core-napi.yml

# Build + publish the @gitsheets/core-napi napi addon with per-platform prebuilds.
#
# This ships the gitsheets-core FFI boundary as prebuilt binaries so a consumer
# `npm install gitsheets` works with NO Rust toolchain: the main package pulls
# the matching @gitsheets/core-napi-<platform> package via optionalDependencies.
#
# Each target builds NATIVELY on its matching runner where possible:
#   x86_64-unknown-linux-gnu  → ubuntu-latest
#   aarch64-unknown-linux-gnu → ubuntu-24.04-arm  (Arm runner)
#   aarch64-apple-darwin      → macos-latest       (Apple Silicon runner)
#   x86_64-pc-windows-msvc    → windows-latest
# and CROSS-builds the two that can't run on any available runner:
#   x86_64-unknown-linux-musl → ubuntu-latest (zig cc cross-link) — build only
#   x86_64-apple-darwin       → macos-latest  (cross)             — build only
#
# Triggers:
#   - pull_request touching rust/**            → build + smoke-test the natives (no publish)
#   - push of a `core-napi-v*` tag             → build, then publish to npm
#   - workflow_dispatch                        → manual build
#
# Publish auth: npm TRUSTED PUBLISHING (OIDC) — no token, matching the repo's
# publish-npm.yml. Each of the 7 packages (@gitsheets/core-napi + the 6 platform
# packages) must already exist on npm AND have a trusted publisher configured
# for this repo + this workflow. One-time bootstrap (a package can't get a
# trusted publisher until it exists): publish an early version of all 7 manually,
# then add the trusted publishers. See rust/gitsheets-napi/README.md "Publishing".
#
# The release marker is the `core-napi-v*` git tag itself; napi prepublish runs
# with --skip-gh-release so it does NOT create a bare `v<version>` GitHub release
# + tag (those collide with the gitsheets JS-package `v*` release namespace that
# publish-npm.yml owns).
name: core-napi

on:
  pull_request:
    paths:
      - 'rust/**'
      - '.github/workflows/core-napi.yml'
  push:
    tags:
      - 'core-napi-v*'
  workflow_dispatch:

defaults:
  run:
    working-directory: rust/gitsheets-napi

jobs:
  build:
    name: build ${{ matrix.target }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Native — build + smoke-test on a matching runner.
          - target: x86_64-unknown-linux-gnu
            host: ubuntu-latest
            test: true
          - target: aarch64-unknown-linux-gnu
            host: ubuntu-24.04-arm
            test: true
          - target: aarch64-apple-darwin
            host: macos-latest
            test: true
          - target: x86_64-pc-windows-msvc
            host: windows-latest
            test: true
          # Cross — build only; the .node can't run on the host arch/libc, so
          # the smoke test is skipped (the logic is covered by the native runs).
          - target: x86_64-unknown-linux-musl
            host: ubuntu-latest
            zig: true
            test: false
          - target: x86_64-apple-darwin
            host: macos-latest
            test: false
    runs-on: ${{ matrix.host }}
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v6
        with:
          node-version: '20'

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust

      # zig cc bundles libc/libgcc and links musl cleanly — napi-rs's
      # recommended cross path. (musl-gcc fails on `libgcc_s.so.1`.)
      - name: Setup zig (musl cross-link)
        if: ${{ matrix.zig }}
        working-directory: ${{ runner.temp }}
        run: |
          ZIG=zig-linux-x86_64-0.13.0
          curl -fsSL "https://ziglang.org/download/0.13.0/${ZIG}.tar.xz" | tar -xJ
          echo "${{ runner.temp }}/${ZIG}" >> "$GITHUB_PATH"

      - name: Configure git identity (the smoke test commits to scratch repos)
        if: ${{ matrix.test }}
        run: |
          git config --global user.name "gitsheets CI"
          git config --global user.email "ci@gitsheets.local"

      - run: npm install

      - name: Build (release)
        run: npm run build -- --target ${{ matrix.target }}${{ matrix.zig && ' --zig' || '' }}

      - name: Smoke test
        if: ${{ matrix.test }}
        run: npm test

      - uses: actions/upload-artifact@v7
        with:
          name: bindings-${{ matrix.target }}
          path: rust/gitsheets-napi/*.node
          if-no-files-found: error

  publish:
    name: publish @gitsheets/core-napi
    if: ${{ startsWith(github.ref, 'refs/tags/core-napi-v') }}
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read    # no GitHub release is created (see --skip-gh-release)
      id-token: write   # npm provenance attestation + OIDC trusted publishing
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v6
        with:
          node-version: '24' # recent npm for OIDC trusted publishing
          registry-url: 'https://registry.npmjs.org'

      - run: npm install

      - name: Set version from tag (e.g. core-napi-v0.2.0 → 0.2.0)
        run: |
          VERSION="${GITHUB_REF_NAME#core-napi-v}"
          export VERSION
          npm version --no-git-tag-version "$VERSION"
          npx napi version
          # `napi version` updates the npm/<triple> package versions but NOT the
          # root optionalDependencies — pin those to the release version too, or
          # the main package would resolve stale platform packages.
          node -e "const fs=require('fs'),p=require('./package.json');for(const k in p.optionalDependencies)p.optionalDependencies[k]=process.env.VERSION;fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n')"

      - name: Collect prebuilt .node artifacts
        uses: actions/download-artifact@v8
        with:
          path: rust/gitsheets-napi/artifacts
          pattern: bindings-*
          merge-multiple: true

      - name: Distribute artifacts into npm/<triple>/
        run: npx napi artifacts --dir artifacts

      - name: Publish (platform packages via prepublishOnly hook, then main)
        # Tokenless: OIDC trusted publishing. Requires all 7 packages to exist
        # with a trusted publisher configured (see the bootstrap note up top).
        # prepublishOnly runs `napi prepublish ... --skip-gh-release`, so no
        # GitHub release/tag is created and no GITHUB_TOKEN is needed.
        run: npm publish --provenance --access public