rust-cli.yml

name: Rust CLI Build

on:
  workflow_call:
  push:
    branches: [ main, feat/rust-cli ]
    paths:
      - 'crates/**'
      - 'Cargo.toml'
      - '.github/workflows/rust-cli.yml'
    tags:
      - 'cli@*'
  pull_request:
    branches: [ main ]
    paths:
      - 'crates/**'
      - 'Cargo.toml'
      - '.github/workflows/rust-cli.yml'

permissions:
  contents: read

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            target: x86_64-unknown-linux-musl
            artifact_name: ov-linux-x86_64
            npm_pkg: cli-linux-x64
            npm_os: linux
            npm_cpu: x64
          - os: ubuntu-24.04
            target: aarch64-unknown-linux-musl
            artifact_name: ov-linux-aarch64
            npm_pkg: cli-linux-arm64
            npm_os: linux
            npm_cpu: arm64
          - os: macos-15-intel
            target: x86_64-apple-darwin
            artifact_name: ov-macos-x86_64
            npm_pkg: cli-darwin-x64
            npm_os: darwin
            npm_cpu: x64
          - os: macos-14
            target: aarch64-apple-darwin
            artifact_name: ov-macos-aarch64
            npm_pkg: cli-darwin-arm64
            npm_os: darwin
            npm_cpu: arm64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact_name: ov-windows-x86_64.exe
            npm_pkg: cli-win32-x64
            npm_os: win32
            npm_cpu: x64

    steps:
    - uses: actions/checkout@v6

    - name: Install Rust
      uses: dtolnay/rust-toolchain@v1
      with:
        toolchain: stable
        targets: ${{ matrix.target }}

    # Linux artifacts are produced as fully static musl binaries so they run on
    # any glibc-flavored distro (CentOS 7/8/Stream 9, RHEL 8/9, Amazon Linux,
    # Alpine, etc.) — the ubuntu-24.04 runner's glibc 2.39 is newer than
    # CentOS 7 (2.17) / RHEL 8 (2.28) / RHEL 9 (2.34), so a gnu-linked binary
    # fails with `version 'GLIBC_2.X' not found`. cargo-zigbuild + zig handle
    # both x86_64 and aarch64 musl cross-compilation with one toolchain;
    # ov_cli uses reqwest+rustls-tls so libssl-dev is no longer needed.
    # Zig is installed via shell to avoid depending on a third-party action
    # not on the org's allowed-actions list.
    - name: Install Zig + cargo-zigbuild (Linux musl cross-build)
      if: runner.os == 'Linux'
      shell: bash
      run: |
        set -euo pipefail
        ZIG_VERSION=0.13.0
        ZIG_DIR="$RUNNER_TEMP/zig-$ZIG_VERSION"
        mkdir -p "$ZIG_DIR"
        curl -fsSL "https://ziglang.org/download/$ZIG_VERSION/zig-linux-x86_64-$ZIG_VERSION.tar.xz" \
          | tar -xJ --strip-components=1 -C "$ZIG_DIR"
        echo "$ZIG_DIR" >> "$GITHUB_PATH"
        cargo install --locked cargo-zigbuild

    - name: Cache Cargo registry and index
      uses: actions/cache@v5
      with:
        path: |
          ~/.cargo/registry/index
          ~/.cargo/registry/cache
          ~/.cargo/git/db
        key: ${{ runner.os }}-cargo-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
        restore-keys: |
          ${{ runner.os }}-cargo-${{ matrix.target }}-
          ${{ runner.os }}-cargo-

    - name: Cache build artifacts
      uses: actions/cache@v5
      with:
        path: target
        key: ${{ runner.os }}-target-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}-${{ hashFiles('crates/**/*.rs') }}
        restore-keys: |
          ${{ runner.os }}-target-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}-
          ${{ runner.os }}-target-${{ matrix.target }}-

    - name: Inject version from tag
      shell: bash
      run: |
        VERSION="${GITHUB_REF#refs/tags/cli@}"
        if [[ "$VERSION" != "$GITHUB_REF" ]]; then
          sed -i.bak "s/^version = \"0.0.0\"/version = \"$VERSION\"/" crates/ov_cli/Cargo.toml
          rm -f crates/ov_cli/Cargo.toml.bak
          echo "Injected version $VERSION into Cargo.toml"
        fi

    - name: Build CLI
      shell: bash
      run: |
        if [[ "${{ runner.os }}" == "Linux" ]]; then
          cargo zigbuild --release --target ${{ matrix.target }} -p ov_cli
        else
          cargo build --release --target ${{ matrix.target }} -p ov_cli
        fi

    - name: Package platform npm package
      shell: bash
      run: |
        VERSION="${GITHUB_REF#refs/tags/cli@}"
        # For non-tag builds, use 0.0.0-dev
        if [[ "$VERSION" == "$GITHUB_REF" ]]; then
          VERSION="0.0.0-dev"
        fi

        PKG_DIR="npm-pkg"
        mkdir -p "$PKG_DIR/bin"

        if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
          cp "target/${{ matrix.target }}/release/ov.exe" "$PKG_DIR/bin/ov.exe"
        else
          cp "target/${{ matrix.target }}/release/ov" "$PKG_DIR/bin/ov"
          chmod +x "$PKG_DIR/bin/ov"
        fi

        node -e "
          const pkg = {
            name: '@openviking/${{ matrix.npm_pkg }}',
            version: '$VERSION',
            description: 'OpenViking CLI native binary for ${{ matrix.npm_os }}-${{ matrix.npm_cpu }}',
            os: ['${{ matrix.npm_os }}'],
            cpu: ['${{ matrix.npm_cpu }}'],
            files: ['bin'],
            license: 'Apache-2.0',
            repository: { type: 'git', url: 'git+https://github.com/volcengine/openviking.git' },
            publishConfig: { access: 'public' }
          };
          require('fs').writeFileSync('$PKG_DIR/package.json', JSON.stringify(pkg, null, 2) + '\n');
        "

    - name: Upload npm package artifact
      uses: actions/upload-artifact@v7
      with:
        name: ${{ matrix.npm_pkg }}
        path: npm-pkg/

  npm-publish:
    name: Publish to npm
    runs-on: ubuntu-24.04
    needs: build
    if: startsWith(github.ref, 'refs/tags/cli@')
    permissions:
      contents: read
      actions: read
      id-token: write
    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Setup Node.js
      uses: actions/setup-node@v6
      with:
        node-version: '24'
        registry-url: 'https://registry.npmjs.org'

    - name: Get version from tag
      id: get_version
      run: echo "version=${GITHUB_REF#refs/tags/cli@}" >> $GITHUB_OUTPUT

    - name: Download all platform artifacts
      uses: actions/download-artifact@v8
      with:
        path: artifacts

    - name: Display artifact structure
      run: ls -R artifacts/

    - name: Publish platform packages
      run: |
        VERSION="${{ steps.get_version.outputs.version }}"
        for pkg_dir in artifacts/cli-*/; do
          pkg_name=$(basename "$pkg_dir")
          package="@openviking/$pkg_name"
          if npm view "$package@$VERSION" version --registry=https://registry.npmjs.org >/dev/null 2>&1; then
            echo "Skipping $package@$VERSION; already published."
            continue
          fi

          echo "Publishing $package@$VERSION..."
          chmod +x "$pkg_dir/bin/ov" 2>/dev/null || true
          cd "$pkg_dir"
          npm publish --access public
          cd "$GITHUB_WORKSPACE"
        done

    - name: Publish wrapper package
      run: |
        VERSION="${{ steps.get_version.outputs.version }}"
        cd npm/cli

        # Inject version into package.json
        node -e "
          const pkg = JSON.parse(require('fs').readFileSync('package.json', 'utf8'));
          pkg.version = '$VERSION';
          for (const dep of Object.keys(pkg.optionalDependencies || {})) {
            pkg.optionalDependencies[dep] = '$VERSION';
          }
          require('fs').writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
        "

        if npm view "@openviking/cli@$VERSION" version --registry=https://registry.npmjs.org >/dev/null 2>&1; then
          echo "Skipping @openviking/cli@$VERSION; already published."
          exit 0
        fi

        echo "Publishing @openviking/cli@$VERSION..."
        npm publish --access public