CI: publish the zenoh-flat-jni the snapshot was built against #3245
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | ||
| on: | ||
| push: | ||
| branches: ["**"] | ||
| pull_request: | ||
| branches: ["**"] | ||
| schedule: | ||
| - cron: "0 6 * * 1-5" | ||
| workflow_dispatch: | ||
| env: | ||
| CARGO_TERM_COLOR: always | ||
| # A run on main publishes two coordinates from two separate uploads — our copy | ||
| # of zenoh-flat-jni, then this SDK naming it. Nothing makes that pair atomic, so | ||
| # runs are serialized rather than cancelled: cancelling a run mid-publication is | ||
| # exactly what leaves the two naming different commits. Per ref, so branches do | ||
| # not queue behind each other. | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: false | ||
| jobs: | ||
| build: | ||
| name: Build on ${{ matrix.os }} | ||
| runs-on: ["${{ matrix.os }}"] | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| os: [ubuntu-latest, macos-latest] | ||
| steps: | ||
| - name: Check out zenoh-java | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| path: zenoh-java | ||
| - uses: actions/setup-java@v4 | ||
| with: | ||
| distribution: temurin | ||
| java-version: 11 | ||
| # rust-toolchain.toml here tracks zenoh-flat-jni's own, because that is | ||
| # what has to compile. Installing it up front keeps a missing toolchain | ||
| # from surfacing in the middle of the Gradle build. | ||
| # | ||
| # Nothing else Rust runs here. Formatting, clippy, the feature-leak test | ||
| # and the native build are zenoh-flat-jni's own CI, on three platforms, | ||
| # for the very commit pinned here; re-running them from this repository | ||
| # only adds ways for the two toolchains to disagree. | ||
| - name: Install Rust toolchain | ||
| working-directory: zenoh-java | ||
| run: rustup show | ||
| - name: Setup Gradle | ||
| uses: gradle/actions/setup-gradle@v4 | ||
| - name: Gradle Test | ||
| working-directory: zenoh-java | ||
| # CI tests against zenoh-flat-jni's source, so it opts into the composite | ||
| # build; settings.gradle.kts then fetches the commit Cargo.lock pins. A | ||
| # release does not opt in: it resolves zenoh-flat-jni from Maven Central | ||
| # like any other consumer. | ||
| # | ||
| # No checkout or cargo step precedes this. The build fetches its own | ||
| # pinned bindings, and their test task depends on their native build, so | ||
| # Gradle drives both git and cargo - which is why `./gradlew jvmTest | ||
| # -PuseLocalJni=true` reproduces this run anywhere. | ||
| run: ./gradlew jvmTest --info -PuseLocalJni=true | ||
| markdown_lint: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: DavidAnson/markdownlint-cli2-action@v18 | ||
| with: | ||
| config: '.markdownlint.yaml' | ||
| globs: '**/README.md' | ||
| # NOTE: In GitHub repository settings, the "Require status checks to pass | ||
| # before merging" branch protection rule ensures that commits are only merged | ||
| # from branches where specific status checks have passed. These checks are | ||
| # specified manually as a list of workflow job names. Thus we use this extra | ||
| # job to signal whether all CI checks have passed. | ||
| ci: | ||
| name: CI status checks | ||
| runs-on: ubuntu-latest | ||
| needs: [build, markdown_lint] | ||
| if: always() | ||
| steps: | ||
| - name: Check whether all jobs pass | ||
| run: echo '${{ toJson(needs) }}' | jq -e 'all(.result == "success")' | ||
| # Everything below publishes, and only from main: every merge there plus the | ||
| # weekday nightly above. Branches and pull requests publish nothing. | ||
| # | ||
| # The snapshot must be usable by someone who is not us, which means its | ||
| # zenoh-flat-jni dependency has to exist — and be the commit this SDK compiled | ||
| # against. It must also not wait on zenoh-flat-jni's CI. Both follow from one | ||
| # rule: this job publishes what it depends on. See CI.md. | ||
| # Which commit that is, and whether the copy already published is it. | ||
| flat_jni_pin: | ||
| name: Resolve the zenoh-flat-jni pin | ||
| if: contains(fromJSON('["refs/heads/main"]'), github.ref) | ||
| needs: ci | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| commit: ${{ steps.pin.outputs.commit }} | ||
| base: ${{ steps.pin.outputs.base }} | ||
| qualifier: ${{ steps.pin.outputs.qualifier }} | ||
| rebuild: ${{ steps.pin.outputs.rebuild }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - id: pin | ||
| run: bash ci/scripts/flat-jni-copy.bash | ||
| # Our own copy, built from that commit by zenoh-flat-jni's own publication | ||
| # workflow — its cross-compilation matrix is six desktop targets and four | ||
| # Android ABIs, and duplicating it here is how the two would drift. | ||
| # | ||
| # The workflow file is taken from its main, reviewed like any dependency; | ||
| # `uses:` cannot hold an expression, so the pin cannot go there. What is built | ||
| # is `branch:`, and that is the whole of the coupling: this needs a *file* in | ||
| # that repository, never a run of its CI. | ||
| # | ||
| # Half an hour when it runs, so it runs only when the pin has moved. | ||
| publish_flat_jni_copy: | ||
| name: Publish our zenoh-flat-jni copy | ||
| needs: flat_jni_pin | ||
| if: needs.flat_jni_pin.outputs.rebuild == 'true' | ||
| uses: eclipse-zenoh/zenoh-flat-jni/.github/workflows/publish.yml@main | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| with: | ||
| snapshot: true | ||
| # A called workflow runs with the caller's context, so it has to be told | ||
| # whose sources to check out. | ||
| source-repository: eclipse-zenoh/zenoh-flat-jni | ||
|
Check failure on line 141 in .github/workflows/ci.yml
|
||
| branch: ${{ needs.flat_jni_pin.outputs.commit }} | ||
| version-qualifier: ${{ needs.flat_jni_pin.outputs.qualifier }} | ||
| # It derives the coordinate from its own version.txt; this is what we | ||
| # expect that to be, so a pin that moved past a version bump there fails | ||
| # before publishing something we cannot resolve. | ||
| expected-base-version: ${{ needs.flat_jni_pin.outputs.base }} | ||
| secrets: inherit | ||
| # Then the SDK snapshot, naming the copy above. Reached both ways: the copy | ||
| # was rebuilt, or it was already current and skipped. | ||
| publish_snapshot_package: | ||
| name: Publish snapshot package | ||
| needs: [flat_jni_pin, publish_flat_jni_copy] | ||
| if: >- | ||
| ${{ !cancelled() | ||
| && needs.flat_jni_pin.result == 'success' | ||
| && needs.publish_flat_jni_copy.result != 'failure' }} | ||
| uses: ./.github/workflows/publish.yml | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| with: | ||
| snapshot: true | ||
| # The commit that triggered this run, not `main`. Concurrency queues a | ||
| # newer run; it does not hold the branch still. Passing the branch name, | ||
| # this job would check out whatever `main` had become while the JNI copy | ||
| # was being built for half an hour — publishing SDK source B against the | ||
| # copy built from A's pin, which is the mismatch the whole job exists to | ||
| # prevent. | ||
| branch: ${{ github.sha }} | ||
| secrets: inherit | ||
