ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

# No id-token: nothing here assumes an AWS role any more. The one private
# dependency, erpl-proto, is reached with a scoped GitHub App token instead.
permissions:
  contents: read

env:
  DUCKDB_VERSION: "1.5.5"

jobs:
  build-and-test:
    name: Build server + run tests (Linux)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install build tools
        run: sudo apt-get update && sudo apt-get install -y ninja-build unzip

      # erpl-proto is private, so `submodules: recursive` on the checkout cannot
      # fetch it with the default GITHUB_TOKEN. Mint a read-only App token scoped
      # to erpl-proto alone -- the scope release.yml already proves -- rather than
      # widening the App's reach to this repository, which is what letting
      # actions/checkout do the submodules would require.
      - name: Mint a read-only token for erpl-proto
        id: proto_token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.REPO_READONLY_GITHUB_APP_ID }}
          private-key: ${{ secrets.REPO_READONLY_GITHUB_APP_KEY }}
          repositories: "erpl-proto"

      # Both rewrites are needed: posthog-telemetry is registered with an SSH
      # URL and a hosted runner has no key, which is the reason actions/checkout
      # sets the same insteadOf when it does submodules itself. The token goes
      # through the environment so it never reaches a command line.
      - name: Check out submodules
        # shell: bash explicitly -- the Windows runner defaults to PowerShell,
        # where $TOKEN is not an environment variable ($env:TOKEN is). Without
        # this the rewrite below gets an empty password and GitHub answers
        # "Invalid username or token" on the one private submodule.
        shell: bash
        env:
          TOKEN: ${{ steps.proto_token.outputs.token }}
        run: |
          git config --global url."https://x-access-token:$TOKEN@github.com/".insteadOf "https://github.com/"
          git config --global --add url."https://x-access-token:$TOKEN@github.com/".insteadOf "git@github.com:"
          git submodule update --init --recursive

      # vcpkg pinned to the manifest's builtin-baseline so Catch2 resolves
      # deterministically; the action exports VCPKG_ROOT for the Makefile.
      - name: Setup vcpkg
        uses: lukka/run-vcpkg@v11
        with:
          vcpkgGitCommitId: 11bbc873e00e9e58d4e9dffb30b7a5493a030e0b

      # Static, needs no SAP and no build: the transport must ship exactly the
      # objects zcl_erpl_rev_footprint.abap says erpl-rev delivers. It shipped
      # seven of fourteen for as long as both lists have existed.
      - name: Transport completeness
        run: ./scripts/check-transport-complete.sh

      # A moved heading or a deleted document otherwise rots quietly, and the
      # first person to find it is a reader who wanted the thing it pointed at.
      - name: Doc links
        run: ./scripts/check-doc-links.sh

      - name: Build (server + tests)
        run: make build

      - name: Run tests
        run: make test

  build-macos:
    # macOS had no CI at all: it was built only by the release workflow, on a
    # tag, which is the worst place to discover a platform break. It matters more
    # now that DuckDB is compiled from source rather than downloaded prebuilt.
    #
    # It builds exactly what the release builds -- erpl-proto, statically linked
    # -- so a break here is a break in the artifact, not in a configuration
    # nobody ships.
    name: Build server + run tests (macOS)
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v4

      - name: Install build tools
        run: brew install ninja

      - name: Setup vcpkg
        uses: lukka/run-vcpkg@v11
        with:
          vcpkgGitCommitId: 11bbc873e00e9e58d4e9dffb30b7a5493a030e0b

      - name: Mint a read-only token for erpl-proto
        id: proto_token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.REPO_READONLY_GITHUB_APP_ID }}
          private-key: ${{ secrets.REPO_READONLY_GITHUB_APP_KEY }}
          repositories: "erpl-proto"

      - name: Check out submodules
        # shell: bash explicitly -- the Windows runner defaults to PowerShell,
        # where $TOKEN is not an environment variable ($env:TOKEN is). Without
        # this the rewrite below gets an empty password and GitHub answers
        # "Invalid username or token" on the one private submodule.
        shell: bash
        env:
          TOKEN: ${{ steps.proto_token.outputs.token }}
        run: |
          git config --global url."https://x-access-token:$TOKEN@github.com/".insteadOf "https://github.com/"
          git config --global --add url."https://x-access-token:$TOKEN@github.com/".insteadOf "git@github.com:"
          git submodule update --init --recursive

      - name: Build the pure-Rust RFC shim
        run: cargo build --release -p erpl-proto-nwrfc --manifest-path erpl-proto/Cargo.toml

      - name: Build (server + tests)
        run: make build VCPKG_TRIPLET=arm64-osx

      - name: Run tests
        run: make test VCPKG_TRIPLET=arm64-osx

  build-windows:
    # The release Windows bundle is built only on tags, so Windows-only breaks
    # used to slip to the release. Build the same x64-windows-static config
    # (server + tests) AND run the suite here on every push/PR.
    name: Build server + run tests (Windows)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup vcpkg
        uses: lukka/run-vcpkg@v11
        with:
          vcpkgGitCommitId: 11bbc873e00e9e58d4e9dffb30b7a5493a030e0b

      - name: Mint a read-only token for erpl-proto
        id: proto_token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.REPO_READONLY_GITHUB_APP_ID }}
          private-key: ${{ secrets.REPO_READONLY_GITHUB_APP_KEY }}
          repositories: "erpl-proto"

      - name: Check out submodules
        # shell: bash explicitly -- the Windows runner defaults to PowerShell,
        # where $TOKEN is not an environment variable ($env:TOKEN is). Without
        # this the rewrite below gets an empty password and GitHub answers
        # "Invalid username or token" on the one private submodule.
        shell: bash
        env:
          TOKEN: ${{ steps.proto_token.outputs.token }}
        run: |
          git config --global url."https://x-access-token:$TOKEN@github.com/".insteadOf "https://github.com/"
          git config --global --add url."https://x-access-token:$TOKEN@github.com/".insteadOf "git@github.com:"
          git submodule update --init --recursive

      - name: Build the pure-Rust RFC shim
        run: cargo build --release -p erpl-proto-nwrfc --manifest-path erpl-proto/Cargo.toml


      - name: Build (server + tests)
        run: |
          # x64-windows-static mirrors the release build: static OpenSSL and a
          # static CRT (/MT) to match DuckDB, compiled from the pinned submodule
          # and linked in. Builds all targets incl. tests, so an MSVC-only
          # compile error fails here instead of at release time.
          cmake -S . -B build -DCMAKE_BUILD_TYPE=Release `
            -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
            -DVCPKG_TARGET_TRIPLET=x64-windows-static `
            -DDUCKDB_VERSION="$env:DUCKDB_VERSION" `
            -DRFC_LINK=static -DERPL_PROTO_ROOT="$PWD/erpl-proto"
          cmake --build build --config Release

      - name: Run tests
        run: .\build\Release\erpl_rev_tests.exe