vorpal.yaml

name: vorpal

on:
  pull_request:
  push:
    branches:
      - main
  schedule:
    - cron: "0 8 * * *"

jobs:
  code-quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: ./script/dev.sh # pre-bake
      - run: ./script/dev.sh make format
      - run: ./script/dev.sh make lint

  package:
    needs:
      - code-quality
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        runner:
          - macos-13
          - macos-latest
          - ubuntu-latest
          - ubuntu-latest-arm64
    steps:
      - uses: actions/checkout@v4

      - run: ./script/dev.sh # pre-bake
      - run: ./script/dev.sh make dist

      - run: |
          echo "ARCH=$(uname -m | tr '[:upper:]' '[:lower:]' | sed 's/arm64/aarch64/')" >> $GITHUB_ENV
          echo "OS=$(uname -s | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV

      - uses: actions/upload-artifact@v4
        with:
          name: vorpal-dist-${{ env.ARCH }}-${{ env.OS }}
          path: dist

  test:
    needs:
      - package
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        runner:
          # - macos-13
          - macos-latest
          - ubuntu-latest
          # - ubuntu-latest-arm64
    steps:
      - uses: actions/checkout@v4

      - if: matrix.runner == 'ubuntu-latest'
        run: |
          ./script/dev/debian.sh

          cat > bwrap << EOF
          abi <abi/4.0>,
          include <tunables/global>

          profile bwrap /usr/bin/bwrap flags=(unconfined) {
            userns,

            # Site-specific additions and overrides. See local/README for details.
            include if exists <local/bwrap>
          }
          EOF

          sudo mv bwrap /etc/apparmor.d/bwrap
          sudo systemctl restart apparmor.service

      - run: |
          sudo mkdir -pv /var/lib/vorpal/{cache,key,sandbox,store}
          sudo chown -R "$(id -u):$(id -g)" /var/lib/vorpal

      - run: |
          echo "ARCH=$(uname -m | tr '[:upper:]' '[:lower:]' | sed 's/arm64/aarch64/')" >> $GITHUB_ENV
          echo "OS=$(uname -s | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV

      - uses: actions/download-artifact@v4
        with:
          name: vorpal-dist-${{ env.ARCH }}-${{ env.OS }}

      - run: |
          mkdir -pv ./dist
          tar -xzvf ./vorpal-${ARCH}-${OS}.tar.gz -C ./dist
          rm -rf ./vorpal-${ARCH}-${OS}.tar.gz

      - run: ./dist/vorpal keys generate

      - uses: actions/github-script@v7
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      - run: |
          ./dist/vorpal start --registry-backend "gha" \
            > worker_output.log 2>&1 &
          WORKER_PID=$(echo $!)
          echo "WORKER_PID=$WORKER_PID" >> $GITHUB_ENV
          echo "Worker pid: $WORKER_PID"

      - run: ./dist/vorpal artifact --name "vorpal-shell"
      - run: ./dist/vorpal artifact --name "vorpal"

      - if: always()
        run: |
          cat worker_output.log || true
          kill $WORKER_PID || true

  release:
    if: github.event.schedule != ''
    needs:
      - test
    permissions:
      attestations: write
      contents: write
      id-token: write
      packages: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - run: git fetch --tags

      - uses: actions/download-artifact@v4
        with:
          fail-on-cache-miss: true
          pattern: vorpal-dist-*

      - env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if gh release view nightly > /dev/null 2>&1; then
            gh release delete --cleanup-tag --yes nightly
          fi
          git tag nightly
          git push --tags

      - uses: softprops/action-gh-release@v2
        with:
          body: Nightly builds from `main` branch.
          fail_on_unmatched_files: true
          files: |
            vorpal-dist-aarch64-darwin/vorpal-aarch64-darwin.tar.gz
            vorpal-dist-aarch64-linux/vorpal-aarch64-linux.tar.gz
            vorpal-dist-x86_64-darwin/vorpal-x86_64-darwin.tar.gz
            vorpal-dist-x86_64-linux/vorpal-x86_64-linux.tar.gz
          name: nightly
          prerelease: true
          tag_name: refs/tags/nightly

      - run: |
          mkdir -pv dist/aarch64-darwin
          mkdir -pv dist/aarch64-linux
          mkdir -pv dist/x86_64-darwin
          mkdir -pv dist/x86_64-linux
          tar -xzvf vorpal-dist-aarch64-darwin/vorpal-aarch64-darwin.tar.gz -C dist/aarch64-darwin
          tar -xzvf vorpal-dist-aarch64-linux/vorpal-aarch64-linux.tar.gz -C dist/aarch64-linux
          tar -xzvf vorpal-dist-x86_64-darwin/vorpal-x86_64-darwin.tar.gz -C dist/x86_64-darwin
          tar -xzvf vorpal-dist-x86_64-linux/vorpal-x86_64-linux.tar.gz -C dist/x86_64-linux
          mv dist/aarch64-darwin/vorpal dist/aarch64-darwin/vorpal-aarch64-darwin
          mv dist/aarch64-linux/vorpal dist/aarch64-linux/vorpal-aarch64-linux
          mv dist/x86_64-darwin/vorpal dist/x86_64-darwin/vorpal-x86_64-darwin
          mv dist/x86_64-linux/vorpal dist/x86_64-linux/vorpal-x86_64-linux

      - uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            dist/aarch64-darwin/vorpal-aarch64-darwin
            dist/aarch64-linux/vorpal-aarch64-linux
            dist/x86_64-darwin/vorpal-x86_64-darwin
            dist/x86_64-linux/vorpal-x86_64-linux