ci.yaml

name: CI
on:
  push:
    tags:
      - "v*.*.*"
    branches:
      - main
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  checks: write
  pull-requests: write
  actions: read
  contents: read

env:
  BUILD_TARGET: "x86_64-unknown-linux-gnu"
  WASM_RQUICKJS_VERSION: "0.0.23"

jobs:
  build-and-store:
    env:
      CARGO_BUILD_JOBS: 20
    runs-on: blacksmith-32vcpu-ubuntu-2204
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v4-rust
          shared-key: debug
          cache-all-crates: true
          save-if: true
      - uses: davidB/rust-cargo-make@v1
      - uses: taiki-e/install-action@v2
        with:
          tool: nextest
      - name: Purge v8 from cache
        run: cargo make --profile ci clear-v8
      - name: Building all executables
        env:
          QUIET: true
        run: cargo make --profile ci build-all-bins-including-tests
        timeout-minutes: 15

      #      - name: Mount binary store
      #        uses: useblacksmith/stickydisk@v1
      #        with:
      #          key: golem-binaries-${{ github.run_id }}
      #          path: ~/golem-binaries-cache

      - name: Packaging all binaries with cargo-nextest
        run: |
          mkdir -pv tmp
          cargo nextest -v archive --archive-file tmp/golem-binaries.tar.zst --zstd-level -7 --cargo-profile dev-ci
        timeout-minutes: 5

      - name: Extract archive
        run: |
          mkdir tmp/golem-binaries
          tar --zstd -xvf tmp/golem-binaries.tar.zst -C tmp/golem-binaries
        timeout-minutes: 2

      #      - name: Move archive to sticky disk
      #        run: mv tmp/golem-binaries.tar.zst ~/golem-binaries-cache/golem-binaries.tar.zst

      - name: Save packaged binaries to cache
        uses: actions/cache/save@v4
        with:
          path: tmp/golem-binaries
          key: golem-binaries-${{ github.run_id }}

  check-clippy-and-format:
    env:
      CARGO_BUILD_JOBS: 10
    runs-on: blacksmith-8vcpu-ubuntu-2204
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v4-rust
          shared-key: debug
          cache-all-crates: true
          save-if: false
      - uses: davidB/rust-cargo-make@v1
      - name: Purge v8 from cache
        run: cargo make --profile ci clear-v8

      - name: Check formatting and clippy rules
        run: cargo make --profile ci check

  unit-tests-and-checks:
    env:
      CARGO_BUILD_JOBS: 10
    runs-on: blacksmith-8vcpu-ubuntu-2204
    needs: build-and-store
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable
      - uses: davidB/rust-cargo-make@v1
      - uses: cargo-bins/cargo-binstall@main

      - name: Install cargo-test-r
        run: cargo binstall --force --locked cargo-test-r@2.2.2
      #      - name: Restore binary archive
      #        uses: actions/download-artifact@v4
      #        with:
      #          name: all-bins-including-tests
      #          path: tmp/golem-binaries.tar.zst
      - name: Restore packaged binaries to cache
        uses: actions/cache/restore@v4
        with:
          path: tmp/golem-binaries
          key: golem-binaries-${{ github.run_id }}
      #      - name: Mount binary store
      #        uses: useblacksmith/stickydisk@v1
      #        with:
      #          key: golem-binaries-${{ github.run_id }}
      #          path: ~/golem-binaries-cache

      - name: Apply binary archive
        run: cargo-test-r reuse-nextest-archive --archive-file tmp/golem-binaries

      - name: Copy required binaries to target # TODO: this should be encoded in the makefile
        run: |
          mkdir -pv target/debug
          find target/nextest-archive
          find target/nextest-archive/target/dev-ci -maxdepth 1 -type f | xargs mv -t target/debug/

      - name: Purge v8 from cache
        run: cargo make --profile ci clear-v8
      - name: Check openapi is up to date
        run: cargo make --profile ci check-openapi
      - name: Check configs are up to date
        run: cargo make --profile ci check-configs
      - name: Unit tests
        run: cargo make --profile ci unit-tests
      - name: Publish Test Report
        uses: ctrf-io/github-test-reporter@v1
        if: always()
        with:
          report-path: "**/target/ctrf-*.json"
          upload-artifact: 'true'
          artifact-name: unit-tests-report
          summary: true
          summary-report: true
          failed-report: true
          slowest-report: true
          github-report: true
          # pull-request-report: true
          flaky-report: true
          collapse-large-reports: true
          exit-on-no-files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  worker-tests:
    env:
      CARGO_BUILD_JOBS: 10
    runs-on: blacksmith-8vcpu-ubuntu-2204
    needs: build-and-store
    strategy:
      fail-fast: false
      matrix:
        group:
          - name: misc
          - name: group1
          - name: group2
    name: worker-tests-${{ matrix.group.name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable
      - uses: davidB/rust-cargo-make@v1
      - uses: cargo-bins/cargo-binstall@main
      - name: Setup Redis
        uses: shogo82148/actions-setup-redis@v1.35.1
        with:
          redis-version: latest
          auto-start: false

      - name: Install cargo-test-r
        run: cargo binstall --force --locked cargo-test-r@2.2.2
      #      - name: Restore binary archive
      #        uses: actions/download-artifact@v4
      #        with:
      #          name: all-bins-including-tests
      #          path: tmp/golem-binaries.tar.zst
      - name: Restore packaged binaries to cache
        uses: actions/cache/restore@v4
        with:
          path: tmp/golem-binaries
          key: golem-binaries-${{ github.run_id }}
      #      - name: Mount binary store
      #        uses: useblacksmith/stickydisk@v1
      #        with:
      #          key: golem-binaries-${{ github.run_id }}
      #          path: ~/golem-binaries-cache

      - name: Apply binary archive
        run: cargo-test-r reuse-nextest-archive --archive-file tmp/golem-binaries

      - name: Purge v8 from cache
        run: cargo make --profile ci clear-v8

      - name: Worker Executor integration tests
        run: cargo make --profile ci worker-executor-tests-${{ matrix.group.name }}
        timeout-minutes: 15
      - name: Publish Test Report
        uses: ctrf-io/github-test-reporter@v1
        if: always()
        with:
          report-path: "**/target/ctrf-*.json"
          upload-artifact: 'true'
          artifact-name: worker-executor-tests-${{ matrix.group.name }}-report
          summary: true
          summary-report: true
          failed-report: true
          slowest-report: true
          github-report: true
          # pull-request-report: true
          flaky-report: true
          collapse-large-reports: true
          exit-on-no-files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  it:
    env:
      CARGO_BUILD_JOBS: 10
    runs-on: ${{ matrix.group.runner || 'blacksmith-8vcpu-ubuntu-2204' }}
    needs: build-and-store
    strategy:
      fail-fast: false
      matrix:
        group:
          - name: integration-tests-group1
            description: "IT #1"
          - name: integration-tests-group2
            description: "IT #2"
          - name: integration-tests-group3
            description: "IT #3"
          - name: integration-tests-group4
            description: "IT #4"
          - name: cli-integration-tests-group1
            description: "CLI tests #1"
          - name: cli-integration-tests-group2
            description: "CLI tests #2"
            runner: blacksmith-16vcpu-ubuntu-2204
          - name: cli-integration-tests-group3
            description: "CLI tests #3"
            runner: blacksmith-16vcpu-ubuntu-2204

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable
      - uses: davidB/rust-cargo-make@v1
      - name: Setup Redis
        uses: shogo82148/actions-setup-redis@v1.35.1
        with:
          redis-version: latest
          auto-start: false

      - uses: cargo-bins/cargo-binstall@main
      - name: Install cargo-component
        if: startsWith(matrix.group.name, 'cli-integration-tests')
        run: cargo binstall --force cargo-component@0.21.1
      - name: Install wasm-tools
        if: startsWith(matrix.group.name, 'cli-integration-tests')
        run: cargo binstall --force --locked wasm-tools@1.227.1
      - name: Install wit-bindgen
        if: startsWith(matrix.group.name, 'cli-integration-tests')
        run: cargo binstall --force --locked wit-bindgen-cli@0.40.0

      - uses: pnpm/action-setup@v2
        if: startsWith(matrix.group.name, 'cli-integration-tests')
        with:
          version: latest
      - name: Install wasm-rquickjs
        if: startsWith(matrix.group.name, 'cli-integration-tests')
        run: cargo install wasm-rquickjs-cli --version $WASM_RQUICKJS_VERSION

      - name: Install cargo-test-r
        run: cargo binstall --force --locked cargo-test-r@2.2.2
      #      - name: Restore binary archive
      #        uses: actions/download-artifact@v4
      #        with:
      #          name: all-bins-including-tests
      #          path: tmp/golem-binaries.tar.zst
      - name: Restore packaged binaries to cache
        uses: actions/cache/restore@v4
        with:
          path: tmp/golem-binaries
          key: golem-binaries-${{ github.run_id }}
      #      - name: Mount binary store
      #        uses: useblacksmith/stickydisk@v1
      #        with:
      #          key: golem-binaries-${{ github.run_id }}
      #          path: ~/golem-binaries-cache

      - name: Apply binary archive
        run: cargo-test-r reuse-nextest-archive --archive-file tmp/golem-binaries

      - name: Copy required binaries to target # TODO: this should be encoded in the makefile
        run: |
          mkdir -pv target/debug
          find target/nextest-archive/target/dev-ci -maxdepth 1 -type f | xargs mv -t target/debug/

      - name: Purge v8 from cache
        run: cargo make --profile ci clear-v8
      - name: ${{ matrix.group.description }}
        env:
          QUIET: true
        run: cargo make --profile ci ${{ matrix.group.name }}
        timeout-minutes: 20
      - name: Publish Test Report
        uses: ctrf-io/github-test-reporter@v1
        if: always()
        with:
          report-path: "**/target/ctrf-*.json"
          upload-artifact: 'true'
          artifact-name: '${{ matrix.group.name }}-report'
          summary: true
          summary-report: true
          failed-report: true
          slowest-report: true
          github-report: true
          # pull-request-report: true
          flaky-report: true
          collapse-large-reports: true
          exit-on-no-files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  #  cleanup:
  #    runs-on: blacksmith
  #    needs:
  #      - worker-tests
  #      - it
  #      - unit-tests-and-checks
  #    if: always()
  #    steps:
  #      - name: Delete sticky disk
  #        uses: useblacksmith/stickydisk-delete@v1
  #        with:
  #          delete-key: golem-binaries-${{ github.run_id }}

  wasm-rpc-stub:
    runs-on: blacksmith
    env:
      CARGO_BUILD_JOBS: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable
      - uses: cargo-bins/cargo-binstall@main
      - name: Install cargo-component
        run: cargo binstall --force cargo-component@0.21.1
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v4-rust
          shared-key: debug
          cache-all-crates: true
          save-if: false
      - uses: davidB/rust-cargo-make@v1
      - name: Purge v8 from cache
        run: cargo make --profile ci clear-v8
      - name: Prepare WIT dependencies
        run: cargo make wit
      - name: Build wasm-rpc in stub mode
        run: cargo component build -p golem-wasm --no-default-features --features stub

  golem-client:
    runs-on: blacksmith
    env:
      CARGO_BUILD_JOBS: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable
      - uses: cargo-bins/cargo-binstall@main
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v4-rust
          shared-key: debug
          cache-all-crates: true
          save-if: false
      - uses: davidB/rust-cargo-make@v1
      - name: Purge v8 from cache
        run: cargo make --profile ci clear-v8
      - name: Prepare WIT dependencies
        run: cargo make wit
      - name: Build golem-client (dependencies in features=client mode)
        run: cargo build -p golem-client

  build-golem-rust:
    runs-on: blacksmith
    steps:
      - uses: actions/checkout@v5
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v2-golem-rust
          shared-key: debug
          cache-all-crates: true
          save-if: false
      - name: Setup Rust
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
          override: true
      - name: Check formatting
        run: cargo fmt -- --check
        working-directory: sdks/rust
      - name: Clippy
        run: cargo clippy -- -Dwarnings
        working-directory: sdks/rust
      - name: Tests
        run: cargo test --all-features
        working-directory: sdks/rust

  build-golem-ts:
    runs-on: blacksmith
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v4
        with:
          node-version: "20.x"
      - uses: pnpm/action-setup@v2
        with:
          version: latest
      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable
      - uses: cargo-bins/cargo-binstall@main
      - name: Install cargo-component
        run: cargo binstall --force cargo-component@0.21.1
      - name: Install wasm-rquickjs
        run: cargo install wasm-rquickjs-cli --version $WASM_RQUICKJS_VERSION

      - name: Install dependencies
        working-directory: sdks/ts
        run: |
          pnpm install

      - name: Check code quality
        working-directory: sdks/ts
        run: |
          pnpm run lint || (
            echo "Linting issues found. Please fix them before proceeding. `npm run lint:fix` may help"
            exit 1
          )

      - name: Check code formatting
        working-directory: sdks/ts
        run: |
          pnpm run format:check || (
            echo "Code formatting issues found. Please run 'npm run format' to fix them."
            exit 1
          )

      - name: Build the package
        working-directory: sdks/ts
        run: |
          pnpm run build

      - name: Verify golem-ts-sdk types are committed
        working-directory: sdks/ts
        run: |
          if ! git diff --exit-code packages/golem-ts-sdk/types; then
            echo "❌ The files in packages/golem-ts-sdk/types differ from the committed version."
            echo "Please run 'pnpm run build' and commit the updated files."
            exit 1
          fi

      - name: Build the agent template WASM binary
        working-directory: sdks/ts
        run: pnpm run build-agent-template

      - name: Run tests
        working-directory: sdks/ts
        run: |
          pnpm run test

  docker-targets-build:
    env:
      CARGO_BUILD_JOBS: 10
    runs-on: blacksmith-16vcpu-ubuntu-2204
    if: github.event_name == 'push' && github.ref_type == 'tag'
    strategy:
      fail-fast: false
      matrix:
        platform:
          - platform: linux/amd64
            name: linux/amd64
            target: x86_64-unknown-linux-gnu
          - platform: linux/arm64
            name: linux/arm64
            target: aarch64-unknown-linux-gnu
            cross: true
    name: docker-targets-build (${{ matrix.platform.platform }})
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Fetch tag
        run: git fetch origin --deepen=1

      - name: Prepare
        run: |
          platform=${{ matrix.platform.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable && rustup target add ${{ matrix.platform.target }}
      - uses: davidB/rust-cargo-make@v1
      - name: Install Rust Target
        run: rustup target add ${{ matrix.platform.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v4-rust
          shared-key: debug
          cache-all-crates: true
          save-if: false

      - run: cargo install cross
        if: ${{ matrix.platform.cross }}

      - name: Purge v8 from cache
        run: cargo make --profile ci clear-v8
      - name: Build executables
        run: cargo make --profile ci build-release
        env:
          PLATFORM_OVERRIDE: ${{ matrix.platform.name }}

      - name: Prepare Targets
        env:
          PLATFORM_OVERRIDE: ${{ matrix.platform.name }}
        run: cargo make --profile ci package-release
      - uses: actions/upload-artifact@v4
        name: Upload Targets
        with:
          name: docker-targets-build-${{ env.PLATFORM_PAIR }}
          path: target/${{ matrix.platform.target }}.tar

  docker-publish-1:
    runs-on: blacksmith
    needs:
      - docker-targets-build
    if: github.event_name == 'push' && github.ref_type == 'tag'
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Fetch tag
        run: git fetch origin --deepen=1

      - name: Prepare
        run: |
          echo "PLATFORMS=linux/amd64,linux/arm64" >> $GITHUB_ENV
      - uses: actions/download-artifact@v4
        name: Download Targets
        with:
          pattern: docker-targets-build-*
          path: target
          merge-multiple: true
      - name: Extract Targets
        run: |
          ls -R target
          cd target
          for f in *.tar; do tar xvf "$f"; done
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Set Docker version
        id: set-version
        run: |
          if [ "${{ github.event_name }}" == 'push' ] && [ "${{ github.ref_type }}" == 'tag' ]; then
            DOCKER_VERSION=$(echo "${{ github.ref }}" | sed 's|^refs/tags/v||')
            echo "DOCKER_VERSION=${DOCKER_VERSION}" >> $GITHUB_ENV
          else
            COMMIT_SHORT_HASH=$(git rev-parse --short=7 HEAD)
            echo "DOCKER_VERSION=${COMMIT_SHORT_HASH}" >> $GITHUB_ENV
          fi
      - uses: jpribyl/action-docker-layer-caching@v0.1.1
        continue-on-error: true
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Extract metadata (tags, labels) for worker executor
        id: meta-worker-executor
        uses: docker/metadata-action@v5
        with:
          images: golemservices/golem-worker-executor
      - name: Build and push worker executor image
        uses: useblacksmith/build-push-action@v1
        with:
          context: .
          file: ./golem-worker-executor/docker/Dockerfile
          push: true
          platforms: ${{ env.PLATFORMS }}
          tags: ${{ steps.meta-worker-executor.outputs.tags }}
          labels: ${{ steps.meta-worker-executor.outputs.labels }}

      - name: Extract metadata (tags, labels) for golem debugging service
        id: meta-golem-debugging-service
        uses: docker/metadata-action@v5
        with:
          images: golemservices/golem-debugging-service
      - name: Build and push golem debugging service image
        uses: useblacksmith/build-push-action@v1
        with:
          context: .
          file: ./golem-debugging-service/docker/Dockerfile
          push: true
          platforms: ${{ env.PLATFORMS }}
          tags: ${{ steps.meta-golem-debugging-service.outputs.tags }}
          labels: ${{ steps.meta-golem-debugging-service.outputs.labels }}

      - name: Extract metadata (tags, labels) for shard manager
        id: meta-shard-manager
        uses: docker/metadata-action@v5
        with:
          images: golemservices/golem-shard-manager
      - name: Build and push shard manager image
        uses: useblacksmith/build-push-action@v1
        with:
          context: .
          file: ./golem-shard-manager/docker/Dockerfile
          push: true
          platforms: ${{ env.PLATFORMS }}
          tags: ${{ steps.meta-shard-manager.outputs.tags }}
          labels: ${{ steps.meta-shard-manager.outputs.labels }}

  docker-publish-2:
    runs-on: blacksmith
    needs:
      - docker-targets-build
    if: github.event_name == 'push' && github.ref_type == 'tag'
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Fetch tag
        run: git fetch origin --deepen=1

      - name: Prepare
        run: |
          echo "PLATFORMS=linux/amd64,linux/arm64" >> $GITHUB_ENV
      - uses: actions/download-artifact@v4
        name: Download Targets
        with:
          pattern: docker-targets-build-*
          path: target
          merge-multiple: true
      - name: Extract Targets
        run: |
          ls -R target
          cd target
          for f in *.tar; do tar xvf "$f"; done
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Set Docker version
        id: set-version
        run: |
          if [ "${{ github.event_name }}" == 'push' ] && [ "${{ github.ref_type }}" == 'tag' ]; then
            DOCKER_VERSION=$(echo "${{ github.ref }}" | sed 's|^refs/tags/v||')
            echo "DOCKER_VERSION=${DOCKER_VERSION}" >> $GITHUB_ENV
          else
            COMMIT_SHORT_HASH=$(git rev-parse --short=7 HEAD)
            echo "DOCKER_VERSION=${COMMIT_SHORT_HASH}" >> $GITHUB_ENV
          fi
      - uses: jpribyl/action-docker-layer-caching@v0.1.1
        continue-on-error: true
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Extract metadata (tags, labels) for registry service
        id: meta-registry-service
        uses: docker/metadata-action@v5
        with:
          images: golemservices/registry-service
      - name: Build and push registry-service
        uses: useblacksmith/build-push-action@v1
        with:
          context: .
          file: ./golem-registry-service/docker/Dockerfile
          push: true
          platforms: ${{ env.PLATFORMS }}
          tags: ${{ steps.meta-registry-service.outputs.tags }}
          labels: ${{ steps.meta-registry-service.outputs.labels }}

      - name: Extract metadata (tags, labels) for golem worker service
        id: meta-golem-worker-service
        uses: docker/metadata-action@v5
        with:
          images: golemservices/golem-worker-service
      - name: Build and push golem worker service image
        uses: useblacksmith/build-push-action@v1
        with:
          context: .
          file: ./golem-worker-service/docker/Dockerfile
          push: true
          platforms: ${{ env.PLATFORMS }}
          tags: ${{ steps.meta-golem-worker-service.outputs.tags }}
          labels: ${{ steps.meta-golem-worker-service.outputs.labels }}

      - name: Extract metadata (tags, labels) for golem component compilation service
        id: meta-golem-component-compilation-service
        uses: docker/metadata-action@v5
        with:
          images: golemservices/golem-component-compilation-service
      - name: Build and push golem component compilation service image
        uses: useblacksmith/build-push-action@v1
        with:
          context: .
          file: ./golem-component-compilation-service/docker/Dockerfile
          push: true
          platforms: ${{ env.PLATFORMS }}
          tags: ${{ steps.meta-golem-component-compilation-service.outputs.tags }}
          labels: ${{ steps.meta-golem-component-compilation-service.outputs.labels }}

  publish:
    needs:
      - check-clippy-and-format
      - unit-tests-and-checks
      - wasm-rpc-stub
      - worker-tests
      - it
    if: "startsWith(github.ref, 'refs/tags/v')"
    env:
      CARGO_BUILD_JOBS: 20
    runs-on: blacksmith-32vcpu-ubuntu-2204
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Fetch tag
        run: git fetch origin --deepen=1

      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v4-rust
          shared-key: release
          cache-all-crates: true
          save-if: true
      - uses: davidB/rust-cargo-make@v1
      - id: get_version
        uses: battila7/get-version-action@v2
      - name: Purge v8 from cache
        run: cargo make --profile ci clear-v8
      - name: Publish all packages
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
          VERSION: ${{ steps.get_version.outputs.version-without-v }}
        run: cargo make --profile ci publish

  publish-binaries:
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'golemcloud/golem'
    strategy:
      fail-fast: false
      matrix:
        project:
          - golem-cli
          - golem
        cfg:
          - rust-target: x86_64-unknown-linux-gnu
            os: blacksmith-32vcpu-ubuntu-2204
          - rust-target: aarch64-unknown-linux-gnu
            os: blacksmith-32vcpu-ubuntu-2204
            cross: true
          - rust-target: x86_64-apple-darwin
            os: macos-latest
          - rust-target: aarch64-apple-darwin
            os: macos-latest
          - rust-target: x86_64-pc-windows-msvc
            os: windows-latest
    name: Publish binaries of ${{ matrix.project }}
    runs-on: ${{ matrix.cfg.os }}
    permissions:
      contents: write
    env:
      CARGO_BUILD_JOBS: 10
    steps:
      - uses: actions/checkout@v5
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Fetch tag
        run: git fetch origin --deepen=1

      - name: Setup Rust
        run: rustup update stable --no-self-update && rustup default stable && rustup target add ${{ matrix.cfg.rust-target }}
      - uses: davidB/rust-cargo-make@v1
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v4-rust
          shared-key: release-${{ matrix.cfg.rust-target }}
          cache-all-crates: true
          save-if: true
      - id: get_version
        uses: battila7/get-version-action@v2
      - name: Set version for all packages
        env:
          VERSION: ${{ steps.get_version.outputs.version-without-v }}
        run: cargo make --profile ci set-version

      - run: cargo install cross
        if: ${{ matrix.cfg.cross }}
      - uses: ilammy/setup-nasm@v1

      - name: Purge v8 from cache
        run: cargo make --profile ci clear-v8
      - run: cargo build -p ${{ matrix.project }} --release --target ${{ matrix.cfg.rust-target }}
        if: ${{ ! matrix.cfg.cross }}
      - run: cross build -p ${{ matrix.project }} --release --target ${{ matrix.cfg.rust-target }}
        if: ${{ matrix.cfg.cross }}

      - run: mv ./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}.exe ./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}.exe
        if: matrix.cfg.os == 'windows-latest'
      - run: mv ./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }} ./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}
        if: matrix.cfg.os != 'windows-latest'

      # - name: Import Code Signing Certificate
      #   if: contains(matrix.cfg.rust-target, 'apple-darwin')
      #   env:
      #     CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
      #     CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
      #   run: |
      #     # Create temporary keychain
      #     KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
      #     KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

      #     # Create and unlock keychain
      #     security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
      #     security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
      #     security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

      #     # Import certificate - use -T to allow codesign access
      #     CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
      #     echo "$CERTIFICATE_BASE64" | base64 --decode > "$CERTIFICATE_PATH"
      #     security import "$CERTIFICATE_PATH" \
      #       -P "$CERTIFICATE_PASSWORD" \
      #       -T /usr/bin/codesign \
      #       -T /usr/bin/security \
      #       -f pkcs12 \
      #       -k "$KEYCHAIN_PATH"

      #     # Add keychain to search list (prepend to existing list)
      #     security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychain -d user | tr -d '"')

      #     # Set partition list to allow codesign to access the certificate
      #     security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

      #     # Debug: verify certificate was imported
      #     echo "Imported certificates:"
      #     security find-identity -v -p codesigning "$KEYCHAIN_PATH"

      # - name: Code Sign Binary
      #   if: contains(matrix.cfg.rust-target, 'apple-darwin')
      #   env:
      #     APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
      #   run: |
      #     BINARY_PATH=./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}

      #     # Debug: list available signing identities
      #     echo "Available signing identities:"
      #     security find-identity -v -p codesigning

      #     # Sign with hardened runtime
      #     codesign --force \
      #       --options runtime \
      #       --timestamp \
      #       --sign "$APPLE_SIGNING_IDENTITY" \
      #       "$BINARY_PATH"

      #     # Verify signature
      #     codesign --verify --verbose "$BINARY_PATH"
      #     codesign --display --verbose=4 "$BINARY_PATH"

      # - name: Create Notarization Archive
      #   if: contains(matrix.cfg.rust-target, 'apple-darwin')
      #   run: |
      #     BINARY_PATH=./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}
      #     ZIP_PATH=./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}.zip

      #     # Create zip for notarization
      #     zip -j "$ZIP_PATH" "$BINARY_PATH"

      # - name: Submit for Notarization
      #   if: contains(matrix.cfg.rust-target, 'apple-darwin')
      #   env:
      #     APPLE_ID: ${{ secrets.APPLE_ID }}
      #     APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      #     APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
      #   run: |
      #     ZIP_PATH=./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}.zip

      #     # Submit for notarization and wait for completion
      #     xcrun notarytool submit "$ZIP_PATH" \
      #       --apple-id "$APPLE_ID" \
      #       --team-id "$APPLE_TEAM_ID" \
      #       --password "$APPLE_APP_PASSWORD" \
      #       --wait false

      # - name: Cleanup Keychain
      #   if: contains(matrix.cfg.rust-target, 'apple-darwin') && always()
      #   run: |
      #     KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
      #     security delete-keychain "$KEYCHAIN_PATH" || true

      - name: Login GH CLI
        shell: bash
        run: gh auth login --with-token < <(echo ${{ secrets.GITHUB_TOKEN }})
      - run: gh release upload -R golemcloud/golem --clobber ${{ github.ref_name }} target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}.exe
        if: matrix.cfg.os == 'windows-latest'
      - run: gh release upload -R golemcloud/golem --clobber ${{ github.ref_name }} target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}
        if: matrix.cfg.os != 'windows-latest'

  publish-slack-notification:
    needs:
      - publish
      - docker-publish-1
      - docker-publish-2
    if: ${{ always() && startsWith(github.ref, 'refs/tags/v') }}
    runs-on: blacksmith
    steps:
      - name: Publish Slack Notification
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_COLOR: ${{ needs.publish.result }}
          SLACK_ICON: https://uploads-ssl.webflow.com/64721eeec7cd7ef4f6f1683e/64831138b73a996d0e831773_32.png
          SLACK_TITLE: "Release Notification"
          SLACK_MESSAGE: "Publish - cargo result: `${{ needs.publish.result }}`, docker-1 result: `${{ needs.docker-publish-1.result }}`, docker-2 result: `${{ needs.docker-publish-2.result }}`"
          SLACK_USERNAME: CI
          SLACK_WEBHOOK: ${{ secrets.SLACK_ALERT_URL }}