ci.yml

name: "Test/Release" # Reminder, to test locally, https://sanjulaganepola.github.io/github-local-actions-docs/
on:
  push:
    branches:
      - "*"
    tags-ignore:
      - "v*"
  workflow_dispatch:
  release:
    types:
      - published

env:
    ZENSIM_TOOLS_VERSION: "tools-v0.1.0"
    # env. context is not available, so we set these in github org vars
    IMAGEFLOW_RELEASE_BUCKET: ${{ vars.IMAGEFLOW_RELEASE_BUCKET || 'imageflow-nightlies' }}
    IMAGEFLOW_RELEASE_BUCKET_REGION: ${{ vars.IMAGEFLOW_RELEASE_BUCKET_REGION || 'us-west-1' }}
    HTTPS_IMAGEFLOW_BUCKET: "https://s3.${{ vars.IMAGEFLOW_RELEASE_BUCKET_REGION }}.amazonaws.com/${{ vars.IMAGEFLOW_RELEASE_BUCKET }}"
    # IMAGEFLOW_DOWNLOAD_COMMIT_BASE: "https://s3.${{ vars.IMAGEFLOW_RELEASE_BUCKET_REGION }}.amazonaws.com/${{ vars.IMAGEFLOW_RELEASE_BUCKET }}/commits/${{ github.sha }}/"
    # IMAGEFLOW_TOOL_DOCKER_x64_FILE : "linux-musl-x64/imageflow_tool.tar.gz"
    # IMAGEFLOW_TOOL_DOCKER_arm64_FILE : "linux-musl-arm64/imageflow_tool.tar.gz"

    NUGET_UPLOAD_NUGET: ${{ vars.NUGET_UPLOAD_NUGET }}
    NUGET_UPLOAD_GITHUB: ${{ vars.NUGET_UPLOAD_GITHUB }}
    REL_NUGET_OUTPUT_DIR: "artifacts/nuget/"
    PROFILE: release
    DELETE_ALL_FROM_NUGET_AFTER_FAILURE: true
    IMAGEFLOW_NET_VERSION: "*-*" # 0.13.2 # Ensure consistency

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          # name is just for display
          # os is the runner
          # package-suffix should never change
          - name: linux-x64
            package-suffix: linux-x64
            os: ubuntu-22.04
            target-cpu: x86-64
            nuget-rid: linux-x64
            target: x86_64-unknown-linux-gnu
            cross: 'true'
            force-cross: 'true'
            max-glibc: '2.17'
            linux: 'true'

          - name: linux-x64-ubuntu-24
            package-suffix: ubuntu-x86_64-24-mistake
            os: ubuntu-24.04
            target-cpu: x86-64
            nuget-rid: linux-x64
            target: x86_64-unknown-linux-gnu
            test-only: 'true' # for testing only, never publish

          - name: linux-arm64-ubuntu-22
            package-suffix: linux-arm64
            os: ubuntu-22.04-arm
            target-cpu: generic
            nuget-rid: linux-arm64
            target: aarch64-unknown-linux-gnu
            features: neon
            cross: 'true'
            force-cross: 'false'
            max-glibc: '2.34'
            linux: 'true'

          - name: osx-x64-15
            package-suffix: osx-x86_64
            os: macos-15-intel
            target-cpu: haswell
            nuget-rid: osx-x64
            target: x86_64-apple-darwin
            mac: 'true'

          - name: osx-arm64-14
            package-suffix: osx-arm64
            os: macos-14
            target-cpu: apple-m1
            nuget-rid: osx-arm64
            target: aarch64-apple-darwin
            mac: 'true'
          - name: win-x64-2022
            package-suffix: win-x86_64
            os: windows-2022
            target-cpu: x86-64
            nuget-rid: win-x64
            target: x86_64-pc-windows-msvc

          - name: win-x86-2022
            package-suffix: win-x86
            os: windows-2022
            target-cpu: generic
            target-feature: +sse,+sse2 # i686 MSVC ABI requires SSE2 for f64 (rust-lang/rust#116344)
            nuget-rid: win-x86
            target: i686-pc-windows-msvc

          - name: win-arm64-11
            package-suffix: win-arm64
            os: windows-11-arm
            target-cpu: generic
            nuget-rid: win-arm64
            target: aarch64-pc-windows-msvc
            woa: 'true'

          - name: linux-musl-x64
            package-suffix: linux-musl-x64
            nuget-rid: linux-musl-x64
            os: ubuntu-24.04
            target-cpu: x86-64
            target: x86_64-unknown-linux-musl
            features: mimalloc
            cross: 'true'
            static: true
            docker-platform: linux/amd64
            docker-image-name: imazen/imageflow_tool
            linux: 'true'

          - name: linux-musl-arm64
            package-suffix: linux-musl-arm64
            nuget-rid: linux-musl-arm64
            os: ubuntu-22.04-arm # ubuntu-latest #ubuntu-22-arm-16gb  #ubuntu-22.04-arm is in public preview
            target-cpu: generic
            target: aarch64-unknown-linux-musl
            features: mimalloc
            cross: 'true'
            static: true
            docker-platform: linux/arm64
            docker-image-name: imazen/imageflow_tool-arm64
            linux: 'true'

    runs-on: ${{ matrix.os }}
    name: "${{ (matrix.cross == 'true') && 'cross ' || ''}}${{ matrix.name }}${{ matrix.target-cpu && format(' cpu: {0}', matrix.target-cpu) }}${{ matrix.target && format(' target: {0}', matrix.target) }}${{ matrix.features && format(' features: {0}', matrix.features) }} runs-on:${{ matrix.os }}"


    steps:
      - name: "Goal: ${{ matrix.test-only != 'true' && github.event_name == 'release' && 'publish' || 'test' }} Imageflow.NativeRuntime.${{ matrix.package-suffix }} & Imageflow.NativeTool.${{ matrix.package-suffix }} with RID ${{ matrix.nuget-rid }}"
        run: echo "Hi"


      - name: Checkout code
        uses: actions/checkout@v6

      - name: Checkout zensim (sibling dependency)
        run: git clone --depth 1 https://github.com/imazen/zensim.git ../zensim

      - name: Parse version
        uses: ./.github/actions/parse-version
        id: parse_version

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.name }}
        if: matrix.cross != 'true'

      - name: Install 7z
        uses: ./.github/actions/install-7z

      - name: Install NASM
        uses: ./.github/actions/install-nasm
        if: matrix.cross != 'true' && runner.os != 'Windows' # nasm.us is down, winget fails

      - name: Install Rust (Windows ARM64)
        uses: ./.github/actions/install-win-arm-rust
        if: matrix.woa == 'true'

      - uses: dtolnay/rust-toolchain@stable
        if: matrix.cross != 'true'

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
        if: matrix.cross == 'true' && matrix.force-cross != 'true'

      - name: Install musl-tools
        run: sudo apt-get update && sudo apt-get install -y musl-tools
        if: contains(matrix.target, 'musl')

      - name: Install cargo-nextest
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-nextest

      - name: Install i686 target
        if: ${{ matrix.target == 'i686-pc-windows-msvc' && matrix.cross != 'true' }}
        uses: dtolnay/rust-toolchain@stable
        with:
          target: i686-pc-windows-msvc

      - run: rustup show

      # ----------------------------------------------------------------------------
      # Provides GITHUB_SHA_SHORT and others
      # ----------------------------------------------------------------------------
      - uses: FranzDiebold/github-env-vars-action@v1.3.0

      - name: Set EXTENSION to .zip or .tar.gz based on OS
        shell: bash
        run: echo "EXTENSION=${{ contains(matrix.os, 'windows') && 'zip' || 'tar.gz' }}" >> $GITHUB_ENV

      - name: Set env vars (1/3)
        shell: bash
        run: |
          echo "TARGET_DIR=target/${{ matrix.target }}/" >> $GITHUB_ENV
          echo "TAG_SHA_SUFFIX=${{ github.ref_name }}-${{ env.GITHUB_SHA_SHORT }}-${{ matrix.package-suffix }}" >> $GITHUB_ENV
          echo "RUSTFLAGS=${{ matrix.target-cpu && format('-Ctarget-cpu={0}', matrix.target-cpu) }} ${{ matrix.target-feature && format('-Ctarget-feature={0}', matrix.target-feature) }}" >> $GITHUB_ENV
          echo "CARGO_PROFILE_TARGET_FEATURES_ARGS=--${{ env.PROFILE }} ${{ matrix.target && format('--target={0}',matrix.target) }} ${{ matrix.features && format('--features={0}',matrix.features) }}" >> $GITHUB_ENV
          echo "CROSS_ARGS=--locked --${{ env.PROFILE }} ${{ matrix.features && format('--features={0}',matrix.features) }}" >> $GITHUB_ENV
          echo "REL_BINARIES_DIR=target/${{ matrix.target }}/${{ env.PROFILE }}/" >> $GITHUB_ENV
          echo "BUILD_EXCLUDE=${{ matrix.build-exclude && format('--exclude={0}',matrix.build-exclude) }}" >> $GITHUB_ENV
          echo "ALLOW_PUBLISH=${{ matrix.test-only != 'true' && github.event_name == 'release' && 'true' || 'false' }}" >> $GITHUB_ENV
          echo "LIBIMAGEFLOW_DYNAMIC=${{ contains(matrix.target, 'windows') && 'imageflow.dll'  || contains(matrix.target, 'apple') && 'libimageflow.dylib' || 'libimageflow.so' }}" >> $GITHUB_ENV
          echo "LIBIMAGEFLOW_STATIC=${{ contains(matrix.target, 'windows') && 'imageflow.lib' || 'libimageflow.a' }}" >> $GITHUB_ENV
          echo "IMAGEFLOW_TOOL=${{ contains(matrix.os, 'windows') && 'imageflow_tool.exe' || 'imageflow_tool' }}" >> $GITHUB_ENV
      
      - name: Set env vars (2/3)
        id: set_tag_sha_suffix
        shell: bash
        run: |
          echo "IMAGEFLOW_TAG_SHA_SUFFIX=imageflow-${{ env.TAG_SHA_SUFFIX }}" >> $GITHUB_ENV

      - name: Set env vars (3/3)
        id: set_vars_step
        shell: bash
        run: |
          echo "NUGET_PACKAGE_VERSION=${{ steps.parse_version.outputs.version }}" >> $GITHUB_ENV
          echo "IMAGEFLOW_TOOL_PATH=${{ env.REL_BINARIES_DIR }}${{ env.IMAGEFLOW_TOOL }}" >> $GITHUB_ENV

          # We want to check these are successfully uploaded
          echo "ESTIMATED_ARTIFACT_URL_COMMITS=${{ env.HTTPS_IMAGEFLOW_BUCKET }}/commits/${{ github.sha }}/${{ matrix.package-suffix }}/imageflow.${{ env.EXTENSION }}" >> $GITHUB_ENV
          echo "ESTIMATED_MUSL_VERSIONED_URL=${{ env.HTTPS_IMAGEFLOW_BUCKET }}/static/${{ github.ref_name }}/${{ env.IMAGEFLOW_TAG_SHA_SUFFIX }}.${{ env.EXTENSION }}" >> $GITHUB_ENV
          echo "ESTIMATED_MUSL_LATEST_URL=${{ env.HTTPS_IMAGEFLOW_BUCKET }}/static/latest/${{ matrix.package-suffix }}.${{ env.EXTENSION }}" >> $GITHUB_ENV

          # These are compiled into the binaries using a build script. We might review to reduce them later.
          echo "ESTIMATED_DOCS_URL=${{ env.HTTPS_IMAGEFLOW_BUCKET }}/doc" >> $GITHUB_ENV
          # Example: https://imageflow-nightlies.s3.amazonaws.com/releases/v2.1.1-rc11/imageflow-v2.1.1-rc11-248d7046-osx-arm64.tar.gz
          echo "ESTIMATED_ARTIFACT_URL=${{ env.HTTPS_IMAGEFLOW_BUCKET }}/releases/${{ github.ref_name }}/${{ env.IMAGEFLOW_TAG_SHA_SUFFIX }}.${{ env.EXTENSION }}" >> $GITHUB_ENV
          echo "CI_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
          echo "CI=True" >> $GITHUB_ENV
          echo "CI_REPO=${{ github.repository }}" >> $GITHUB_ENV
          echo "CI_JOB_URL=https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" >> $GITHUB_ENV
          echo "CI_JOB_TITLE=GitHub ${{ github.job }} ${{ matrix.name }}" >> $GITHUB_ENV # Use github.job instead of job_id
          echo "CI_STRING=GitHub actions" >> $GITHUB_ENV
          echo "CI_PULL_REQUEST_INFO=${{ github.event_name != 'release' }}" >> $GITHUB_ENV
          echo "CI_BUILD_URL=https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" >> $GITHUB_ENV
          echo "DEBUG=False" >> $GITHUB_ENV
          echo "TARGET_CPU=${{ matrix.target-cpu }}" >> $GITHUB_ENV
          echo "REL_NUGET_ARCHIVE_DIR=./artifacts/upload/nuget/${{ github.ref_type == 'tag' && github.ref_name || 'vTEST' }}/" >> $GITHUB_ENV # May not be needed anymore
          echo "CI_RELEASE=${{ github.event_name == 'release' && 'true' || 'false' }}" >> $GITHUB_ENV

      - if: contains(matrix.target, 'musl')
        name: "Edit imageflow_abi/Cargo.toml to build staticlib instead of cdylib and use strip and lto"
        run: |
          echo "Editing imageflow_abi/Cargo.toml to replace the cydlib with staticlib"
          sed -i 's/\["cdylib"\]/\["staticlib"\]/g' imageflow_abi/Cargo.toml
          echo "Editing ./Cargo.toml to remove all instances of '# enable on musl: '"
          sed -i '/# enable on musl:/d' ./Cargo.toml
          echo "Finished editing imageflow_abi/Cargo.toml: "
          cat imageflow_abi/Cargo.toml


      # TESTS ---------------------------------------------------------------------
      - name: "cargo nextest run --all --locked --profile ci ${{ env.CARGO_PROFILE_TARGET_FEATURES_ARGS }}"
        run: cargo nextest run --all --locked --profile ci ${{ env.CARGO_PROFILE_TARGET_FEATURES_ARGS }}
        env:
          REGRESS_MANIFEST_DIR: ${{ github.workspace }}/.image-cache/manifests
        if: matrix.cross != 'true'

      - name: Install cross
        uses: taiki-e/install-action@v2
        with:
          tool: cross
        if: matrix.force-cross == 'true'

      - name: "nextest run (cross) --target ${{ matrix.target }} ${{ env.CROSS_ARGS }} --profile ci"
        shell: bash
        run: |
          if [ "${{ matrix.force-cross }}" = "true" ]; then
            cross nextest run --target ${{ matrix.target }} ${{ env.CROSS_ARGS }} --profile ci
          else
            cargo nextest run --target ${{ matrix.target }} ${{ env.CROSS_ARGS }} --profile ci
          fi
        env:
          CROSS_CONTAINER_OPTS: "--volume ${{ github.workspace }}/../zensim:${{ github.workspace }}/../zensim"
          REGRESS_MANIFEST_DIR: ${{ github.workspace }}/.image-cache/manifests
        if: matrix.cross == 'true'

      - name: Download regress_report
        shell: bash
        run: |
          case "${{ runner.os }}-${{ runner.arch }}" in
            Linux-X64)   ASSET="regress_report-linux-x64" ;;
            Linux-ARM64) ASSET="regress_report-linux-arm64" ;;
            macOS-X64)   ASSET="regress_report-macos-x64" ;;
            macOS-ARM64) ASSET="regress_report-macos-arm64" ;;
            Windows-X64)   ASSET="regress_report-windows-x64.exe" ;;
            Windows-ARM64) ASSET="regress_report-windows-arm64.exe" ;;
            *) echo "Unknown platform: ${{ runner.os }}-${{ runner.arch }}"; exit 1 ;;
          esac
          gh release download "${{ env.ZENSIM_TOOLS_VERSION }}" \
            --repo imazen/zensim \
            --pattern "$ASSET" \
            --output regress_report${{ contains(runner.os, 'Windows') && '.exe' || '' }}
          chmod +x regress_report${{ contains(runner.os, 'Windows') && '.exe' || '' }}
        env:
          GH_TOKEN: ${{ github.token }}
        if: always() && hashFiles('.image-cache/manifests/*.tsv') != ''

      - name: Generate regression report
        shell: bash
        run: |
          ./regress_report${{ contains(runner.os, 'Windows') && '.exe' || '' }} \
            --manifest-dir .image-cache/manifests \
            --diffs-dir .image-cache/diffs \
            --platform "${{ matrix.name }}" \
            --combine-output .image-cache/test-manifest.tsv \
            -o .image-cache/regression-report.html
        if: always() && hashFiles('.image-cache/manifests/*.tsv') != ''

      - name: Upload updated checksums
        uses: actions/upload-artifact@v4
        with:
          name: checksums-${{ matrix.name }}
          path: imageflow_core/tests/integration/visuals/*.checksums
        if: always()

      - name: Upload test output images (for debugging)
        uses: actions/upload-artifact@v4
        with:
          name: test-outputs-${{ matrix.name }}
          path: |
            .image-cache/outputs/
            .image-cache/diffs/
            .image-cache/manifests/
            .image-cache/test-manifest.tsv
            .image-cache/regression-report.html
          if-no-files-found: ignore
        if: always()

      # BUILD ---------------------------------------------------------------------
      - name: "cargo build --all ${{ env.BUILD_EXCLUDE }} ${{ env.CARGO_PROFILE_TARGET_FEATURES_ARGS }}"
        if: matrix.cross != 'true'
        run: cargo build --all ${{ env.BUILD_EXCLUDE }} ${{ env.CARGO_PROFILE_TARGET_FEATURES_ARGS }}


      - name: "cross cargo build --target ${{ matrix.target }} ${{ env.CROSS_ARGS }}"
        uses: houseabsolute/actions-rust-cross@v1.0.2
        with:
          command: "build"
          target: ${{ matrix.target }}
          args: "--all ${{ env.BUILD_EXCLUDE }} ${{ env.CROSS_ARGS }}"
          force-use-cross: ${{ matrix.force-cross == 'true' || false }}
        env:
          CROSS_CONTAINER_OPTS: "--volume ${{ github.workspace }}/../zensim:${{ github.workspace }}/../zensim"
        if: matrix.cross == 'true'


      # CHECK GLIBC ---------------------------------------------------------------------
      - name: "Check GLIBC version and dynamic dependencies of ${{ env.LIBIMAGEFLOW_DYNAMIC }}"
        if: matrix.max-glibc
        run: |
          chmod +x ./ci/check-glibc.sh
          ./ci/check-glibc.sh "${{ env.REL_BINARIES_DIR }}${{ env.LIBIMAGEFLOW_DYNAMIC }}" "${{ matrix.max-glibc }}"
        shell: bash

      # CHECK IMAGEFLOW_TOOL ---------------------------------------------------------------------
      - run: "${{ env.IMAGEFLOW_TOOL_PATH }} diagnose --show-compilation-info"
        shell: bash
        if: matrix.cross != 'true'

      # BUILD DOCUMENTATION ---------------------------------------------------------------------
      - name: "Build ${{ env.PROFILE }} Docs"
        run: cargo doc --all --no-deps ${{ env.CARGO_PROFILE_TARGET_FEATURES_ARGS }}
        if: matrix.name == 'linux-x64-ubuntu-24'

      # CREATE ZIP/TAR FILES FOR UPLOAD ---------------------------------------------------------------------
      - name: "Create zip/tar files for S3/Release upload" # (always, so we know if it fails before we make a release)
        shell: bash
        run: |
          chmod +x ./ci/pack_artifacts.sh
          ./ci/pack_artifacts.sh
        env:
          TARGET_DIR: ${{ env.TARGET_DIR }}
          REL_BINARIES_DIR: ${{ env.REL_BINARIES_DIR }}
          EXTENSION: ${{ env.EXTENSION }}
          IMAGEFLOW_TAG_SHA_SUFFIX: ${{ env.IMAGEFLOW_TAG_SHA_SUFFIX }}
          LIBIMAGEFLOW_STATIC: ${{ env.LIBIMAGEFLOW_STATIC }}
          LIBIMAGEFLOW_DYNAMIC: ${{ env.LIBIMAGEFLOW_DYNAMIC }}
          MATRIX_COMMIT_SUFFIX: ${{ matrix.package-suffix }}
          MATRIX_TARGET: ${{ matrix.target }} # not used?
          HTTPS_UPLOAD_BASE: ${{ env.HTTPS_IMAGEFLOW_BUCKET }}
          TAG_SHA_SUFFIX: ${{ env.TAG_SHA_SUFFIX }}
          IMAGEFLOW_TOOL: ${{ env.IMAGEFLOW_TOOL }}


      # STAGE NATIVE BINARIES FOR NUGET PACKING JOB ---------------------------------------------------------------------
      - name: Stage Native Binaries for NuGet Artifact and S3 Upload
        if: ${{ !matrix.test-only }} # Don't stage binaries for unpublished builds
        shell: bash
        run: |
          NUGET_STAGE_DIR="artifacts/native_binaries/${{ matrix.nuget-rid }}"
          S3_STAGE_DIR="artifacts/upload/${{ matrix.package-suffix }}" # Using package-suffix for S3 path

          mkdir -p "$NUGET_STAGE_DIR"
          mkdir -p "$S3_STAGE_DIR"

          echo "Staging native binaries from ${{ env.REL_BINARIES_DIR }} for RID ${{ matrix.nuget-rid }}"
          echo "  NuGet artifact dir: $NUGET_STAGE_DIR"
          echo "  S3 upload dir:    $S3_STAGE_DIR"

          TOOL_PATH="${{ env.IMAGEFLOW_TOOL_PATH }}"
          DYNAMIC_LIB_PATH="${{ env.REL_BINARIES_DIR }}${{ env.LIBIMAGEFLOW_DYNAMIC }}"
          STATIC_LIB_PATH="${{ env.REL_BINARIES_DIR }}${{ env.LIBIMAGEFLOW_STATIC }}"

          tool_exists=false
          dynamic_lib_exists=false
          static_lib_exists=false

          # Check and Copy Tool
          if [[ -f "$TOOL_PATH" ]]; then
            tool_exists=true
            cp "$TOOL_PATH" "$NUGET_STAGE_DIR/"
            cp "$TOOL_PATH" "$S3_STAGE_DIR/"
            echo "  Copied tool: ${{ env.IMAGEFLOW_TOOL }}"
          fi

          # Check and Copy Dynamic Lib
          if [[ -f "$DYNAMIC_LIB_PATH" ]]; then
            dynamic_lib_exists=true
            # Only copy dynamic lib if not a static build
            if [[ "${{ matrix.static }}" != "true" ]]; then
               cp "$DYNAMIC_LIB_PATH" "$NUGET_STAGE_DIR/"
               cp "$DYNAMIC_LIB_PATH" "$S3_STAGE_DIR/"
               echo "  Copied dynamic lib: ${{ env.LIBIMAGEFLOW_DYNAMIC }}"
            else
               echo "  Skipping dynamic lib copy for static build."
            fi
          fi

          # Check and Copy Static Lib
          if [[ -f "$STATIC_LIB_PATH" ]]; then
            static_lib_exists=true
            cp "$STATIC_LIB_PATH" "$NUGET_STAGE_DIR/"
            cp "$STATIC_LIB_PATH" "$S3_STAGE_DIR/" # Also copy static lib to S3 dir if it exists
            echo "  Copied static lib: ${{ env.LIBIMAGEFLOW_STATIC }}"
          fi

          # --- Validation ---
          echo "  Performing validation..."
          if [[ "$tool_exists" != "true" ]]; then
             echo "Error: Required tool executable not found at $TOOL_PATH" >&2
             exit 1
          fi

          if [[ "${{ matrix.static }}" == "true" ]]; then
            if [[ "$static_lib_exists" != "true" ]]; then
              echo "Error: Static build requires static library, but it was not found at $STATIC_LIB_PATH" >&2
              exit 1
            else
               echo "  Static build validation passed (tool and static lib exist)."
            fi
          else # Not a static build
            if [[ "$dynamic_lib_exists" != "true" ]]; then
              echo "Error: Non-static build requires dynamic library, but it was not found at $DYNAMIC_LIB_PATH" >&2
              exit 1
            else
               echo "  Dynamic build validation passed (tool and dynamic lib exist)."
            fi
          fi


      - name: List Staged Native Binaries (Before Upload)
        if: ${{ !matrix.test-only }}
        shell: bash
        run: |
          echo "--- Contents of NuGet staging dir: artifacts/native_binaries/${{ matrix.nuget-rid }}/"
          ls -R "artifacts/native_binaries/${{ matrix.nuget-rid }}/"
          echo "--- Contents of S3 staging dir: artifacts/upload/${{ matrix.package-suffix }}/"
          ls -R "artifacts/upload/${{ matrix.package-suffix }}/"

      - name: Upload Native Binaries Artifact
        if: ${{ !matrix.test-only }} # Don't upload artifacts for unpublished builds
        uses: actions/upload-artifact@v4
        with:
          name: native-binaries-${{ matrix.nuget-rid }}
          path: artifacts/native_binaries/
          if-no-files-found: error # Fail if expected binaries weren't staged
          retention-days: 3 # Keep artifacts long enough for pack job


      # PER-RID PACK & TEST ---------------------------------------------------------------------
      - name: Run Single Pack & Test Script for RID ${{ matrix.nuget-rid }}
        if: ${{ !matrix.static && !matrix.test-only }} # Only test if runtime package exists
        shell: pwsh
        run: |
          ./dotnet/nuget/scripts/build-pipeline.ps1 `
            -Mode SingleCI `
            -TargetRid "${{ matrix.nuget-rid }}" `
            -PackageVersion "${{ env.NUGET_PACKAGE_VERSION }}" `
            -ImageflowNetVersion "${{ env.IMAGEFLOW_NET_VERSION }}" `
            -NativeArtifactBasePath "$(pwd)/artifacts/native_binaries/${{ matrix.nuget-rid }}" `
            -PackOutputDirectory "./temp_nuget_pkg/${{ matrix.nuget-rid }}" # Temporary output for testing this RID
            # -SkipTest:$false is default

      # No test results file to upload - script checks exit code
      # - name: Upload Test Results (from single-pack-and-test run)
      #   if: ${{ !matrix.static && !matrix.test-only }} # If test was run
      #   uses: actions/upload-artifact@v4
      #   with:
      #     name: test-results-${{ matrix.nuget-rid }}
      #     path: "./dotnet/nuget/test/bin/Release/**/*.trx" # Assuming TRX output path
      #     if-no-files-found: ignore # Don't fail if tests didn't run or produce output


      # UPLOAD S3/RELEASE/DOCKER ---------------------------------------------------------------------
      - name: "Upload to Github Release"
        if: ${{ env.ALLOW_PUBLISH == 'true' }}
        uses: xresloader/upload-to-github-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          file: "./artifacts/github/*.${{ env.EXTENSION }}"
          tags: true
          overwrite: true
          verbose: true

      - name: Upload ./artifacts/upload to S3
        if: ${{ env.ALLOW_PUBLISH == 'true' }}
        uses: shallwefootball/s3-upload-action@master
        with:
          aws_key_id: ${{ secrets.AWS_KEY_ID }}
          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY}}
          aws_bucket: ${{ env.IMAGEFLOW_RELEASE_BUCKET }}
          source_dir: ./artifacts/upload
          destination_dir: ''


      - name: "Verify artifacts are now on S3, and public"
        if: ${{ env.ALLOW_PUBLISH == 'true' }}
        shell: bash
        continue-on-error: true
        run: |
          # Function to test URL silently and return status
          test_url() {
            if curl -s -f -I "$1" 2>/dev/null >/dev/null; then
              echo "✓ OK $1"
              return 0
            else
              echo "✗ FAILED $1"
              return 1
            fi
          }

          # Test all relevant URLs
          failed=0
          test_url "${{ env.ESTIMATED_ARTIFACT_URL }}" || failed=1
          test_url "${{ env.ESTIMATED_ARTIFACT_URL_COMMITS }}" || failed=1

          # Test MUSL-specific URLs if applicable
          if [[ ${{ matrix.target }} == *"musl"* ]]; then
            test_url "${{ env.ESTIMATED_MUSL_VERSIONED_URL }}" || failed=1
            test_url "${{ env.ESTIMATED_MUSL_LATEST_URL }}" || failed=1
          fi

          # Exit with failure if any URL test failed
          exit $failed


      - name: From git, get 'latest' / 'main' / 'v1.2.3' tags
        id: meta
        if: ${{ contains(matrix.docker-image-name, 'imageflow') }}
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ matrix.docker-image-name }}
          labels: |
            org.opencontainers.image.title=imageflow_tool
            org.opencontainers.image.description=imageflow_tool - Secure, high performance image optimization and manipulation for web servers.
            org.opencontainers.image.vendor=imazen
            org.opencontainers.image.licenses=AGPL-3.0

      - name: "Set up Docker Buildx"
        if: ${{ contains(matrix.docker-image-name, 'imageflow') }}
        uses: docker/setup-buildx-action@v3

      - name: "Login to Docker Hub"
        if: ${{ env.ALLOW_PUBLISH == 'true' && contains(matrix.docker-image-name, 'imageflow') }}
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: "Copy imageflow_tool to docker context"
        if: ${{ contains(matrix.docker-image-name, 'imageflow') }}
        run: cp ${{ env.IMAGEFLOW_TOOL_PATH }} ./docker/imageflow_tool/imageflow_tool
        shell: bash

      - name: "Build and push imageflow_tool Docker image (allow failure)"
        continue-on-error: true
        if: ${{ contains(matrix.docker-image-name, 'imageflow') }}
        uses: docker/build-push-action@v6
        with:
          context: ./docker/imageflow_tool/
          file: ./docker/imageflow_tool/Dockerfile
          # call: build (default I think)
          platforms: ${{ matrix.docker-platform }}
          push: ${{ env.ALLOW_PUBLISH == 'true' }}
          labels:  ${{ steps.meta.outputs.labels }}
          tags: ${{ steps.meta.outputs.tags }}


  aggregate-regression:
    needs: [build]
    if: always()
    runs-on: ubuntu-24.04
    name: "Cross-platform regression report"
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: test-outputs-*
          path: artifacts/

      - name: Download regress_report
        run: |
          gh release download "${{ env.ZENSIM_TOOLS_VERSION }}" \
            --repo imazen/zensim \
            --pattern "regress_report-linux-x64" \
            --output regress_report
          chmod +x regress_report
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Generate merged regression report
        run: |
          PLATFORMS=()
          for dir in artifacts/test-outputs-*/; do
            name=$(basename "$dir" | sed 's/^test-outputs-//')
            manifest_dir="$dir/manifests"
            diffs_dir="$dir/diffs"
            if [ -d "$manifest_dir" ] && ls "$manifest_dir"/*.tsv 1>/dev/null 2>&1; then
              PLATFORMS+=("--platform" "$name" "--manifest-dir" "$manifest_dir")
              if [ -d "$diffs_dir" ]; then
                PLATFORMS+=("--diffs-dir" "$diffs_dir")
              fi
            fi
          done
          if [ ${#PLATFORMS[@]} -eq 0 ]; then
            echo "No platforms produced manifests"
            exit 0
          fi
          echo "Generating merged report for: ${PLATFORMS[*]}"
          ./regress_report "${PLATFORMS[@]}" -o merged-regression-report.html

      - uses: actions/upload-artifact@v4
        with:
          name: merged-regression-report
          path: merged-regression-report.html
          if-no-files-found: warn

  pack-and-publish-nuget:
    needs: [build]
    runs-on: ubuntu-latest # Use Linux for consistency in packing/pushing
    name: "Pack Solution & Publish NuGet Packages"

    # Grant permissions to write packages to GitHub Packages
    permissions:
      contents: read
      packages: write


    steps:
      - name: "Goal: ${{ github.event_name == 'release' && 'Pack, Test, and Publish' || 'Pack and Test' }} all NuGet packages"
        run: echo "Starting NuGet pack, test, and publish job..."

      - name: Checkout code
        uses: actions/checkout@v6

      - name: Parse version
        uses: ./.github/actions/parse-version
        id: parse_version
      - run: echo "NUGET_PACKAGE_VERSION=${{ steps.parse_version.outputs.version }}" >> $GITHUB_ENV

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x' # Or your required version

      - name: Download all Native Binaries artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: native-binaries-* # Match artifact names from build job
          path: artifacts/native_binaries/ # Download into this base directory
          merge-multiple: true # Critical: ensures RIDs are in subdirs like artifacts/native_binaries/win-x64

      - name: List downloaded artifacts (for debugging)
        run: find artifacts/native_binaries

      - name: Run Merge, Pack, Test, and Publish Script
        shell: pwsh
        run: |
          $pushNuGet = "${{ github.event_name == 'release' && env.NUGET_UPLOAD_NUGET == 'true' }}" -eq "true"
          $pushGitHub = "${{ github.event_name == 'release' && env.NUGET_UPLOAD_GITHUB == 'true' }}" -eq "true"
          # $deleteOnFail = $true # Handled by default in build-pipeline.ps1

          $pipelineArgs = @{
            Mode                  = 'MultiCI'
            PackageVersion        = "${{ env.NUGET_PACKAGE_VERSION }}"
            ImageflowNetVersion   = "*"
            NativeArtifactBasePath = "$(pwd)/artifacts/native_binaries" # Base path containing all downloaded RID subdirs
            PackOutputDirectory   = "${{ env.REL_NUGET_OUTPUT_DIR }}"    # Final output directory
            SkipTest              = $false
            TargetRid             = "linux-x64"
            # Push switches added conditionally below
            DeleteNuGetOnFailure = $true # Default, can be set to $false or controlled by env var if needed
          }
          if ($pushNuGet) {
              Write-Host "Setting PushToNuGet to true"
              $pipelineArgs['PushToNuGet'] = $true
              $pipelineArgs['NuGetApiKey'] = "${{ secrets.NUGET_API_KEY }}"
              # NuGetSourceUrl uses default unless overridden
          }
          if ($pushGitHub) {
              Write-Host "Setting PushToGitHub to true"
               $pipelineArgs['PushToGitHub'] = $true
               # Assumes gh CLI is present and GITHUB_TOKEN is in env
          }
          Write-Host "build-pipeline.ps1 args: $pipelineArgs"
          # Execute the pipeline script with splatted arguments
          ./dotnet/nuget/scripts/build-pipeline.ps1 @pipelineArgs
        env:
          NUGET_UPLOAD_NUGET: ${{ env.NUGET_UPLOAD_NUGET }} # Needed for conditional check above
          NUGET_UPLOAD_GITHUB: ${{ env.NUGET_UPLOAD_GITHUB }} # Needed for conditional check above
          REL_NUGET_OUTPUT_DIR: ${{ env.REL_NUGET_OUTPUT_DIR }} # Define where final packages go