ci.yml

name: Continuous Integration

on:
  pull_request:
  push:
    branches:
      - main
      - releases/*

permissions:
  contents: read
  actions: write

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  # Is it the official main branch, or an official release branches?
  #
  # Variable IS_TEMPORALIO_SDK_TYPESCRIPT_REPO is configured to true on the official repo.
  # It can be used to determine if the present execution has access to secrets or not.
  #
  # AFAIK there's no way to break that line w/o introducing a trailing LF that breaks usage. Sorry.
  IS_MAIN_OR_RELEASE: ${{ vars.IS_TEMPORALIO_SDK_TYPESCRIPT_REPO == 'true' && github.event_name != 'pull_request' && ( github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/releases')) }}

  # Use these variables to force specific version of CLI/Time Skipping Server for SDK tests
  # TESTS_CLI_VERSION: 'v0.13.2'
  # TESTS_TIME_SKIPPING_SERVER_VERSION: 'v1.24.1'

jobs:
  # Compile native bridge code for each target platform.
  # Uploads the native library for each target as a build artifact.
  compile-native-binaries-debug:
    timeout-minutes: 20
    strategy:
      fail-fast: true
      matrix:
        include:
          - platform: linux-x64
            runner: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            out-file: libtemporal_sdk_typescript_bridge.so
          - platform: linux-arm
            runner: ubuntu-24.04-arm64-2-core
            target: aarch64-unknown-linux-gnu
            out-file: libtemporal_sdk_typescript_bridge.so
          - platform: macos-x64
            runner: macos-13
            target: x86_64-apple-darwin
            out-file: libtemporal_sdk_typescript_bridge.dylib
          - platform: macos-arm
            runner: macos-14
            target: aarch64-apple-darwin
            out-file: libtemporal_sdk_typescript_bridge.dylib
          - platform: windows-x64
            runner: windows-latest
            target: x86_64-pc-windows-msvc
            out-file: temporal_sdk_typescript_bridge.dll
    name: Compile Native Binaries (${{ matrix.platform }})
    runs-on: ${{ matrix.runner }}
    defaults:
      run:
        shell: bash
    steps:
      - name: 'Checkout code'
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: 'Cache index.node'
        id: cached-artifact
        uses: actions/cache@v4
        with:
          path: ./packages/core-bridge/releases
          key: corebridge-artifactcache-debug-${{ matrix.platform }}-${{ hashFiles('./packages/core-bridge/**/Cargo.lock', './packages/core-bridge/**/*.rs') }}

      - name: Install protoc
        if: steps.cached-artifact.outputs.cache-hit != 'true'
        uses: arduino/setup-protoc@v3
        with:
          # TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
          version: '23.x'
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Upgrade Rust to latest stable
        uses: dtolnay/rust-toolchain@stable

      - name: Rust Cargo and Build cache
        if: steps.cached-artifact.outputs.cache-hit != 'true'
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: packages/core-bridge -> target
          prefix-key: corebridge-buildcache-debug
          shared-key: ${{ matrix.platform }}
          env-vars: ''
          save-if: ${{ env.IS_MAIN_OR_RELEASE == 'true' }}

      - name: Compile rust code
        if: steps.cached-artifact.outputs.cache-hit != 'true'
        working-directory: ./packages/core-bridge
        run: |
          set -x
          cargo build --target ${{ matrix.target }}
          mkdir -p ./releases/${{ matrix.target }}
          cp target/${{ matrix.target }}/debug/${{ matrix.out-file }} ./releases/${{ matrix.target }}/index.node

      - uses: actions/upload-artifact@v4
        with:
          name: corebridge-native-debug-${{ matrix.platform }}
          # Actual file will be named ${{ matrix.target }}/index.node
          path: ./packages/core-bridge/releases/*/index.node

  # Run integration tests.
  # Uses the native binaries built in compile-native-binaries, but build `@temporalio/*` packages locally.
  integration-tests:
    timeout-minutes: 20
    needs:
      - compile-native-binaries-debug
    strategy:
      fail-fast: false
      matrix:
        node: [18, 22, 24] # Min and max officially supported Node versions + next max
        platform: [linux-x64, linux-arm, macos-x64, macos-arm, windows-x64]
        include:
          - platform: linux-x64
            runner: ubuntu-latest
            # For efficiency, we only run non-reuse-v8-context tests on this platform
            reuse-v8-context: false
          - platform: linux-arm
            runner: ubuntu-24.04-arm64-2-core
            reuse-v8-context: true
          - platform: macos-x64
            runner: macos-13
            reuse-v8-context: true
          - platform: macos-arm
            runner: macos-14
            reuse-v8-context: true
          - platform: windows-x64
            runner: windows-latest
            reuse-v8-context: true
    runs-on: ${{ matrix.runner }}
    name: Run Integration Tests (${{ matrix.platform }}, Node ${{ matrix.node }}, Reuse V8 Context ${{ matrix.reuse-v8-context }})
    defaults:
      run:
        shell: bash
    steps:
      # For some unknown reason, execution of TSC may sometime introduce a CRLF/LF mismatch on some
      # pure JS files that are preserved in the repo, which would later cause a failure when trying
      # to publish packages to Verdaccio, as Lerna requires that the Git repo be clean.
      - name: Set git config
        run: git config --global core.autocrlf false

      - name: 'Checkout code'
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Download core-bridge native libraries
        uses: actions/download-artifact@v4
        with:
          name: corebridge-native-debug-${{ matrix.platform }}
          path: ./packages/core-bridge/releases

      - name: Install Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-release-override || matrix.node }}

      # On Windows, the 'runner.temp' variable uses backslashes as path separators, but
      # that may pose problems in later steps when we try to join that with subpaths;
      # e.g. '${{ runner.temp }}/npm-registry' would get interpolated to 'd:\a\_temp/npm-registry',
      # which may effectively get interpreted as by bash as 'd:a_temp/npm-registry', resulting in
      # the apparition of an unwanted 'a_temp' directory.
      #
      # This step ensures that the 'runner.temp' variable is normalized to use forward slashes.
      - name: Get normalized path to temp directory
        id: tmp-dir
        run: echo "dir=$(pwd)" >> ${GITHUB_OUTPUT}
        working-directory: ${{ runner.temp }}

      - name: Get NPM cache directory
        id: npm-cache-dir
        run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}

      - name: Restore NPM cache
        uses: actions/cache/restore@v4
        with:
          path: ${{ steps.npm-cache-dir.outputs.dir }}
          key: npm-main-${{ matrix.platform }}-${{ hashFiles('./package-lock.json') }}
          restore-keys: |
            npm-main-${{ matrix.platform }}-

      - name: Download dependencies
        # Make up to 3 attempts to install NPM dependencies, to work around transient NPM errors :(
        run: |
          npm ci --ignore-scripts --verbose || npm ci --ignore-scripts --verbose || npm ci --ignore-scripts --verbose

      - name: Compile code
        run: npm run build -- --ignore @temporalio/core-bridge

      - name: Publish to Verdaccio
        run: node scripts/publish-to-verdaccio.js --registry-dir ${{ steps.tmp-dir.outputs.dir }}/npm-registry

      - name: Install Temporal CLI
        uses: temporalio/setup-temporal@v0

      - name: Run Temporal CLI
        working-directory: ${{ runner.temp }}
        run: |
          temporal server start-dev \
            --db-filename temporal.sqlite \
            --sqlite-pragma journal_mode=WAL \
            --sqlite-pragma synchronous=OFF \
            --headless &> ./devserver.log &

      - name: Run Tests
        run: npm run test
        env:
          RUN_INTEGRATION_TESTS: true
          REUSE_V8_CONTEXT: ${{ matrix.reuse-v8-context }}

          # For Temporal Cloud + mTLS tests
          TEMPORAL_CLOUD_MTLS_TEST_TARGET_HOST: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}.tmprl.cloud:7233
          TEMPORAL_CLOUD_MTLS_TEST_NAMESPACE: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}
          TEMPORAL_CLOUD_MTLS_TEST_CLIENT_CERT: ${{ secrets.TEMPORAL_CLIENT_CERT }}
          TEMPORAL_CLOUD_MTLS_TEST_CLIENT_KEY: ${{ secrets.TEMPORAL_CLIENT_KEY }}

          # For Temporal Cloud + API key tests
          TEMPORAL_CLOUD_API_KEY_TEST_TARGET_HOST: us-west-2.aws.api.temporal.io:7233
          TEMPORAL_CLOUD_API_KEY_TEST_NAMESPACE: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}
          TEMPORAL_CLOUD_API_KEY_TEST_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}

          # For Temporal Cloud + Cloud Ops tests
          TEMPORAL_CLOUD_OPS_TEST_TARGET_HOST: saas-api.tmprl.cloud:443
          TEMPORAL_CLOUD_OPS_TEST_NAMESPACE: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}
          TEMPORAL_CLOUD_OPS_TEST_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
          TEMPORAL_CLOUD_OPS_TEST_API_VERSION: 2024-05-13-00

      # FIXME: Move samples tests to a custom activity
      # Sample 1: hello-world to local server
      - name: Instantiate sample project using verdaccio artifacts - Hello World
        run: |
          node scripts/init-from-verdaccio.js --registry-dir ${{ steps.tmp-dir.outputs.dir }}/npm-registry --sample https://github.com/temporalio/samples-typescript/tree/main/hello-world --target-dir ${{ steps.tmp-dir.outputs.dir }}/sample-hello-world
          node scripts/test-example.js --work-dir "${{ steps.tmp-dir.outputs.dir }}/sample-hello-world"

      # Sample 2: hello-world-mtls to cloud server
      - name: Instantiate sample project using verdaccio artifacts - Hello World MTLS
        run: |
          if [ -z "$TEMPORAL_ADDRESS" ] || [ -z "$TEMPORAL_NAMESPACE" ] || [ -z "$TEMPORAL_CLIENT_CERT" ] || [ -z "$TEMPORAL_CLIENT_KEY" ]; then
            echo "Skipping hello-world-mtls sample test as required environment variables are not set"
            exit 0
          fi

          node scripts/create-certs-dir.js ${{ steps.tmp-dir.outputs.dir }}/certs
          node scripts/init-from-verdaccio.js --registry-dir ${{ steps.tmp-dir.outputs.dir }}/npm-registry --sample https://github.com/temporalio/samples-typescript/tree/main/hello-world-mtls --target-dir ${{ steps.tmp-dir.outputs.dir }}/sample-hello-world-mtls
          node scripts/test-example.js --work-dir "${{ steps.tmp-dir.outputs.dir }}/sample-hello-world-mtls"
        env:
          # These env vars are used by the hello-world-mtls sample
          TEMPORAL_ADDRESS: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}.tmprl.cloud:7233
          TEMPORAL_NAMESPACE: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}
          TEMPORAL_CLIENT_CERT: ${{ secrets.TEMPORAL_CLIENT_CERT }}
          TEMPORAL_CLIENT_KEY: ${{ secrets.TEMPORAL_CLIENT_KEY }}
          TEMPORAL_TASK_QUEUE: ${{ format('tssdk-ci-{0}-{1}-sample-hello-world-mtls-{2}-{3}', matrix.platform, matrix.node, github.run_id, github.run_attempt) }}

          TEMPORAL_CLIENT_CERT_PATH: ${{ steps.tmp-dir.outputs.dir }}/certs/client.pem
          TEMPORAL_CLIENT_KEY_PATH: ${{ steps.tmp-dir.outputs.dir }}/certs/client.key

      - name: Destroy certs dir
        if: always()
        run: rm -rf ${{ steps.tmp-dir.outputs.dir }}/certs
        continue-on-error: true

      # Sample 3: fetch-esm to local server
      - name: Instantiate sample project using verdaccio artifacts - Fetch ESM
        run: |
          node scripts/init-from-verdaccio.js --registry-dir ${{ steps.tmp-dir.outputs.dir }}/npm-registry --sample https://github.com/temporalio/samples-typescript/tree/main/fetch-esm --target-dir ${{ steps.tmp-dir.outputs.dir }}/sample-fetch-esm
          node scripts/test-example.js --work-dir "${{ steps.tmp-dir.outputs.dir }}/sample-fetch-esm"

      # End samples

      - name: Upload NPM logs
        uses: actions/upload-artifact@v4
        if: failure() || cancelled()
        with:
          name: integration-tests-${{ matrix.platform }}-node${{ matrix.node }}-${{ matrix.reuse-v8-context && 'reuse' || 'noreuse' }}-logs
          path: ${{ startsWith(matrix.platform, 'windows') && 'C:\\npm\\_logs\\' || '~/.npm/_logs/' }}

      - name: Upload Dev Server logs
        uses: actions/upload-artifact@v4
        if: failure() || cancelled()
        with:
          name: integration-tests-${{ matrix.platform }}-node${{ matrix.node }}-${{ matrix.reuse-v8-context && 'reuse' || 'noreuse' }}-devserver-logs
          path: ${{ steps.tmp-dir.outputs.dir }}/devserver.log

  conventions:
    name: Lint and Prune
    uses: ./.github/workflows/conventions.yml

  # Runs the features repo tests with this repo's current SDK code
  # FIXME: Update this job to reuse native build artifacts from compile-native-binaries
  features-tests:
    name: Features Tests
    uses: temporalio/features/.github/workflows/typescript.yaml@main
    with:
      typescript-repo-path: ${{github.event.pull_request.head.repo.full_name}}
      version: ${{github.event.pull_request.head.ref}}
      version-is-repo-ref: true
      features-repo-ref: main

  stress-tests-no-reuse-context:
    name: Stress Tests (No Reuse V8 Context)
    # FIXME: Update this job to reuse native build artifacts from compile-native-binaries
    uses: ./.github/workflows/stress.yml
    with:
      test-type: ci-stress
      test-timeout-minutes: 20
      reuse-v8-context: false

  stress-tests-reuse-context:
    name: Stress Tests (Reuse V8 Context)
    # FIXME: Update this job to reuse native build artifacts from compile-native-binaries
    uses: ./.github/workflows/stress.yml
    with:
      test-type: ci-stress
      test-timeout-minutes: 20
      reuse-v8-context: true

  docs:
    name: Build Docs
    uses: ./.github/workflows/docs.yml
    with:
      # Can't publish from forks, as secrets won't be available
      publish_target: ${{ vars.IS_TEMPORALIO_SDK_TYPESCRIPT_REPO == 'true' && 'draft' || '' }}
    secrets:
      ALGOLIA_API_KEY: ${{ secrets.ALGOLIA_API_KEY }}
      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
      VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
      VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}