config.yml

version: 2.1

# Cache key bump: 4

# These "CircleCI Orbs" are reusable bits of configuration that can be shared
# across projects.  See https://circleci.com/orbs/ for more information.
orbs:
  slack: circleci/slack@6.1.3
  secops: apollo/circleci-secops-orb@2.0.9

executors:
  amd_linux_build: &amd_linux_build_executor
    docker:
      - image: ghcr.io/apollographql/ci-utility-docker-images/apollo-rust-builder:0.30.4
    resource_class: xlarge
    environment:
      CARGO_BUILD_JOBS: 4
      RUST_TEST_THREADS: 6
      MISE_ENV: ci
  amd_linux_helm: &amd_linux_helm_executor
    docker:
      - image: ghcr.io/apollographql/ci-utility-docker-images/apollo-rust-builder:0.30.4
    resource_class: small
    environment:
      MISE_ENV: ci
  amd_linux_test: &amd_linux_test_executor
    docker:
      - image: ghcr.io/apollographql/ci-utility-docker-images/apollo-rust-builder:0.30.4
      - image: cimg/redis:7.4.8
      - image: openzipkin/zipkin:3.6.1
      - image: ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent:v1.46.0
      # redis cluster - 3 primaries, 3 replicas
      - image: cimg/redis:7.4.8
        command: [ "redis-server", "--protected-mode", "no", "--port", "7000", "--cluster-enabled", "yes" ]
      - image: cimg/redis:7.4.8
        command: [ "redis-server", "--protected-mode", "no", "--port", "7001", "--cluster-enabled", "yes" ]
      - image: cimg/redis:7.4.8
        command: [ "redis-server", "--protected-mode", "no", "--port", "7002", "--cluster-enabled", "yes" ]
      - image: cimg/redis:7.4.8
        command: [ "redis-server", "--protected-mode", "no", "--port", "7003", "--cluster-enabled", "yes" ]
      - image: cimg/redis:7.4.8
        command: [ "redis-server", "--protected-mode", "no", "--port", "7004", "--cluster-enabled", "yes" ]
      - image: cimg/redis:7.4.8
        command: [ "redis-server", "--protected-mode", "no", "--port", "7005", "--cluster-enabled", "yes" ]
      - image: cimg/redis:7.4.8
        command: [ "sh", "-c", "sleep 30; echo yes | redis-cli --cluster create --cluster-replicas 1 localhost:7000 localhost:7001 localhost:7002 localhost:7003 localhost:7004 localhost:7005" ]
    resource_class: 2xlarge
    environment:
      MISE_ENV: ci
      CARGO_BUILD_JOBS: 4
  arm_linux_build: &arm_linux_build_executor
    docker:
      - image: ghcr.io/apollographql/ci-utility-docker-images/apollo-rust-builder:0.30.4
    resource_class: arm.xlarge
    environment:
      MISE_ENV: ci
      CARGO_BUILD_JOBS: 8
  arm_linux_test: &arm_linux_test_executor
    docker:
      - image: ghcr.io/apollographql/ci-utility-docker-images/apollo-rust-builder:0.30.4
    resource_class: arm.xlarge
    environment:
      MISE_ENV: ci
      CARGO_BUILD_JOBS: 8
  macos_build: &macos_build_executor
    macos:
      # See https://circleci.com/docs/xcode-policy along with the support matrix
      # at https://circleci.com/docs/using-macos#supported-xcode-versions.
      # We use the major.minor notation to bring in compatible patches.
      xcode: "15.4.0"
    resource_class: m4pro.large
    environment:
      MISE_ENV: ci,ci-mac
  macos_test: &macos_test_executor
    macos:
      # See https://circleci.com/docs/xcode-policy along with the support matrix
      # at https://circleci.com/docs/using-macos#supported-xcode-versions.
      # We use the major.minor notation to bring in compatible patches.
      xcode: "15.4.0"
    resource_class: m4pro.large
    environment:
      MISE_ENV: ci,ci-mac
  windows_build: &windows_build_executor
    machine:
      image: "windows-server-2019-vs2019:2024.02.21"
    resource_class: windows.2xlarge
    shell: bash.exe --login -eo pipefail
    environment:
      MISE_ENV: ci,windows
      CARGO_BUILD_JOBS: 4
  windows_test: &windows_test_executor
    machine:
      image: "windows-server-2019-vs2019:2024.02.21"
    resource_class: windows.2xlarge
    shell: bash.exe --login -eo pipefail
    environment:
      MISE_ENV: ci,windows
      CARGO_BUILD_JOBS: 4

# We don't use {{ arch }} because on windows it is unstable https://discuss.circleci.com/t/value-of-arch-unstable-on-windows/40079
parameters:
  toolchain_version:
    type: string
    default: '{{ checksum ".circleci/config.yml" }}-v3-{{ checksum "~/.arch" }}-{{ checksum ".config/mise/config.toml" }}-{{ checksum "rust-toolchain.toml" }}-{{ checksum "~/.daily_version" }}'
  merge_version:
    type: string
    default: '{{ checksum ".circleci/config.yml" }}-v3-{{ checksum "~/.arch" }}-{{ checksum ".config/mise/config.toml" }}-{{ checksum "rust-toolchain.toml" }}-{{ checksum "~/.merge_version" }}'
  nightly:
    type: boolean
    default: false
  coverage:
    type: boolean
    default: false
  # quick_nightly will skip testing and only build the release artifacts.
  quick_nightly:
    type: boolean
    default: false
  test_updated_cargo_deps:
    type: boolean
    default: false

# These are common environment variables that we want to set on on all jobs.
# While these could conceivably be set on the CircleCI project settings'
# as "Secrets", these are not really secrets, and its convenient to keep them in
# code.  Also, most of our secrets are not necessary for _most_ of our jobs, so this enables
# forks of the project to run their own tests on their own CircleCI deployments with no
# additional configuration.
common_job_environment: &common_job_environment
  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
  RUST_BACKTRACE: full
  CARGO_INCREMENTAL: 0
  MISE_VERSION: v2025.7.26
commands:
  setup_environment:
    parameters:
      platform:
        type: executor
    steps:
      - unify_environment:
          platform: << parameters.platform >>
      - create_cache_keys
      - restore_cache:
          keys:
            - "<< pipeline.parameters.toolchain_version >>"
      - install_mise:
          platform: << parameters.platform >>
      - fetch_dependencies
      - save_cache:
          key: "<< pipeline.parameters.toolchain_version >>"
          paths:
            - ~/.cargo
            - ~/.rustup
            - ~/.local

  # Even though all executors use bash there are a number of differences that can be taken care of up front.
  # Windows shell commands are found on the path before the linux subsystem commands, so use aliases to override.
  # OSX doesn't seem to support aliases properly, so we use a symlink
  unify_environment:
    parameters:
      platform:
        type: executor
    steps:
      - run:
          name: Setup path
          command: echo 'export PATH="$HOME/.local/bin:$HOME/.local/aliases:$PATH"' >> "$BASH_ENV"
      - when:
          condition:
            or:
              - equal: [*amd_linux_build_executor, << parameters.platform >>]
              - equal: [*amd_linux_test_executor, << parameters.platform >>]
              - equal: [*amd_linux_helm_executor, << parameters.platform >>]
          steps:
            - run:
                name: Write arch
                command: |
                  echo 'amd_linux' >> ~/.arch
      - when:
          condition:
            or:
              - equal: [*arm_linux_build_executor, << parameters.platform >>]
              - equal: [*arm_linux_test_executor, << parameters.platform >>]
          steps:
            - run:
                name: Write arch
                command: |
                  echo 'arm_linux' >> ~/.arch
      - when:
          condition:
            or:
              - equal: [*macos_build_executor, << parameters.platform >>]
              - equal: [*macos_test_executor, << parameters.platform >>]
          steps:
            - run:
                name: Make link to md5
                command: |
                  mkdir -p ~/.local/aliases
                  ln -s /sbin/md5 ~/.local/aliases/md5sum
            - run:
                name: Write arch
                command: |
                  echo 'osx' >> ~/.arch
      - when:
          condition:
            or:
              - equal: [*windows_build_executor, << parameters.platform >>]
              - equal: [*windows_test_executor, << parameters.platform >>]
          steps:
            - run:
                name: Extend Bash profile for Windows
                command: |
                  echo 'alias find=/bin/find' >> "$BASH_ENV"
                  echo 'alias sort=/bin/sort' >> "$BASH_ENV"
                  echo 'export EXECUTABLE_SUFFIX=".exe"' >> "$BASH_ENV"
                  echo 'export PATH="$HOME/AppData/Local/mise/shims:$HOME/scoop/apps/mise/current/bin:$HOME/scoop/shims:$PATH"' >> "$BASH_ENV"
            - run:
                name: Write arch
                command: |
                  echo 'windows' >> ~/.arch

  # Create files that are useful for cache keys
  create_cache_keys:
    steps:
      - run:
          name: Create cache keys
          command: |
            # The Rust index takes time to download. Update this daily.
            date +%j > ~/.daily_version
            # The closest common ancestor to the default branch, so that test jobs can take advantage previous compiles
            git remote set-head origin -a
            TARGET_BRANCH=$(git rev-parse --abbrev-ref origin/HEAD)
            echo "Target branch is ${TARGET_BRANCH}"
            COMMON_ANCESTOR_REF=$(git merge-base HEAD "${TARGET_BRANCH}")
            echo "Common ancestor is ${COMMON_ANCESTOR_REF}"
            echo "${CIRCLE_PROJECT_REPONAME}-${COMMON_ANCESTOR_REF}" > ~/.merge_version

  # Install mise for tool version management
  install_mise:
    parameters:
      platform:
        type: executor
    steps:
      - when:
          condition:
            or:
              - equal: [*amd_linux_helm_executor, << parameters.platform >>]
              - equal: [*amd_linux_build_executor, << parameters.platform >>]
              - equal: [*amd_linux_test_executor, << parameters.platform >>]
              - equal: [*arm_linux_build_executor, << parameters.platform >>]
              - equal: [*arm_linux_test_executor, << parameters.platform >>]
              - equal: [*macos_build_executor, << parameters.platform >>]
              - equal: [*macos_test_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install mise
                command: |
                  curl https://mise.jdx.dev/install.sh | sh
                  mise activate bash >> "$BASH_ENV"
                  mise install --yes --quiet
      - when:
          condition:
            or:
              - equal: [*windows_build_executor, << parameters.platform >>]
              - equal: [*windows_test_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install scoop
                shell: powershell.exe -ExecutionPolicy Bypass
                command: |
                  iex "& {$(irm get.scoop.sh)} -RunAsAdmin"
            - run:
                name: Install mise
                command: |
                  scoop install mise@${MISE_VERSION#v}
                  mise install --yes --quiet
  fetch_dependencies:
    steps:
      - run:
          name: Fetch dependencies
          command: cargo fetch --locked

  xtask_fmt_check:
    steps:
      - run:
          name: Check formatting
          command: cargo fmt --all -- --config imports_granularity=Item,group_imports=StdExternalCrate --check

  xtask_lint:
    steps:
      - restore_cache:
          keys:
            - "<< pipeline.parameters.merge_version >>-lint"
      - run: cargo xtask lint
      - when:
          condition:
            equal: ["dev", "<< pipeline.git.branch >>"]
          steps:
            - save_cache:
                key: "<< pipeline.parameters.merge_version >>-lint"
                paths:
                  - target
  xtask_release_preverify:
    steps:
      - run: cargo xtask release pre-verify

  xtask_check_helm:
    steps:
      - run:
          name: Validate helm manifests
          command: |
            # Create list of kube versions
            CURRENT_KUBE_VERSIONS=$(curl -s -L https://raw.githubusercontent.com/kubernetes/website/main/data/releases/schedule.yaml \
              | yq -o json '.' \
              | jq --raw-output '.schedules[] | select((now | strftime("%Y-%m-%dT00:00:00Z")) as $date | .releaseDate < $date and .endOfLifeDate > $date) | select(.previousPatches != null) | .previousPatches[].release')

            TEMPLATE_DIR=$(mktemp -d)
            MINOR_VERSION="${kube_version%.*}"
            SUCCEEDED=false

            # For each k8s minor version (e.g.: 1.28) we will try to validate against the most recent patch release (e.g. 1.28.3)
            # We use curl --head to check if support is available. If it isn't we then try the next most recent release.
            # As soon as we find an available release we try to use it. If we don't find an available release for a minor version, then we will ignore that silently
            for kube_version in ${CURRENT_KUBE_VERSIONS}; do
              if [[ "${kube_version%.*}" == "${MINOR_VERSION}" ]]; then
                if [[ ${SUCCEEDED} == true ]]; then
                  continue
                fi
              else
                MINOR_VERSION="${kube_version%.*}"
                SUCCEEDED=false
              fi

              # Sometimes the database has not been updated with schema details. If that happens, just skip the kubeconform checks until the database is updated"
              if ! curl --head --silent --output /dev/null  --fail "https://github.com/yannh/kubernetes-json-schema/tree/master/v${kube_version}"; then
                echo "Skipping validation for kubernetes version: ${kube_version} until the schema database is updated."
                continue
              fi

              echo "Validating against schema version: ${kube_version}"

              # Use helm to template our chart against kube_version
              helm template --kube-version "${kube_version}" router helm/chart/router --set autoscaling.enabled=true > "${TEMPLATE_DIR}/router-${kube_version}.yaml"

              # Execute kubeconform on our templated charts to ensure they are good
              kubeconform \
                --kubernetes-version "${kube_version}" \
                --strict \
                --schema-location default \
                --verbose \
                "${TEMPLATE_DIR}/router-${kube_version}.yaml"
              SUCCEEDED=true
            done

  xtask_check_compliance:
    steps:
      - restore_cache:
          keys:
            - "<< pipeline.parameters.merge_version >>-compliance"
      # cargo-deny fetches a rustsec advisory DB, which has to happen on github.com over https
      - run: git config --global --unset-all url.ssh://git@github.com.insteadof
      - run: cargo xtask check-compliance
      - when:
          condition:
            equal: ["dev", "<< pipeline.git.branch >>"]
          steps:
            - save_cache:
                key: "<< pipeline.parameters.merge_version >>-compliance"
                paths:
                  - target
  xtask_test:
    parameters:
      variant:
        type: string
        default: "default"
    steps:
      - restore_cache:
          keys:
            - "<< pipeline.parameters.merge_version >>-test-<< parameters.variant >>"
      - run:
          name: Run tests
          environment:
            # Use the settings from the "ci" profile in nextest configuration.
            NEXTEST_PROFILE: ci
          command: |
            cargo xtask test --no-fail-fast --workspace --locked --features ci,snapshot

      - run:
          name: Delete large files from cache
          command: |
            find target/debug/deps -type f -size +50M -delete
            rm target/debug/router*
      - when:
          condition:
            equal: ["dev", "<< pipeline.git.branch >>"]
          steps:
            - save_cache:
                key: "<< pipeline.parameters.merge_version >>-test-<< parameters.variant >>"
                paths:
                  - target
      - store_test_results:
          # The results from nextest that power the CircleCI Insights.
          path: ./target/nextest/ci/junit.xml
  # Temporarily disable cargo-fuzz https://github.com/apollographql/router/pull/7488
  # fuzz_build:
  #   steps:
  #     - run: cargo +nightly fuzz build
  do_coverage:
    parameters:
      variant:
        type: string
        default: "default"
    steps:
      - run:
          name: Run coverage
          environment:
            # Use the settings from the "ci" profile in nextest configuration.
            NEXTEST_PROFILE: ci
          command: cargo llvm-cov nextest --ignore-run-fail --codecov --output-path codecov_report.json
      - run:
          name: Upload coverage report
          command: |
            # Upload the coverage report to Codecov.
            codecov-cli --auto-load-params-from CircleCI upload-process --file ./codecov_report.json --token "${CODECOV_TOKEN}"
      - store_artifacts:
          path: ./codecov_report.json

jobs:
  fmt_check:
    environment:
      <<: *common_job_environment
    parameters:
      platform:
        type: executor
    executor: << parameters.platform >>
    steps:
      - checkout
      - setup_environment:
          platform: << parameters.platform >>
      - xtask_fmt_check

  lint:
    environment:
      <<: *common_job_environment
    parameters:
      platform:
        type: executor
    executor: << parameters.platform >>
    steps:
      - checkout
      - setup_environment:
          platform: << parameters.platform >>
      - xtask_lint

  check_helm:
    environment:
      <<: *common_job_environment
    parameters:
      platform:
        type: executor
    executor: << parameters.platform >>
    steps:
      - when:
          condition:
            equal: [*amd_linux_helm_executor, << parameters.platform >>]
          steps:
            - checkout
            - setup_environment:
                platform: << parameters.platform >>
            - xtask_check_helm

  check_compliance:
    environment:
      <<: *common_job_environment
    parameters:
      platform:
        type: executor
    executor: << parameters.platform >>
    steps:
      - checkout
      - setup_environment:
          platform: << parameters.platform >>
      - xtask_check_compliance

  test:
    environment:
      <<: *common_job_environment
    parameters:
      platform:
        type: executor
      fuzz:
        type: boolean
        default: false
      coverage:
        type: boolean
        default: false
    executor: << parameters.platform >>
    steps:
      - checkout
      - setup_environment:
          platform: << parameters.platform >>
      - xtask_test
      # Temporarily disable cargo-fuzz https://github.com/apollographql/router/pull/7488
      # - when:
      #     condition:
      #       and:
      #         - equal: [ true, << parameters.fuzz >> ]
      #         - equal: [ *arm_linux_test_executor, << parameters.platform >> ]
      #     steps:
      #       - fuzz_build
  coverage:
    environment:
      <<: *common_job_environment
    parameters:
      platform:
        type: executor
    executor: << parameters.platform >>
    steps:
      - checkout
      - setup_environment:
          platform: << parameters.platform >>
      - do_coverage

  test_updated:
    environment:
      <<: *common_job_environment
    parameters:
      platform:
        type: executor
        default: amd_linux_test
      from_test_updated_cargo_deps_workflow:
        type: boolean
        default: false
    executor: << parameters.platform >>
    steps:
      - checkout
      - setup_environment:
          platform: << parameters.platform >>
      - run:
          name: Update all Rust dependencies
          command: |
            rm Cargo.lock
            cargo fetch
      - xtask_test:
          variant: "updated"

      - when:
          condition:
            equal:
              [true, << parameters.from_test_updated_cargo_deps_workflow >>]
          steps:
            - slack/notify:
                event: fail
                custom: |
                  {
                    "blocks": [
                      {
                        "type": "section",
                        "text": {
                          "type": "mrkdwn",
                          "text": ":x: The `test_updated_cargo_deps` workflow has **failed** for `${CIRCLE_JOB}` on `${CIRCLE_PROJECT_REPONAME}`'s `${CIRCLE_BRANCH}`!"
                        }
                      },
                      {
                        "type": "actions",
                        "elements": [
                          {
                            "type": "button",
                            "action_id": "success_tagged_deploy_view",
                            "text": {
                              "type": "plain_text",
                              "text": "View Job"
                            },
                            "url": "${CIRCLE_BUILD_URL}"
                          }
                        ]
                      }
                    ]
                  }
            - slack/notify:
                event: pass
                custom: |
                  {
                    "blocks": [
                      {
                        "type": "section",
                        "text": {
                          "type": "mrkdwn",
                          "text": ":white_check_mark: The `test_updated_cargo_deps` workflow has passed for `${CIRCLE_JOB}` on `${CIRCLE_PROJECT_REPONAME}`'s `${CIRCLE_BRANCH}`."
                        }
                      },
                      {
                        "type": "actions",
                        "elements": [
                          {
                            "type": "button",
                            "action_id": "success_tagged_deploy_view",
                            "text": {
                              "type": "plain_text",
                              "text": "View Job"
                            },
                            "url": "${CIRCLE_BUILD_URL}"
                          }
                        ]
                      }
                    ]
                  }
  pre_verify_release:
    environment:
      <<: *common_job_environment
    parameters:
      platform:
        type: executor
    executor: << parameters.platform >>
    steps:
      - checkout
      - setup_environment:
          platform: << parameters.platform >>
      - xtask_release_preverify

  build_release:
    parameters:
      platform:
        type: executor
      nightly:
        type: boolean
        default: false
    executor: << parameters.platform >>
    environment:
      <<: *common_job_environment
      RELEASE_BIN: router
      APPLE_TEAM_ID: "YQK948L752"
      APPLE_USERNAME: "opensource@apollographql.com"
      REPO_URL: << pipeline.project.git_url >>
    steps:
      - checkout
      - setup_environment:
          platform: << parameters.platform >>
      - when:
          condition:
            or:
              - equal: [*macos_build_executor, << parameters.platform >>]

          steps:
            - when:
                condition:
                  equal: [true, << parameters.nightly >>]
                steps:
                  - run: cargo xtask release prepare nightly
            - run:
                command: >
                  cargo xtask dist --target aarch64-apple-darwin
            - run:
                command: >
                  cargo xtask dist --target x86_64-apple-darwin
            - run:
                command: >
                  mkdir -p artifacts
            - run:
                command: >
                  cargo xtask package
                  --target aarch64-apple-darwin
                  --apple-team-id ${APPLE_TEAM_ID}
                  --apple-username ${APPLE_USERNAME}
                  --cert-bundle-base64 ${MACOS_CERT_BUNDLE_BASE64}
                  --cert-bundle-password ${MACOS_CERT_BUNDLE_PASSWORD}
                  --keychain-password ${MACOS_KEYCHAIN_PASSWORD}
                  --notarization-password ${MACOS_NOTARIZATION_PASSWORD}
                  --output artifacts/
            - run:
                command: >
                  cargo xtask package
                  --target x86_64-apple-darwin
                  --apple-team-id ${APPLE_TEAM_ID}
                  --apple-username ${APPLE_USERNAME}
                  --cert-bundle-base64 ${MACOS_CERT_BUNDLE_BASE64}
                  --cert-bundle-password ${MACOS_CERT_BUNDLE_PASSWORD}
                  --keychain-password ${MACOS_KEYCHAIN_PASSWORD}
                  --notarization-password ${MACOS_NOTARIZATION_PASSWORD}
                  --output artifacts/
      - when:
          condition:
            or:
              - equal: [*amd_linux_build_executor, << parameters.platform >>]
              - equal: [*arm_linux_build_executor, << parameters.platform >>]
              - equal: [*windows_build_executor, << parameters.platform >>]
          steps:
            # This will set the version to include current date and commit hash
            - when:
                condition:
                  equal: [true, << parameters.nightly >>]
                steps:
                  - run: cargo xtask release prepare nightly
            - run:
                command: >
                  cargo xtask dist
            - run:
                command: >
                  mkdir -p artifacts
            - run:
                command: >
                  cargo xtask package --output artifacts/
      - persist_to_workspace:
          root: artifacts
          paths:
            - "*"
      - store_artifacts:
          path: artifacts/
      - when:
          condition:
            and:
              - equal: [*amd_linux_build_executor, << parameters.platform >>]
              - equal: [true, << parameters.nightly >>]
              - matches:
                  pattern: "^https:\\/\\/github\\.com\\/apollographql\\/router.*$"
                  value: << pipeline.project.git_url >>
          steps:
            - setup_remote_docker:
                # CircleCI Image Policy
                #   https://circleci.com/docs/remote-docker-images-support-policy/
                version: docker23
                docker_layer_caching: true
            - run:
                name: Docker build
                command: |
                  # Source of the new image will be ser to the repo URL.
                  # This will have the effect of setting org.opencontainers.image.source and org.opencontainers.image.author to the originating pipeline
                  # Therefore the docker image will have the same permissions as the originating project.
                  # See: https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package#connecting-a-repository-to-a-container-image-using-the-command-line

                  BASE_VERSION=$(cargo metadata --format-version=1 --no-deps | jq --raw-output '.packages[0].version')
                  ARTIFACT_FILENAME="router-v${BASE_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
                  ARTIFACT_URL="https://output.circle-artifacts.com/output/job/${CIRCLE_WORKFLOW_JOB_ID}/artifacts/0/artifacts/${ARTIFACT_FILENAME}"
                  VERSION="v$(echo "${BASE_VERSION}" | tr "+" "-")"
                  ROUTER_TAG=ghcr.io/apollographql/nightly/router

                  # Validate local artifact exists and calculate its checksum as a safety net
                  if [ ! -f "artifacts/${ARTIFACT_FILENAME}" ]; then
                    echo "Error: Local artifact not found: artifacts/${ARTIFACT_FILENAME}"
                    exit 1
                  fi
                  LOCAL_ARTIFACT_SHA256SUM=$(sha256sum "artifacts/${ARTIFACT_FILENAME}" | cut -d' ' -f1)
                  echo "Local artifact checksum: ${LOCAL_ARTIFACT_SHA256SUM}"

                  # Download the artifact and calculate its checksum
                  echo "Downloading artifact to calculate checksum..."
                  curl -sSL -H "Circle-Token: ${CIRCLE_TOKEN}" -o "router-artifact.tar.gz" "${ARTIFACT_URL}"

                  # Calculate checksum of the tarball (not the binary inside)
                  ARTIFACT_URL_SHA256SUM=$(sha256sum "router-artifact.tar.gz" | cut -d' ' -f1)
                  rm -f router-artifact.tar.gz

                  # Compare local vs remote artifact checksums
                  if [ "${LOCAL_ARTIFACT_SHA256SUM}" != "${ARTIFACT_URL_SHA256SUM}" ]; then
                    echo "Error: Local and remote artifact checksums don't match!"
                    echo "Local:      ${LOCAL_ARTIFACT_SHA256SUM}"
                    echo "Remote: ${ARTIFACT_URL_SHA256SUM}"
                    exit 1
                  fi
                  echo "Local and remote artifact checksums match: ${LOCAL_ARTIFACT_SHA256SUM}"

                  echo "REPO_URL: ${REPO_URL}"
                  echo "BASE_VERSION: ${BASE_VERSION}"
                  echo "ARTIFACT_FILENAME: ${ARTIFACT_FILENAME}"
                  echo "ARTIFACT_URL: ${ARTIFACT_URL}"
                  echo "ARTIFACT_URL_SHA256SUM: ${ARTIFACT_URL_SHA256SUM}"
                  echo "LOCAL_ARTIFACT_SHA256SUM: ${LOCAL_ARTIFACT_SHA256SUM}"
                  echo "VERSION: ${VERSION}"
                  echo "ROUTER_TAG: ${ROUTER_TAG}"

                  # Create a multi-arch builder which works properly under qemu
                  docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
                  docker context create buildx-build
                  docker buildx create --driver docker-container --use buildx-build
                  docker buildx inspect --bootstrap
                  # Note: GH Token owned by apollo-bot2, no expire
                  echo ${GITHUB_OCI_TOKEN} | docker login ghcr.io -u apollo-bot2 --password-stdin
                  # TODO: Can't figure out how to build multi-arch image from ARTIFACT_URL right now. Figure out later...
                  # Build and push debug image
                  docker buildx build --load --platform linux/amd64 --build-arg CIRCLE_TOKEN="${CIRCLE_TOKEN}" --build-arg REPO_URL="${REPO_URL}" --build-arg ARTIFACT_URL="${ARTIFACT_URL}" --build-arg ARTIFACT_URL_SHA256SUM="${ARTIFACT_URL_SHA256SUM}" --build-arg DEBUG_IMAGE="true" --build-arg ROUTER_RELEASE=${VERSION} --build-arg BASE_VERSION=${BASE_VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION}-debug dockerfiles/.
                  docker push ${ROUTER_TAG}:${VERSION}-debug
                  # Build and push release image
                  docker buildx build --load --platform linux/amd64 --build-arg CIRCLE_TOKEN="${CIRCLE_TOKEN}" --build-arg REPO_URL="${REPO_URL}" --build-arg ARTIFACT_URL="${ARTIFACT_URL}" --build-arg ARTIFACT_URL_SHA256SUM="${ARTIFACT_URL_SHA256SUM}" --build-arg ROUTER_RELEASE=${VERSION} --build-arg BASE_VERSION=${BASE_VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION} dockerfiles/.
                  docker push ${ROUTER_TAG}:${VERSION}
                  # save containers for analysis
                  mkdir built-containers
                  docker save -o built-containers/router_${VERSION}-debug.tar ${ROUTER_TAG}:${VERSION}-debug
                  docker save -o built-containers/router_${VERSION}.tar ${ROUTER_TAG}:${VERSION}

            - persist_to_workspace:
                root: .
                paths:
                  - "built-containers/*.tar"
            - run:
                name: Helm build
                command: |
                  # Package up the helm chart
                  helm package helm/chart/router
                  # Make sure we have the newest chart
                  CHART=$(ls -t router*.tgz| head -1)
                  # Note: GH Token owned by apollo-bot2, no expire
                  echo ${GITHUB_OCI_TOKEN} | helm registry login -u apollo-bot2 --password-stdin ghcr.io
                  # Push chart to repository
                  helm push ${CHART} oci://ghcr.io/apollographql/helm-charts-nightly
      - when:
          condition:
            equal: [true, << parameters.nightly >>]
          steps:
            - slack/notify:
                event: fail
                custom: |
                  {
                    "blocks": [
                      {
                        "type": "section",
                        "text": {
                          "type": "mrkdwn",
                          "text": ":x: A `nightly` release run has **failed** for `${CIRCLE_JOB}` on `${CIRCLE_PROJECT_REPONAME}`'s `${CIRCLE_BRANCH}`!"
                        }
                      },
                      {
                        "type": "actions",
                        "elements": [
                          {
                            "type": "button",
                            "action_id": "success_tagged_deploy_view",
                            "text": {
                              "type": "plain_text",
                              "text": "View Job"
                            },
                            "url": "${CIRCLE_BUILD_URL}"
                          }
                        ]
                      }
                    ]
                  }
            - slack/notify:
                event: pass
                custom: |
                  {
                    "blocks": [
                      {
                        "type": "section",
                        "text": {
                          "type": "mrkdwn",
                          "text": ":white_check_mark: A `nightly` build has completed for `${CIRCLE_JOB}` on `${CIRCLE_PROJECT_REPONAME}`'s `${CIRCLE_BRANCH}`."
                        }
                      },
                      {
                        "type": "actions",
                        "elements": [
                          {
                            "type": "button",
                            "action_id": "success_tagged_deploy_view",
                            "text": {
                              "type": "plain_text",
                              "text": "View Job"
                            },
                            "url": "${CIRCLE_BUILD_URL}"
                          }
                        ]
                      }
                    ]
                  }

  publish_github_release:
    docker:
      - image: ghcr.io/apollographql/ci-utility-docker-images/apollo-rust-builder:0.30.4
    resource_class: small
    environment:
      <<: *common_job_environment
      VERSION: << pipeline.git.tag >>
    steps:
      - when:
          condition:
            not:
              equal:
                [
                  "https://github.com/apollographql/router",
                  << pipeline.project.git_url >>,
                ]
          steps:
            - run:
                command: >
                  echo "Not publishing any github release."
      - when:
          condition:
            equal:
              [
                "https://github.com/apollographql/router",
                << pipeline.project.git_url >>,
              ]
          steps:
            - checkout
            - setup_environment:
                platform: amd_linux_build
            - setup_remote_docker:
                # CircleCI Image Policy
                #   https://circleci.com/docs/remote-docker-images-support-policy/
                version: 20.10.24
                docker_layer_caching: true
            - attach_workspace:
                at: artifacts
            - run:
                command: >
                  cd artifacts && sha256sum *.tar.gz > sha256sums.txt
            - run:
                command: >
                  cd artifacts && md5sum *.tar.gz > md5sums.txt
            - run:
                command: >
                  cd artifacts && sha1sum *.tar.gz > sha1sums.txt

            - run:
                name: Publish to Crates.io
                command: |
                  # Remove leading 'v' which is present on the Git tag; Cargo doesn't want that leading 'v'
                  VERSION_WITHOUT_LEADING_V="${VERSION#v}"
                  echo "Publishing apollo-federation@${VERSION_WITHOUT_LEADING_V} and apollo-router@${VERSION_WITHOUT_LEADING_V}"
                  # Just do a dry-run for now on apollo-federation, since that's a leading
                  # indicator that the publish is going to work.  We don't do the attempt for
                  # router because it's dependent on apollo-federation, so it'll definitely fail.
                  cargo publish -p apollo-federation@${VERSION_WITHOUT_LEADING_V}
                  cargo publish -p apollo-router@${VERSION_WITHOUT_LEADING_V}

            - run:
                name: Create GitHub Release
                command: >
                  case "$VERSION" in

                    # If the VERSION contains a dash, consider it a pre-release version.
                    # This is in-line with SemVer's expectations/designations!
                    *-*) gh release create $VERSION --prerelease --notes-file /dev/null --title $VERSION artifacts/* ;;

                    # In all other cases, publish it as the latest version.
                    *) gh release create $VERSION --notes-file /dev/null --title $VERSION artifacts/* ;;

                  esac
            - run:
                name: Docker build
                command: |
                  ROUTER_TAG=ghcr.io/apollographql/router
                  # Create a multi-arch builder which works properly under qemu
                  docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
                  docker context create buildx-build
                  docker buildx create --driver docker-container --use buildx-build
                  docker buildx inspect --bootstrap
                  # Note: GH Token owned by apollo-bot2, no expire
                  echo ${GITHUB_OCI_TOKEN} | docker login ghcr.io -u apollo-bot2 --password-stdin
                  # To prevent overwrite, check to see if our images already exists
                  # If the manifest command succeeds, the images already exist
                  docker manifest inspect ${ROUTER_TAG}:${VERSION}  > /dev/null && exit 1
                  docker manifest inspect ${ROUTER_TAG}:${VERSION}-debug  > /dev/null && exit 1
                  # Build and push debug image
                  docker buildx build --platform linux/amd64,linux/arm64 --push --build-arg DEBUG_IMAGE="true" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION}-debug dockerfiles/.
                  # Build and push release image
                  docker buildx build --platform linux/amd64,linux/arm64 --push --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION} dockerfiles/.
            - run:
                name: Helm build
                command: |
                  # Package up the helm chart
                  helm package helm/chart/router
                  # Make sure we have the newest chart
                  CHART=$(ls -t router*.tgz| head -1)
                  # Note: GH Token owned by apollo-bot2, no expire
                  echo ${GITHUB_OCI_TOKEN} | helm registry login -u apollo-bot2 --password-stdin ghcr.io
                  # To prevent overwrite, check to see if our chart already exists
                  # If the show all command succeeds, the chart already exists
                  VERSION=$(basename ${CHART} .tgz)
                  helm show all oci://ghcr.io/apollographql/helm-charts/router --version ${VERSION} > /dev/null && exit 1
                  # Push chart to repository
                  helm push ${CHART} oci://ghcr.io/apollographql/helm-charts

workflows:
  test_updated_cargo_deps:
    when: << pipeline.parameters.test_updated_cargo_deps >>
    jobs:
      - test_updated:
          platform: amd_linux_test
          from_test_updated_cargo_deps_workflow: true
  ci_checks:
    when:
      not:
        or:
          - << pipeline.parameters.nightly >>
          - << pipeline.parameters.quick_nightly >>
          - << pipeline.parameters.test_updated_cargo_deps >>
    jobs:
      - fmt_check:
          matrix:
            parameters:
              platform: [amd_linux_helm]
      - lint:
          matrix:
            parameters:
              platform: [amd_linux_build]
      - check_helm:
          matrix:
            parameters:
              platform: [amd_linux_helm]
      - check_compliance:
          matrix:
            parameters:
              platform: [amd_linux_build]

      - test:
          # this should be changed back to true on dev after release
          fuzz: false
          requires:
            - fmt_check
          matrix:
            parameters:
              platform:
                [macos_test, windows_test, amd_linux_test, arm_linux_test]
  quick-nightly:
    when: << pipeline.parameters.quick_nightly >>
    jobs:
      - build_release:
          nightly: true
          context:
            - router
            - orb-publishing
          matrix:
            parameters:
              platform:
                [macos_build, windows_build, amd_linux_build, arm_linux_build]
  coverage_only:
    when: << pipeline.parameters.coverage >>
    jobs:
      - coverage:
          matrix:
            parameters:
              platform: [macos_test]
  nightly:
    when: << pipeline.parameters.nightly >>
    jobs:
      - lint:
          matrix:
            parameters:
              platform: [amd_linux_build]
      - check_helm:
          matrix:
            parameters:
              platform: [amd_linux_helm]
      - check_compliance:
          matrix:
            parameters:
              platform: [amd_linux_build]
      - test:
          requires:
            - lint
          matrix:
            parameters:
              platform:
                [macos_test, windows_test, amd_linux_test, arm_linux_test]
      - coverage:
          matrix:
            parameters:
              platform: [macos_test]
      - build_release:
          requires:
            - test
            - check_helm
            - check_compliance
          nightly: true
          context:
            - router
            - orb-publishing
          matrix:
            parameters:
              platform:
                [macos_build, windows_build, amd_linux_build, arm_linux_build]
      - secops/wiz-docker:
          context:
            - platform-docker-ro
            - wiz
            - github-orb
          requires:
            - build_release
          container-dir: /tmp/workspace/built-containers
          # Disables all PR comments from this job
          do-pr-comments: false
          # Scan job will return 1 if findings violating the Wiz policy are found.
          # Toggle off to prevent any CI failures OR
          # contact Apollo's Security team to adjust what violates the
          # Wiz policy used in this scan.
          fail-on-findings: true
          # Configure scan job to use a policy specific to apollo-router.
          # This allows us to tailor the policy applied during the scans to router.
          wiz-policies: Apollo-Router-Vulnerabilities-Policy

  release:
    when:
      not:
        or:
          - << pipeline.parameters.nightly >>
          - << pipeline.parameters.quick_nightly >>
          - << pipeline.parameters.test_updated_cargo_deps >>
    jobs:
      - pre_verify_release:
          matrix:
            parameters:
              platform: [amd_linux_build]
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /v.*/
      - lint:
          matrix:
            parameters:
              platform: [amd_linux_build]
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /v.*/
      - check_helm:
          matrix:
            parameters:
              platform: [amd_linux_helm]
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /v.*/
      - check_compliance:
          matrix:
            parameters:
              platform: [amd_linux_build]
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /v.*/
      - test:
          matrix:
            parameters:
              platform:
                [macos_test, windows_test, amd_linux_test, arm_linux_test]
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /v.*/
      - build_release:
          matrix:
            parameters:
              platform:
                [macos_build, windows_build, amd_linux_build, arm_linux_build]
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /v.*/
      - publish_github_release:
          requires:
            - build_release
            - lint
            - check_helm
            - check_compliance
            - pre_verify_release
            - test
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /v.*/

  security-scans:
    when:
      not:
        or:
          - << pipeline.parameters.nightly >>
          - << pipeline.parameters.quick_nightly >>
          - << pipeline.parameters.test_updated_cargo_deps >>
    jobs:
      - secops/gitleaks:
          context:
            - secops-oidc
            - github-orb
          git-base-revision: <<#pipeline.git.base_revision>><<pipeline.git.base_revision>><</pipeline.git.base_revision >>
          git-revision: << pipeline.git.revision >>
      - secops/semgrep:
          context:
            - secops-oidc
            - github-orb
          git-base-revision: <<#pipeline.git.base_revision>><<pipeline.git.base_revision>><</pipeline.git.base_revision >>
          disabled-signatures: "rules.providers.semgrep.security.javascript.lang.security.detect-insecure-websocket"