matter.yml

name: Matter code generation

permissions:
  contents: write

on:
  push:
  pull_request:
  workflow_dispatch:

env:
  ZAP_TEST_TIMEOUT: 3600000
  ZAP_TEMPSTATE: 1
  BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
  P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
  TRUSTED_CERTIFICATE_BASE64: ${{ secrets.TRUSTED_CERTIFICATE_BASE64 }}
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  KEYCHAIN_PASSWORD: silabs

jobs:
  prepare-zap:
    name: Prepare zap for Matter generation
    runs-on: ${{ matrix.os }}

    strategy:
      matrix:
        node-version: [20.x]
        os: [ubuntu-22.04]

    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      - run: sudo ./src-script/install-packages-ubuntu
      - run: sudo apt-get install --fix-missing libxml2-utils
      - run: node --version
      - run: npm --version
      - run: npm ci
      - run: npm run metafile-check
      - run: npm run version-stamp
      - run: npm rebuild canvas --update-binary
      - run: npm rebuild libxmljs --update-binary
      - run: npm run lic
      - run: npm run build-spa
      - run: npm run lint
      - run: npm run xml-validate
      - run: npm run self-check

  build-zap:
    name: Build ZAP
    needs: [prepare-zap]
    runs-on: ${{ matrix.os }}

    # Platforms to build on/for
    strategy:
      matrix:
        os: [ubuntu-22.04]
      fail-fast: false

    steps:
      - name: Check out Git repository
        uses: actions/checkout@v4

      - name: Install Node.js, NPM and Yarn
        uses: actions/setup-node@v4
        with:
          node-version: 20.x
          cache: 'npm'

      - name: Prepare Linux build environment
        if: startsWith(matrix.os, 'ubuntu')
        run: |
          sudo ./src-script/install-packages-ubuntu

      - name: Initialize...
        run: |
          npm rebuild canvas --update-binary
          npm rebuild libxmljs --update-binary
          npm ci
          npm run version-stamp

      - name: Building frontend / backend
        run: |
          npm run build

      - name: Build & Release for Linux
        if: startsWith(matrix.os, 'ubuntu')
        run: |
          npm run pack:linux
          npm run pkg:linux
          ls ./dist/
          npm run pack:cli:linux

          mv dist/zap-linux-amd64.deb dist/zap-linux-x64.deb
          mv dist/zap-linux-x86_64.rpm dist/zap-linux-x64.rpm

        env:
          GH_TOKEN: ${{ secrets.github_token }}
          # macOS notarization API key
          # CSC_LINK: ${{ secrets.api_key_id }}
          # CSC_KEY_PASSWORD: ${{ secrets.api_key_issuer_id }}

      - name: Verify zap-cli exists in Linux x64 .zip package
        if: startsWith(matrix.os, 'ubuntu')
        run: |
          output=$(./node_modules/7zip-bin/linux/x64/7za l ./dist/zap-linux-x64.zip)
          expression=zap-cli
          if [[ $output == *"$expression"* ]]; then
            echo "Output contains $expression"
          else
            echo "Output does not contain $expression"
            exit 1
          fi
      - name: Verify zap-cli exists in Linux arm64 .zip package
        if: startsWith(matrix.os, 'ubuntu')
        run: |
          output=$(./node_modules/7zip-bin/linux/x64/7za l ./dist/zap-linux-arm64.zip)
          expression=zap-cli
          if [[ $output == *"$expression"* ]]; then
            echo "Output contains $expression"
          else
            echo "Output does not contain $expression"
            exit 1
          fi
      - name: ZAP binary check (Linux) - unzip
        if: startsWith(matrix.os, 'ubuntu')
        run: unzip dist/zap-linux-x64.zip -d dist/zap-linux
      - name: ZAP binary check (Linux) - check version is set
        if: startsWith(matrix.os, 'ubuntu')
        uses: GuillaumeFalourd/assert-command-line-output@v2.1
        with:
          command_line: ./dist/zap-linux/zap --version
          contains: '0.0.0'
          expected_result: FAILED
      - name: ZAP binary check (Linux) - check version is set via CLI
        if: startsWith(matrix.os, 'ubuntu')
        uses: GuillaumeFalourd/assert-command-line-output@v2.1
        with:
          command_line: ./dist/zap-linux/zap-cli --version
          contains: '0.0.0'
          expected_result: FAILED
      - name: ZAP binary check (Linux) - unzip cleanup
        if: startsWith(matrix.os, 'ubuntu')
        run: rm -rf dist/zap-linux
      - name: Verify apack.json exists in package's base directory
        if: startsWith(matrix.os, 'ubuntu')
        uses: GuillaumeFalourd/assert-command-line-output@v2.1
        with:
          command_line: ./node_modules/7zip-bin/linux/x64/7za l ./dist/zap-linux-x64.zip | grep apack.json
          contains: 'apack.json'
      - name: Verify apack.json exists in package's app.asar archive
        if: startsWith(matrix.os, 'ubuntu')
        uses: GuillaumeFalourd/assert-command-line-output@v2.1
        with:
          command_line: npx asar l ./dist/linux-unpacked/resources/app.asar | grep apack.json
          contains: 'apack.json'
      - name: Archive Linux (x64) .zip file
        uses: actions/upload-artifact@v4
        if: startsWith(matrix.os, 'ubuntu')
        with:
          name: zap-linux-x64-zip
          path: dist/zap-linux-x64.zip
      - name: Archive Linux (arm64) .zip file
        uses: actions/upload-artifact@v4
        if: startsWith(matrix.os, 'ubuntu')
        with:
          name: zap-linux-arm64-zip
          path: dist/zap-linux-arm64.zip
      - name: Archive Linux .rpm file
        uses: actions/upload-artifact@v4
        if: startsWith(matrix.os, 'ubuntu')
        with:
          name: zap-linux-x64-rpm
          path: dist/zap-linux-x64.rpm
      - name: Archive Linux x64 .deb file
        uses: actions/upload-artifact@v4
        if: startsWith(matrix.os, 'ubuntu')
        with:
          name: zap-linux-x64-deb
          path: dist/zap-linux-x64.deb

  matter-sdk-codegen-master:
    name: Test matter sdk codegen changes (master)
    needs: [build-zap]
    runs-on: ubuntu-22.04

    # CHIP container required because clang-format version needs to match
    container:
      image: ghcr.io/project-chip/chip-build:125

    steps:
      - uses: actions/download-artifact@v4
        with:
          name: zap-linux-x64-zip

      - name: Unpack linux artifact
        run: |
          mkdir zap-release && cd zap-release && unzip ../zap-linux-x64.zip

      # Checkout without actions/checkout@v4 since that one uses a repository specific token
      - name: Checkout Matter SDK (master)
        run: |
          git clone --depth 1 --branch master https://github.com/project-chip/connectedhomeip.git chip_repo

      - name: Ensure matter embedded zap is not available
        run: |
          rm -f /usr/bin/zap-cli
          rm -rf /opt/zap-*

      - name: Generate all (master)
        run: |
          cd chip_repo
          ./scripts/checkout_submodules.py --allow-changing-global-git-config --shallow --platform linux
          ZAP_INSTALL_PATH=$(pwd)/../zap-release scripts/run_in_build_env.sh "scripts/tools/zap_regen_all.py --type global"
          ZAP_INSTALL_PATH=$(pwd)/../zap-release scripts/run_in_build_env.sh "scripts/tools/zap_regen_all.py --type specific"

      - name: Ensure git works in the chip repository checkout
        run: git config --global --add safe.directory `pwd`/chip_repo

      - name: Check for uncommited changes (master)
        run: |
          cd chip_repo
          git add .
          # Show the full diff
          git diff-index -p HEAD --
          # Also show just the files that are different, to make it easy
          # to tell at a glance what might be going on.  And throw in
          # --exit-code to make this job fail if there is a difference.
          git diff-index --exit-code HEAD --

  matter-sdk-codegen-v1-4-2:
    name: Test matter sdk codegen changes (v1.4.2-branch)
    needs: [build-zap]
    runs-on: ubuntu-22.04

    # CHIP container required because clang-format version needs to match
    container:
      image: ghcr.io/project-chip/chip-build:125

    steps:
      - uses: actions/download-artifact@v4
        with:
          name: zap-linux-x64-zip

      - name: Unpack linux artifact
        run: |
          mkdir zap-release && cd zap-release && unzip ../zap-linux-x64.zip

      # Checkout without actions/checkout@v4 since that one uses a repository specific token
      - name: Checkout Matter SDK (v1.4.2-branch)
        run: |
          git clone --depth 1 --branch v1.4.2-branch https://github.com/project-chip/connectedhomeip.git chip_repo

      - name: Ensure matter embedded zap is not available
        run: |
          rm -f /usr/bin/zap-cli
          rm -rf /opt/zap-*

      - name: Generate all (v1.4.2-branch)
        run: |
          cd chip_repo
          ./scripts/checkout_submodules.py --allow-changing-global-git-config --shallow --platform linux
          ZAP_INSTALL_PATH=$(pwd)/../zap-release scripts/run_in_build_env.sh "scripts/tools/zap_regen_all.py --type global"
          ZAP_INSTALL_PATH=$(pwd)/../zap-release scripts/run_in_build_env.sh "scripts/tools/zap_regen_all.py --type specific"

      - name: Ensure git works in the chip repository checkout
        run: git config --global --add safe.directory `pwd`/chip_repo

      - name: Check for uncommited changes (v1.4.2-branch)
        run: |
          cd chip_repo
          git add .
          # v1.4.2-branch: ignore regen drift on existing .matter files (vs this LTS baseline).
          # This was done because there was a provisional conformance update that was added to ZAP
          # which affected all branches but is the correct change for this/all-old branches.
          # Use a plain pipe (not bash process substitution) — chip-build runs /bin/sh.
          git ls-files | awk '/\.matter$/ { print }' | while IFS= read -r f; do
            if git rev-parse "HEAD:${f}" >/dev/null 2>&1; then
              git restore --source=HEAD --staged --worktree -- "$f"
            fi
          done
          # Show the full diff
          git diff-index -p HEAD --
          # Also show just the files that are different, to make it easy
          # to tell at a glance what might be going on.  And throw in
          # --exit-code to make this job fail if there is a difference.
          git diff-index --exit-code HEAD --