letro-authentication-service/.github/workflows/build.yaml

name: Build

on:
  push:
    branches: [ main ]
    tags:
      - 'v*'
  pull_request:
    branches: [ main ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_NET_GIT_FETCH_WITH_CLI: "true"

jobs:
  build-assets:
    name: Build assets
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@v4.0.0

      - name: Setup OPA
        uses: open-policy-agent/setup-opa@v2.1.0
        with:
          version: 0.55.0

      - name: Install Node
        uses: actions/setup-node@v3.8.1
        with:
          node-version: 18

      - name: Install Node dependencies
        working-directory: ./frontend
        run: npm ci

      - name: Build frontend
        working-directory: ./frontend
        run: npm run build

      - name: Build policies
        working-directory: ./policies
        run: make

      - name: Collect the artifacts
        run: |
          mkdir share/
          mv policies/policy.wasm share/policy.wasm
          mv frontend/dist/manifest.json share/manifest.json
          mv frontend/dist/ share/assets
          mv templates/ share/templates

      - name: Upload the artifacts
        uses: actions/upload-artifact@v3.1.3
        with:
          name: artifacts
          path: share/


  build-linux:
    name: Build for Linux ${{ matrix.arch }}
    runs-on: ubuntu-22.04

    needs:
      - build-assets

    strategy:
      fail-fast: false
      matrix:
        arch: [x86_64, aarch64]

    steps:
      - name: Checkout the code
        uses: actions/checkout@v4.0.0

      - name: Install Rust toolchain
        run: |
          rustup toolchain install stable
          rustup default stable
          rustup target add ${{ matrix.arch }}-unknown-linux-musl

      - name: Setup Rust build cache
        uses: Swatinem/rust-cache@v2.6.2
        with:
          shared-key: ${{ matrix.arch }}-linux
          save-if: "${{ github.event_name != 'pull_request' }}"

      - name: Install zig and cargo-zigbuild
        run: pip3 install ziglang==0.11.0 cargo-zigbuild==0.17.1

      - name: Build the binary
        run: |
          cargo zigbuild \
            --release \
            --target=${{ matrix.arch }}-unknown-linux-musl \
            --no-default-features \
            --features dist \
            -p mas-cli

      - name: Download the artifacts
        uses: actions/download-artifact@v3.0.2
        with:
          name: artifacts
          path: share/

      - name: Create the archive
        run: |
          mkdir dist/
          mv share/ dist/
          mv target/${{ matrix.arch }}-unknown-linux-musl/release/mas-cli dist/
          mv LICENSE dist/
          chmod -R u=rwX,go=rX dist/
          tar -czvf mas-cli-${{ matrix.arch }}-linux.tar.gz --owner=0 --group=0 -C dist/ .

      - name: Upload the binary as artifact
        uses: actions/upload-artifact@v3.1.3
        with:
          name: ${{ matrix.arch }}-linux
          path: mas-cli-${{ matrix.arch }}-linux.tar.gz


  build-macos:
    name: Build for macOS ${{ matrix.arch }}
    runs-on: ubuntu-22.04
    env:
      SDKROOT: /opt/MacOSX11.3.sdk

    needs:
      - build-assets

    strategy:
      fail-fast: false
      matrix:
        arch: [x86_64, aarch64]

    steps:
      - name: Checkout the code
        uses: actions/checkout@v4.0.0

      - name: Install Rust toolchain
        run: |
          rustup toolchain install stable
          rustup default stable
          rustup target add ${{ matrix.arch }}-apple-darwin

      - name: Setup Rust build cache
        uses: Swatinem/rust-cache@v2.6.2
        with:
          shared-key: ${{ matrix.arch }}-macos
          save-if: "${{ github.event_name != 'pull_request' }}"

      - name: Install zig and cargo-zigbuild
        run: pip3 install ziglang==0.11.0 cargo-zigbuild==0.17.1

      - name: Download the macOS SDK
        run: curl -L "https://github.com/phracker/MacOSX-SDKs/releases/download/11.3/MacOSX11.3.sdk.tar.xz" | tar -J -x -C /opt

      - name: Build the binary
        run: |
          cargo zigbuild \
            --release \
            --target=${{ matrix.arch }}-apple-darwin \
            --no-default-features \
            --features dist \
            -p mas-cli

      - name: Create CACHEDIR.TAG files
        # This is a workaround for `cargo-zigbuild` not creating the CACHEDIR.TAG files
        # https://github.com/rust-cross/cargo-zigbuild/issues/165
        run: |
          touch target/CACHEDIR.TAG
          touch target/${{ matrix.arch }}-apple-darwin/CACHEDIR.TAG

      - name: Download the artifacts
        uses: actions/download-artifact@v3.0.2
        with:
          name: artifacts
          path: share/

      - name: Create the archive
        run: |
          mkdir dist/
          mv share/ dist/
          mv target/${{ matrix.arch }}-apple-darwin/release/mas-cli dist/
          mv LICENSE dist/
          chmod -R u=rwX,go=rX dist/
          tar -czvf mas-cli-${{ matrix.arch }}-macos.tar.gz --owner=0 --group=0 -C dist/ .

      - name: Upload the binary as artifact
        uses: actions/upload-artifact@v3.1.3
        with:
          name: ${{ matrix.arch }}-macos
          path: mas-cli-${{ matrix.arch }}-macos.tar.gz

  release:
    name: Release
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    needs:
      - build-linux
      - build-macos
    steps:
      - name: Download the artifacts from the previous job
        uses: actions/download-artifact@v3
        with:
          path: artifacts

      - name: Move the release assets
        run: |
          mv ./artifacts/{x86_64,aarch64}-{linux,macos}/* ./

      - name: Prepare a release
        uses: softprops/action-gh-release@v1
        with:
          files: |
            mas-cli-aarch64-linux.tar.gz
            mas-cli-aarch64-macos.tar.gz
            mas-cli-x86_64-linux.tar.gz
            mas-cli-x86_64-macos.tar.gz
          draft: true