_rust-binary.yml

name: Rust Binary Release

on:
  workflow_call:
    inputs:
      bin_name:
        description: 'Binary name (e.g., image-resize)'
        required: true
        type: string
      manifest_path:
        description: 'Path to Cargo.toml (e.g., image-resize/Cargo.toml)'
        required: true
        type: string
      tag_name:
        description: 'Git tag for the GitHub Release (e.g., image-resize/v1.0.0)'
        required: true
        type: string
      is_prerelease:
        description: 'Mark as pre-release'
        required: false
        type: boolean
        default: false
      skip_create_release:
        description: 'Skip GH release creation (assumes release already exists for the tag)'
        required: false
        type: boolean
        default: false
      dry_run:
        description: 'Build binaries without uploading or creating releases'
        required: false
        type: boolean
        default: false
      targets:
        description: 'Optional comma-separated subset of build targets (default: all). Use to mark a worker as unix-only, host-only, etc.'
        required: false
        type: string
        default: ''
      version_override:
        description: 'When set, rewrite [package].version in manifest_path to this value before building. Used by the harness bundle to force coordinated versions across deps.'
        required: false
        type: string
        default: ''
      web_bundle:
        description: "Pre-build the SPA in <worker>/web/ (Node + pnpm) and ship the dist artifact to every matrix shard before `cargo build`. Required when the worker's build.rs embeds a Vite-built bundle (e.g. console)."
        required: false
        type: boolean
        default: false

env:
  CARGO_TERM_COLOR: always
  CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
  CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER: arm-linux-gnueabihf-gcc

jobs:
  pre-build:
    name: Pre-build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        if: inputs.skip_create_release != true && inputs.dry_run != true

      - name: Create GitHub Release
        if: inputs.skip_create_release != true && inputs.dry_run != true
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.tag_name }}
          name: ${{ inputs.bin_name }} ${{ inputs.tag_name }}
          draft: false
          prerelease: ${{ inputs.is_prerelease }}
          generate_release_notes: true

  matrix:
    name: Compute build matrix
    runs-on: ubuntu-latest
    outputs:
      include: ${{ steps.compute.outputs.include }}
    steps:
      - name: Compute matrix
        id: compute
        env:
          TARGETS: ${{ inputs.targets }}
        run: |
          python3 - <<'PY'
          import json, os, sys
          all_targets = [
              {"target": "x86_64-apple-darwin",            "os": "macos-latest"},
              {"target": "aarch64-apple-darwin",           "os": "macos-latest"},
              {"target": "x86_64-pc-windows-msvc",         "os": "windows-latest"},
              {"target": "i686-pc-windows-msvc",           "os": "windows-latest"},
              {"target": "aarch64-pc-windows-msvc",        "os": "windows-latest"},
              {"target": "x86_64-unknown-linux-gnu",       "os": "ubuntu-22.04"},
              {"target": "x86_64-unknown-linux-musl",      "os": "ubuntu-latest"},
              {"target": "aarch64-unknown-linux-gnu",      "os": "ubuntu-22.04"},
              {"target": "armv7-unknown-linux-gnueabihf",  "os": "ubuntu-22.04"},
          ]
          raw = (os.environ.get("TARGETS") or "").strip()
          if raw:
              wanted = [t.strip() for t in raw.split(",") if t.strip()]
              known = {t["target"] for t in all_targets}
              unknown = [t for t in wanted if t not in known]
              if unknown:
                  print(f"::error::unknown targets requested: {unknown}; known={sorted(known)}")
                  sys.exit(1)
              include = [t for t in all_targets if t["target"] in set(wanted)]
              if not include:
                  print("::error::targets filter resolved to empty set")
                  sys.exit(1)
          else:
              include = all_targets
          out = open(os.environ["GITHUB_OUTPUT"], "a")
          out.write(f"include={json.dumps(include)}\n")
          out.close()
          print(f"::notice::building {len(include)} target(s): {[t['target'] for t in include]}")
          PY

  # Workers like `console` embed a Vite-built SPA into the binary via
  # `rust-embed` (see `console/build.rs`). The matrix runners only carry
  # the Rust toolchain — running pnpm there would either fail outright
  # (Windows / cross-compile shards lack Node) or rebuild the same
  # platform-independent bundle nine times. Instead we build the SPA
  # once on a Linux runner, upload `<worker>/web/dist/` as an artifact,
  # and have every matrix shard download it before `cargo build`. The
  # crate's `build.rs` short-circuits when `web/dist/index.html` exists,
  # so the embed-time check is satisfied without ever touching pnpm
  # inside the cross-compile shards.
  web-build:
    name: Pre-build SPA bundle
    needs: [matrix]
    if: inputs.web_bundle
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Resolve worker dir
        id: dirs
        env:
          MANIFEST: ${{ inputs.manifest_path }}
        run: |
          set -euo pipefail
          worker=$(dirname "$MANIFEST")
          if [[ -z "$worker" || "$worker" == "." ]]; then
            echo "::error::could not derive worker dir from manifest_path=$MANIFEST"
            exit 1
          fi
          if [[ ! -f "$worker/web/package.json" ]]; then
            echo "::error::$worker/web/package.json not found; web_bundle=true requires a vite project under <worker>/web/"
            exit 1
          fi
          echo "worker=$worker" >> "$GITHUB_OUTPUT"
          echo "::notice::pre-building SPA bundle in $worker/web/"

      # `pnpm/action-setup` must run before `setup-node` so that
      # `setup-node`'s `cache: 'pnpm'` finds the binary on PATH.
      - uses: pnpm/action-setup@v4
        with:
          version: 10

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'pnpm'
          cache-dependency-path: ${{ steps.dirs.outputs.worker }}/web/pnpm-lock.yaml

      - name: pnpm install
        working-directory: ${{ steps.dirs.outputs.worker }}/web
        run: pnpm install --frozen-lockfile

      - name: pnpm build
        working-directory: ${{ steps.dirs.outputs.worker }}/web
        run: pnpm build

      - name: Upload web bundle
        uses: actions/upload-artifact@v4
        with:
          name: web-bundle
          path: ${{ steps.dirs.outputs.worker }}/web/dist/
          if-no-files-found: error
          retention-days: 1

  build:
    name: Build ${{ matrix.target }}
    needs: [pre-build, matrix, web-build]
    # `web-build` is gated on `inputs.web_bundle`, so it is skipped for any
    # worker without a `web/package.json` (database, shell, mcp, …). GitHub
    # Actions' default `success()` gate treats a skipped need as "not
    # succeeded", which would cascade-skip every matrix shard and leak
    # downstream as an empty GitHub Release — see #66 (database/v0.1.0).
    if: ${{ !failure() && !cancelled() }}
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.matrix.outputs.include) }}

    steps:
      - uses: actions/checkout@v4

      - name: Rewrite SSH to HTTPS for public deps
        run: git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"

      - name: Install cross-compilation tools
        if: runner.os == 'Linux'
        env:
          BUILD_TARGET: ${{ matrix.target }}
        run: |
          sudo apt-get update
          case "$BUILD_TARGET" in
            x86_64-unknown-linux-musl)
              sudo apt-get install -y musl-tools
              ;;
            aarch64-unknown-linux-gnu)
              sudo apt-get install -y gcc-aarch64-linux-gnu libc6-dev-arm64-cross
              ;;
            armv7-unknown-linux-gnueabihf)
              sudo apt-get install -y gcc-arm-linux-gnueabihf libc6-dev-armhf-cross
              ;;
          esac

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # Workers live in subdirectories (no Cargo.toml at the repo root). Derive
      # the worker's directory from manifest_path so rust-cache runs its
      # `cargo metadata` there instead of the root.
      - name: Resolve worker directory for cache
        id: cache_workdir
        shell: bash
        run: printf 'dir=%s\n' "$(dirname '${{ inputs.manifest_path }}')" >> "$GITHUB_OUTPUT"

      - name: Cache cargo registry & build
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ inputs.bin_name }}-${{ matrix.target }}
          # Without this, rust-cache defaults to the repo root, where there is no
          # Cargo.toml — its `cargo metadata` exits 101 and the cache is never
          # found or saved, so every build of every target ships cold.
          workspaces: ${{ steps.cache_workdir.outputs.dir }}

      - name: Rewrite [package].version (bundle coordinated release)
        if: inputs.version_override != ''
        shell: bash
        env:
          MANIFEST: ${{ inputs.manifest_path }}
          VERSION: ${{ inputs.version_override }}
        run: |
          python3 - <<'PY'
          import os, pathlib, re, sys
          path = pathlib.Path(os.environ["MANIFEST"])
          version = os.environ["VERSION"]
          if not path.is_file():
              print(f"::error::manifest not found: {path}")
              sys.exit(1)
          lines = path.read_text().splitlines(keepends=True)
          out, in_package, rewrote = [], False, False
          for line in lines:
              stripped = line.strip()
              if stripped.startswith("["):
                  in_package = stripped == "[package]"
                  out.append(line)
                  continue
              if in_package and not rewrote:
                  m = re.match(r'(\s*version\s*=\s*)"[^"]*"(.*)', line)
                  if m:
                      out.append(f'{m.group(1)}"{version}"{m.group(2)}\n')
                      rewrote = True
                      continue
              out.append(line)
          if not rewrote:
              print(f"::error::[package].version not found in {path}")
              sys.exit(1)
          path.write_text("".join(out))
          print(f"::notice::set [package].version to {version} in {path}")
          PY

      # When `web_bundle: true`, the SPA was built by the `web-build` job
      # above. Download the artifact, drop it at `<worker>/web/dist/`, and
      # signal `build.rs` to skip its own pnpm invocation. Without this
      # the cross-compile shards would either fail (no Node/pnpm) or
      # rebuild the same platform-independent bundle nine times.
      - name: Resolve worker dir
        if: inputs.web_bundle
        id: dirs
        shell: bash
        env:
          MANIFEST: ${{ inputs.manifest_path }}
        run: |
          set -euo pipefail
          worker=$(dirname "$MANIFEST")
          echo "worker=$worker" >> "$GITHUB_OUTPUT"

      - name: Download web bundle
        if: inputs.web_bundle
        uses: actions/download-artifact@v4
        with:
          name: web-bundle
          path: ${{ steps.dirs.outputs.worker }}/web/dist/

      - name: Build and upload binary
        uses: taiki-e/upload-rust-binary-action@v1
        env:
          # Honored by `console/build.rs` (and any future build.rs that
          # wraps a pnpm SPA): when set, the script trusts the `web/dist/`
          # already on disk and never invokes pnpm. The dist comes from
          # the `web-build` job's artifact above.
          SKIP_WEB_BUILD: ${{ inputs.web_bundle && '1' || '' }}
        with:
          bin: ${{ inputs.bin_name }}
          target: ${{ matrix.target }}
          ref: refs/tags/${{ inputs.tag_name }}
          tar: unix
          zip: windows
          checksum: sha256
          manifest-path: ${{ inputs.manifest_path }}
          token: ${{ github.token }}
          dry-run: ${{ inputs.dry_run }}