CD.yml

name: CD

on:
  # JoltPhysicsC says so itself, the moment it cuts a release. The cron below fires day 1 at
  # 03:00 and JoltPhysicsC's porter agent runs day 2 at 05:00, so the monthly look happened 26
  # hours before there was anything to find -- and cutting the release is a manual step after
  # that, so a version of JoltPhysics took two months to reach this package rather than one.
  repository_dispatch:
    types: [upstream-released]

  # Kept as a safety net rather than as the mechanism. If a dispatch is ever lost, the chain
  # recovers by itself next month instead of stopping forever.
  schedule:
    - cron: "0 3 1 * *"
  workflow_dispatch:
    inputs:
      skip-assets-publishing:
        description: 'Skip assets publishing'
        required: false
        type: boolean
        default: false
      force-publish:
        description: 'Publish even when the generated code is unchanged'
        required: false
        type: boolean
        default: false
      publish-only:
        description: 'Publish main exactly as it stands, without looking at upstream'
        required: false
        type: boolean
        default: false

jobs:
  # Reports how far behind the tracked JoltPhysicsC release we are, without touching the
  # tree. Its answer decides nothing here -- the fetch inside the CD resolves the same
  # release -- but it puts the version in the run summary before anything is committed,
  # which is what makes a surprise visible rather than archaeological.
  resolve:
    if: github.event_name != 'schedule' || github.ref == 'refs/heads/main'
    uses: EvergineTeam/Evergine.Bindings/.github/workflows/binding-resolve-upstream.yml@v1

  cd:
    needs: resolve
    if: always() && needs.resolve.result == 'success' && !cancelled()
    # binding-tracked-cd, not binding-simple-cd. simple-cd builds and publishes
    # unconditionally, which is why a cron could not be added to it: it would ship a
    # package every month whether or not the API moved. tracked-cd reads binding.yml,
    # fetches what it declares, and publishes only when the generated code changed.
    uses: EvergineTeam/Evergine.Bindings/.github/workflows/binding-tracked-cd.yml@v1
    with:
      # Windows, because CppAst's libclang cannot resolve <stdint.h> on the Linux runner
      # and the parse aborts. The generator would then emit a smaller binding, not none.
      runner-os: windows-latest
      generator-project: "JoltPhysicsGen/JoltPhysicsGen.csproj"
      generator-name: "JoltPhysicsGen"
      binding-project: "Evergine.Bindings.JoltPhysics/Evergine.Bindings.JoltPhysics.csproj"
      target-framework: "net10.0"
      dotnet-version: "10.x"
      nuget-version: "6.x"
      runtime-identifier: "win-x64"
      build-configuration: "Release"
      revision: ${{ github.run_number }}
      # No natives-artifact-pattern: the ten libraries are not built here. They come from
      # the release assets the manifest declares, unpacked by the fetch step, which is
      # also what satisfies the CD's refusal to commit a bump without them.
      force-publish: ${{ inputs.force-publish || false }}
      publish-only: ${{ inputs.publish-only || false }}
      # Never from here. Publishing moved into its own job, behind the smoke test, so no
      # package reaches nuget.org without having been installed and run first. This used to be
      # `!inputs.skip-assets-publishing`, and a scheduled run has no inputs to negate, so it
      # evaluated true: the monthly cron published on its own, unverified, and did so exactly
      # when the generated API had moved and the risk was highest.
      publish-enabled: false
      enable-email-notifications: true
    secrets:
      NUGET_UPLOAD_TOKEN: ${{ secrets.EVERGINE_NUGETORG_TOKEN }}
      WAVE_SENDGRID_TOKEN: ${{ secrets.WAVE_SENDGRID_TOKEN }}
      EVERGINE_EMAILREPORT_LIST: ${{ secrets.EVERGINE_EMAILREPORT_LIST }}
      EVERGINE_EMAIL: ${{ secrets.EVERGINE_EMAIL }}

  # Installs the package that was just built on the five runtime identifiers a runner can execute
  # and drops a sphere onto a floor through it. The CD only proves the package builds -- it links
  # nothing, loads nothing and calls nothing, so a package with the wrong natives, or none for an
  # identifier, looks exactly like a good one until somebody installs it.
  smoke:
    needs: cd
    if: needs.cd.outputs.packaged == 'true'
    uses: ./.github/workflows/package-smoke.yml
    with:
      cd-run-id: ''

  # Only now, and only if every leg passed. `needs: smoke` is the gate: a red leg means this job
  # never starts.
  publish:
    needs: [cd, smoke]
    if: needs.cd.outputs.packaged == 'true' && !inputs.skip-assets-publishing
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/download-artifact@v4
        with:
          name: nuget-packages
          path: nupkgs

      - name: Publish to nuget.org
        uses: EvergineTeam/Evergine.Bindings/.github/actions/nuget-publish@v1
        with:
          packages-folder: nupkgs
          auth-token: ${{ secrets.EVERGINE_NUGETORG_TOKEN }}