ci-main.yml

name: ci main

# Full pipeline on push to main: format, build/test, publish artifacts + Docker,
# release snapshot, notify. PRs use ci-pr.yml (format + build/test only).
#
# Job graph:
#
#   format ─────────────────────────────────────────────┐
#   build (linux, asan debug) ── publish ── release ────┼── notify
#                                                       │   (always)

on:
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  checks: write
  packages: write

jobs:
  # ════════════════════════════════════════════════════════════════════════════
  # Verify: format + build/test matrix
  # ════════════════════════════════════════════════════════════════════════════

  format:
    runs-on: ubuntu-latest
    container: debian:trixie
    steps:
      - name: Install tools
        run: apt-get update && apt-get install -y --no-install-recommends ca-certificates git clang-format

      - uses: actions/checkout@v4

      - name: Check formatting
        run: bash scripts/format.sh --check

  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux
            preset: default
            build_dir: build
            runner: ubuntu-22.04
          - name: asan debug
            preset: san
            build_dir: build-san
            runner: ubuntu-22.04
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.OMOQ_APP_ID }}
          private-key: ${{ secrets.OMOQ_APP_PRIV_KEY }}

      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Install system dependencies
        run: bash deps/moxygen/standalone/install-system-deps.sh

      - name: Download moxygen artifacts
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: bash scripts/setup-deps-tarball.sh

      - name: Configure
        run: bash scripts/configure.sh ${{ matrix.build_dir }} ${{ matrix.preset }}

      - name: Build
        run: cmake --build ${{ matrix.build_dir }} -j$(getconf _NPROCESSORS_ONLN)

      - name: Test
        env:
          ASAN_OPTIONS: ${{ matrix.name == 'asan debug' && 'detect_leaks=1:abort_on_error=1' || '' }}
        run: ctest --test-dir ${{ matrix.build_dir }} --output-on-failure --output-junit test-results.xml

      - name: Publish test results
        uses: dorny/test-reporter@v1.9.1
        if: success() || failure()
        with:
          name: "test (${{ matrix.name }})"
          path: ${{ matrix.build_dir }}/test-results.xml
          reporter: java-junit
          fail-on-empty: ${{ job.status == 'success' && 'true' || 'false' }}

  # ════════════════════════════════════════════════════════════════════════════
  # Publish: build o-rly artifacts + Docker image (needs verify to pass)
  # ════════════════════════════════════════════════════════════════════════════

  publish:
    needs: [build]
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: ubuntu-22.04-amd64
    name: publish (${{ matrix.name }})
    runs-on: ubuntu-22.04
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.OMOQ_APP_ID }}
          private-key: ${{ secrets.OMOQ_APP_PRIV_KEY }}

      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Install system dependencies
        run: bash deps/moxygen/standalone/install-system-deps.sh

      - name: Download moxygen artifacts
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: bash scripts/setup-deps-tarball.sh

      - name: Set up ccache
        uses: hendrikmuhs/ccache-action@v1
        with:
          key: publish-${{ matrix.name }}
          max-size: 500M

      - name: Configure
        run: |
          cmake -S . -B _build --preset default \
            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
            -DCMAKE_PREFIX_PATH="$(cat .scratch/cmake_prefix_path.txt)" \
            -DBUILD_TESTING=OFF

      - name: Build
        run: cmake --build _build -j$(getconf _NPROCESSORS_ONLN)

      - name: Install
        run: cmake --install _build --prefix "$GITHUB_WORKSPACE/install"

      - name: Log in to GHCR
        if: runner.os == 'Linux'
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Build and push Docker image
        if: runner.os == 'Linux'
        run: |
          SHORT="${GITHUB_SHA:0:7}"
          IMAGE="ghcr.io/${{ github.repository }}"
          docker build -f docker/Dockerfile \
            -t "${IMAGE}:${SHORT}" \
            -t "${IMAGE}:latest" \
            .
          docker push "${IMAGE}:${SHORT}"
          docker push "${IMAGE}:latest"

      - name: Package
        id: package
        run: |
          ARTIFACT="${{ github.event.repository.name }}-${{ matrix.name }}.tar.gz"
          tar czf "$ARTIFACT" -C "$GITHUB_WORKSPACE/install" .
          echo "artifact=$ARTIFACT" >> "$GITHUB_OUTPUT"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.package.outputs.artifact }}
          path: ${{ steps.package.outputs.artifact }}
          retention-days: 90

  # ════════════════════════════════════════════════════════════════════════════
  # Release: create/update snapshot-latest pre-release (all green)
  # ════════════════════════════════════════════════════════════════════════════

  release:
    needs: [build, publish]
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts/

      - name: Publish snapshot
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          SHORT="${GITHUB_SHA:0:7}"
          TAG="snapshot-latest"

          gh release delete "$TAG" --yes 2>/dev/null || true
          git tag -d "$TAG" 2>/dev/null || true
          git push origin ":refs/tags/$TAG" 2>/dev/null || true

          gh release create "$TAG" artifacts/**/* \
            --title "Latest build ($SHORT)" \
            --prerelease \
            --notes "$(cat <<EOF
          Rolling snapshot of the latest build from \`main\`.

          **Commit:** \`${GITHUB_SHA}\`
          **Built:** $(date -u +%Y-%m-%dT%H:%M:%SZ)
          **Docker:** \`ghcr.io/${{ github.repository }}:${SHORT}\`

          This pre-release is automatically replaced on every push to \`main\`.
          EOF
          )"

  # ════════════════════════════════════════════════════════════════════════════
  # Notify: aggregate status (runs after everything)
  # ════════════════════════════════════════════════════════════════════════════

  notify:
    needs: [format, build, publish, release]
    if: always()
    runs-on: ubuntu-22.04
    steps:
      - name: Notify Slack
        continue-on-error: true
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.OMOQ_SLACK_WEBHOOK_URL }}
        run: |
          SHORT="${GITHUB_SHA:0:7}"
          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

          # Map job results to status symbols
          fmt_status() {
            case "$1" in
              success)   echo "✓" ;;
              failure)   echo "✗" ;;
              cancelled) echo "⊘" ;;
              *)         echo "—" ;;
            esac
          }

          FMT=$(fmt_status "${{ needs.format.result }}")
          VER=$(fmt_status "${{ needs.build.result }}")
          PUB=$(fmt_status "${{ needs.publish.result }}")
          REL=$(fmt_status "${{ needs.release.result }}")

          STATUS="format:${FMT} verify:${VER} publish:${PUB} release:${REL}"

          if [ "${{ needs.release.result }}" = "success" ]; then
            REL_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/snapshot-latest"
            TEXT=":white_check_mark: *${{ github.repository }}* \`${{ github.ref_name }}\` \`${SHORT}\` — ${STATUS}  <${RUN_URL}|#${{ github.run_number }}> artifacts: <${REL_URL}|view>"
          else
            TEXT=":x: *${{ github.repository }}* \`${{ github.ref_name }}\` \`${SHORT}\` — ${STATUS}  <${RUN_URL}|#${{ github.run_number }}>"
          fi

          curl -s -X POST "$SLACK_WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            --data "{\"text\": \"${TEXT}\"}"

      - name: Notify email
        continue-on-error: true
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.OMOQ_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.OMOQ_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          SHORT="${GITHUB_SHA:0:7}"
          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

          FMT="${{ needs.format.result }}"
          VER="${{ needs.build.result }}"
          PUB="${{ needs.publish.result }}"
          REL="${{ needs.release.result }}"

          STATUS="format:${FMT} verify:${VER} publish:${PUB} release:${REL}"

          if [ "${{ needs.release.result }}" = "success" ]; then
            REL_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/snapshot-latest"
            SUBJECT="[o-rly] published ${{ github.ref_name }} ${SHORT}"
            BODY="Repository: ${{ github.repository }}\nBranch: ${{ github.ref_name }}\nCommit: ${GITHUB_SHA}\nStatus: ${STATUS}\nDocker: ghcr.io/${{ github.repository }}:${SHORT}\nArtifacts: ${REL_URL}\nRun: ${RUN_URL}"
          else
            SUBJECT="[o-rly] pipeline failed ${{ github.ref_name }} ${SHORT}"
            BODY="Repository: ${{ github.repository }}\nBranch: ${{ github.ref_name }}\nCommit: ${GITHUB_SHA}\nStatus: ${STATUS}\nRun: ${RUN_URL}"
          fi

          aws ses send-email \
            --from "noreply@ci.openmoq.org" \
            --destination '{"ToAddresses":["github-notifications@openmoq.org"]}' \
            --message "{
              \"Subject\": {\"Data\": \"${SUBJECT}\"},
              \"Body\": {\"Text\": {\"Data\": \"${BODY}\"}}
            }"