runtime.yml

name: Managed runtimes

on:
  workflow_dispatch:
    inputs:
      publish_version:
        description: Existing package version to republish, for example 0.2.1
        required: false
        type: string
  push:
    tags:
      - "v*"
  pull_request:
    paths:
      - packaging/runtime/**
      - src/fp_tools/runtime.py
      - src/fp_tools/resources/runtime_manifest.json
      - .github/workflows/runtime.yml

permissions:
  contents: write

jobs:
  ensure-release:
    runs-on: ubuntu-latest
    steps:
      - name: Ensure the release exists
        if: startsWith(github.ref, 'refs/tags/') || inputs.publish_version != ''
        env:
          GH_TOKEN: ${{ github.token }}
          PUBLISH_VERSION: ${{ inputs.publish_version }}
        shell: bash
        run: |
          release_tag="${GITHUB_REF_NAME}"
          if [[ "${GITHUB_REF}" != refs/tags/* ]]; then release_tag="v${PUBLISH_VERSION#v}"; fi
          if ! gh release view "${release_tag}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            release_flags=()
            if [[ "${release_tag}" == *rc* ]]; then release_flags+=(--prerelease); fi
            gh release create "${release_tag}" \
              --repo "${GITHUB_REPOSITORY}" \
              --title "fp-tools ${release_tag}" \
              --generate-notes \
              "${release_flags[@]}"
          fi

  native:
    name: ${{ matrix.platform }} / ${{ matrix.component }}
    needs: ensure-release
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
    strategy:
      fail-fast: false
      matrix:
        include:
          - {runner: ubuntu-latest, platform: linux-x86_64, component: core}
          - {runner: ubuntu-latest, platform: linux-x86_64, component: meme}
          - {runner: ubuntu-latest, platform: linux-x86_64, component: homer}
          - {runner: ubuntu-24.04-arm, platform: linux-arm64, component: core}
          - {runner: ubuntu-24.04-arm, platform: linux-arm64, component: meme}
          - {runner: ubuntu-24.04-arm, platform: linux-arm64, component: homer}
          - {runner: macos-15-intel, platform: macos-x86_64, component: meme}
          - {runner: macos-15, platform: macos-arm64, component: meme}
    steps:
      - uses: actions/checkout@v7
      - uses: mamba-org/setup-micromamba@v2
        with:
          environment-file: packaging/runtime/${{ matrix.component }}.yml
          environment-name: runtime
          cache-environment: true
      - name: Pack and inspect runtime
        shell: bash -el {0}
        env:
          COMPONENT: ${{ matrix.component }}
        run: |
          mkdir -p runtime-out runtime-smoke
          conda-pack -p "${MAMBA_ROOT_PREFIX}/envs/runtime" -o "runtime-out/${{ matrix.component }}.tar.gz"
          micromamba list -n runtime --json > "runtime-out/${{ matrix.component }}-sbom.json"
          tar -xzf "runtime-out/${{ matrix.component }}.tar.gz" -C runtime-smoke
          runtime-smoke/bin/python runtime-smoke/bin/conda-unpack
          runtime-smoke/bin/python - <<'PY'
          import json
          import os
          from pathlib import Path

          json.load(open(f"runtime-out/{os.environ['COMPONENT']}-sbom.json"))
          manifest = json.load(open("src/fp_tools/resources/runtime_manifest.json"))
          missing = [
              name
              for name in manifest["components"][os.environ["COMPONENT"]]["commands"]
              if not (Path("runtime-smoke/bin") / name).exists()
          ]
          assert not missing, f"Runtime is missing commands: {missing}"
          PY
      - name: Publish runtime archive
        if: startsWith(github.ref, 'refs/tags/') || inputs.publish_version != ''
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          PUBLISH_VERSION: ${{ inputs.publish_version }}
        run: |
          version="${GITHUB_REF_NAME#v}"
          if [[ "${GITHUB_REF}" != refs/tags/* ]]; then version="${PUBLISH_VERSION#v}"; fi
          release_tag="v${version}"
          asset="fp-tools-runtime-${{ matrix.component }}-${version}-${{ matrix.platform }}.tar.gz"
          mv "runtime-out/${{ matrix.component }}.tar.gz" "runtime-out/${asset}"
          (cd runtime-out && sha256sum "${asset}" > "${asset}.sha256")
          gh release upload "${release_tag}" \
            "runtime-out/${asset}" "runtime-out/${asset}.sha256" \
            --repo "${GITHUB_REPOSITORY}" --clobber
      - uses: actions/upload-artifact@v7
        with:
          name: runtime-${{ matrix.platform }}-${{ matrix.component }}-metadata
          path: runtime-out/${{ matrix.component }}-sbom.json

  windows-wsl:
    name: windows-x64 / MEME WSL2 runtime
    needs: ensure-release
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-buildx-action@v4
      - name: Build and export MEME-only runtime rootfs
        shell: bash
        run: |
          docker build \
            -f packaging/runtime/windows-meme.Dockerfile \
            -t fp-tools-wsl-meme-runtime .
          container_id="$(docker create fp-tools-wsl-meme-runtime)"
          trap 'docker rm -f "${container_id}" >/dev/null 2>&1 || true' EXIT
          mkdir -p runtime-out
          docker export "${container_id}" | gzip -1 > runtime-out/fp-tools-wsl-rootfs.tar.gz
      - name: Publish WSL2 runtime archive
        if: startsWith(github.ref, 'refs/tags/') || inputs.publish_version != ''
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          PUBLISH_VERSION: ${{ inputs.publish_version }}
        run: |
          version="${GITHUB_REF_NAME#v}"
          if [[ "${GITHUB_REF}" != refs/tags/* ]]; then version="${PUBLISH_VERSION#v}"; fi
          release_tag="v${version}"
          asset="fp-tools-runtime-wsl-meme-${version}-linux-x86_64.tar.gz"
          mv runtime-out/fp-tools-wsl-rootfs.tar.gz "runtime-out/${asset}"
          (cd runtime-out && sha256sum "${asset}" > "${asset}.sha256")
          gh release upload "${release_tag}" \
            "runtime-out/${asset}" "runtime-out/${asset}.sha256" \
            --repo "${GITHUB_REPOSITORY}" --clobber

  publish-and-test:
    name: public artifact and Windows WSL2 smoke test
    if: startsWith(github.ref, 'refs/tags/') || inputs.publish_version != ''
    needs: [native, windows-wsl]
    runs-on: windows-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install package and import private WSL2 distribution
        shell: pwsh
        run: |
          python -m pip install --only-binary=:all: .
          fp-tools-runtime install meme
          fp-tools-runtime status
          $version = python -c "import fp_tools; print(fp_tools.__version__)"
          $distroName = "fp-tools-" + ($version -replace '\.', '-')
          $distro = (wsl.exe --list --quiet | Out-String).Replace("`0", "")
          if ($distro -notmatch [regex]::Escape($distroName)) { throw "fp-tools WSL runtime was not imported" }
          wsl.exe --distribution $distroName --exec /opt/conda/bin/streme --version