native.yml

name: Native integration

on:
  # Prose and the docs site never reach a native build. Crate READMEs and
  # changelogs are not compiled here (no doctests), so they are skipped too.
  push:
    branches: [main]
    paths-ignore:
      - "docs/**"
      - "**/*.md"
  pull_request:
    paths-ignore:
      - "docs/**"
      - "**/*.md"
  release:
    types: [published]

permissions:
  contents: read

concurrency:
  group: native-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name != 'release' }}

jobs:
  rust-consumers:
    name: Rust consumers / ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, macos-15-intel, windows-2022]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/target/downstream-ci
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067
        with:
          toolchain: 1.99.1
      - name: Cache Rust build
        # Dependencies only (rust-cache drops workspace artifacts). Saved from
        # main alone, so a branch or pull request can read the cache but never
        # write into it; a release builds cold, because its archives ship.
        if: github.event_name != 'release'
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: consumers-${{ matrix.os }}
          workspaces: ". -> target/downstream-ci"
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Unit-test downstream gate policy
        run: python -m unittest tests/downstream/test_downstream_consumers.py
      - name: Exercise immutable copied Rust consumers
        run: python scripts/test-downstream-consumers.py --revision "${{ github.sha }}"

  cmake:
    name: ${{ matrix.os }} / ${{ matrix.build_type }} / ${{ matrix.linkage }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, macos-15-intel, windows-2022]
        build_type: [Debug, Release]
        linkage: [SHARED, STATIC]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/target/native-ci
      MACOSX_DEPLOYMENT_TARGET: ${{ matrix.os == 'macos-15-intel' && '13.0' || '' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067
        with:
          toolchain: 1.99.1
      - name: Cache Rust build
        # Dependencies only (rust-cache drops workspace artifacts). Saved from
        # main alone, so a branch or pull request can read the cache but never
        # write into it; a release builds cold, because its archives ship.
        if: github.event_name != 'release'
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: cmake-${{ matrix.os }}-${{ matrix.build_type }}
          workspaces: ". -> target/native-ci"
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Verify source/package CMake equivalence
        run: python scripts/test-native-cmake.py --build-type ${{ matrix.build_type }} --linkage ${{ matrix.linkage }} --mutations
      - name: Exercise immutable source pin
        if: matrix.os == 'ubuntu-22.04' && matrix.build_type == 'Release' && matrix.linkage == 'SHARED'
        run: python scripts/test-native-fetch.py --build-type Release
      - name: Package host release artifact
        if: github.event_name == 'release' && matrix.build_type == 'Release' && matrix.linkage == 'SHARED'
        run: python scripts/package-native.py --target ${{ matrix.os == 'ubuntu-22.04' && 'x86_64-unknown-linux-gnu' || matrix.os == 'macos-15-intel' && 'x86_64-apple-darwin' || 'x86_64-pc-windows-msvc' }} --output-dir dist/native
      - name: Verify host release artifact
        if: github.event_name == 'release' && matrix.build_type == 'Release' && matrix.linkage == 'SHARED'
        shell: bash
        run: |
          archive=$(find dist/native -type f \( -name '*.tar.gz' -o -name '*.zip' \) -print -quit)
          python scripts/verify-native-package.py "$archive"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: github.event_name == 'release' && matrix.build_type == 'Release' && matrix.linkage == 'SHARED'
        with:
          name: native-${{ matrix.os }}
          path: dist/native/*
          if-no-files-found: error

  windows-arm64:
    name: windows-11-arm / ${{ matrix.build_type }} / ${{ matrix.linkage }}
    strategy:
      fail-fast: false
      matrix:
        build_type: [Debug, Release]
        linkage: [SHARED, STATIC]
    runs-on: windows-11-arm
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/target/native-ci
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067
        with:
          toolchain: 1.99.1
      - name: Cache Rust build
        # Dependencies only (rust-cache drops workspace artifacts). Saved from
        # main alone, so a branch or pull request can read the cache but never
        # write into it; a release builds cold, because its archives ship.
        if: github.event_name != 'release'
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: cmake-windows-11-arm-${{ matrix.build_type }}
          workspaces: ". -> target/native-ci"
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Verify source/package CMake equivalence
        run: python scripts/test-native-cmake.py --build-type ${{ matrix.build_type }} --linkage ${{ matrix.linkage }} --mutations
      - name: Package host release artifact
        if: github.event_name == 'release' && matrix.build_type == 'Release' && matrix.linkage == 'SHARED'
        run: python scripts/package-native.py --target aarch64-pc-windows-msvc --output-dir dist/native
      - name: Verify host release artifact
        if: github.event_name == 'release' && matrix.build_type == 'Release' && matrix.linkage == 'SHARED'
        shell: bash
        run: python scripts/verify-native-package.py dist/native/axiolid-native-v*-aarch64-pc-windows-msvc.zip
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: github.event_name == 'release' && matrix.build_type == 'Release' && matrix.linkage == 'SHARED'
        with:
          name: native-windows-arm64
          path: dist/native/*
          if-no-files-found: error

  cross-aarch64-linux:
    name: Cross / aarch64-unknown-linux-gnu
    runs-on: ubuntu-22.04
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/target/native-ci
      CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067
        with:
          toolchain: 1.99.1
          targets: aarch64-unknown-linux-gnu
      - name: Cache Rust build
        # Dependencies only (rust-cache drops workspace artifacts). Saved from
        # main alone, so a branch or pull request can read the cache but never
        # write into it; a release builds cold, because its archives ship.
        if: github.event_name != 'release'
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: cross-aarch64-linux
          workspaces: ". -> target/native-ci"
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Install cross linker
        run: sudo apt-get update && sudo -S -p '' apt-get install --yes gcc-aarch64-linux-gnu
      - name: Build and package cross target
        run: python scripts/package-native.py --target aarch64-unknown-linux-gnu --output-dir dist/native
      - name: Verify cross-target binary identities
        run: python scripts/verify-native-package.py dist/native/axiolid-native-v*-aarch64-unknown-linux-gnu.tar.gz
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: github.event_name == 'release'
        with:
          name: native-aarch64-linux
          path: dist/native/*
          if-no-files-found: error

  publish-assets:
    name: Attach native archives
    if: github.event_name == 'release'
    needs: [cmake, windows-arm64, cross-aarch64-linux]
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Require the release tag to match the workspace version
        run: |
          version=$(python scripts/package-native.py --print-version)
          test "${{ github.event.release.tag_name }}" = "v${version}"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: native-*
          path: dist/native
          merge-multiple: true
      - name: Verify release set and consolidate checksums
        run: |
          tag="${{ github.event.release.tag_name }}"
          python scripts/verify-native-release-set.py dist/native --source-commit "$(git rev-parse HEAD)" --version "${tag#v}"
      - name: Attach immutable release assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "${{ github.event.release.tag_name }}" dist/native/* --clobber