openmoq · gmarzot · Mar 12, 2026 · Mar 12, 2026
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
@@ -0,0 +1,297 @@
+name: ci main
+
+# Full pipeline on push to main: format, build/test, publish artifacts + Docker,
+# release snapshot, notify. PRs use ci-pr.yml (format + build/test only).
+#
+# Job graph:
+#
+#   format ─────────────────────────────────────────────┐
+#   build (linux, asan debug) ── publish ── release ────┼── notify
+#                                                       │   (always)
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  checks: write
+  packages: write
+
+jobs:
+  # ════════════════════════════════════════════════════════════════════════════
+  # Verify: format + build/test matrix
+  # ════════════════════════════════════════════════════════════════════════════
+
+  format:
+    runs-on: ubuntu-latest
+    container: debian:trixie
+    steps:
+      - name: Install tools
+        run: apt-get update && apt-get install -y --no-install-recommends ca-certificates git clang-format
+
+      - uses: actions/checkout@v4
+
+      - name: Check formatting
+        run: bash scripts/format.sh --check
+
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: linux
+            preset: default
+            build_dir: build
+            runner: ubuntu-22.04
+          - name: asan debug
+            preset: san
+            build_dir: build-san
+            runner: ubuntu-22.04
+    name: ${{ matrix.name }}
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OMOQ_APP_ID }}
+          private-key: ${{ secrets.OMOQ_APP_PRIV_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Install system dependencies
+        run: bash deps/moxygen/standalone/install-system-deps.sh
+
+      - name: Download moxygen artifacts
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: bash scripts/setup-deps-tarball.sh
+
+      - name: Configure
+        run: bash scripts/configure.sh ${{ matrix.build_dir }} ${{ matrix.preset }}
+
+      - name: Build
+        run: cmake --build ${{ matrix.build_dir }} -j$(getconf _NPROCESSORS_ONLN)
+
+      - name: Test
+        env:
+          ASAN_OPTIONS: ${{ matrix.name == 'asan debug' && 'detect_leaks=1:abort_on_error=1' || '' }}
+        run: ctest --test-dir ${{ matrix.build_dir }} --output-on-failure --output-junit test-results.xml
+
+      - name: Publish test results
+        uses: dorny/test-reporter@v1.9.1
+        if: success() || failure()
+        with:
+          name: "test (${{ matrix.name }})"
+          path: ${{ matrix.build_dir }}/test-results.xml
+          reporter: java-junit
+          fail-on-empty: ${{ job.status == 'success' && 'true' || 'false' }}
+
+  # ════════════════════════════════════════════════════════════════════════════
+  # Publish: build o-rly artifacts + Docker image (needs verify to pass)
+  # ════════════════════════════════════════════════════════════════════════════
+
+  publish:
+    needs: [build]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: ubuntu-22.04-amd64
+    name: publish (${{ matrix.name }})
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OMOQ_APP_ID }}
+          private-key: ${{ secrets.OMOQ_APP_PRIV_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Install system dependencies
+        run: bash deps/moxygen/standalone/install-system-deps.sh
+
+      - name: Download moxygen artifacts
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: bash scripts/setup-deps-tarball.sh
+
+      - name: Set up ccache
+        uses: hendrikmuhs/ccache-action@v1
+        with:
+          key: publish-${{ matrix.name }}
+          max-size: 500M
+
+      - name: Configure
+        run: |
+          cmake -S . -B _build --preset default \
+            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
+            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
+            -DCMAKE_PREFIX_PATH="$(cat .scratch/cmake_prefix_path.txt)" \
+            -DBUILD_TESTING=OFF
+
+      - name: Build
+        run: cmake --build _build -j$(getconf _NPROCESSORS_ONLN)
+
+      - name: Install
+        run: cmake --install _build --prefix "$GITHUB_WORKSPACE/install"
+
+      - name: Log in to GHCR
+        if: runner.os == 'Linux'
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      - name: Build and push Docker image
+        if: runner.os == 'Linux'
+        run: |
+          SHORT="${GITHUB_SHA:0:7}"
+          IMAGE="ghcr.io/${{ github.repository }}"
+          docker build -f docker/Dockerfile \
+            -t "${IMAGE}:${SHORT}" \
+            -t "${IMAGE}:latest" \
+            .
+          docker push "${IMAGE}:${SHORT}"
+          docker push "${IMAGE}:latest"
+
+      - name: Package
+        id: package
+        run: |
+          ARTIFACT="${{ github.event.repository.name }}-${{ matrix.name }}.tar.gz"
+          tar czf "$ARTIFACT" -C "$GITHUB_WORKSPACE/install" .
+          echo "artifact=$ARTIFACT" >> "$GITHUB_OUTPUT"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.package.outputs.artifact }}
+          path: ${{ steps.package.outputs.artifact }}
+          retention-days: 90
+
+  # ════════════════════════════════════════════════════════════════════════════
+  # Release: create/update snapshot-latest pre-release (all green)
+  # ════════════════════════════════════════════════════════════════════════════
+
+  release:
+    needs: [build, publish]
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts/
+
+      - name: Publish snapshot
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          SHORT="${GITHUB_SHA:0:7}"
+          TAG="snapshot-latest"
+
+          gh release delete "$TAG" --yes 2>/dev/null || true
+          git tag -d "$TAG" 2>/dev/null || true
+          git push origin ":refs/tags/$TAG" 2>/dev/null || true
+
+          gh release create "$TAG" artifacts/**/* \
+            --title "Latest build ($SHORT)" \
+            --prerelease \
+            --notes "$(cat <<EOF
+          Rolling snapshot of the latest build from \`main\`.
+
+          **Commit:** \`${GITHUB_SHA}\`
+          **Built:** $(date -u +%Y-%m-%dT%H:%M:%SZ)
+          **Docker:** \`ghcr.io/${{ github.repository }}:${SHORT}\`
+
+          This pre-release is automatically replaced on every push to \`main\`.
+          EOF
+          )"
+
+  # ════════════════════════════════════════════════════════════════════════════
+  # Notify: aggregate status (runs after everything)
+  # ════════════════════════════════════════════════════════════════════════════
+
+  notify:
+    needs: [format, build, publish, release]
+    if: always()
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Notify Slack
+        continue-on-error: true
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.OMOQ_SLACK_WEBHOOK_URL }}
+        run: |
+          SHORT="${GITHUB_SHA:0:7}"
+          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+          # Map job results to status symbols
+          fmt_status() {
+            case "$1" in
+              success)   echo "✓" ;;
+              failure)   echo "✗" ;;
+              cancelled) echo "⊘" ;;
+              *)         echo "—" ;;
+            esac
+          }
+
+          FMT=$(fmt_status "${{ needs.format.result }}")
+          VER=$(fmt_status "${{ needs.build.result }}")
+          PUB=$(fmt_status "${{ needs.publish.result }}")
+          REL=$(fmt_status "${{ needs.release.result }}")
+
+          STATUS="format:${FMT} verify:${VER} publish:${PUB} release:${REL}"
+
+          if [ "${{ needs.release.result }}" = "success" ]; then
+            REL_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/snapshot-latest"
+            TEXT=":white_check_mark: *${{ github.repository }}* \`${{ github.ref_name }}\` \`${SHORT}\` — ${STATUS}  <${RUN_URL}|#${{ github.run_number }}> artifacts: <${REL_URL}|view>"
+          else
+            TEXT=":x: *${{ github.repository }}* \`${{ github.ref_name }}\` \`${SHORT}\` — ${STATUS}  <${RUN_URL}|#${{ github.run_number }}>"
+          fi
+
+          curl -s -X POST "$SLACK_WEBHOOK_URL" \
+            -H "Content-Type: application/json" \
+            --data "{\"text\": \"${TEXT}\"}"
+
+      - name: Notify email
+        continue-on-error: true
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.OMOQ_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.OMOQ_AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
+        run: |
+          SHORT="${GITHUB_SHA:0:7}"
+          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+          FMT="${{ needs.format.result }}"
+          VER="${{ needs.build.result }}"
+          PUB="${{ needs.publish.result }}"
+          REL="${{ needs.release.result }}"
+
+          STATUS="format:${FMT} verify:${VER} publish:${PUB} release:${REL}"
+
+          if [ "${{ needs.release.result }}" = "success" ]; then
+            REL_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/snapshot-latest"
+            SUBJECT="[o-rly] published ${{ github.ref_name }} ${SHORT}"
+            BODY="Repository: ${{ github.repository }}\nBranch: ${{ github.ref_name }}\nCommit: ${GITHUB_SHA}\nStatus: ${STATUS}\nDocker: ghcr.io/${{ github.repository }}:${SHORT}\nArtifacts: ${REL_URL}\nRun: ${RUN_URL}"
+          else
+            SUBJECT="[o-rly] pipeline failed ${{ github.ref_name }} ${SHORT}"
+            BODY="Repository: ${{ github.repository }}\nBranch: ${{ github.ref_name }}\nCommit: ${GITHUB_SHA}\nStatus: ${STATUS}\nRun: ${RUN_URL}"
+          fi
+
+          aws ses send-email \
+            --from "noreply@ci.openmoq.org" \
+            --destination '{"ToAddresses":["github-notifications@openmoq.org"]}' \
+            --message "{
+              \"Subject\": {\"Data\": \"${SUBJECT}\"},
+              \"Body\": {\"Text\": {\"Data\": \"${BODY}\"}}
+            }"
diff --git a/.github/workflows/verify.yml → .github/workflows/ci-pr.yml b/.github/workflows/verify.yml → .github/workflows/ci-pr.yml
@@ -1,10 +1,15 @@
-name: verify
+name: ci pr
+
+# PR verification: format + build/test matrix.
+# Main push uses ci-main.yml which adds publish/release/notify.
 
 on:
   pull_request:
     branches: [main]
-  push:
-    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -77,4 +82,3 @@ jobs:
           path: ${{ matrix.build_dir }}/test-results.xml
           reporter: java-junit
           fail-on-empty: ${{ job.status == 'success' && 'true' || 'false' }}
-
diff --git a/.github/workflows/notify-main-failure.yml b/.github/workflows/notify-main-failure.yml