release.yml

name: Rust Build, Test, and Release
### https://github.com/harmless-tech/rust-github-actions

on:
  push:
    tags:
      - "v**"
  workflow_dispatch:

permissions:
  id-token: write
  attestations: write
  contents: write

env:
  bin-name: qstract
  feature-set: ''
  hack-group: ''
  cache: false
  CARGO_TERM_COLOR: always

jobs:
  release:
    outputs:
      tag: ${{ github.ref_name }}
      name: ${{ github.ref_name }}
      prerelease: ${{ steps.regex-tag.outputs.match == '' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: KyoriPowered/action-regex-match@v4
        id: regex-tag
        with:
          text: ${{ github.ref }}
          regex: '^refs\/tags\/v\d+\.\d+\.\d+$'

#  publish-crates-io:
#    if: ${{ ! contains(github.ref, '-dev') }}
#    runs-on: ubuntu-latest
#    needs: [ release, check-fmt, clippy, ink-cross, apple-darwin, pc-windows-msvc ]
#    steps:
#      - uses: actions/checkout@v4
#      - name: Update Rust
#        run: |
#          rustup update
#          rustc --version
#      - name: Publish
#        run: cargo publish --verbose --locked --token ${CRATES_TOKEN}
#        env:
#          CRATES_TOKEN: ${{ secrets.CRATES_TOKEN }}

  publish-github-releases:
    runs-on: ubuntu-latest
    needs: [ release, check-fmt, clippy, ink-cross, apple-darwin, pc-windows-msvc ]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
      - name: Merge hashes
        shell: bash
        run: |
          set -euxo pipefail
          echo -n "" > hashes.sha256
          for D in target-*; do
            if [ -d "${D}" ]; then
              echo "${D}"
              pushd "${D}"
              cat *.sha256 >> ../hashes.sha256
              popd
            fi
          done
#      - name: Sign archives
#        shell: bash
#        run: |
#          set -euxo pipefail
#          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
#          brew install minisign
#          echo -n "$SIGNING_KEY" | base64 --decode > ~/.minisign_secret.key
#          for D in target-*; do
#            if [ -d "${D}" ]; then
#              echo "${D}"
#              pushd "${D}"
#
#              for file in ./*.tar.gz ./*.zip; do
#                if [ -f "$file" ]; then
#                  minisign -S -s ~/.minisign_secret.key -m $file
#                  minisign -V -p ../keys/cargo-prebuilt.pub -m $file
#                fi
#              done
#
#              popd
#            fi
#          done
#          rm -f ~/.minisign_secret.key
#        env:
#          SIGNING_KEY: ${{ secrets.MINISIGN_SIGNING_KEY }}
      - name: Create and push artifacts to release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ needs.release.outputs.tag }}
          name: ${{ needs.release.outputs.name }}
          allowUpdates: true
          prerelease: ${{ needs.release.outputs.prerelease }}
          artifacts: "target-*/qstract-*,hashes.sha256"
          body: ""

  check-fmt:
    env:
      CARGO_TERM_COLOR: never
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install nightly
        run: rustup toolchain install nightly --allow-downgrade -c rustfmt
      - name: Rustfmt Check
        run: |
          set -o pipefail
          cargo +nightly fmt --check 2>&1 | tee .step-data.txt
      - name: Put into summary (success)
        if: success()
        run: echo "Success" >> $GITHUB_STEP_SUMMARY
      - name: Put into summary (failure)
        if: failure()
        run: |
          echo "Failed!" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`shell" >> $GITHUB_STEP_SUMMARY
          cat .step-data.txt >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

  clippy:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-pc-windows-msvc
            os: windows-latest
    env:
      CARGO_TERM_COLOR: never
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - name: Update Rust
        run: |
          rustup update
          rustc --version
      - uses: Swatinem/rust-cache@v2
        if: ${{ env.cache == 'true' }}
      - name: Clippy Check
        shell: bash
        run: |
          set -o pipefail
          cargo clippy --all-targets --verbose --workspace --profile=zmall --locked -- -D warnings 2>&1 | tee .step-data.txt
          cargo clippy --all-targets --verbose --workspace --profile=zmall --locked ${{ env.feature-set }} -- -D warnings 2>&1 | tee .step-data.txt
      - name: Put into summary (success)
        if: success()
        shell: bash
        run: echo "Success" >> $GITHUB_STEP_SUMMARY
      - name: Put into summary (failure)
        if: failure()
        shell: bash
        run: |
          echo "Failed!" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`shell" >> $GITHUB_STEP_SUMMARY
          cat .step-data.txt >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

  cargo-hack:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-pc-windows-msvc
            os: windows-latest
    env:
      CARGO_TERM_COLOR: never
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - name: Update Rust
        run: |
          rustup update
          rustc --version
      - uses: cargo-prebuilt/cargo-prebuilt-action@v4
        with:
          pkgs: cargo-hack
      - uses: Swatinem/rust-cache@v2
        if: ${{ env.cache == 'true' }}
      - name: Hack Check (each-feature)
        shell: bash
        run: |
          set -o pipefail
          cargo hack check --each-feature --no-dev-deps --verbose --workspace --profile=zmall --locked 2>&1 | tee .step-data.txt
      - name: Hack Check (feature-powerset)
        shell: bash
        run: |
          set -o pipefail
          cargo hack check --feature-powerset ${{ env.hack-group }} --no-dev-deps --verbose --workspace --profile=zmall --locked 2>&1 | tee .step-data.txt
      - name: Put into summary (success)
        if: success()
        shell: bash
        run: echo "Success" >> $GITHUB_STEP_SUMMARY
      - name: Put into summary (failure)
        if: failure()
        shell: bash
        run: |
          echo "Failed!" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`shell" >> $GITHUB_STEP_SUMMARY
          cat .step-data.txt >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

  cargo-msrv:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          # Remove for now. GH actions doesn't like installing toolchains on windows.
          # - target: x86_64-pc-windows-msvc
          #   os: windows-latest
    env:
      CARGO_TERM_COLOR: never
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - name: Update Rust
        run: |
          rustup update
          rustc --version
      - uses: cargo-prebuilt/cargo-prebuilt-action@v4
        with:
          pkgs: cargo-binstall
      - name: Install cargo-msrv
        run: cargo binstall --no-confirm cargo-msrv
      - uses: Swatinem/rust-cache@v2
        if: ${{ env.cache == 'true' }}
      - name: MSRV Check
        shell: bash
        run: |
          set -o pipefail
          cargo msrv verify -- cargo check --verbose --profile=zmall --locked 2>&1 | tee .step-data.txt
      - name: Put into summary (success)
        if: success()
        shell: bash
        run: echo "Success" >> $GITHUB_STEP_SUMMARY
      - name: Put into summary (failure)
        if: failure()
        shell: bash
        run: |
          echo "Failed!" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`shell" >> $GITHUB_STEP_SUMMARY
          cat .step-data.txt >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

  cargo-deny:
    env:
      CARGO_TERM_COLOR: never
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Update Rust
        run: |
          rustup update
          rustc --version
      - uses: cargo-prebuilt/cargo-prebuilt-action@v4
        with:
          pkgs: cargo-deny
      - name: Cargo Deny
        shell: bash
        run: |
          set -o pipefail
          cargo deny check 2>&1 | tee .step-data.txt
      - name: Put into summary (success)
        if: success()
        shell: bash
        run: echo "Success" >> $GITHUB_STEP_SUMMARY
      - name: Put into summary (failure)
        if: failure()
        shell: bash
        run: |
          echo "Failed!" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`shell" >> $GITHUB_STEP_SUMMARY
          cat .step-data.txt >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

  reports:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Update Rust
        run: |
          rustup update
          rustc --version
      - uses: cargo-prebuilt/cargo-prebuilt-action@v4
        with:
          pkgs: cargo-audit
      - uses: Swatinem/rust-cache@v2
        if: ${{ env.cache == 'true' }}
      - name: Cache Advisory DB
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/advisory-db
          key: cache-advisory-db
      - name: Deps Report
        run: |
          test -f Cargo.lock || cargo generate-lockfile --verbose
          echo "### Deps:" >> $GITHUB_STEP_SUMMARY
          echo "Generated on: $(date --utc)" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          cargo tree --verbose -e normal,build --locked >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
      - name: Audit Report
        run: |
          echo "### Audit:" >> $GITHUB_STEP_SUMMARY
          echo "Generated on: $(date --utc)" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          cargo audit >> $GITHUB_STEP_SUMMARY || true
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

  ink-cross:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-unknown-linux-gnu
            can-test: false
          - target: aarch64-unknown-linux-musl
            can-test: false
          - target: armv7-unknown-linux-gnueabihf
            can-test: false
          - target: armv7-unknown-linux-musleabihf
            can-test: false
          - target: powerpc64le-unknown-linux-gnu
            can-test: false
          - target: powerpc64-unknown-linux-gnu
            can-test: false
          - target: riscv64gc-unknown-linux-gnu
            can-test: false
          - target: s390x-unknown-linux-gnu
            can-test: false
          - target: x86_64-unknown-linux-gnu
            can-test: true
          - target: x86_64-unknown-linux-musl
            can-test: true
          - target: x86_64-unknown-freebsd
            can-test: false
          - target: x86_64-unknown-netbsd
            can-test: false
    runs-on: ubuntu-latest
    needs: [ check-fmt, clippy, cargo-hack, cargo-msrv, cargo-deny ]
    steps:
      - uses: actions/checkout@v4
      - uses: cargo-prebuilt/cargo-prebuilt-action@v4
        with:
          pkgs: coreutils
      - uses: Swatinem/rust-cache@v2
        if: ${{ env.cache == 'true' }}
      - name: Build
        run: |
          docker run --rm \
          --userns host --user $(id -u):$(id -g) \
          -v $HOME/.cargo/registry:/usr/local/cargo/registry \
          -v ./:/project \
          ghcr.io/cargo-prebuilt/ink-cross:nightly-${{ matrix.target }} \
          auditable build --verbose --workspace --profile=zmall --locked --target ${{ matrix.target }} ${{ env.feature-set }}
      - name: Run tests
        if: ${{ matrix.can-test }}
        run: |
          BIN_LOC="./target/${{ matrix.target }}/zmall/${{ env.bin-name }}" ./test/_test.sh
      - name: Rename
        run: cp ./target/${{ matrix.target }}/zmall/${{ env.bin-name }} ./${{ env.bin-name }}-${{ matrix.target }}
      - name: Chmod
        run: chmod +x ./${{ env.bin-name }}-${{ matrix.target }}
      - uses: actions/attest-build-provenance@v2
        with:
          subject-path: ./${{ env.bin-name }}-${{ matrix.target }}
      - name: Hash
        run: echo "$(coreutils sha256sum ./${{ env.bin-name }}-${{ matrix.target }})" > ${{ matrix.target }}.sha256
      - name: Artifact
        uses: actions/upload-artifact@v4
        with:
          name: target-${{ matrix.target }}
          path: |
            ${{ env.bin-name }}-${{ matrix.target }}
            ${{ matrix.target }}.sha256

  apple-darwin:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-apple-darwin
            os: macos-13
          - target: aarch64-apple-darwin
            os: macos-latest
    runs-on: ${{ matrix.os }}
    needs: [ check-fmt, clippy, cargo-hack, cargo-msrv, cargo-deny ]
    steps:
      - uses: actions/checkout@v4
      - name: Update Rust and add target
        run: |
          rustup toolchain install nightly
          rustc +nightly --version
          rustup target add ${{ matrix.target }}
          rustup component add rust-src --toolchain nightly --target ${{ matrix.target }}
      - uses: cargo-prebuilt/cargo-prebuilt-action@v4
        with:
          pkgs: cargo-auditable,coreutils
      - uses: Swatinem/rust-cache@v2
        if: ${{ env.cache == 'true' }}
      - name: Build
        run: cargo +nightly auditable build --verbose --workspace --profile=zmall --locked --target ${{ matrix.target }} ${{ env.feature-set }}
      - name: Run tests
        if: ${{ matrix.can-test }}
        run: |
          BIN_LOC="./target/${{ matrix.target }}/zmall/${{ env.bin-name }}" ./test/_test.sh
      - name: Rename
        run: cp ./target/${{ matrix.target }}/zmall/${{ env.bin-name }} ./${{ env.bin-name }}-${{ matrix.target }}
      - name: Chmod
        run: chmod +x ./${{ env.bin-name }}-${{ matrix.target }}
      - uses: actions/attest-build-provenance@v2
        with:
          subject-path: ./${{ env.bin-name }}-${{ matrix.target }}
      - name: Hash
        run: echo "$(coreutils sha256sum ./${{ env.bin-name }}-${{ matrix.target }})" > ${{ matrix.target }}.sha256
      - name: Artifact
        uses: actions/upload-artifact@v4
        with:
          name: target-${{ matrix.target }}
          path: |
            ${{ env.bin-name }}-${{ matrix.target }}
            ${{ matrix.target }}.sha256

  pc-windows-msvc:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-pc-windows-msvc
            can-test: true
          - target: aarch64-pc-windows-msvc
            can-test: false
    runs-on: windows-latest
    needs: [ check-fmt, clippy, cargo-hack, cargo-msrv, cargo-deny ]
    steps:
      - uses: actions/checkout@v4
      - name: Update Rust and add target
        run: |
          rustup toolchain install nightly
          rustc +nightly --version
          rustup target add ${{ matrix.target }}
          rustup component add rust-src --toolchain nightly --target ${{ matrix.target }}
      - uses: cargo-prebuilt/cargo-prebuilt-action@v4
        with:
          pkgs: cargo-auditable,coreutils
      - uses: Swatinem/rust-cache@v2
        if: ${{ env.cache == 'true' }}
      - name: Build
        run: cargo +nightly auditable build --verbose --workspace --profile=zmall --locked --target ${{ matrix.target }} ${{ env.feature-set }}
      - name: Rename
        run: cp ./target/${{ matrix.target }}/zmall/${{ env.bin-name }}.exe ./${{ env.bin-name }}-${{ matrix.target }}.exe
      - uses: actions/attest-build-provenance@v2
        with:
          subject-path: ./${{ env.bin-name }}-${{ matrix.target }}.exe
      - name: Hash
        run: echo "$(coreutils sha256sum ./${{ env.bin-name }}-${{ matrix.target }}.exe)" > ${{ matrix.target }}.sha256
      - name: Artifact
        uses: actions/upload-artifact@v4
        with:
          name: target-${{ matrix.target }}
          path: |
            ${{ env.bin-name }}-${{ matrix.target }}.exe
            ${{ matrix.target }}.sha256