embedding_build_template.yml

name: Embeddings Build Template

on:
  workflow_call:
    inputs:
      distr:
        required: true
        type: string
      arch:
        required: true
        type: string
      setup:
        required: false
        type: string
        default: ""

jobs:
  # Quality check job - runs tests and clippy before build
  quality-check:
    runs-on: ubuntu-24.04
    defaults:
      run:
        shell: bash
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - name: Setup Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
          components: clippy, rustfmt
          override: true

      - name: Install protoc
        uses: arduino/setup-protoc@v3
        with:
          version: '29.3'
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: cargo-registry-${{ runner.os }}-${{ hashFiles('embeddings/Cargo.lock') }}
          restore-keys: cargo-registry-${{ runner.os }}-

      - name: Cache cargo build target
        uses: actions/cache@v4
        with:
          path: ./embeddings/target
          key: cargo-target-${{ runner.os }}-${{ hashFiles('embeddings/Cargo.lock') }}-${{ hashFiles('embeddings/src/**/*.rs') }}
          restore-keys: |
            cargo-target-${{ runner.os }}-${{ hashFiles('embeddings/Cargo.lock') }}-
            cargo-target-${{ runner.os }}-

      - name: Cache ML test models
        uses: actions/cache@v4
        with:
          path: ./embeddings/.cache/manticore
          key: ml-models-${{ runner.os }}-${{ hashFiles('embeddings/src/model/local_test.rs') }}
          restore-keys: ml-models-${{ runner.os }}-

      - name: Run Clippy (strict mode)
        run: cargo clippy --lib --manifest-path ./embeddings/Cargo.toml -- -D warnings

      - name: Check code formatting
        run: cargo fmt --check --manifest-path ./embeddings/Cargo.toml

      - name: Run unit tests
        run: cargo test --lib --verbose --manifest-path ./embeddings/Cargo.toml
        env:
          RUST_BACKTRACE: 1

      - name: Run OpenAI integration tests (if API key available)
        run: |
          cd ./embeddings
          if [ -n "${{ secrets.OPENAI_API_KEY }}" ]; then
            echo "✅ Running OpenAI integration tests..."
            cargo test --lib openai_test::tests --verbose
          else
            echo "⏭️  Skipping OpenAI tests - OPENAI_API_KEY not configured"
          fi

          if [ -n "${{ secrets.VOYAGE_API_KEY }}" ]; then
            echo "✅ Running Voyager integration tests..."
            cargo test --lib voyager_test::tests --verbose
          else
            echo "⏭️  Skipping Voyager tests - VOYAGE_API_KEY not configured"
          fi

          if [ -n "${{ secrets.JINA_API_KEY }}" ]; then
            echo "✅ Running Jina integration tests..."
            cargo test --lib jina_test::tests --verbose
          else
            echo "⏭️  Skipping Jina tests - JINA_API_KEY not configured"
          fi
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          VOYAGE_API_KEY: ${{ secrets.VOYAGE_API_KEY }}
          JINA_API_KEY: ${{ secrets.JINA_API_KEY }}
          RUST_BACKTRACE: 1

      - name: Clean build target bloat
        if: always()
        run: |
          rm -rf ./embeddings/target/debug/incremental
          rm -rf ./embeddings/target/debug/.fingerprint
          find ./embeddings/target/debug -name "*.d" -delete 2>/dev/null || true

      - name: Quality check summary
        run: |
          echo "✅ Quality Check Summary:"
          echo "- Clippy: Passed (zero warnings enforced)"
          echo "- Format: Checked and compliant"
          echo "- Tests: All unit tests passed"
          echo "- OpenAI: $([ -n "${{ secrets.OPENAI_API_KEY }}" ] && echo "Integration tested" || echo "Skipped (no API key)")"
          echo "- Voyage: $([ -n "${{ secrets.VOYAGE_API_KEY }}" ] && echo "Integration tested" || echo "Skipped (no API key)")"
          echo "- Jina: $([ -n "${{ secrets.JINA_API_KEY }}" ] && echo "Integration tested" || echo "Skipped (no API key)")"

  build:
    needs: quality-check  # Only run build after quality check passes
    runs-on: ${{ 
      (inputs.distr == 'linux' && inputs.arch == 'aarch64' && 'ubuntu-24.04-arm') ||
      (inputs.distr == 'linux' && 'ubuntu-24.04') ||
      (inputs.distr == 'macos' && 'macos-14') ||
      (inputs.distr == 'windows' && 'windows-2022') ||
      'ubuntu-24.04' }}
    defaults:
      run:
        shell: bash
    timeout-minutes: 30
    steps:
      - name: Setup
        if: ${{ inputs.setup }}
        run: |
          ${{ inputs.setup }}

      - name: Check distribution type
        id: vars
        run: |
          case ${{ inputs.distr }} in
            linux)
              target="unknown-linux-gnu"
              ;;
            macos)
              target="apple-darwin"
              ;;
            windows)
              target="pc-windows-msvc"
              ;;
            *)
              echo "Unsupported distribution type: ${{ inputs.distr }}"
              exit 1
              ;;
          esac
          target="${{ inputs.arch }}-${target}"
          echo "target=${target}" >> $GITHUB_OUTPUT

          lib_dir="./embeddings/target/${target}/release"
          echo "lib_dir=${lib_dir}" >> $GITHUB_OUTPUT

      - uses: actions/checkout@v4

      - name: Setup Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
          target: ${{ steps.vars.outputs.target }}
          override: true

      - name: Install protoc
        if: ${{ inputs.distr != 'linux' }}
        uses: arduino/setup-protoc@v3
        with:
          version: '29.3'
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract git metadata
        id: git_meta
        run: |
          git config --global --add safe.directory "$(pwd)"

          commit="$(git log -1 --format=%h)"
          timestamp="$(git log -1 --date=format-local:%y%m%d%H --format=%cd)"

          if [[ -z "${commit}" || -z "${timestamp}" ]]; then
            echo "Failed to extract git metadata for embeddings versioning"
            exit 1
          fi

          echo "commit=${commit}" >> "$GITHUB_OUTPUT"
          echo "timestamp=${timestamp}" >> "$GITHUB_OUTPUT"

      - name: Prepare build args
        id: params
        run: |
          # Enable platform-specific BLAS acceleration:
          # - macOS: Apple Accelerate framework (always available)
          # - Linux/Windows x86_64: Intel MKL (downloaded at build time)
          # - Linux aarch64: no extra BLAS (gemm crate uses NEON via runtime detection)
          features=""
          if [[ "${{ inputs.distr }}" == "macos" ]]; then
            features="--features accelerate"
          elif [[ "${{ inputs.arch }}" == "x86_64" ]]; then
            features="--features mkl"
          fi

          args=(
            "--target"
            "${{ steps.vars.outputs.target }}"
            "--lib"
            "--release"
            "--manifest-path"
            "./embeddings/Cargo.toml"
            ${features}
          )
          echo "args=${args[@]}" >> $GITHUB_OUTPUT

      - name: Cache cargo registry for Docker build
        if: ${{ inputs.distr == 'linux' }}
        uses: actions/cache@v4
        with:
          path: |
            .cargo-cache/registry
            .cargo-cache/git
          key: emb-build-cargo-${{ runner.os }}-${{ inputs.arch }}-${{ hashFiles('embeddings/Cargo.lock') }}
          restore-keys: emb-build-cargo-${{ runner.os }}-${{ inputs.arch }}-

      - name: Build for Linux
        if: ${{ inputs.distr == 'linux' }}
        run: |
          # Set Docker image based on architecture
          # Download glibc2_17-compatible ORT static lib (avoids __isoc23_strtoll from pyke.io builds)
          ORT_VERSION="1.24.2"
          if [[ "${{ inputs.arch }}" == "aarch64" ]]; then
            docker_image="ghcr.io/manticoresoftware/rust-min-libc:aarch64-rust1.94.1-glibc2.27-openssl1.1.1k"
            ort_asset="onnxruntime-linux-aarch64-static_lib-${ORT_VERSION}-glibc2_17"
          else
            docker_image="ghcr.io/manticoresoftware/rust-min-libc:amd64-rust1.94.1-glibc2.27-openssl1.1.1k"
            ort_asset="onnxruntime-linux-x64-static_lib-${ORT_VERSION}-glibc2_17"
          fi

          curl -sL "https://github.com/csukuangfj/onnxruntime-libs/releases/download/v${ORT_VERSION}/${ort_asset}.zip" -o /tmp/ort.zip
          unzip -q /tmp/ort.zip -d /tmp/ort

          docker run --rm  \
            -v $(pwd):/src \
            -v $(pwd)/.cargo-cache:/cargo-cache \
            -v /tmp/ort/${ort_asset}/lib:/ort-lib \
            -w /src \
            -u root \
            -e CARGO_HOME=/cargo-cache \
            -e ORT_LIB_PATH=/ort-lib \
            -e MKLROOT=/opt/intel/oneapi/mkl/latest \
            -e GIT_COMMIT_ID="${{ steps.git_meta.outputs.commit }}" \
            -e GIT_TIMESTAMP_ID="${{ steps.git_meta.outputs.timestamp }}" \
            --entrypoint bash \
            "${docker_image}" \
            -c "cargo build ${{ steps.params.outputs.args }}"
          sudo chown -hR $(id -u):$(id -g) ${{ steps.vars.outputs.lib_dir }}
          sudo chown -hR $(id -u):$(id -g) .cargo-cache


      - name: Download ONNX Runtime static library
        if: ${{ inputs.distr == 'macos' || inputs.distr == 'windows' }}
        shell: bash
        run: |
          ort_version="1.24.2"
          if [[ "${{ inputs.distr }}" == "macos" ]]; then
            if [[ "${{ inputs.arch }}" == "aarch64" ]]; then
              ort_name="onnxruntime-osx-arm64-static_lib-${ort_version}"
            else
              ort_name="onnxruntime-osx-x86_64-static_lib-${ort_version}"
            fi
            curl -sL "https://github.com/csukuangfj/onnxruntime-libs/releases/download/v${ort_version}/${ort_name}.zip" -o /tmp/ort.zip
            unzip -q /tmp/ort.zip -d /tmp/ort
            echo "ORT_LIB_LOCATION=/tmp/ort/${ort_name}/lib" >> $GITHUB_ENV
          else
            if [[ "${{ inputs.arch }}" == "aarch64" ]]; then
              ort_name="onnxruntime-win-arm64-static_lib-MD-Release-${ort_version}"
            else
              ort_name="onnxruntime-win-x64-static_lib-MD-Release-${ort_version}"
            fi
            curl -sL "https://github.com/csukuangfj/onnxruntime-libs/releases/download/v${ort_version}/${ort_name}.tar.bz2" -o ort.tar.bz2
            mkdir -p ort-lib
            tar xjf ort.tar.bz2 -C ort-lib
            echo "ORT_LIB_LOCATION=${{ github.workspace }}/ort-lib/${ort_name}/lib" >> $GITHUB_ENV
          fi

      - name: Build native
        if: ${{ inputs.distr == 'windows' || inputs.distr == 'macos' }}
        run: |
          rustup target add ${{ steps.vars.outputs.target }}
          cargo build ${{ steps.params.outputs.args }}
        env:
          GIT_COMMIT_ID: ${{ steps.git_meta.outputs.commit }}
          GIT_TIMESTAMP_ID: ${{ steps.git_meta.outputs.timestamp }}

      - run: | 
          mkdir build
          lib_dir="${{ steps.vars.outputs.lib_dir }}"
          ls -la $lib_dir/*
          find $lib_dir -type f \( -name "libmanticore*.so" -o -name "libmanticore*.dylib" -o -name "manticore*.dll" \) -exec cp {} build/ \;

          # Rename libmanticore*.so to lib_manticore*.so
          for file in build/libmanticore*.so; do
            if [ -f "$file" ]; then
              base=$(basename "$file")
              newbase=$(echo "$base" | sed 's/^libmanticore/lib_manticore/')
              mv "$file" "build/$newbase"
              echo "Renamed $file to build/$newbase"
            fi
          done

          # Rename libmanticore*.dylib to lib_manticore*.dylib
          for file in build/libmanticore*.dylib; do
              if [ -f "$file" ]; then
                  base=$(basename "$file")
                  newbase=$(echo "$base" | sed 's/^libmanticore/lib_manticore/')
                  mv "$file" "build/$newbase"
                  echo "Renamed $file to build/$newbase"
              fi
          done

          # Rename manticore*.dll to lib_manticore*.dll
          for file in build/manticore*.dll; do
              if [ -f "$file" ]; then
                  base=$(basename "$file")
                  newbase="lib_$base"
                  mv "$file" "build/$newbase"
                  echo "Renamed $file to build/$newbase"
              fi
          done

          if [[ "${{ inputs.distr }}" == "windows" && "${{ inputs.arch }}" != "aarch64" ]]; then
            echo "=== Package Windows runtime DLL dependencies ==="
            openmp_redist_version="2025.3.3.31"
            openmp_redist_dir=".openmp-redist"
            for dll in libiomp5md.dll; do
              dep=$(find ./embeddings/target "$HOME/.cargo" -type f -iname "$dll" 2>/dev/null | head -1)
              if [[ -z "$dep" ]]; then
                echo "$dll was not found in the Cargo build tree; downloading Intel OpenMP redist ${openmp_redist_version}"
                rm -rf "$openmp_redist_dir"
                mkdir -p "$openmp_redist_dir/pkg"
                curl -fsSL \
                  "https://api.nuget.org/v3-flatcontainer/intelopenmp.redist.win/${openmp_redist_version}/intelopenmp.redist.win.${openmp_redist_version}.nupkg" \
                  -o "$openmp_redist_dir/intelopenmp.redist.win.zip"
                powershell -NoProfile -NonInteractive -Command \
                  "Expand-Archive -LiteralPath '$(cygpath -w "$openmp_redist_dir/intelopenmp.redist.win.zip")' -DestinationPath '$(cygpath -w "$openmp_redist_dir/pkg")' -Force"
                dep=$(find "$openmp_redist_dir/pkg" -type f -iname "$dll" | head -1)
              fi

              if [[ -z "$dep" ]]; then
                echo "Required Windows runtime dependency was not found after redist download: $dll"
                find ./embeddings/target "$HOME/.cargo" "$openmp_redist_dir" -type f -iname "*.dll" 2>/dev/null | sort || true
                exit 1
              fi

              cp "$dep" build/
              echo "Packaged $dll from $dep"
            done
          elif [[ "${{ inputs.distr }}" == "windows" ]]; then
            echo "Skipping Intel OpenMP runtime packaging for Windows ${{ inputs.arch }}; Intel OpenMP redist currently ships win-x64 DLLs only"
          fi

      - name: Verify Linux library compatibility
        if: ${{ inputs.distr == 'linux' }}
        run: |
          lib=$(find build -name "lib_manticore_knn_embeddings.so" | head -1)
          if [ -z "$lib" ]; then
            echo "Embeddings library not found in build/, skipping check"
            exit 0
          fi

          echo "=== Checking $lib ==="
          failed=0

          # Check GLIBC — must not exceed 2.27
          max_glibc=$(objdump -T "$lib" | grep -oE 'GLIBC_[0-9.]+' | sort -u -t. -k1,1 -k2,2n | tail -1)
          echo "Max GLIBC: $max_glibc"
          glibc_minor=$(echo "$max_glibc" | grep -oE '[0-9]+$')
          if [ -n "$glibc_minor" ] && [ "$glibc_minor" -gt 27 ]; then
            echo "FAIL: GLIBC requirement $max_glibc exceeds 2.27"
            failed=1
          fi

          # Check GLIBCXX — must have none (libstdc++ should be static)
          glibcxx=$(objdump -T "$lib" | grep -c 'GLIBCXX' || true)
          echo "GLIBCXX dynamic symbols: $glibcxx"
          if [ "$glibcxx" -gt 0 ]; then
            echo "FAIL: Found GLIBCXX dynamic symbols — libstdc++ not statically linked"
            objdump -T "$lib" | grep 'GLIBCXX' | head -5
            failed=1
          fi

          # Check __isoc23 — must have none
          isoc23=$(nm -D "$lib" 2>/dev/null | grep -c '__isoc23' || true)
          echo "__isoc23 symbols: $isoc23"
          if [ "$isoc23" -gt 0 ]; then
            echo "FAIL: Found __isoc23 symbols — ORT prebuilt has wrong glibc target"
            failed=1
          fi

          if [ "$failed" -eq 1 ]; then
            echo ""
            echo "Library compatibility check FAILED"
            exit 1
          fi
          echo "All checks passed"

      - name: Verify Windows embeddings DLL loading
        if: ${{ inputs.distr == 'windows' }}
        shell: powershell
        run: |
          $ErrorActionPreference = "Stop"
          $dll = "build\lib_manticore_knn_embeddings.dll"

          if (-not (Test-Path $dll)) {
            throw "Embeddings DLL was not found at $dll"
          }

          if ("${{ inputs.arch }}" -ne "aarch64" -and -not (Test-Path "build\libiomp5md.dll")) {
            throw "Required runtime DLL was not packaged: build\libiomp5md.dll"
          }

          Write-Host "=== Packaged embeddings files ==="
          Get-ChildItem -Force build | Format-List Name,Length,FullName

          Write-Host "=== dumpbin /dependents ==="
          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
          $vsInstall = $null
          if (Test-Path $vswhere) {
            $vsInstall = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
          }
          if (-not $vsInstall) {
            throw "Visual Studio installation was not found by vswhere"
          }

          $vcvars = Join-Path $vsInstall "VC\Auxiliary\Build\vcvars64.bat"
          if (-not (Test-Path $vcvars)) {
            throw "vcvars64.bat was not found at $vcvars"
          }

          cmd /c "`"$vcvars`" >nul && dumpbin /dependents `"$dll`""
          if ($LASTEXITCODE -ne 0) {
            throw "dumpbin /dependents failed"
          }

          cmd /c "`"$vcvars`" >nul && dumpbin /exports `"$dll`" | findstr GetLibFuncs"
          if ($LASTEXITCODE -ne 0) {
            throw "GetLibFuncs export was not found"
          }

          if ("${{ inputs.arch }}" -eq "aarch64") {
            Write-Host "Skipping direct LoadLibraryW probe for Windows aarch64; GitHub runner is x64 and cannot load an ARM64 DLL"
            exit 0
          }

          Write-Host "=== Direct LoadLibraryW probe ==="
          $buildDir = (Resolve-Path "build").Path
          $env:PATH = "$buildDir;$env:PATH"

          Add-Type -TypeDefinition @'
          using System;
          using System.Runtime.InteropServices;

          public static class NativeDllProbe
          {
              [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
              public static extern IntPtr LoadLibraryW(string lpFileName);
          }
          '@

          $fullDll = (Resolve-Path $dll).Path
          $handle = [NativeDllProbe]::LoadLibraryW($fullDll)
          if ($handle -eq [IntPtr]::Zero) {
            $code = [Runtime.InteropServices.Marshal]::GetLastWin32Error()
            $message = (New-Object ComponentModel.Win32Exception($code)).Message
            throw "LoadLibraryW($fullDll) failed: $code $message"
          }

          Write-Host "LoadLibraryW($fullDll) succeeded: $handle"

      - name: Install current Bash on macOS
        if: inputs.distr == 'macos'
        run: brew install bash

      - name: Upload build artifacts
        if: success()
        uses: manticoresoftware/upload_artifact_with_retries@v4
        with:
          name: embeddings_${{ inputs.distr }}_${{ inputs.arch }}
          path: ./build/*