-22.04
            target: armv7
            manylinux: auto
            os: linux
          - runner: ubuntu-22.04
            target: ppc64le
            manylinux: auto
            os: linux

          # Linux musllinux
          - runner: ubuntu-22.04
            target: x86_64
            manylinux: musllinux_1_2
            os: musllinux
          - runner: ubuntu-22.04
            target: x86
            manylinux: musllinux_1_2
            os: musllinux
          - runner: ubuntu-22.04
            target: aarch64
            manylinux: musllinux_1_2
            os: musllinux
          - runner: ubuntu-22.04
            target: armv7
            manylinux: musllinux_1_2
            os: musllinux

          # Windows
          - runner: windows-latest
            target: x64
            os: windows
          - runner: windows-latest
            target: x86
            os: windows

          # macOS
          - runner: macos-14
            target: x86_64
            os: macos
          - runner: macos-14
            target: aarch64
            os: macos
    steps:
      - uses: actions/checkout@v4
      - name: Build wheels
        uses: PyO3/maturin-action@main
        with:
          target: ${{ matrix.target }}
          args: --release --out dist
          working-directory: bridge/python
          manylinux: ${{ matrix.manylinux || '' }}
          before-script-linux: |
            # ring v0.17 requires __ARM_ARCH for ARM assembly;
            # older manylinux2014 cross-GCC does not define it.
            # These are target-specific, so harmless on non-ARM builds.
            export CFLAGS_aarch64_unknown_linux_gnu="${CFLAGS_aarch64_unknown_linux_gnu:-} -D__ARM_ARCH=8"
            export CFLAGS_armv7_unknown_linux_gnueabihf="${CFLAGS_armv7_unknown_linux_gnueabihf:-} -D__ARM_ARCH=7"
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-${{ matrix.os }}-${{ matrix.target }}
          path: bridge/python/dist

  node-publish:
    name: Node Publish
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    needs:
      - changepacks
      - node-build
    if: ${{ contains(needs.changepacks.outputs.changepacks, 'bridge/node/package.json') }}
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - name: Install dependencies
        run: bun install
      - name: Build
        run: bun run build
        working-directory: bridge/node
      - name: create npm dirs
        run: bunx napi create-npm-dirs
        working-directory: bridge/node
      - name: Download all artifacts
        uses: actions/download-artifact@v5
        with:
          path: bridge/node/artifacts
      - name: Move artifacts
        run: bun run artifacts
        working-directory: bridge/node
      - name: List packages
        run: ls -R ./npm
        working-directory: bridge/node
      - name: Publish
        run: |
          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
          npm publish --access public
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        working-directory: bridge/node
      - name: Upload Asset
        uses: owjs3901/upload-github-release-asset@main
        with:
          upload_url: ${{ fromJson(needs.changepacks.outputs.release_assets_urls)['bridge/node/package.json'] }}
          asset_path: bridge/node/npm/*/dependency-check-updates.*.node

  python-publish:
    name: Python Publish
    runs-on: ubuntu-latest
    if: ${{ contains(needs.changepacks.outputs.changepacks, 'bridge/python/pyproject.toml') }}
    needs:
      - changepacks
      - python-build
    permissions:
      id-token: write
      contents: write
      attestations: write
    steps:
      - uses: actions/download-artifact@v4
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: 'wheels-*/*'
      - name: Publish to PyPI
        uses: PyO3/maturin-action@main
        env:
          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        with:
          command: upload
          args: --non-interactive --skip-existing wheels-*/*
      - name: List wheels
        run: ls -R .
      - name: Upload Asset
        uses: owjs3901/upload-github-release-asset@main
        with:
          upload_url: ${{ fromJson(needs.changepacks.outputs.release_assets_urls)['bridge/python/pyproject.toml'] }}
          asset_path: '*/*.whl'

  upload-assets:
    needs: changepacks
    if: ${{ contains(needs.changepacks.outputs.changepacks, 'crates/cli/Cargo.toml') }}
    permissions:
      contents: write
      id-token: write
    name: Upload Assets for ${{ matrix.platform }}
    runs-on: ${{ matrix.platform }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: ubuntu-22.04
            os: linux
            target: x86_64-unknown-linux-gnu
            binary_name: dependency-check-updates-linux-x86_64
          - platform: windows-2022
            os: windows
            target: x86_64-pc-windows-msvc
            binary_name: dependency-check-updates-windows-x86_64.exe
          - platform: macos-14
            os: macos
            target: x86_64-apple-darwin
            binary_name: dependency-check-updates-darwin-x86_64
          - platform: macos-14
            os: macos
            target: aarch64-apple-darwin
            binary_name: dependency-check-updates-darwin-arm64
    steps:
      - uses: actions/checkout@v5
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable
          target: ${{ matrix.target }}
          components: clippy, rustfmt
      - name: Build Rust binary
        run: cargo build --release --target ${{ matrix.target }} -p dependency-check-updates
      - name: Rename binary
        run: mv target/${{ matrix.target }}/release/dependency-check-updates${{ matrix.os == 'windows' && '.exe' || '' }} ${{ matrix.binary_name }}
      - name: Upload Asset
        uses: owjs3901/upload-github-release-asset@main
        with:
          upload_url: ${{ fromJson(needs.changepacks.outputs.release_assets_urls)['crates/cli/Cargo.toml'] }}
          asset_path: ${{ matrix.binary_name }}