build.yml

name: Build Fizzy plugin

# Reusable workflow: build a Fizzy plugin for every target, hash each binary, assemble the
# author manifest, and publish all of them as Release assets. Runs in the *caller's* repo
# context (so `actions/checkout` pulls the plugin source).
#
# Identity (`id` / `version` / `min_sdk_version`) comes from the caller's `plugin.zig.zon`.
# `fizzy_sdk_version` + `abi_fingerprint` come from `zig-out/sdk-meta.json` (emitted by
# `fizzy.plugin.install`). All 6 targets cross-compile from ubuntu-latest — no macOS/Windows
# runners, no signing, no dlopen. Do not hand-copy sdk/fingerprint into caller YAML.
on:
  workflow_call:
    inputs:
      id:
        description: "Override plugin id (default: plugin.zig.zon .id)."
        required: false
        type: string
        default: ""
      version:
        description: "Override release version, no leading v (default: tag without v, checked against plugin.zig.zon .version)."
        required: false
        type: string
        default: ""
      zig-version:
        description: "Zig toolchain version."
        required: false
        type: string
        default: "0.16.0"
      artifact-path:
        description: "Built dylib path relative to repo root, sans extension (default zig-out/<id>)."
        required: false
        type: string
        default: ""
      targets:
        description: "Comma-separated os_arch subset to build (default: all 6). E.g. 'macos-aarch64,macos-x86_64,linux-x86_64,linux-aarch64'."
        required: false
        type: string
        default: ""

permissions:
  contents: write

env:
  ZIG_GLOBAL_CACHE_DIR: ${{ github.workspace }}/zig-global-cache

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.matrix.outputs.matrix }}
      id: ${{ steps.meta.outputs.id }}
      version: ${{ steps.meta.outputs.version }}
      min_sdk_version: ${{ steps.meta.outputs.min_sdk_version }}
      action_ref: ${{ steps.action_ref.outputs.ref }}
    steps:
      - uses: actions/checkout@v4

      # Scripts live in this action repo; the reusable workflow runs in the caller's
      # workspace, so it needs a second explicit checkout of this repo for them.
      #
      # This can't be resolved dynamically: `github.workflow_ref` (and `$GITHUB_WORKFLOW_REF`)
      # reflects the *caller's own* triggering workflow ref (e.g. a plugin repo's
      # `release.yml@refs/tags/v0.2.9`), not the ref this reusable `build.yml` was itself
      # pinned at via the caller's `uses: fizzyedit/plugin-build-action/.github/workflows/
      # build.yml@vN` line — there is no GitHub Actions context variable that exposes that.
      # A prior version of this step tried to extract it from `$GITHUB_WORKFLOW_REF` anyway,
      # which silently fetched the *caller's* release tag instead of this repo's own — that
      # tag never exists here, so every release failed at checkout.
      #
      # So: hardcode the major version this file's scripts are compatible with. Bump this
      # literal by hand whenever a new major tag (v4, v5, …) changes the scripts' interface.
      - name: Resolve plugin-build-action ref
        id: action_ref
        shell: bash
        run: |
          set -euo pipefail
          ref="v3"
          echo "ref=$ref" >> "$GITHUB_OUTPUT"
          echo "Using plugin-build-action@$ref for scripts"

      - uses: actions/checkout@v4
        with:
          repository: fizzyedit/plugin-build-action
          ref: ${{ steps.action_ref.outputs.ref }}
          path: .plugin-build-action

      - name: Read plugin.zig.zon + resolve release version
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          py=$(command -v python3 || command -v python)
          zon=$("$py" .plugin-build-action/scripts/read_plugin_zon.py plugin.zig.zon)
          echo "$zon"

          zon_id=$(printf '%s' "$zon" | "$py" -c 'import json,sys; print(json.load(sys.stdin)["id"])')
          zon_version=$(printf '%s' "$zon" | "$py" -c 'import json,sys; print(json.load(sys.stdin)["version"])')
          zon_min=$(printf '%s' "$zon" | "$py" -c 'import json,sys; print(json.load(sys.stdin)["min_sdk_version"])')

          id="${{ inputs.id }}"
          [ -n "$id" ] || id="$zon_id"
          if [ "$id" != "$zon_id" ]; then
            echo "::error::inputs.id ($id) does not match plugin.zig.zon .id ($zon_id)"
            exit 1
          fi

          # Prefer an explicit input, else the triggering tag (v0.1.2 → 0.1.2).
          version="${{ inputs.version }}"
          if [ -z "$version" ]; then
            ref="${GITHUB_REF_NAME:-}"
            case "$ref" in
              v*) version="${ref#v}" ;;
              *)
                echo "::error::no version input and ref '$ref' is not a v* tag; pass inputs.version or tag vX.Y.Z"
                exit 1
                ;;
            esac
          fi

          if [ "$version" != "$zon_version" ]; then
            echo "::error::release version ($version) does not match plugin.zig.zon .version ($zon_version). Bump plugin.zig.zon before tagging."
            exit 1
          fi

          {
            echo "id=$id"
            echo "version=$version"
            echo "min_sdk_version=$zon_min"
          } >> "$GITHUB_OUTPUT"
          echo "OK: id=$id version=$version min_sdk_version=${zon_min:-"(default to pinned sdk)"}"

      - name: Compute build matrix
        id: matrix
        shell: bash
        run: |
          set -euo pipefail
          # All targets cross-compile from ubuntu-latest. Plugins are unsigned pure Zig +
          # vendored C (plus optional prebuilt .a/.lib deps like ghostty_vt), so there is no
          # need for macOS/Windows runners or code signing. sdk-meta.json is emitted at build
          # time — no dlopen on the runner required.
          all='[
            {"os_arch":"macos-aarch64","zig_target":"aarch64-macos","ext":"dylib"},
            {"os_arch":"macos-x86_64","zig_target":"x86_64-macos","ext":"dylib"},
            {"os_arch":"linux-x86_64","zig_target":"x86_64-linux-gnu","ext":"so"},
            {"os_arch":"linux-aarch64","zig_target":"aarch64-linux-gnu","ext":"so"},
            {"os_arch":"windows-x86_64","zig_target":"x86_64-windows","ext":"dll"},
            {"os_arch":"windows-aarch64","zig_target":"aarch64-windows","ext":"dll"}
          ]'
          targets="${{ inputs.targets }}"
          if [ -z "$targets" ]; then
            filtered="$all"
          else
            keep=$(printf '%s' "$targets" | jq -R -c 'split(",")')
            filtered=$(printf '%s' "$all" | jq -c --argjson keep "$keep" '[.[] | select(.os_arch as $o | $keep | index($o) != null)]')
          fi
          if [ "$(printf '%s' "$filtered" | jq 'length')" = "0" ]; then
            echo "::error::targets '$targets' matched none of the known os_arch values"; exit 1
          fi
          echo "matrix=$(printf '%s' "$filtered" | jq -c .)" >> "$GITHUB_OUTPUT"

  build:
    needs: setup
    name: build ${{ matrix.os_arch }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.setup.outputs.matrix) }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/checkout@v4
        with:
          repository: fizzyedit/plugin-build-action
          ref: ${{ needs.setup.outputs.action_ref }}
          path: .plugin-build-action

      - name: Pre-create Zig cache tmp/
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p "$ZIG_GLOBAL_CACHE_DIR/tmp"
          mkdir -p "${ZIG_LOCAL_CACHE_DIR:-$GITHUB_WORKSPACE/.zig-cache}/tmp"

      - uses: mlugg/setup-zig@v2
        with:
          version: ${{ inputs.zig-version }}

      # Zig 0.16's HTTP client doesn't retry on `HttpConnectionClosing` from GitHub.
      # Pre-fetch deps in a retry loop (separate from the build) so flaky Windows CI
      # fetches don't fail the whole matrix job. See fizzy .github/workflows/ci.yml.
      - name: Fetch dependencies (with retries)
        shell: bash
        run: |
          set -euo pipefail
          fetch() {
            local args="$1"
            local n=0
            until [ "$n" -ge 5 ]; do
              zig build --fetch $args && return 0
              n=$((n+1))
              echo "Fetch attempt $n ($args) failed, sleeping $((n*10))s before retry..."
              sleep $((n*10))
            done
            return 1
          }
          fetch "" || exit 1
          fetch "-Doptimize=ReleaseFast -Dtarget=${{ matrix.zig_target }}" || exit 1

      - name: Build (ReleaseFast, ${{ matrix.zig_target }})
        shell: bash
        run: |
          set -euo pipefail
          zig build -Doptimize=ReleaseFast -Dtarget=${{ matrix.zig_target }}

      - name: Stage binary + sha256 fragment
        shell: bash
        run: |
          set -euo pipefail
          id="${{ needs.setup.outputs.id }}"
          version="${{ needs.setup.outputs.version }}"
          base="${{ inputs.artifact-path }}"
          [ -n "$base" ] || base="zig-out/${id}"
          src="${base}.${{ matrix.ext }}"
          asset="${id}-${{ matrix.os_arch }}.${{ matrix.ext }}"
          test -f "$src" || { echo "::error::built artifact not found at $src"; exit 1; }

          mkdir -p out frag
          cp "$src" "out/${asset}"

          if command -v sha256sum >/dev/null; then
            sum=$(sha256sum "$src" | awk '{print $1}')
          else
            sum=$(shasum -a 256 "$src" | awk '{print $1}')
          fi

          url="https://github.com/${{ github.repository }}/releases/download/v${version}/${asset}"
          printf '{"os_arch":"%s","url":"%s","sha256":"%s"}\n' \
            "${{ matrix.os_arch }}" "$url" "$sum" > "frag/${{ matrix.os_arch }}.json"
          cat "frag/${{ matrix.os_arch }}.json"

      # sdk-meta.json is emitted by fizzy.plugin.install at build time (same pin + optimize
      # class as the dylib). Available for every cross target — no dlopen on the runner.
      - name: Collect SDK metadata
        shell: bash
        run: |
          set -euo pipefail
          py=$(command -v python3 || command -v python)
          id="${{ needs.setup.outputs.id }}"
          test -f zig-out/sdk-meta.json || {
            echo "::error::zig-out/sdk-meta.json missing — rebuild against a fizzy pin that emits it from fizzy.plugin.install"
            exit 1
          }
          mkdir -p sdk-meta
          cp zig-out/sdk-meta.json "sdk-meta/${{ matrix.os_arch }}.json"
          cat "sdk-meta/${{ matrix.os_arch }}.json"

          got_id=$("$py" -c 'import json,sys; print(json.load(open(sys.argv[1]))["id"])' "sdk-meta/${{ matrix.os_arch }}.json")
          got_ver=$("$py" -c 'import json,sys; print(json.load(open(sys.argv[1]))["version"])' "sdk-meta/${{ matrix.os_arch }}.json")
          if [ "$got_id" != "$id" ]; then
            echo "::error::sdk-meta id ($got_id) != plugin.zig.zon id ($id)"; exit 1
          fi
          if [ "$got_ver" != "${{ needs.setup.outputs.version }}" ]; then
            echo "::error::sdk-meta version ($got_ver) != release version (${{ needs.setup.outputs.version }})"; exit 1
          fi

          zon_min="${{ needs.setup.outputs.min_sdk_version }}"
          if [ -n "$zon_min" ]; then
            got_min=$("$py" -c 'import json,sys; print(json.load(open(sys.argv[1]))["min_sdk_version"])' "sdk-meta/${{ matrix.os_arch }}.json")
            if [ "$got_min" != "$zon_min" ]; then
              echo "::error::sdk-meta min_sdk_version ($got_min) != plugin.zig.zon ($zon_min)"; exit 1
            fi
          fi

      - uses: actions/upload-artifact@v4
        with:
          name: binary-${{ matrix.os_arch }}
          path: out/*
      - uses: actions/upload-artifact@v4
        with:
          name: frag-${{ matrix.os_arch }}
          path: frag/*
      - uses: actions/upload-artifact@v4
        with:
          name: sdk-meta-${{ matrix.os_arch }}
          path: sdk-meta/*

  publish:
    needs: [setup, build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          repository: fizzyedit/plugin-build-action
          ref: ${{ needs.setup.outputs.action_ref }}
          path: .plugin-build-action

      - uses: actions/download-artifact@v4
        with:
          pattern: binary-*
          path: dist
          merge-multiple: true
      - uses: actions/download-artifact@v4
        with:
          pattern: frag-*
          path: frags
          merge-multiple: true
      - uses: actions/download-artifact@v4
        with:
          pattern: sdk-meta-*
          path: sdk-metas
          merge-multiple: true

      - name: Consensus SDK metadata
        id: sdk
        shell: bash
        run: |
          set -euo pipefail
          py=$(command -v python3 || command -v python)
          shopt -s nullglob
          files=(sdk-metas/*.json)
          if [ "${#files[@]}" -eq 0 ]; then
            echo "::error::no sdk-meta artifacts from any target"
            exit 1
          fi
          "$py" - "${files[@]}" <<'PY'
          import json, sys
          metas = [json.loads(open(p).read()) for p in sys.argv[1:]]
          fps = {m["abi_fingerprint"] for m in metas}
          sdks = {m["fizzy_sdk_version"] for m in metas}
          mins = {m["min_sdk_version"] for m in metas}
          if len(fps) != 1:
              print(f"::error::targets disagree on abi_fingerprint: {sorted(fps)}")
              sys.exit(1)
          if len(sdks) != 1:
              print(f"::error::targets disagree on fizzy_sdk_version: {sorted(sdks)}")
              sys.exit(1)
          if len(mins) != 1:
              print(f"::error::targets disagree on min_sdk_version: {sorted(mins)}")
              sys.exit(1)
          m = metas[0]
          print(f"OK: consensus from {len(metas)} cross-target(s): "
                f"fizzy_sdk_version={m['fizzy_sdk_version']} "
                f"abi_fingerprint={m['abi_fingerprint']} "
                f"min_sdk_version={m['min_sdk_version']}")
          with open("sdk-consensus.json", "w") as f:
              json.dump(m, f, indent=2)
              f.write("\n")
          PY
          {
            echo "abi_fingerprint=$("$py" -c 'import json; print(json.load(open("sdk-consensus.json"))["abi_fingerprint"])')"
            echo "fizzy_sdk_version=$("$py" -c 'import json; print(json.load(open("sdk-consensus.json"))["fizzy_sdk_version"])')"
            echo "min_sdk_version=$("$py" -c 'import json; print(json.load(open("sdk-consensus.json"))["min_sdk_version"])')"
          } >> "$GITHUB_OUTPUT"

      - name: Assemble manifest.json
        run: |
          python3 .plugin-build-action/scripts/assemble_manifest.py \
            --id "${{ needs.setup.outputs.id }}" \
            --version "${{ needs.setup.outputs.version }}" \
            --abi-fingerprint "${{ steps.sdk.outputs.abi_fingerprint }}" \
            --fizzy-sdk-version "${{ steps.sdk.outputs.fizzy_sdk_version }}" \
            --min-sdk-version "${{ steps.sdk.outputs.min_sdk_version }}" \
            --merge-url "https://github.com/${{ github.repository }}/releases/latest/download/manifest.json" \
            --frags frags \
            --out dist/manifest.json
          echo "----- manifest.json -----"; cat dist/manifest.json

      - name: Publish release (binaries + manifest)
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.setup.outputs.version }}
          files: |
            dist/*.dylib
            dist/*.so
            dist/*.dll
            dist/manifest.json