build.yml

name: Build

on:
  push:
    branches: [ main, master, develop ]
  pull_request:
    branches: [ main, master, develop ]
  workflow_dispatch:

jobs:
  build:
    name: Build on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact_name: rohas-macos-arm64
          - os: macos-latest
            target: x86_64-apple-darwin
            artifact_name: rohas-macos-x86_64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact_name: rohas-windows-x86_64
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact_name: rohas-linux-x86_64
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            artifact_name: rohas-linux-arm64

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install cross-compilation dependencies (Linux ARM64)
        if: matrix.target == 'aarch64-unknown-linux-gnu' && matrix.os != 'ubuntu-24.04-arm'
        run: |
          sudo dpkg --add-architecture arm64
          sudo apt-get update
          sudo apt-get install -y \
            gcc-aarch64-linux-gnu \
            g++-aarch64-linux-gnu \
            libc6-dev-arm64-cross \
            pkg-config \
            cmake \
            python3.12-dev \
            libpython3.12-dev:arm64
          rustup target add aarch64-unknown-linux-gnu
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
          echo "CXX_aarch64-unknown-linux-gnu=aarch64-linux-gnu-g++" >> $GITHUB_ENV
          echo "PYO3_CROSS_PYTHON_VERSION=3.12" >> $GITHUB_ENV
          echo "PYO3_CROSS_LIB_DIR=/usr/lib/aarch64-linux-gnu" >> $GITHUB_ENV
          echo "PYO3_CROSS_INCLUDE_DIR=/usr/include/aarch64-linux-gnu/python3.12" >> $GITHUB_ENV

      - name: Install native ARM dependencies
        if: matrix.target == 'aarch64-unknown-linux-gnu' && matrix.os == 'ubuntu-24.04-arm'
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential pkg-config cmake python3.12-dev libpython3.12-dev

      - name: Install build dependencies (for vendored OpenSSL)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y make perl

      - name: Get Cargo lock hash
        id: cargo-lock
        shell: bash
        run: |
          if [ -f "Cargo.lock" ]; then
            # macOS uses shasum, Linux uses sha256sum, Windows bash has sha256sum
            if command -v shasum > /dev/null 2>&1; then
              echo "hash=$(shasum -a 256 Cargo.lock | cut -d' ' -f1)" >> $GITHUB_OUTPUT
            elif command -v sha256sum > /dev/null 2>&1; then
              echo "hash=$(sha256sum Cargo.lock | cut -d' ' -f1)" >> $GITHUB_OUTPUT
            else
              # Fallback: use git hash-object if available
              echo "hash=$(git hash-object Cargo.lock)" >> $GITHUB_OUTPUT
            fi
          else
            echo "hash=no-lock" >> $GITHUB_OUTPUT
          fi

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-${{ matrix.target }}-${{ steps.cargo-lock.outputs.hash }}
          restore-keys: |
            ${{ runner.os }}-cargo-${{ matrix.target }}-

      - name: Build
        env:
          OPENSSL_STATIC: 1
          OPENSSL_VENDORED: 1
        run: cargo build --release --target ${{ matrix.target }}

      - name: Import Apple Code Signing Certificate
        if: runner.os == 'macOS'
        uses: apple-actions/import-codesign-certs@v2
        with:
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      - name: Code Sign macOS Binary
        if: runner.os == 'macOS'
        shell: bash
        run: |
          BINARY="target/${{ matrix.target }}/release/rohas"
          if [ -f "$BINARY" ]; then
            SIGNING_IDENTITY="${{ secrets.APPLE_SIGNING_IDENTITY }}"
            if [ -z "$SIGNING_IDENTITY" ]; then
              echo "Warning: APPLE_SIGNING_IDENTITY not set, skipping code signing"
            else
              codesign --force --timestamp --options runtime --sign "$SIGNING_IDENTITY" "$BINARY"
              codesign --verify --verbose "$BINARY"
            fi
          else
            echo "Binary not found at $BINARY"
            exit 1
          fi

      - name: Prepare artifact (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $binary = "target\${{ matrix.target }}\release\rohas.exe"
          if (Test-Path $binary) {
            New-Item -ItemType Directory -Force -Path release | Out-Null
            Copy-Item $binary "release\rohas.exe"
            echo "ARTIFACT_PATH=release\rohas.exe" | Out-File -FilePath $env:GITHUB_ENV -Append
            echo "ARTIFACT_NAME=${{ matrix.artifact_name }}.exe" | Out-File -FilePath $env:GITHUB_ENV -Append
          } else {
            Write-Error "Binary not found at $binary"
            exit 1
          }

      - name: Prepare artifact (Unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          BINARY="target/${{ matrix.target }}/release/rohas"
          if [ -f "$BINARY" ]; then
            mkdir -p release
            cp "$BINARY" "release/rohas"
            echo "ARTIFACT_PATH=release/rohas" >> $GITHUB_ENV
            echo "ARTIFACT_NAME=${{ matrix.artifact_name }}" >> $GITHUB_ENV
          else
            echo "Binary not found!"
            exit 1
          fi

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact_name }}
          path: ${{ env.ARTIFACT_PATH }}
          retention-days: 7