anyllm-proxy/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always

jobs:
  frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: crates/proxy/admin-ui/package-lock.json
      - name: Install dependencies
        working-directory: crates/proxy/admin-ui
        run: npm ci
      - name: TypeScript check
        working-directory: crates/proxy/admin-ui
        run: npx tsc --noEmit
      - name: Lint
        working-directory: crates/proxy/admin-ui
        run: npm run lint
      - name: Build
        working-directory: crates/proxy/admin-ui
        run: npm run build
      - name: Upload dist
        uses: actions/upload-artifact@v4
        with:
          name: admin-ui-dist
          path: crates/proxy/admin-ui/dist/

  test:
    needs: frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Download dist
        uses: actions/download-artifact@v4
        with:
          name: admin-ui-dist
          path: crates/proxy/admin-ui/dist/
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@v2
      - name: Check formatting
        run: cargo fmt --check
      - name: Clippy
        run: cargo clippy -- -D warnings
      - name: Build
        run: cargo build
      - name: Test
        run: cargo test
      - name: Security audit
        run: |
          cargo install cargo-audit --locked --quiet
          cargo audit

  build-release:
    name: Build (${{ matrix.target }})
    needs: test
    if: startsWith(github.ref, 'refs/tags/v')
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86_64
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            binary: anyllm_proxy
            deb_arch: amd64
          # Linux ARM64 (native GitHub runner)
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            binary: anyllm_proxy
            deb_arch: arm64
          # macOS Apple Silicon
          - os: macos-latest
            target: aarch64-apple-darwin
            binary: anyllm_proxy
          # macOS Intel
          - os: macos-latest
            target: x86_64-apple-darwin
            binary: anyllm_proxy
          # Windows x86_64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            binary: anyllm_proxy.exe
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - name: Download dist
        uses: actions/download-artifact@v4
        with:
          name: admin-ui-dist
          path: crates/proxy/admin-ui/dist/
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}
      - name: Build
        run: cargo build --release -p anyllm_proxy --target ${{ matrix.target }}
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: anyllm_proxy-${{ matrix.target }}
          path: target/${{ matrix.target }}/release/${{ matrix.binary }}
      - name: Build deb package
        if: matrix.deb_arch != ''
        run: |
          cargo install cargo-deb --locked --quiet
          cargo deb -p anyllm_proxy --no-build --no-strip --target ${{ matrix.target }}
      - name: Upload deb artifact
        if: matrix.deb_arch != ''
        uses: actions/upload-artifact@v4
        with:
          name: anyllm-proxy-deb-${{ matrix.deb_arch }}
          path: target/${{ matrix.target }}/debian/*.deb

  test-deb:
    name: Test deb (${{ matrix.arch }})
    needs: build-release
    if: startsWith(github.ref, 'refs/tags/v')
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            os: ubuntu-latest
          - arch: arm64
            os: ubuntu-24.04-arm
    runs-on: ${{ matrix.os }}
    steps:
      - name: Download deb
        uses: actions/download-artifact@v4
        with:
          name: anyllm-proxy-deb-${{ matrix.arch }}
          path: ./deb

      - name: Inspect package
        run: |
          dpkg-deb --info ./deb/*.deb
          dpkg-deb --contents ./deb/*.deb

      - name: Lint package
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq lintian
          lintian --no-tag-display-limit ./deb/*.deb || true

      - name: Install package
        run: |
          sudo dpkg -i ./deb/*.deb || true
          sudo apt-get install -f -y

      - name: Verify binary
        run: |
          test -x /usr/bin/anyllm-proxy
          file /usr/bin/anyllm-proxy | grep -q "ELF"

      - name: Verify systemd unit
        run: |
          systemd-analyze verify /lib/systemd/system/anyllm-proxy.service

      - name: Verify postinst artifacts
        run: |
          getent passwd anyllm
          test -d /var/lib/anyllm
          stat -c '%U:%G' /var/lib/anyllm | grep -q 'anyllm:anyllm'

      - name: Verify config file
        run: |
          test -f /etc/default/anyllm-proxy

  release-assets:
    name: Upload release assets
    needs: [test-deb]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download amd64 deb
        uses: actions/download-artifact@v4
        with:
          name: anyllm-proxy-deb-amd64
          path: ./debs
      - name: Download arm64 deb
        uses: actions/download-artifact@v4
        with:
          name: anyllm-proxy-deb-arm64
          path: ./debs
      - name: Upload to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          ls -la ./debs/
          gh release upload "${{ github.ref_name }}" ./debs/*.deb --repo "${{ github.repository }}" --clobber

  publish:
    name: Publish to crates.io
    needs: [test, build-release]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      # Publish in dependency order. --no-verify skips re-building from the
      # packed tarball; the test job already verified the build.
      # Sleeps give the crates.io index time to propagate before dependents publish.
      - name: Publish anyllm_translate
        run: cargo publish -p anyllm_translate
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      - name: Wait for index propagation
        run: sleep 30
      - name: Publish anyllm_client
        run: cargo publish -p anyllm_client --no-verify
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      - name: Wait for index propagation
        run: sleep 30
      - name: Publish anyllm_proxy
        run: cargo publish -p anyllm_proxy --no-verify
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}