publish.yml

on:
  push:
    tags:
      - v*
  workflow_dispatch:

jobs:
  build:
    # TODO: should we run the tests, or can we assume that a v* tag ought to
    # get published?
    name: build
    strategy:
      matrix:
        node: [20]
        os:
          - name: darwin
            architecture: arm64
            host: macos-14

          - name: linux
            architecture: x86-64
            host: ubuntu-20.04
    env:
      CC: clang
      CXX: clang++
      npm_config_clang: 1
      GYP_DEFINES: use_obsolete_asm=true
    runs-on: ${{ matrix.os.host }}
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          check-latest: true
      - name: Prebuildify
        run: |
          [[ $(uname -o) == *Linux ]] && \
            sudo apt-get update && \
            sudo apt-get install -y software-properties-common git build-essential clang libssl-dev libkrb5-dev libc++-dev wget python3
          npm ci
          npx prebuildify --napi --strip --tag-libc -t "$(node --version | tr -d 'v')"
      - uses: actions/upload-artifact@v4
        with:
          name: prebuild-${{ runner.os }}-${{ runner.arch }}
          path: ./prebuilds
          retention-days: 14

  cross-compile:
    name: "cross compile linux/arm"
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-qemu-action@v3
      - name: build linux glibc arm
        run: |
          docker build --platform=linux/arm64 --tag nodegit-linux-glibc-arm64 -f scripts/Dockerfile.debian .
          docker create --platform=linux/arm64 --name nodegit-linux-glibc-arm64 nodegit-linux-glibc-arm64
          docker cp "nodegit-linux-glibc-arm64:/app/prebuilds" .
      - name: build linux musl x64
        run: |
          docker build --platform=linux/amd64 --tag nodegit-linux-musl-amd64 -f scripts/Dockerfile.alpine .
          docker create --platform=linux/amd64 --name nodegit-linux-musl-amd64 nodegit-linux-musl-amd64
          docker cp "nodegit-linux-musl-amd64:/app/prebuilds" .
      - name: build linux musl arm
        run: |
          docker build --platform=linux/arm64 --tag nodegit-linux-musl-arm64 -f scripts/Dockerfile.alpine .
          docker create --platform=linux/arm64 --name nodegit-linux-musl-arm64 nodegit-linux-musl-arm64
          docker cp "nodegit-linux-musl-arm64:/app/prebuilds" .
      - name: "list the generated files"
        run: find prebuilds
      - uses: actions/upload-artifact@v4
        with:
          name: prebuild-linux-arm64
          path: ./prebuilds
          retention-days: 14

  # https://docs.npmjs.com/generating-provenance-statements#publishing-packages-with-provenance-via-github-actions
  publish:
    runs-on: ubuntu-latest
    needs: [build, cross-compile]
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          check-latest: true
          registry-url: "https://registry.npmjs.org"
          scope: "readme"
      - name: download built libraries
        id: download
        uses: actions/download-artifact@v4
        with:
          path: prebuilds
      - name: copy libs
        run: |
          set -x
          mkdir -p prebuilds/linux-arm64
          mkdir -p prebuilds/linux-x64
          mkdir -p prebuilds/darwin-arm64
          find ${{ steps.download.outputs.download-path }}
          mv ${{ steps.download.outputs.download-path}}/prebuild-Linux-X64/linux-x64/* ./prebuilds/linux-x64/
          mv ${{ steps.download.outputs.download-path}}/prebuild-linux-arm64/linux-arm64/* ./prebuilds/linux-arm64/
          mv ${{ steps.download.outputs.download-path}}/prebuild-linux-arm64/linux-x64/* ./prebuilds/linux-x64/
          mv ${{ steps.download.outputs.download-path}}/prebuild-macOS-ARM64/darwin-arm64/* ./prebuilds/darwin-arm64/
          find ./prebuilds
      - name: npm install
        run: npm ci
      - name: publish
        run: |
          (cat "$NPM_CONFIG_USERCONFIG" || true) && npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}