ci.yaml

name: Continuous Integration
on:
  pull_request:
  merge_group:
    types: [checks_requested]
  push:
    branches:
      - main

permissions:
  contents: read
  actions: write

jobs:
  validate-server-version:
    name: Validate Server Version
    if: github.event_name == 'push' || github.event_name == 'merge_group' || github.base_ref == 'main'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Validate server dependency version
        run: go run ./internal/cmd/validate-server-version
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-test:
    strategy:
      fail-fast: false
      matrix:
        os:
          [
            ubuntu-latest,
            macos-latest,
            macos-15-intel,
            windows-latest,
            ubuntu-arm,
          ]
        include:
          - os: ubuntu-latest
            checkGenCommands: true
            cloudTestTarget: true
          - os: ubuntu-arm
            runsOn: ubuntu-24.04-arm
    runs-on: ${{ matrix.runsOn || matrix.os }}
    env:
      # We can't check this directly in the cloud test's `if:` condition below,
      # so we have to check it here and report it in an env variable.
      HAS_SECRETS: ${{ secrets.TEMPORAL_CLIENT_CERT != '' && secrets.TEMPORAL_CLIENT_KEY != '' }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Install gotestsum
        run: go install gotest.tools/gotestsum@latest

      - name: Create junit-xml directory
        run: mkdir junit-xml

      - name: Test
        run: gotestsum --junitfile junit-xml/${{matrix.os}}.xml -- ./...

      - name: Upload junit-xml artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--${{matrix.os}}
          path: junit-xml
          retention-days: 14

      - name: Tidy modules, confirm unchanged
        if: ${{ matrix.checkGenCommands }}
        shell: bash
        run: |
          go mod tidy
          (
            cd cliext
            go mod tidy
          )
          git diff --exit-code -- go.mod go.sum cliext/go.mod cliext/go.sum

      - name: Regen code, confirm unchanged
        if: ${{ matrix.checkGenCommands }}
        run: |
          go run ./cmd/gen-commands -input internal/temporalcli/commands.yaml -pkg temporalcli -context "*CommandContext" > internal/temporalcli/commands.gen.go
          go run ./cmd/gen-commands -input cliext/option-sets.yaml -pkg cliext > cliext/flags.gen.go
          git diff --exit-code

      - name: Generate docs, confirm working
        if: ${{ matrix.checkGenCommands }}
        run: go run ./cmd/gen-docs -input internal/temporalcli/commands.yaml -input cliext/option-sets.yaml -output dist/docs

      - name: Test cloud mTLS
        if: ${{ matrix.cloudTestTarget && env.HAS_SECRETS == 'true' }}
        env:
          TEMPORAL_ADDRESS: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}.tmprl.cloud:7233
          TEMPORAL_NAMESPACE: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}
          TEMPORAL_TLS_CERT: client.crt
          TEMPORAL_TLS_CERT_CONTENT: ${{ secrets.TEMPORAL_CLIENT_CERT }}
          TEMPORAL_TLS_KEY: client.key
          TEMPORAL_TLS_KEY_CONTENT: ${{ secrets.TEMPORAL_CLIENT_KEY }}
        shell: bash
        run: |
          printf '%s\n' "$TEMPORAL_TLS_CERT_CONTENT" >> client.crt
          printf '%s\n' "$TEMPORAL_TLS_KEY_CONTENT" >> client.key
          go run ./cmd/temporal workflow list --limit 2

      - name: Test cloud API key env var
        if: ${{ matrix.cloudTestTarget && env.HAS_SECRETS == 'true' }}
        env:
          TEMPORAL_ADDRESS: ca-central-1.aws.api.temporal.io:7233
          TEMPORAL_NAMESPACE: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}
          TEMPORAL_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
        shell: bash
        run: go run ./cmd/temporal workflow list --limit 2

      - name: Test cloud API key arg
        if: ${{ matrix.cloudTestTarget && env.HAS_SECRETS == 'true' }}
        env:
          TEMPORAL_ADDRESS: ca-central-1.aws.api.temporal.io:7233
          TEMPORAL_NAMESPACE: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}
        shell: bash
        run: go run ./cmd/temporal workflow list --limit 2 --api-key ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}

  ci-passed:
    name: ci-passed
    if: always()
    needs:
      - validate-server-version
      - build-test
    runs-on: ubuntu-latest
    steps:
      - name: Verify required jobs passed
        env:
          VALIDATE_SERVER_VERSION_RESULT: ${{ needs.validate-server-version.result }}
          BUILD_TEST_RESULT: ${{ needs.build-test.result }}
        run: |
          if [[ "$VALIDATE_SERVER_VERSION_RESULT" != "success" || "$BUILD_TEST_RESULT" != "success" ]]; then
            echo "Required CI jobs did not pass" >&2
            exit 1
          fi