ci.yml

name: CI

on:
  push:
    branches: [main, "release/**"]
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  CI_MAIN_PUSH: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}

jobs:
  preflight:
    name: preflight
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: ./.github/actions/omnifs-just

      - uses: dtolnay/rust-toolchain@stable

      - name: Run preflight checks
        run: |
          set -euo pipefail
          just ci-preflight-fast
          just ci-preflight-policy

      - name: Check release metadata
        if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release/')
        run: |
          set -euo pipefail
          just release-check

  components:
    name: components
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-just

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-wasip2

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: components
          cache-on-failure: true

      - uses: taiki-e/install-action@v2
        with:
          tool: wasm-tools@1.246.2

      - name: Check, build, and validate WASM components
        run: just ci-wasm

      - name: Stage WASM components
        run: |
          set -euo pipefail
          mkdir -p dist-wasm
          cp target/wasm32-wasip2/release/*.wasm dist-wasm/
          test -n "$(find dist-wasm -maxdepth 1 -name 'omnifs_provider_*.wasm' -print -quit)"
          test -f dist-wasm/omnifs_tool_archive.wasm
          test -f dist-wasm/test_provider.wasm

      - name: Attest WASM components
        if: env.CI_MAIN_PUSH == 'true'
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: dist-wasm/*.wasm

      - name: Upload WASM components
        uses: actions/upload-artifact@v7
        with:
          name: omnifs-wasm
          path: dist-wasm/*.wasm
          retention-days: 90
          if-no-files-found: error

  host-build:
    name: host build
    runs-on: blacksmith-4vcpu-ubuntu-2404
    env:
      CARGO_INCREMENTAL: "0"
      CARGO_TARGET_DIR: ${{ github.workspace }}/target/host-build
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-just

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: host-build
          cache-on-failure: true

      - uses: taiki-e/install-action@v2
        with:
          tool: nextest@0.9.132

      - name: Lint and archive host tests
        run: just ci-host-build

      - name: Upload host test archive
        uses: actions/upload-artifact@v7
        with:
          name: host-tests
          path: dist/host-tests/*
          retention-days: 1
          if-no-files-found: error

  host-test:
    name: host test
    runs-on: blacksmith-4vcpu-ubuntu-2404
    needs: [components, host-build]
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-just

      - uses: dtolnay/rust-toolchain@stable

      - uses: taiki-e/install-action@v2
        with:
          tool: nextest@0.9.132

      - name: Download host test archive
        uses: actions/download-artifact@v8
        with:
          name: host-tests
          path: dist/host-tests

      - name: Prepare WASM sidecar directory
        run: rm -rf target/wasm32-wasip2/release

      - name: Download WASM sidecar inputs
        uses: actions/download-artifact@v8
        with:
          name: omnifs-wasm
          path: target/wasm32-wasip2/release

      - name: Cache wasmtime component compilations
        # Wasmtime's on-disk cache is internally content-addressed (WASM hash +
        # wasmtime version), so stale entries are harmless and won't be served
        # to mismatched callers. GitHub caches are immutable, so use a unique
        # write key but restore through a stable OS/arch namespace shared by
        # push and pull_request runs.
        uses: actions/cache@v5
        with:
          path: ~/.cache/wasmtime
          key: wasmtime-cache-${{ runner.os }}-${{ runner.arch }}-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
            wasmtime-cache-${{ runner.os }}-${{ runner.arch }}-
            wasmtime-cache-${{ runner.os }}-

      - name: Run host tests
        run: just ci-host-test

  cli-linux-x64:
    name: cli linux x64
    if: >-
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
        (github.event.pull_request.user.login == 'raulk' ||
         contains(github.event.pull_request.labels.*.name, 'ci-full')))
    runs-on: blacksmith-4vcpu-ubuntu-2404
    env:
      CARGO_INCREMENTAL: "0"
      CARGO_TARGET_DIR: ${{ github.workspace }}/target/cli-linux-x64
    permissions:
      contents: read
      packages: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-just

      - uses: ./.github/actions/omnifs-docker

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: cli-linux-x64
          cache-on-failure: true

      - uses: goto-bus-stop/setup-zig@v2
        with:
          version: 0.15.2

      - name: Build Linux x64 CLI
        id: build
        run: just ci-build-linux x86_64-unknown-linux-gnu.2.17

      - name: Package Linux x64 CLI
        run: just ci-package-cli linux-x64 "${{ steps.build.outputs.artifact }}"

      - name: Attest Linux x64 CLI archive
        if: env.CI_MAIN_PUSH == 'true'
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: dist/cli/linux-x64/omnifs-cli-linux-x64.tar.xz

      - name: Upload Linux x64 CLI archive
        uses: actions/upload-artifact@v7
        with:
          name: omnifs-cli-linux-x64
          path: dist/cli/linux-x64/omnifs-cli-linux-x64.tar.xz*
          retention-days: 90
          if-no-files-found: error

  cli-linux-arm64:
    name: cli linux arm64
    if: >-
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
        (github.event.pull_request.user.login == 'raulk' ||
         contains(github.event.pull_request.labels.*.name, 'ci-full')))
    runs-on: blacksmith-4vcpu-ubuntu-2404-arm
    env:
      CARGO_INCREMENTAL: "0"
      CARGO_TARGET_DIR: ${{ github.workspace }}/target/cli-linux-arm64
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-just

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: cli-linux-arm64
          cache-on-failure: true

      - uses: goto-bus-stop/setup-zig@v2
        with:
          version: 0.15.2

      - name: Build Linux arm64 CLI
        id: build
        run: just ci-build-linux aarch64-unknown-linux-gnu.2.17

      - name: Package Linux arm64 CLI
        run: just ci-package-cli linux-arm64 "${{ steps.build.outputs.artifact }}"

      - name: Attest Linux arm64 CLI archive
        if: env.CI_MAIN_PUSH == 'true'
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: dist/cli/linux-arm64/omnifs-cli-linux-arm64.tar.xz

      - name: Upload Linux arm64 CLI archive
        uses: actions/upload-artifact@v7
        with:
          name: omnifs-cli-linux-arm64
          path: dist/cli/linux-arm64/omnifs-cli-linux-arm64.tar.xz*
          retention-days: 90
          if-no-files-found: error

  cli-darwin:
    name: cli darwin
    if: >-
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
        (github.event.pull_request.user.login == 'raulk' ||
         contains(github.event.pull_request.labels.*.name, 'ci-full')))
    runs-on: blacksmith-4vcpu-ubuntu-2404
    env:
      CARGO_INCREMENTAL: "0"
      CARGO_TARGET_DIR: ${{ github.workspace }}/target/cli-darwin
    permissions:
      contents: read
      packages: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-just

      - uses: ./.github/actions/omnifs-docker

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: cli-darwin
          cache-on-failure: true
          cache-directories: .cache/darwin-rustup

      - name: Build Darwin CLI binaries
        id: build
        env:
          DARWIN_RUSTUP_HOME: ${{ github.workspace }}/.cache/darwin-rustup
        run: just ci-build-darwin

      - name: Package Darwin CLI archives
        run: |
          set -euo pipefail
          just ci-package-cli darwin-x64 "${{ steps.build.outputs.x64_artifact }}"
          just ci-package-cli darwin-arm64 "${{ steps.build.outputs.arm64_artifact }}"

      - name: Attest Darwin CLI archives
        if: env.CI_MAIN_PUSH == 'true'
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: dist/cli/*/omnifs-cli-*.tar.xz

      - name: Upload Darwin x64 CLI archive
        uses: actions/upload-artifact@v7
        with:
          name: omnifs-cli-darwin-x64
          path: dist/cli/darwin-x64/omnifs-cli-darwin-x64.tar.xz*
          retention-days: 90
          if-no-files-found: error

      - name: Upload Darwin arm64 CLI archive
        uses: actions/upload-artifact@v7
        with:
          name: omnifs-cli-darwin-arm64
          path: dist/cli/darwin-arm64/omnifs-cli-darwin-arm64.tar.xz*
          retention-days: 90
          if-no-files-found: error

  docker-amd64:
    name: docker amd64
    if: >-
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
        (github.event.pull_request.user.login == 'raulk' ||
         contains(github.event.pull_request.labels.*.name, 'ci-full')))
    runs-on: ubuntu-latest
    needs: [components, cli-linux-x64]
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-just

      - uses: ./.github/actions/omnifs-docker

      - name: Download WASM components
        uses: actions/download-artifact@v8
        with:
          name: omnifs-wasm
          path: dist-wasm

      - name: Download Linux x64 CLI archive
        uses: actions/download-artifact@v8
        with:
          name: omnifs-cli-linux-x64
          path: dist-cli

      - name: Extract Linux x64 CLI binary
        run: |
          set -euo pipefail
          mkdir -p dist-cli/bin
          tar -C dist-cli/bin -xJf dist-cli/omnifs-cli-linux-x64.tar.xz
          test -x dist-cli/bin/omnifs

      - name: Build and push amd64 Docker image
        id: docker
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:docker-amd64-${{ github.sha }}
          PLATFORM: linux/amd64
          PUSH: "true"
          OMNIFS_BINARY: ${{ github.workspace }}/dist-cli/bin/omnifs
          OMNIFS_WASM_DIR: ${{ github.workspace }}/dist-wasm
        run: just ci-build-runtime

      - name: Export amd64 image digest
        run: |
          set -euo pipefail
          digest="${{ steps.docker.outputs.digest }}"
          test -n "$digest"
          mkdir -p /tmp/digests
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload amd64 image digest
        uses: actions/upload-artifact@v7
        with:
          name: docker-digest-amd64
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # The arm64 Docker build and smoke run on an arm64 runner so the image is
  # assembled and smoked natively. amd64 uses ubuntu-latest for lower queue time.
  docker-arm64:
    name: docker arm64
    if: >-
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
        (github.event.pull_request.user.login == 'raulk' ||
         contains(github.event.pull_request.labels.*.name, 'ci-full')))
    runs-on: blacksmith-4vcpu-ubuntu-2404-arm
    needs: [components, cli-linux-arm64]
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-just

      - uses: ./.github/actions/omnifs-docker

      - name: Download WASM components
        uses: actions/download-artifact@v8
        with:
          name: omnifs-wasm
          path: dist-wasm

      - name: Download Linux arm64 CLI archive
        uses: actions/download-artifact@v8
        with:
          name: omnifs-cli-linux-arm64
          path: dist-cli

      - name: Extract Linux arm64 CLI binary
        run: |
          set -euo pipefail
          mkdir -p dist-cli/bin
          tar -C dist-cli/bin -xJf dist-cli/omnifs-cli-linux-arm64.tar.xz
          test -x dist-cli/bin/omnifs

      - name: Build and push arm64 Docker image
        id: docker
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:docker-arm64-${{ github.sha }}
          PLATFORM: linux/arm64
          PUSH: "true"
          OMNIFS_BINARY: ${{ github.workspace }}/dist-cli/bin/omnifs
          OMNIFS_WASM_DIR: ${{ github.workspace }}/dist-wasm
        run: just ci-build-runtime

      - name: Export arm64 image digest
        run: |
          set -euo pipefail
          digest="${{ steps.docker.outputs.digest }}"
          test -n "$digest"
          mkdir -p /tmp/digests
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload arm64 image digest
        uses: actions/upload-artifact@v7
        with:
          name: docker-digest-arm64
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  smoke-amd64:
    name: smoke amd64
    if: >-
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
        (github.event.pull_request.user.login == 'raulk' ||
         contains(github.event.pull_request.labels.*.name, 'ci-full')))
    runs-on: ubuntu-latest
    needs: docker-amd64
    timeout-minutes: 30
    permissions:
      contents: read
      packages: read
    env:
      CONTAINER: omnifs
      IMAGE: ghcr.io/${{ github.repository }}:smoke
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-just

      - uses: ./.github/actions/omnifs-docker

      - name: Download amd64 image digest
        uses: actions/download-artifact@v8
        with:
          name: docker-digest-amd64
          path: /tmp/digests

      - name: Pull the amd64 image and tag it for smoke
        run: |
          set -euo pipefail
          digest_path=$(find /tmp/digests -mindepth 1 -maxdepth 1 -type f | head -n 1)
          test -n "$digest_path"
          digest_file="${digest_path##*/}"
          ref="${REGISTRY}/${IMAGE_NAME}@sha256:${digest_file}"
          docker pull "$ref"
          docker tag "$ref" "$IMAGE"

      - name: Run container smoke test
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: just ci-smoke-container

  smoke-arm64:
    name: smoke arm64
    if: >-
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
        (github.event.pull_request.user.login == 'raulk' ||
         contains(github.event.pull_request.labels.*.name, 'ci-full')))
    runs-on: blacksmith-4vcpu-ubuntu-2404-arm
    needs: docker-arm64
    timeout-minutes: 30
    permissions:
      contents: read
      packages: read
    env:
      CONTAINER: omnifs
      IMAGE: ghcr.io/${{ github.repository }}:smoke
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-just

      - uses: ./.github/actions/omnifs-docker

      - name: Download arm64 image digest
        uses: actions/download-artifact@v8
        with:
          name: docker-digest-arm64
          path: /tmp/digests

      - name: Pull the arm64 image and tag it for smoke
        run: |
          set -euo pipefail
          digest_path=$(find /tmp/digests -mindepth 1 -maxdepth 1 -type f | head -n 1)
          test -n "$digest_path"
          digest_file="${digest_path##*/}"
          ref="${REGISTRY}/${IMAGE_NAME}@sha256:${digest_file}"
          docker pull "$ref"
          docker tag "$ref" "$IMAGE"

      - name: Run container smoke test
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: just ci-smoke-container

  publish:
    name: publish
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs:
      - preflight
      - components
      - host-build
      - host-test
      - cli-linux-x64
      - cli-linux-arm64
      - cli-darwin
      - docker-amd64
      - docker-arm64
      - smoke-amd64
      - smoke-arm64
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/omnifs-docker

      - name: Download image digests
        uses: actions/download-artifact@v8
        with:
          pattern: docker-digest-*
          path: /tmp/digests
          merge-multiple: true

      - name: Publish multi-platform manifest
        run: |
          set -euo pipefail
          refs=()
          for digest_file in /tmp/digests/*; do
            digest="${digest_file##*/}"
            refs+=("${REGISTRY}/${IMAGE_NAME}@sha256:${digest}")
          done
          test "${#refs[@]}" -ge 2
          tag="${REGISTRY}/${IMAGE_NAME}:sha-${GITHUB_SHA}"
          docker buildx imagetools create -t "$tag" "${refs[@]}"
          docker buildx imagetools inspect "$tag" > manifest.txt
          grep -q 'Platform:.*linux/amd64' manifest.txt
          grep -q 'Platform:.*linux/arm64' manifest.txt
          awk '/^Digest:/ { print $2; exit }' manifest.txt > manifest-digest.txt

      - name: Upload manifest digest
        uses: actions/upload-artifact@v7
        with:
          name: docker-manifest-digest
          path: |
            manifest.txt
            manifest-digest.txt
          retention-days: 90
          if-no-files-found: error