run_command.yml

on:
  workflow_call:
    inputs:
      ec2-image-id:
        type: string
        required: false
        default: ami-042a37e33a285c22b
      ec2-instance-type:
        type: string
        required: false
        default: c4.4xlarge
      key-name:
        type: string
        required: false
        default: perf-long
      ec2-subnet-id:
        type: string
        required: false
        default: subnet-0390bf48ec3e870ab
      ec2-security-group-id:
        type: string
        required: false
        default: sg-02993a2e1fa61b1c7
      ec2-volume-size:
        type: string
        required: false
        default: '200'
      submodules:
        type: string
        required: false
        default: 'true'
      command:
        type: string
        required: true
        default: 'sleep 60s'
      sanitizer:
        required: false
        type: string
        default: ''
      arch:
        required: false
        type: string
        default: 'x64'
      tag:
        required: false
        type: string
        default: 'sanitizer'
      timeout:
        required: false
        type: number
        default: 0
      run_mode:
        required: false
        type: string
        default: 'start' # start_spot, start
      upload_files:
        required: false
        type: string
        default: ''
      upjob:
        type: string
        required: false
        default: ''
      s3_upload:
        required: false
        type: boolean
        default: false
      s3_output_path:
        required: false
        type: string
        default: 'proton/cross-compile/macOS-x86'
      prerelease:
        required: false
        default: false
        type: boolean
      ref:
        required: false
        type: string
        default: ''
      generate_release_notes:
        required: false
        type: boolean
        default: true
      release_body:
        required: false
        type: string
        default: |
          ## Docker Images Available

          ```bash
          docker pull d.timeplus.com/timeplus-io/proton:latest
          ```

          For detailed usage and more information, check out the Timeplus documentation: https://docs.timeplus.com/
      upload_only:
        required: false
        type: boolean
        default: false
    outputs:
      tag_name:
        description: "Tag name for releae build use"
        value: ${{ jobs.execute-command.outputs.tag_name }}
    secrets:
      AWS_ACCESS_KEY_ID:
        required: true
      AWS_SECRET_ACCESS_KEY:
        required: true
      AWS_REGION:
        required: true
      AWS_S3_BUCKET:
        required: true
      GH_PERSONAL_ACCESS_TOKEN:
        required: true
      DOCKERHUB_USERNAME:
        required: true
      DOCKERHUB_TOKEN:
        required: true
      TIMEPLUS_ADDRESS:
        required: false
      TIMEPLUS_API_KEY:
        required: false
      TIMEPLUS_WORKSPACE:
        required: false
      TP_DEMO_API_KEY:
        required: false
      TP_DEMO_SITE_API_KEY:
        required: false

jobs:
  start-runner:
    name: Start self-hosted EC2 runner
    runs-on: ubuntu-latest
    outputs:
      label: ${{ steps.start-ec2-runner.outputs.label }}
      ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6.0.0
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}
      - name: Start EC2 runner
        id: start-ec2-runner
        # Temporary pin to the Node 24-compatible fork until the companion ec2-github-runner PR merges.
        uses: yokofly/ec2-github-runner@522cb941f0d76565385ce7aeb6771bf58451ba1b
        with:
          mode: ${{ inputs.run_mode }}
          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          key-name: ${{ inputs.key-name }}
          ec2-image-id: ${{ inputs.ec2-image-id }}
          ec2-instance-type: ${{ inputs.ec2-instance-type }}
          ec2-volume-size: ${{ inputs.ec2-volume-size }}
          subnet-id: ${{ inputs.ec2-subnet-id }}
          security-group-id: ${{ inputs.ec2-security-group-id }}
          aws-resource-tags: > # optional, requires additional permissions
            [
              {"Key": "Name", "Value": "ec2-github-runner-${{ github.sha }}"},
              {"Key": "GitHubRepository", "Value": "${{ github.repository }}"}
            ]

  execute-command:
    name: Execute Command
    needs: start-runner # required to start the main job when the runner is ready
    runs-on: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner
    outputs:
      tag_name: ${{ steps.execute.outputs.tag_name }}
    env:
      SANITIZER: ${{ inputs.sanitizer }}
      ARCH: ${{ inputs.arch }}
      TAG: ${{ inputs.tag }}
      TIMEPLUS_ADDRESS: ${{ secrets.TIMEPLUS_ADDRESS }}
      TIMEPLUS_API_KEY: ${{ secrets.TIMEPLUS_API_KEY }}
      TIMEPLUS_WORKSPACE: ${{ secrets.TIMEPLUS_WORKSPACE }}
      TP_DEMO_API_KEY: ${{ secrets.TP_DEMO_API_KEY }}
      TP_DEMO_SITE_API_KEY: ${{ secrets.TP_DEMO_SITE_API_KEY }}
      GH_PERSONAL_ACCESS_TOKEN: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
    steps:
      - name: Configure AWS credentials from Test account
        uses: aws-actions/configure-aws-credentials@v6.0.0
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}
      
      - name: Login to DockerHub
        uses: docker/login-action@v4.0.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}

      - name: Checkout Repo
        uses: actions/checkout@v5.0.1
        with:
          token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          submodules: ${{ inputs.submodules }}
          ref: ${{ inputs.ref }}
      - name: Checkout quark
        uses: actions/checkout@v5.0.1
        with:
          repository: timeplus-io/quark
          path: quark
          token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
      - name: Prepare directory
        run: mkdir /test_output /artifacts

      - name: execute
        id: execute
        timeout-minutes: ${{ inputs.timeout }}
        run: |
          {
            echo "::group::Command"
            cat <<'__PROTON_COMMAND_EOF__'
          ${{ inputs.command }}
          __PROTON_COMMAND_EOF__
            echo "::endgroup::"
            echo "--- Command Output ---"
            ${{ inputs.command }}
          } 1> >(tee /artifacts/${{ inputs.upjob }}_execute_command_${{ github.run_id }}.txt)

      - name: Upload to S3
        if: ${{ inputs.s3_upload }}
        run: |
          BINARY_PATH=$(find $GITHUB_WORKSPACE -name "proton-*-Darwin-x86_64" -type f)
          
          if [ -z "$BINARY_PATH" ]; then
            echo "Error: Could not find binary file"
            exit 1
          fi
          
          # Calculate SHA256
          sha256sum $BINARY_PATH
          
          # Upload to S3
          aws s3 cp --no-progress $BINARY_PATH s3://${{ secrets.AWS_S3_BUCKET }}/${{ inputs.s3_output_path }}/
          
          # no need clean up?
          # rm -rf $GITHUB_WORKSPACE/ccache
          # rm -rf $GITHUB_WORKSPACE/build_docker

      - name: Create/overwrite release notes and upload assets
        if: ${{ !inputs.s3_upload && inputs.upload_files != '' && !inputs.upload_only }}
        uses: softprops/action-gh-release@v2.5.0
        with:
          files: ${{ inputs.upload_files }}
          token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          generate_release_notes: ${{ inputs.generate_release_notes }}
          append_body: false
          prerelease: ${{ inputs.prerelease }}
          tag_name: ${{ steps.execute.outputs.tag_name }}
          body: ${{ inputs.release_body }}

      - name: Upload assets to existing release (no body changes)
        if: ${{ !inputs.s3_upload && inputs.upload_files != '' && inputs.upload_only }}
        uses: softprops/action-gh-release@v2.5.0
        with:
          files: ${{ inputs.upload_files }}
          token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          prerelease: ${{ inputs.prerelease }}
          tag_name: ${{ steps.execute.outputs.tag_name }}

      - name: Upload Artifact
        if: ${{ always() && inputs.upjob != '' }}
        uses: actions/upload-artifact@v6.0.0
        with:
          name: Artifact-${{ inputs.upjob }}-${{ github.run_id }}
          path: |
            /artifacts/*
          retention-days: 7

  stop-runner:
    name: Stop self-hosted EC2 runner
    needs:
      - start-runner # required to get output from the start-runner job
      - execute-command # required to wait when the main job is done
    runs-on: ubuntu-latest
    if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6.0.0
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}
      - name: Stop EC2 runner
        # Keep the stop path on the same pinned fork revision as start.
        uses: yokofly/ec2-github-runner@522cb941f0d76565385ce7aeb6771bf58451ba1b
        with:
          mode: stop
          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          label: ${{ needs.start-runner.outputs.label }}
          ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }}