build.yml

# Copyright (C) 2023 Toitware ApS. All rights reserved.

name: Build

on:
  workflow_dispatch:
    inputs:
      upload_service_snapshot:
        description: Upload the service snapshot image to Artemis
        type: boolean
        required: true
        default: false
      sign_macos:
        description: Sign the macOS binary
        type: boolean
        required: true
        default: false
      sign_windows:
        description: Sign the Windows binary
        type: boolean
        required: true
        default: false
  release:
    types: [published]
  push:

env:
  SUPPORTED_SDK_VERSIONS: |
      v2.0.0-alpha.159

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Setup Toit
        shell: bash
        run: |
          SUPPORTED_ARRAY=($SUPPORTED_SDK_VERSIONS)
          if [[ "$(make dev-sdk-version)" != "${SUPPORTED_ARRAY[-1]}" ]]; then
            echo "Test SDK version is not last supported SDK version"
            exit 1
          fi
          export TOIT_VERSION=${SUPPORTED_ARRAY[-1]}
          echo "TOIT_VERSION=$TOIT_VERSION" >> $GITHUB_ENV

      - name: Setup Toit
        uses: toitlang/action-setup@v1
        with:
          toit-version: ${{ env.TOIT_VERSION }}

      - name: Install dependencies
        run: |
          sudo apt-get update -q
          sudo apt-get install -q ninja-build
          ninja --version

      - name: Run cmake
        shell: bash
        run: |
          make rebuild-cmake

      - name: Build the CLI
        shell: bash
        run: |
          make

      - name: Build release binaries
        shell: bash
        run: |
          mkdir -p out/linux
          toit.compile -o out/linux/artemis build/snapshots/artemis.snapshot

          for SYSTEM in windows macos aarch64; do
            if [[ $SYSTEM == "windows" ]]; then
              BIN_EXTENSION=".exe"
            else
              BIN_EXTENSION=""
            fi
            if [[ $SYSTEM == "aarch64" ]]; then
              OS="linux"
              ARCH="arm64"
            elif [[ $SYSTEM == "macos" ]]; then
              OS="darwin"
              ARCH="amd64"
            else
              OS=$SYSTEM
              ARCH="amd64"
            fi
            mkdir -p out/$SYSTEM
            toit.compile --arch $ARCH --os $OS \
              -o out/$SYSTEM/artemis$BIN_EXTENSION build/snapshots/artemis.snapshot
          done

      - name: Rename snapshot
        shell: bash
        run: |
          UUID=$(build/bin/snapshot_uuid$BIN_EXTENSION build/snapshots/artemis.snapshot)
          echo "ARTEMIS_UUID=$UUID" >> $GITHUB_ENV
          mv build/snapshots/artemis.snapshot build/snapshots/artemis-$UUID.snapshot

      - name: Sign in to Artemis
        shell: bash
        env:
          ARTEMIS_EMAIL: leon@toit.io
          ARTEMIS_PASSWORD: ${{ secrets.LEON_ARTEMIS_PW }}
        run: |
          # We log in with the Artemis executable.
          # It will set the authentication in the config file which is also
          # used by the uploader.
          build/bin/artemis auth login --email "$ARTEMIS_EMAIL" --password "$ARTEMIS_PASSWORD"

      - name: Upload snapshot to Artemis
        if: github.event_name == 'release' || inputs.upload_service_snapshot
        shell: bash
        run: |
          # No need to cache the snapshots in a local snapshot directory.
          mkdir -p tmp_snapshots
          build/bin/uploader cli-snapshot \
            --snapshot-directory tmp_snapshots \
            build/snapshots/*.snapshot

      - name: Build and upload service images
        if: github.event_name == 'release'
        shell: bash
        run: |
          # No need to cache the snapshots in a local snapshot directory.
          mkdir -p tmp_snapshots
          for version in $SUPPORTED_SDK_VERSIONS; do
            # For each supported SDK version, build the locally checked out
            # version of the service and upload it to Artemis.
            build/bin/uploader service \
                --snapshot-directory tmp_snapshots \
                --sdk-version $version \
                --service-version ${{ github.event.release.tag_name }} \
                --local \
                --force
            build/bin/uploader service \
                --snapshot-directory tmp_snapshots \
                --sdk-version $version \
                --service-version "${{ github.event.release.tag_name }}+O1" \
                --local \
                --optimization-level=1 \
                --force
          done

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: artemis
          path: |
            build/bin/*
            build/snapshots/artemis-${{ env.ARTEMIS_UUID }}.snapshot

      - name: Upload release artifacts
        uses: actions/upload-artifact@v4
        with:
          name: artemis-release-binaries
          path: out/*

  package-macos:
    runs-on: macos-latest
    needs: [build]

    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: artemis-release-binaries
          path: in

      - name: Install dependencies
        run: |
          set -e
          brew install create-dmg
          brew install zip

      - name: Copy to build
        run: |
          mkdir -p build/macos
          cp in/macos/artemis build/macos/artemis

      - name: Setup binary rights
        run: |
          chmod +x build/macos/artemis

      - name: Sign and notarize
        if: github.event_name == 'release' || inputs.sign_macos
        uses: toitlang/action-macos-sign-notarize@v1.2.0
        with:
          certificate: ${{ secrets.MACOS_CERTIFICATE }}
          certificate-password: ${{ secrets.MACOS_CERTIFICATE_PWD }}
          username: ${{ secrets.AC_USERNAME }}
          password: ${{ secrets.AC_PASSWORD }}
          apple-team-id: 33DS2ZRDST
          # Signs in place.
          app-path: build/macos/artemis

      - name: Create out folder
        run: |
          mkdir -p out

      - name: Create a DMG
        run: |
          # Use an empty directory as source so we don't accidentally add other files than the
          # artemis binary.
          set -e
          mkdir empty
          create-dmg \
              --volname "artemis" \
              --add-file artemis build/macos/artemis 0 0 \
              out/artemis.dmg \
              empty

      - name: Create a ZIP
        run: |
          zip -j out/artemis.zip build/macos/artemis

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: artemis-packaged-macos
          path: ./out

  package-windows:
    runs-on: windows-latest
    needs: [build]

    steps:
      - uses: actions/checkout@v4

      - name: Git version
        id: version
        uses: toitlang/action-git-version@v1.1.0

      - uses: actions/download-artifact@v4
        with:
          name: artemis-release-binaries
          path: in

      - name: Copy to build
        shell: bash
        run: |
          mkdir -p build/windows
          cp in/windows/artemis.exe build/windows/artemis.exe

      - name: Sign Windows binary
        if: github.event_name == 'release' || inputs.sign_windows
        uses: toitlang/action-code-sign@5da128f4fb4f719c1b667867815f6c31e743b111 # v1.1.0
        with:
          certificate: ${{ secrets.DIGICERT_CERTIFICATE }}
          api-key: ${{ secrets.DIGICERT_API_KEY }}
          certificate-password: ${{ secrets.DIGICERT_PASSWORD }}
          certificate-fingerprint: ${{ secrets.DIGICERT_FINGERPRINT }}
          keypair-alias: ${{ vars.DIGICERT_KEYPAIR_ALIAS }}
          path: build/windows

      - name: Create out folder
        shell: bash
        run: |
          mkdir -p out

      - name: Create a ZIP
        shell: bash
        run: |
          cd build/windows
          7z a -tzip ../../out/artemis-windows.zip artemis.exe

      - name: Build Windows installer
        shell: powershell
        run: |
          $versionV = "${{ steps.version.outputs.version }}"
          $version = $versionV.Substring(1)
          & tools\windows_installer\build.bat $version $PWD\build\windows\artemis.exe build\windows\artemis_installer_x64.exe

      - name: Sign Windows installer
        if: github.event_name == 'release' || inputs.sign_windows
        uses: toitlang/action-code-sign@5da128f4fb4f719c1b667867815f6c31e743b111 # v1.1.0
        with:
          certificate: ${{ secrets.DIGICERT_CERTIFICATE }}
          api-key: ${{ secrets.DIGICERT_API_KEY }}
          certificate-password: ${{ secrets.DIGICERT_PASSWORD }}
          certificate-fingerprint: ${{ secrets.DIGICERT_FINGERPRINT }}
          keypair-alias: ${{ vars.DIGICERT_KEYPAIR_ALIAS }}
          path: build/windows/artemis_installer_x64.exe

      - name: Copy installer to output
        shell: bash
        run: |
          cp build/windows/artemis_installer_x64.exe out

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: artemis-packaged-windows
          path: ./out

      - name: Test installer
        shell: powershell
        run: |
          & $PWD\out/artemis_installer_x64.exe /SILENT /SUPPRESSMSGBOXES /NORESTART /LOG="install.log"

      - name: Upload install log
        uses: actions/upload-artifact@v4
        with:
          name: install-log
          path: |
            install.log

  package-linux:
    runs-on: ubuntu-latest
    needs: [build]

    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: artemis-release-binaries
          path: in

      - name: Create a tarballs
        run: |
          mkdir -p out
          chmod +x in/linux/artemis
          tar c -z -C in/linux -f out/artemis-linux.tar.gz artemis
          chmod +x in/aarch64/artemis
          tar c -z -C in/aarch64 -f out/artemis-linux-aarch64.tar.gz artemis

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: artemis-packaged-linux
          path: ./out

  update_public:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Checkout release-repo
        uses: actions/checkout@v4
        with:
          repository: toitware/artemis-releases
          path: release-repo
          token: ${{ secrets.LEON_ARTEMIS_RELEASE_PAT }}

      - name: Checkout docs-repo
        uses: actions/checkout@v4
        with:
          repository: toitware/web-docs
          path: docs-repo
          token: ${{ secrets.LEON_ARTEMIS_RELEASE_PAT }}

      - name: Update examples, broker, and schemas
        shell: bash
        run: |
          rm -rf release-repo/examples
          cp -r public/examples release-repo/examples

          rm -rf release-repo/broker
          cp -r public/supabase_broker release-repo/broker

          rm -rf release-repo/schemas
          cp -r public/schemas release-repo/schemas

      - name: Update docs
        shell: bash
        run: |
          rm -rf docs-repo/docs/getstarted/fleet
          cp -r public/docs/fleet docs-repo/docs/getstarted/fleet

      - name: Update SDK versions
        shell: bash
        run: |
          SUPPORTED_ARRAY=($SUPPORTED_SDK_VERSIONS)
          export TOIT_VERSION=${SUPPORTED_ARRAY[-1]}

          sed -i "s/SDK-VERSION/$TOIT_VERSION/g" release-repo/examples/*
          sed -i "s/SDK-VERSION/$TOIT_VERSION/g" docs-repo/docs/getstarted/fleet/*

      - name: Update Artemis versions
        if: github.event_name == 'release'
        shell: bash
        run: |
          export ARTEMIS_VERSION=${{ github.event.release.tag_name }}

          sed -i "s/ARTEMIS-VERSION/$ARTEMIS_VERSION/g" release-repo/examples/*
          sed -i "s/ARTEMIS-VERSION/$ARTEMIS_VERSION/g" docs-repo/docs/getstarted/fleet/*

      - name: Commit and push example and broker
        if: github.event_name == 'release'
        run: |
          cd release-repo
          git config user.name "Leon Gungadin Mogensen"
          git config user.email "leon@toit.io"
          git add .
          git commit -m "Update examples and broker for version ${{ github.event.release.tag_name }}" || true
          git push

      - name: Commit and push docs
        if: github.event_name == 'release'
        run: |
          cd docs-repo
          git config user.name "Leon Gungadin Mogensen"
          git config user.email "leon@toit.io"
          git add .
          git commit -m "Update docs for Artemis ${{ github.event.release.tag_name }}" || true
          git push

  do_release:
    runs-on: ubuntu-latest
    needs: [package-windows, package-linux, package-macos, update_public]
    steps:
      - uses: actions/checkout@v4

      - name: Download Linux artifacts
        uses: actions/download-artifact@v4
        with:
          name: artemis-packaged-linux
          path: in-linux

      - name: Download macOS artifacts
        uses: actions/download-artifact@v4
        with:
          name: artemis-packaged-macos
          path: in-mac

      - name: Download Windows artifacts
        uses: actions/download-artifact@v4
        with:
          name: artemis-packaged-windows
          path: in-windows

      - name: Prepare release assets
        shell: bash
        run: |
          mkdir release-assets

          mv in-linux/artemis-linux.tar.gz release-assets/artemis-linux.tar.gz
          mv in-linux/artemis-linux-aarch64.tar.gz release-assets/artemis-linux-aarch64.tar.gz

          mv in-windows/artemis-windows.zip release-assets/artemis-windows.zip
          mv in-windows/artemis_installer_x64.exe release-assets/artemis-installer-x64.exe

          mv in-mac/artemis.dmg release-assets/artemis.dmg
          mv in-mac/artemis.zip release-assets/artemis-macos.zip

      - name: Upload release artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-assets
          path: release-assets

      - name: Upload release artifacts as assets
        if: github.event_name == 'release'
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file_glob: true
          file: release-assets/*
          tag: ${{ github.event.release.tag_name }}
          overwrite: true

      - name: Create public release
        if: github.event_name == 'release'
        env:
          GITHUB_TOKEN: ${{ secrets.LEON_ARTEMIS_RELEASE_PAT }}
        run: |
          BODY=$(cat << '__EOF__'
          ${{ github.event.release.body }}
          __EOF__
          )
          BODY=$(echo "$BODY" | sed 's/ by @.*$//' | sed '/^## Private/,$d')
          gh release create "${{ github.event.release.tag_name }}" \
            -R toitware/artemis-releases \
            -t "${{ github.event.release.name }}" \
            -n "$BODY" \
            release-assets/*