name: "CI"

on:
  workflow_dispatch:
    inputs:
      Docker:
        required: false
        default: false
        type: boolean
      Release:
        required: false
        default: false
        type: boolean
  push:
    tags: ["v*.*.*"]

env:
  SCCACHE_GHA_ENABLED: true
  RUSTC_WRAPPER: sccache
  CARGO_TERM_COLOR: always
  CARGO_NET_RETRY: 10
  CARGO_NET_GIT_FETCH_WITH_CLI: true
  AWS_LC_SYS_PREBUILT_NASM: 1

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  multiarch:
    strategy:
      fail-fast: false
      matrix:
        include:
          - variant: gnu
          - variant: musl
    name: Merge image / ${{matrix.variant}}
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      attestations: write
      packages: write
    needs: [linux]
    if: github.event_name == 'push' || inputs.Docker
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@v4.1.2
      - name: Log In to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{github.repository_owner}}
          password: ${{github.token}}

      - name: Log In to DockerHub
        uses: docker/login-action@v4
        with:
          username: ${{secrets.DOCKERHUB_USERNAME}}
          password: ${{secrets.DOCKERHUB_TOKEN}}

      - name: Download ${{matrix.variant}} meta bake definition
        uses: actions/download-artifact@v8
        with:
          name: bake-meta-${{matrix.variant}}
          path: ${{ runner.temp }}/${{matrix.variant}}

      - name: Download ${{matrix.variant}} digests
        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/${{matrix.variant}}/digests
          pattern: digests-${{matrix.variant}}-*
          merge-multiple: true

      - name: Create ${{matrix.variant}} manifest list and push
        working-directory: ${{ runner.temp }}/${{matrix.variant}}/digests
        run: |
          docker buildx imagetools create $(jq -cr '.target."docker-metadata-action".tags | map(select(startswith("ghcr.io/${{github.repository}}")) | "-t " + .) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) \
            $(printf 'ghcr.io/${{github.repository}}@sha256:%s ' *)
          docker buildx imagetools create $(jq -cr '.target."docker-metadata-action".tags | map(select(startswith("index.docker.io/${{github.repository}}")) | "-t " + .) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) \
            $(printf 'index.docker.io/${{github.repository}}@sha256:%s ' *)

      - name: Inspect ${{matrix.variant}} image
        id: manifest-digest
        run: |
          docker buildx imagetools inspect --format '{{json .Manifest}}' ghcr.io/${{github.repository}}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) | jq -r '.digest' > GHCR_DIGEST_SHA
          echo "GHCR_DIGEST_SHA=$(cat GHCR_DIGEST_SHA)" | tee -a "${GITHUB_ENV}"
          docker buildx imagetools inspect --format '{{json .Manifest}}' index.docker.io/${{github.repository}}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) | jq -r '.digest' > DOCKERHUB_DIGEST_SHA
          echo "DOCKERHUB_DIGEST_SHA=$(cat DOCKERHUB_DIGEST_SHA)" | tee -a "${GITHUB_ENV}"
          cosign sign --yes $(jq --arg GHCR_DIGEST_SHA "$(cat GHCR_DIGEST_SHA)" -cr '.target."docker-metadata-action".tags | map(select(startswith("ghcr.io/${{github.repository}}")) | . + "@" + $GHCR_DIGEST_SHA) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json)
          cosign sign --yes $(jq --arg DOCKERHUB_DIGEST_SHA "$(cat DOCKERHUB_DIGEST_SHA)" -cr '.target."docker-metadata-action".tags | map(select(startswith("index.docker.io/${{github.repository}}")) | . + "@" + $DOCKERHUB_DIGEST_SHA) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json)

      - name: Attest GHCR
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ghcr.io/${{github.repository}}
          subject-digest: ${{ env.GHCR_DIGEST_SHA }}
          push-to-registry: true

      - name: Attest Dockerhub
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: index.docker.io/${{github.repository}}
          subject-digest: ${{ env.DOCKERHUB_DIGEST_SHA }}
          push-to-registry: true

  linux:
    permissions:
      id-token: write
      contents: write
      attestations: write
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            platform: linux/amd64
            suffix: ""
            build_env: ""
          - target: x86_64-unknown-linux-musl
            platform: linux/amd64
            suffix: "-alpine"
            build_env: ""
          - target: aarch64-unknown-linux-gnu
            platform: linux/arm64
            suffix: ""
            build_env: "JEMALLOC_SYS_WITH_LG_PAGE=16 "
          - target: aarch64-unknown-linux-musl
            platform: linux/arm64
            suffix: "-alpine"
            build_env: "JEMALLOC_SYS_WITH_LG_PAGE=16 "
          - target: armv7-unknown-linux-gnueabihf
            platform: linux/arm/v7
            suffix: ""
            build_env: "JEMALLOC_SYS_WITH_LG_PAGE=16 "
          - target: armv7-unknown-linux-musleabihf
            platform: linux/arm/v7
            suffix: "-alpine"
            build_env: "JEMALLOC_SYS_WITH_LG_PAGE=16 "
          - target: arm-unknown-linux-gnueabihf
            platform: linux/arm/v6
            suffix: ""
            build_env: ""
          - target: arm-unknown-linux-musleabihf
            platform: linux/arm/v6
            suffix: "-alpine"
            build_env: ""
    name: Build / ${{matrix.target}}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Free disk space (heavy ARM targets)
        if: contains(matrix.target, 'arm')
        run: |
          df -h /mnt /
          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/.ghcup /usr/local/share/powershell /usr/share/swift /opt/hostedtoolcache/CodeQL
          sudo docker image prune --all --force || true
          df -h /mnt /

      - name: Add swap (heavy ARM targets)
        if: contains(matrix.target, 'arm')
        run: |
          mnt_avail=$(df --output=avail -k /mnt | tail -1)
          if [ "$mnt_avail" -lt 18874368 ]; then
            echo "Insufficient space on /mnt (${mnt_avail}K available), aborting swap setup"
            exit 1
          fi
          sudo fallocate -l 16G /mnt/swapfile
          sudo chmod 600 /mnt/swapfile
          sudo mkswap /mnt/swapfile
          sudo swapon /mnt/swapfile
          sudo sysctl vm.swappiness=80
          free -h
          swapon --show

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        with:
          platforms: "arm64,arm"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["https://mirror.gcr.io"]
          driver-opts: |
            network=host

      - name: Log In to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{github.repository_owner}}
          password: ${{github.token}}

      - name: Log In to DockerHub
        uses: docker/login-action@v4
        with:
          username: ${{secrets.DOCKERHUB_USERNAME}}
          password: ${{secrets.DOCKERHUB_TOKEN}}

      - name: Calculate shasum of external deps
        id: cal-dep-shasum
        run: |
          echo "checksum=$(yq -p toml -oy '.package[] | select((.source | contains("")) or (.checksum | contains("")))' Cargo.lock | sha256sum | awk '{print $1}')" >> "$GITHUB_OUTPUT"

      - name: Cache apt
        uses: actions/cache@v6.1.0
        id: apt-cache
        with:
          path: |
            var-cache-apt
            var-lib-apt
          key: apt-cache-${{ hashFiles('Dockerfile.build') }}

      - name: Cache Cargo
        uses: actions/cache@v6.1.0
        id: cargo-cache
        with:
          path: |
            usr-local-cargo-registry
            usr-local-cargo-git
          key: cargo-cache-${{ steps.cal-dep-shasum.outputs.checksum }}

      - name: Inject cache into docker
        uses: reproducible-containers/buildkit-cache-dance@v3.4.0
        with:
          cache-map: |
            {
              "var-cache-apt": "/var/cache/apt",
              "var-lib-apt": "/var/lib/apt",
              "usr-local-cargo-registry": "/usr/local/cargo/registry",
              "usr-local-cargo-git": "/usr/local/cargo/git"
            }
          skip-extraction: ${{ steps.cargo-cache.outputs.cache-hit }} && ${{ steps.apt-cache.outputs.cache-hit }}

      - name: Extract Metadata for Docker
        uses: docker/metadata-action@v6
        id: meta
        with:
          images: |
            index.docker.io/${{github.repository}}
            ghcr.io/${{github.repository}}
          flavor: |
            suffix=${{matrix.suffix}},onlatest=true
          tags: |
            type=ref,event=tag
            type=ref,event=branch,prefix=branch-
            type=edge,branch=main
            type=semver,pattern=v{{major}}.{{minor}}

      - name: Build Artifact
        id: bake
        uses: docker/bake-action@v7
        env:
          DOCKER_BUILD_RECORD_UPLOAD: false
          TARGET: ${{matrix.target}}
          GHCR_REPO: ghcr.io/${{github.repository}}
          BUILD_ENV: ${{matrix.build_env}}
          DOCKER_PLATFORM: ${{matrix.platform}}
          SUFFIX: ${{matrix.suffix}}
        with:
          source: .
          set: |
            *.tags=
            image.output=type=image,"name=ghcr.io/${{github.repository}},index.docker.io/${{github.repository}}",push-by-digest=true,name-canonical=true,push=true,compression=zstd,compression-level=9,force-compression=true,oci-mediatypes=true
          files: |
            docker-bake.hcl
            ${{ steps.meta.outputs.bake-file }}
          targets: ${{(github.event_name == 'push' || inputs.Docker) && 'build,image' || 'build'}}

      - name: Upload Artifacts
        uses: actions/upload-artifact@v7.0.1
        with:
          name: artifact-${{matrix.target}}
          path: |
            artifact
            !artifact/*.json

      - name: Export digest & Rename meta bake definition file
        if: github.event_name == 'push' || inputs.Docker
        run: |
          mv "${{ steps.meta.outputs.bake-file }}" "${{ runner.temp }}/bake-meta.json"
          mkdir -p ${{ runner.temp }}/digests
          digest="${{ fromJSON(steps.bake.outputs.metadata).image['containerimage.digest'] }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        if: github.event_name == 'push' || inputs.Docker
        uses: actions/upload-artifact@v7.0.1
        with:
          name: digests-${{matrix.suffix == '' && 'gnu' || 'musl'}}-${{ matrix.target }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

      - name: Upload GNU meta bake definition
        uses: actions/upload-artifact@v7.0.1
        if: (github.event_name == 'push' || inputs.Docker) && endsWith(matrix.target,'gnu') && startsWith(matrix.target,'x86')
        with:
          name: bake-meta-gnu
          path: ${{ runner.temp }}/bake-meta.json
          if-no-files-found: error
          retention-days: 1

      - name: Upload musl meta bake definition
        uses: actions/upload-artifact@v7.0.1
        if: (github.event_name == 'push' || inputs.Docker) && endsWith(matrix.target,'musl') && startsWith(matrix.target,'x86')
        with:
          name: bake-meta-musl
          path: ${{ runner.temp }}/bake-meta.json
          if-no-files-found: error
          retention-days: 1

  windows:
    name: Build / ${{matrix.target}}
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          #   - target: aarch64-pc-windows-msvc
          - target: x86_64-pc-windows-msvc

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Run sccache-cache
        uses: mozilla-actions/sccache-action@v0.0.11
        with:
          disable_annotations: true

      - name: Build
        run: |
          rustup target add ${{matrix.target}}
          cargo build --release --target ${{matrix.target}} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise"
          mkdir -p artifacts
          mv ./target/${{matrix.target}}/release/stalwart.exe ./artifacts/stalwart.exe

      - name: Upload Artifacts
        uses: actions/upload-artifact@v7.0.1
        with:
          name: artifact-${{matrix.target}}
          path: artifacts

  macos:
    name: Build / ${{matrix.target}}
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
          - target: x86_64-apple-darwin
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Run sccache-cache
        uses: mozilla-actions/sccache-action@v0.0.11
        with:
          disable_annotations: true

      #- name: Build FoundationDB Edition
      #  env:
      #    GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      #  run: |
      #    rustup target add ${{matrix.target}}
      #    # Pin FoundationDB 7.4.x (Apple publishes these as prereleases)
      #    curl --retry 5 -Lso foundationdb.pkg "$(gh api -X GET /repos/apple/foundationdb/releases --jq '[.[] | select(.tag_name | startswith("7.4."))] | sort_by(.tag_name | split(".") | map(tonumber)) | reverse | .[0].assets[] | select(.name | test("${{startsWith(matrix.target, 'x86') && 'x86_64' || 'arm64'}}" + ".pkg$")) | .browser_download_url')"
      #    echo "=== Package contents ==="
      #    pkgutil --payload-files foundationdb.pkg || true
      #    sudo installer -allowUntrusted -verbose -dumplog -pkg foundationdb.pkg -target /
      #    cargo build --release --target ${{matrix.target}} -p stalwart --no-default-features --features "foundationdb s3 redis nats enterprise"
      #    mkdir -p artifacts
      #    mv ./target/${{matrix.target}}/release/stalwart ./artifacts/stalwart-foundationdb

      - name: Build
        run: |
          rustup target add ${{matrix.target}}
          cargo build --release --target ${{matrix.target}} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise"
          mkdir -p artifacts
          mv ./target/${{matrix.target}}/release/stalwart ./artifacts/stalwart

      - name: Upload Artifacts
        uses: actions/upload-artifact@v7.0.1
        with:
          name: artifact-${{matrix.target}}
          path: artifacts

  freebsd:
    name: Build / ${{matrix.target}}
    runs-on: ubuntu-latest
    timeout-minutes: 360
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-freebsd
            arch: x86_64
          # - target: aarch64-unknown-freebsd
          #   arch: aarch64
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Build in FreeBSD VM
        uses: vmactions/freebsd-vm@v1
        with:
          release: "15.1"
          arch: ${{matrix.arch}}
          usesh: true
          mem: 14336
          cpu: 4
          sync: rsync
          copyback: true
          # gmake: required by jemalloc-sys on BSD hosts
          # llvm: provides libclang for bindgen (librocksdb-sys)
          # rust: libsqlite3-sys 0.38 uses cfg_select!, stabilized in Rust
          # 1.95. The default 'quarterly' pkg repo still ships rust 1.94, so
          # switch to the 'latest' repo (currently 1.96.1). rustup is not an
          # option here: aarch64-unknown-freebsd has no rustup toolchains yet.
          prepare: |
            set -e
            mkdir -p /usr/local/etc/pkg/repos
            echo 'FreeBSD: { url: "pkg+https://pkg.freebsd.org/${ABI}/latest", mirror_type: "srv" }' > /usr/local/etc/pkg/repos/FreeBSD.conf
            pkg update -f
            env ASSUME_ALWAYS_YES=yes pkg bootstrap -f
            pkg update -f
            pkg install -y rust gmake llvm rocksdb
            rustc --version
          run: |
            set -e
            export CARGO_TARGET_DIR=/tmp/target
            export CARGO_TERM_COLOR=always
            export CARGO_NET_RETRY=10
            cargo build --release -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise"
            mkdir -p artifacts
            cp /tmp/target/release/stalwart artifacts/stalwart

      - name: Upload Artifacts
        uses: actions/upload-artifact@v7.0.1
        with:
          name: artifact-${{matrix.target}}
          path: artifacts

  release:
    name: Release
    permissions:
      id-token: write
      contents: write
      attestations: write
    if: github.event_name == 'push' || inputs.Release
    needs: [linux, windows, macos, freebsd]
    runs-on: ubuntu-latest
    steps:
      # Must run before artifacts are downloaded — checkout cleans the workspace.
      - name: Checkout (for CHANGELOG)
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/checkout@v7

      - name: Download Artifacts
        uses: actions/download-artifact@v8
        with:
          path: archive
          pattern: artifact-*

      - name: Compress
        run: |
          set -eux
          BASE_DIR="$(pwd)/archive"
          compress_files() {
              local dir="$1"
              local archive_dir_name="${dir#artifact-}"
              cd "$dir"
              # Process each file in the directory
              for file in `ls`; do
                  filename="${file%.*}"
                  extension="${file##*.}"
                  if [ "$extension" = "exe" ]; then
                      7z a -tzip "${filename}-${archive_dir_name}.zip" "$file" > /dev/null
                  else
                      tar -czf "${filename}-${archive_dir_name}.tar.gz" "$file"
                  fi
              done
              cd $BASE_DIR
          }
          cd $BASE_DIR
          for arch_dir in `ls`; do
              dir_name=$(basename "$arch_dir")
              compress_files "$dir_name"
          done

      - name: Attest binary
        id: attest
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: |
            archive/**/*.tar.gz
            archive/**/*.zip

      - name: Use cosign to sign existing artifacts
        uses: sigstore/gh-action-sigstore-python@v3.5.0
        with:
          inputs: |
            archive/**/*.tar.gz
            archive/**/*.zip

      - name: Build release body
        run: |
          if [ "${{ startsWith(github.ref, 'refs/tags/') }}" = "true" ]; then
            awk '/^## \[/{c++} c==1' CHANGELOG.md > release_body.md
            echo "" >> release_body.md
          else
            : > release_body.md
          fi
          cat >> release_body.md <<EOF
          <hr />

          ### Check binary attestation [here](${{ steps.attest.outputs.attestation-url }})
          EOF

      - name: Release
        uses: softprops/action-gh-release@v3
        with:
          files: |
            archive/**/*.tar.gz
            archive/**/*.zip
            archive/**/*.sigstore.json
          prerelease: ${{!startsWith(github.ref, 'refs/tags/') || null}}
          tag_name: ${{!startsWith(github.ref, 'refs/tags/') && 'nightly' || null}}
          # Tag-push releases are created as drafts; the `publish` job un-drafts
          # them only after all build jobs succeed, so watcher notifications
          # don't fire on broken builds.
          draft: ${{ startsWith(github.ref, 'refs/tags/') || null }}
          body_path: release_body.md

  publish:
    name: Publish release
    needs: [linux, windows, macos, freebsd, multiarch, release]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Un-draft release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release edit "${{ github.ref_name }}" --draft=false --latest --repo "${{ github.repository }}"

  cleanup:
    name: Cleanup failed release
    needs: [linux, windows, macos, freebsd, multiarch, release]
    if: failure() && startsWith(github.ref, 'refs/tags/') && github.run_attempt >= 3
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Delete draft release and tag
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release delete "${{ github.ref_name }}" --yes --cleanup-tag --repo "${{ github.repository }}" || true