canary.yml

name: Canary

on:
  push:
    branches:
      - main
    paths-ignore:
      - "docs/**"
      - "**/*.md"
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: canary
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    timeout-minutes: 40
    env:
      # Don't reference `secrets.*` in `if:` expressions; GitHub rejects that at workflow-parse time.
      MACOS_SIGN_P12_B64: ${{ secrets.MACOS_SIGN_P12_B64 }}
      MACOS_SIGN_P12_PASSWORD: ${{ secrets.MACOS_SIGN_P12_PASSWORD }}
      MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
    strategy:
      matrix:
        include:
          - target: x86_64-apple-darwin
            os: macos-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest

    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Validate readme casing
        run: scripts/ci/check-readme-case.sh

      - name: Cache vendored deps
        uses: actions/cache@v4
        with:
          path: |
            .vendor/flow-vendor
            lib/vendor
            lib/vendor-manifest
          key: ${{ runner.os }}-${{ runner.arch }}-vendor-${{ hashFiles('vendor.lock.toml') }}

      - name: Verify pinned vendor commit is published
        run: scripts/vendor/vendor-repo.sh verify-pinned-origin

      - name: Hydrate vendored deps
        run: scripts/vendor/vendor-repo.sh hydrate

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Cache Rust build
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: ". -> target"
          cache-on-failure: true

      - name: Install cross-compilation tools (Linux ARM)
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu

      - name: Build
        run: |
          if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
            export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc
          fi
          cargo build --release --target ${{ matrix.target }} --bin f

      - name: Import code-signing certificates (macOS)
        if: runner.os == 'macOS' && env.MACOS_SIGN_P12_B64 != ''
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ env.MACOS_SIGN_P12_B64 }}
          p12-password: ${{ env.MACOS_SIGN_P12_PASSWORD }}

      - name: Codesign (macOS)
        if: runner.os == 'macOS' && env.MACOS_SIGN_P12_B64 != '' && env.MACOS_SIGN_IDENTITY != ''
        run: |
          BIN="target/${{ matrix.target }}/release/f"
          codesign --force --options runtime --timestamp --sign "$MACOS_SIGN_IDENTITY" "$BIN"
          codesign -vvv --strict "$BIN"

      - name: Package
        run: |
          mkdir -p dist
          cp target/${{ matrix.target }}/release/f dist/
          cd dist
          tar -czvf flow-${{ matrix.target }}.tar.gz f
          cd ..

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: flow-${{ matrix.target }}
          path: dist/flow-${{ matrix.target }}.tar.gz

  build-linux-host-simd:
    timeout-minutes: 40
    runs-on: [self-hosted, linux, x64, ci-1focus]
    env:
      RUSTFLAGS: -C target-cpu=native
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Validate readme casing
        run: scripts/ci/check-readme-case.sh

      - name: Cache vendored deps
        uses: actions/cache@v4
        with:
          path: |
            .vendor/flow-vendor
            lib/vendor
            lib/vendor-manifest
          key: ${{ runner.os }}-${{ runner.arch }}-vendor-${{ hashFiles('vendor.lock.toml') }}

      - name: Verify pinned vendor commit is published
        run: scripts/vendor/vendor-repo.sh verify-pinned-origin

      - name: Hydrate vendored deps
        run: scripts/vendor/vendor-repo.sh hydrate

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu

      - name: Cache Rust build
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: ". -> target"
          cache-on-failure: true

      - name: Build (Linux host SIMD)
        run: cargo build --release --target x86_64-unknown-linux-gnu --features linux-host-simd-json --bin f

      - name: Package
        run: |
          mkdir -p dist
          cp target/x86_64-unknown-linux-gnu/release/f dist/
          cd dist
          tar -czvf flow-x86_64-unknown-linux-gnu-linux-host-simd.tar.gz f
          cd ..

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: flow-x86_64-unknown-linux-gnu-linux-host-simd
          path: dist/flow-x86_64-unknown-linux-gnu-linux-host-simd.tar.gz

  release:
    needs: [build, build-linux-host-simd]
    timeout-minutes: 20
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Prepare release files
        run: |
          mkdir -p release
          find artifacts -name "*.tar.gz" -exec cp {} release/ \;
          cd release
          sha256sum *.tar.gz > checksums.txt
          cat checksums.txt

      - name: Move canary tag to this commit
        run: |
          git tag -f canary "${GITHUB_SHA}"
          git push origin -f refs/tags/canary

      - name: Create/Update Canary Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: canary
          name: Canary
          prerelease: true
          generate_release_notes: false
          files: release/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}