release-dotnet.yml

name: Build .NET SDK
run-name: "Build .NET SDK ${{ github.ref_name }}"

# Build-only: packs the NuGet package with all native runtimes and uploads it
# as an artifact. Publishing and the GitHub Release happen downstream.

on:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-ffi:
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: { group: databricks-protected-runner-group, labels: linux-ubuntu-latest }
            target: x86_64-unknown-linux-gnu
            static_lib: libzerobus_ffi.a
            dynamic_lib: libzerobus_ffi.so
            artifact_dir: linux-x64
            cross: false
          - runner: { group: databricks-protected-runner-group, labels: linux-ubuntu-latest }
            target: aarch64-unknown-linux-gnu
            static_lib: libzerobus_ffi.a
            dynamic_lib: libzerobus_ffi.so
            artifact_dir: linux-arm64
            cross: true
          - runner: { group: databricks-protected-runner-group, labels: linux-ubuntu-latest }
            target: x86_64-unknown-linux-musl
            static_lib: libzerobus_ffi.a
            dynamic_lib: libzerobus_ffi.so
            artifact_dir: linux-musl-x64
            cross: false
            zigbuild: true
            rustflags: "-C target-feature=-crt-static"
          - runner: { group: databricks-protected-runner-group, labels: linux-ubuntu-latest }
            target: aarch64-unknown-linux-musl
            static_lib: libzerobus_ffi.a
            dynamic_lib: libzerobus_ffi.so
            artifact_dir: linux-musl-arm64
            cross: false
            zigbuild: true
            rustflags: "-C target-feature=-crt-static"
          - runner: { group: databricks-protected-runner-group, labels: windows-server-latest }
            target: x86_64-pc-windows-msvc
            static_lib: zerobus_ffi.lib
            dynamic_lib: zerobus_ffi.dll
            artifact_dir: win-x64
            cross: false
          # macOS is omitted: the runtime .dylib must be linked against Apple's
          # Security/CoreFoundation frameworks, which are unavailable when
          # cross-compiling from Linux. Add macOS once a Mac build host exists.

    name: Build FFI - ${{ matrix.artifact_dir }}
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      id-token: write

    defaults:
      run:
        working-directory: rust

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Get JFrog OIDC token
        shell: bash
        run: bash "$GITHUB_WORKSPACE/.github/scripts/jfrog-oidc-token.sh"

      - name: Configure cargo for JFrog
        shell: bash
        run: bash "$GITHUB_WORKSPACE/.github/scripts/configure-cargo.sh"

      - name: Install protoc
        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install cross-compilation toolchain (Linux ARM64)
        if: matrix.cross
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq gcc-aarch64-linux-gnu
          mkdir -p .cargo
          echo '[target.aarch64-unknown-linux-gnu]' > .cargo/config.toml
          echo 'linker = "aarch64-linux-gnu-gcc"' >> .cargo/config.toml

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          targets: ${{ matrix.target }}

      - name: Install Zig (zigbuild targets)
        if: matrix.zigbuild
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
        with:
          version: 0.13.0

      - name: Install cargo-zigbuild (zigbuild targets)
        if: matrix.zigbuild
        run: cargo install cargo-zigbuild --locked --version 0.19.8

      - name: Build FFI library
        if: '!matrix.zigbuild'
        run: cargo build --release -p zerobus-ffi --target ${{ matrix.target }}

      # musl (Alpine) libraries are cross-compiled from glibc Linux via zigbuild.
      - name: Build FFI library (zigbuild)
        if: matrix.zigbuild
        env:
          RUSTFLAGS: ${{ matrix.rustflags }}
        run: cargo zigbuild --release -p zerobus-ffi --target ${{ matrix.target }}

      - name: Prepare artifacts
        shell: bash
        run: |
          mkdir -p artifacts/${{ matrix.artifact_dir }}/native
          cp target/${{ matrix.target }}/release/${{ matrix.static_lib }} artifacts/${{ matrix.artifact_dir }}/native/
          cp target/${{ matrix.target }}/release/${{ matrix.dynamic_lib }} artifacts/${{ matrix.artifact_dir }}/native/

      - name: Upload artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ffi-${{ matrix.artifact_dir }}
          path: rust/artifacts/${{ matrix.artifact_dir }}
          if-no-files-found: error

  package:
    name: Pack NuGet package
    needs: build-ffi
    runs-on:
      group: databricks-protected-runner-group
      labels: linux-ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: dotnet

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Set up .NET
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
        with:
          dotnet-version: 10.0.x

      - name: Download all native libraries
        # download-artifact paths are relative to the workspace root, not the
        # job working-directory, so download under dotnet/ explicitly.
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: dotnet/native
          pattern: ffi-*
          merge-multiple: false

      - name: Consolidate native libraries
        # Each ffi-<rid> artifact holds native/<libs>; place it at runtimes/<rid>/native.
        run: |
          for dir in native/ffi-*/; do
            rid=$(basename "$dir" | sed 's/^ffi-//')
            mkdir -p "src/Zerobus/runtimes/$rid"
            cp -r "$dir/native" "src/Zerobus/runtimes/$rid/"
          done
          echo "Consolidated runtimes:"
          find src/Zerobus/runtimes -type f | sort

      - name: Assert expected native RID payloads are present
        run: |
          expected=(
            "src/Zerobus/runtimes/linux-x64/native/libzerobus_ffi.so"
            "src/Zerobus/runtimes/linux-arm64/native/libzerobus_ffi.so"
            "src/Zerobus/runtimes/linux-musl-x64/native/libzerobus_ffi.so"
            "src/Zerobus/runtimes/linux-musl-arm64/native/libzerobus_ffi.so"
            "src/Zerobus/runtimes/win-x64/native/zerobus_ffi.dll"
          )
          missing=0
          for f in "${expected[@]}"; do
            if [ ! -f "$f" ]; then
              echo "Missing expected native artifact: $f"
              missing=1
            fi
          done
          if [ "$missing" -ne 0 ]; then
            echo "RID payload assertion failed; refusing to pack incomplete nupkg."
            exit 1
          fi

      - name: Package NuGet
        env:
          CI: true
        run: |
          dotnet pack src/Zerobus/Zerobus.csproj \
            --configuration Release \
            --output ./packages \
            -p:SkipNativeBuild=true \
            -p:CI=true

      - name: Upload NuGet package
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: dotnet-package
          path: dotnet/packages/*.nupkg
          if-no-files-found: error