ci.yml

name: Build, verify, and release

on:
  pull_request:
  push:
    branches:
      - main

concurrency:
  group: sift-${{ github.ref }}
  cancel-in-progress: false

env:
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true

jobs:
  verify:
    name: Verify source and tests
    runs-on: windows-latest
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup .NET
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
        with:
          dotnet-version: 10.0.x
          cache: true
          cache-dependency-path: |
            src/Stratus.Sift.Cli/packages.lock.json
            src/Stratus.Sift.Core/packages.lock.json
            src/Stratus.Sift.Contracts/packages.lock.json
            src/Stratus.Sift.FileSystem/packages.lock.json
            src/Stratus.Sift.Connectors/packages.lock.json
            tests/Stratus.Sift.Cli.Tests/packages.lock.json

      - name: Restore locked dependencies
        run: dotnet restore Stratus.Sift.slnx --locked-mode

      - name: Build
        run: dotnet build Stratus.Sift.slnx --configuration Release --no-restore

      - name: Test
        run: dotnet test Stratus.Sift.slnx --configuration Release --no-build

      - name: Verify source boundary
        shell: pwsh
        run: ./eng/Verify-PublicBoundary.ps1

  build-release:
    name: Build ${{ matrix.rid }}
    needs: verify
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - rid: win-x64
            runner: windows-latest
            executable: sift.exe
          - rid: win-arm64
            runner: windows-11-arm
            executable: sift-win-arm64.exe
          - rid: linux-x64
            runner: ubuntu-24.04
            executable: sift-linux-x64
          - rid: linux-arm64
            runner: ubuntu-24.04-arm
            executable: sift-linux-arm64
          - rid: osx-x64
            runner: macos-15-intel
            executable: sift-osx-x64
          - rid: osx-arm64
            runner: macos-15
            executable: sift-osx-arm64

    steps:
      - name: Checkout
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup .NET
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
        with:
          dotnet-version: 10.0.x
          cache: true
          cache-dependency-path: |
            eng/locks/packages.${{ matrix.rid }}.lock.json
            src/Stratus.Sift.Core/packages.lock.json
            src/Stratus.Sift.Contracts/packages.lock.json
            src/Stratus.Sift.FileSystem/packages.lock.json
            src/Stratus.Sift.Connectors/packages.lock.json

      - name: Set release version
        id: version
        shell: pwsh
        run: '"version=0.1.${{ github.run_number }}" | Out-File -FilePath $env:GITHUB_OUTPUT -Append'

      - name: Build Native AOT release
        shell: pwsh
        run: ./eng/Build-Release.ps1 -Version '${{ steps.version.outputs.version }}' -RuntimeIdentifier '${{ matrix.rid }}'

      - name: Smoke test native executable
        shell: pwsh
        run: |
          $executable = Resolve-Path './artifacts/release/${{ matrix.rid }}/${{ matrix.executable }}'
          if (-not $IsWindows) {
            chmod 755 $executable
          }
          $version = (& $executable --version).Trim()
          if ($LASTEXITCODE -ne 0 -or -not $version.StartsWith('${{ steps.version.outputs.version }}')) {
            throw "Unexpected version: $version"
          }
          $smokeOutput = Join-Path $env:RUNNER_TEMP 'sift-smoke.json'
          & $executable local --path . --enum-only --output $smokeOutput --output-format json
          $json = Get-Content -LiteralPath $smokeOutput -Raw | ConvertFrom-Json
          if ($LASTEXITCODE -ne 0 -or $json.SchemaVersion -ne '1.0' -or $json.Errors -ne 0) {
            throw 'The native scan smoke test failed.'
          }

      - name: Verify executable boundary
        shell: pwsh
        run: ./eng/Verify-PublicBoundary.ps1 -ArtifactPath './artifacts/release/${{ matrix.rid }}/${{ matrix.executable }}'

      - name: Upload release assets
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-${{ matrix.rid }}
          path: artifacts/release/${{ matrix.rid }}/*
          if-no-files-found: error
          retention-days: 7

  release:
    name: Publish release
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs:
      - verify
      - build-release
    runs-on: ubuntu-24.04
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set release version
        id: version
        shell: pwsh
        run: '"version=0.1.${{ github.run_number }}" | Out-File -FilePath $env:GITHUB_OUTPUT -Append'

      - name: Download release assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: release-*
          path: artifacts/release
          merge-multiple: true

      - name: Verify assets and write checksums
        shell: pwsh
        run: |
          $releaseRoot = Resolve-Path 'artifacts/release'
          $partialChecksums = @(Get-ChildItem $releaseRoot -File -Filter 'SHA256SUMS-*.txt')
          if ($partialChecksums.Count -ne 6) {
            throw "Expected six platform checksum files, found $($partialChecksums.Count)."
          }
          foreach ($checksumFile in $partialChecksums) {
            $lines = [System.IO.File]::ReadAllLines($checksumFile.FullName)
            if ($lines.Count -ne 1) {
              throw "Expected one binary checksum in $($checksumFile.Name), found $($lines.Count)."
            }
            foreach ($line in $lines) {
              if ($line -notmatch '^([0-9a-f]{64})  (.+)$') {
                throw "Invalid checksum line in $($checksumFile.Name): $line"
              }
              $asset = Join-Path $releaseRoot $Matches[2]
              $actual = (Get-FileHash -LiteralPath $asset -Algorithm SHA256).Hash.ToLowerInvariant()
              if ($actual -ne $Matches[1]) {
                throw "Checksum mismatch for $($Matches[2])."
              }
            }
          }
          $assets = @(Get-ChildItem $releaseRoot -File | Where-Object Name -NotLike 'SHA256SUMS-*.txt' | Sort-Object Name)
          if ($assets.Count -ne 6) {
            throw "Expected six release binaries, found $($assets.Count)."
          }
          $checksums = foreach ($asset in $assets) {
            $hash = (Get-FileHash -LiteralPath $asset.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
            "$hash  $($asset.Name)"
          }
          [System.IO.File]::WriteAllLines(
            (Join-Path $releaseRoot 'SHA256SUMS.txt'),
            $checksums,
            [System.Text.UTF8Encoding]::new($false))
          Remove-Item $partialChecksums.FullName -Force

      - name: Create GitHub release
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ steps.version.outputs.version }}
        run: |
          $tag = "v$env:RELEASE_VERSION"
          $assets = @(Get-ChildItem 'artifacts/release' -File | Sort-Object Name | ForEach-Object FullName)
          if (gh release view $tag 2>$null) {
            gh release upload $tag @assets --clobber
          }
          else {
            gh release create $tag @assets --target $env:GITHUB_SHA --generate-notes --title "Stratus Sift $env:RELEASE_VERSION"
          }