letro-authentication-service/.github/workflows/build.yaml

name: Build
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_NET_GIT_FETCH_WITH_CLI: "true"

jobs:
  build-assets:
    name: Build assets
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@v3.5.3

      - name: Setup OPA
        uses: open-policy-agent/setup-opa@v2.1.0
        with:
          version: 0.54.0

      - name: Install Node
        uses: actions/setup-node@v3.7.0
        with:
          node-version: 18

      - name: Install Node dependencies
        working-directory: ./frontend
        run: npm ci

      - name: Build frontend
        working-directory: ./frontend
        run: npm run build

      - name: Build policies
        working-directory: ./policies
        run: make

      - name: Collect the artifacts
        run: |
          mkdir share/
          mv policies/policy.wasm share/policy.wasm
          mv frontend/dist/manifest.json share/manifest.json
          mv frontend/dist/ share/assets
          mv templates/ share/templates

      - name: Upload the artifacts
        uses: actions/upload-artifact@v3.1.2
        with:
          name: artifacts
          path: share/


  build-linux:
    name: Build for Linux ${{ matrix.arch }}
    runs-on: ubuntu-22.04

    needs:
      - build-assets

    strategy:
      fail-fast: false
      matrix:
        arch: [x86_64, aarch64]

    steps:
      - name: Checkout the code
        uses: actions/checkout@v3.5.3

      - name: Install Rust toolchain
        run: |
          rustup toolchain install stable
          rustup default stable
          rustup target add ${{ matrix.arch }}-unknown-linux-musl

      - name: Setup Rust build cache
        uses: Swatinem/rust-cache@v2.6.0
        with:
          shared-key: ${{ matrix.arch }}-linux
          save-if: "${{ github.event_name != 'pull_request' }}"

      - name: Install zig and cargo-zigbuild
        run: pip3 install ziglang==0.9.1 cargo-zigbuild==0.16.12

      - name: Build the binary
        run: |
          cargo zigbuild \
            --release \
            --target=${{ matrix.arch }}-unknown-linux-musl \
            --no-default-features \
            --features dist \
            -p mas-cli

      - name: Download the artifacts
        uses: actions/download-artifact@v3.0.2
        with:
          name: artifacts
          path: share/

      - name: Create the archive
        run: |
          mkdir dist/
          mv share/ dist/
          mv target/${{ matrix.arch }}-unknown-linux-musl/release/mas-cli dist/
          mv LICENSE dist/
          chmod -R u=rwX,go=rX dist/
          tar -czvf mas-cli-${{ matrix.arch }}-linux.tar.gz --owner=0 --group=0 -C dist/ .

      - name: Upload the binary as artifact
        uses: actions/upload-artifact@v3.1.2
        with:
          name: ${{ matrix.arch }}-linux
          path: mas-cli-${{ matrix.arch }}-linux.tar.gz


  build-macos:
    name: Build for macOS ${{ matrix.arch }}
    runs-on: ubuntu-22.04
    env:
      SDKROOT: /opt/MacOSX11.3.sdk

    needs:
      - build-assets

    strategy:
      fail-fast: false
      matrix:
        arch: [x86_64, aarch64]

    steps:
      - name: Checkout the code
        uses: actions/checkout@v3.5.3

      - name: Install Rust toolchain
        run: |
          rustup toolchain install stable
          rustup default stable
          rustup target add ${{ matrix.arch }}-apple-darwin

      - name: Setup Rust build cache
        uses: Swatinem/rust-cache@v2.6.0
        with:
          shared-key: ${{ matrix.arch }}-macos
          save-if: "${{ github.event_name != 'pull_request' }}"

      - name: Install zig and cargo-zigbuild
        # XXX: note how the ziglang version is not the same as the Dockerfile and the Linux build
        # This is because there is an issue with zig 0.10.x when building the `psm` crate for Linux, but it works fine for macOS
        # The reason we're not on 0.9.x for the macOS build is because there is an issue for linking the final binary with 0.9.x
        # This should all be fixed once zig 0.11.x is released in a few weeks
        run: pip3 install ziglang==0.10.1.post1 cargo-zigbuild==0.16.12

      - name: Download the macOS SDK
        run: curl -L "https://github.com/phracker/MacOSX-SDKs/releases/download/11.3/MacOSX11.3.sdk.tar.xz" | tar -J -x -C /opt

      - name: Build the binary
        run: |
          cargo zigbuild \
            --release \
            --target=${{ matrix.arch }}-apple-darwin \
            --no-default-features \
            --features dist \
            -p mas-cli

      - name: Download the artifacts
        uses: actions/download-artifact@v3.0.2
        with:
          name: artifacts
          path: share/

      - name: Create the archive
        run: |
          mkdir dist/
          mv share/ dist/
          mv target/${{ matrix.arch }}-apple-darwin/release/mas-cli dist/
          mv LICENSE dist/
          chmod -R u=rwX,go=rX dist/
          tar -czvf mas-cli-${{ matrix.arch }}-macos.tar.gz --owner=0 --group=0 -C dist/ .

      - name: Upload the binary as artifact
        uses: actions/upload-artifact@v3.1.2
        with:
          name: ${{ matrix.arch }}-macos
          path: mas-cli-${{ matrix.arch }}-macos.tar.gz