package.yml

name: CD

on:
  push:
    branches:
      - main
    tags:
      - "v*.*.*"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_type }}
  cancel-in-progress: false

jobs:
  package:
    strategy:
      fail-fast: false
      matrix:
        platform:
          - os: ubuntu-22.04
            type: native
            artifact: ubuntu-x64
            cc: gcc
            cxx: g++
            shell: sh
          - os: ubuntu-22.04-arm
            type: native
            artifact: ubuntu-arm
            cc: gcc
            cxx: g++
            shell: sh
          - os: ubuntu-latest
            type: container
            artifact: alpine-x64
            container: alpine:3.21
            cc: gcc
            cxx: g++
            shell: sh
          - os: macos-15-intel
            type: native
            artifact: macos-x64
            cc: clang
            cxx: clang++
            shell: sh
          - os: macos-15
            type: native
            artifact: macos-arm
            cc: clang
            cxx: clang++
            shell: sh
          - os: windows-latest
            type: native
            artifact: windows-x64
            shell: pwsh

    defaults:
      run:
        shell: ${{ matrix.platform.shell }}

    runs-on: ${{ matrix.platform.os }}
    container: ${{ matrix.platform.container }}

    # Building the ARM64 Docker image on QEMU takes forever
    timeout-minutes: 60

    env:
      CC: ${{ matrix.platform.cc }}
      CXX: ${{ matrix.platform.cxx }}
    steps:
      - name: Install dependencies (Alpine)
        if: matrix.platform.type == 'container'
        run: apk add --no-cache cmake make g++ zsh bash jq pipx git perl-utils

      - name: Install pre-commit
        run: pipx install pre-commit

      - uses: actions/checkout@v4
      - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
        if: matrix.platform.type == 'container'
      - name: Install dependencies (macOS)
        if: runner.os == 'macos'
        run: brew bundle
        env:
          HOMEBREW_NO_ANALYTICS: 1
          HOMEBREW_NO_AUTO_UPDATE: 1
      - name: Install dependencies (Linux)
        if: runner.os == 'linux' && matrix.platform.type == 'native'
        run: sudo apt-get update --yes && sudo apt-get install --yes zsh

      - run: cmake --version

      - name: Configure JSON Schema (Continuous)
        if: github.ref_type == 'branch'
        run: >
          cmake -S . -B ./build
          -DCMAKE_BUILD_TYPE:STRING=Release
          -DJSONSCHEMA_PORTABLE:BOOL=ON
          -DJSONSCHEMA_TESTS:BOOL=ON
          -DJSONSCHEMA_TESTS_CI:BOOL=ON
          -DJSONSCHEMA_CONTINUOUS:BOOL=ON
          -DBUILD_SHARED_LIBS:BOOL=OFF
          -DCMAKE_COMPILE_WARNING_AS_ERROR:BOOL=ON

      - name: Configure JSON Schema (Release)
        if: github.ref_type == 'tag'
        run: >
          cmake -S . -B ./build
          -DCMAKE_BUILD_TYPE:STRING=Release
          -DJSONSCHEMA_PORTABLE:BOOL=ON
          -DJSONSCHEMA_TESTS:BOOL=ON
          -DJSONSCHEMA_TESTS_CI:BOOL=ON
          -DJSONSCHEMA_CONTINUOUS:BOOL=OFF
          -DBUILD_SHARED_LIBS:BOOL=OFF
          -DCMAKE_COMPILE_WARNING_AS_ERROR:BOOL=ON

      - run: cmake --build ./build --config Release --parallel 4
      - run: >
          cmake --install ./build --prefix ./build/dist --config Release --verbose
          --component sourcemeta_jsonschema

      # Not every CTest version supports the --test-dir option. If such option
      # is not recognized, `ctest` will successfully exit finding no tests.
      # Better to be sure and `cd` all the time here.
      - run: cd ./build && ctest --build-config Release --output-on-failure --parallel

      - run: cpack --config build/CPackConfig.cmake -B build/out -C Release

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.platform.artifact }}
          path: build/out/*.zip
          retention-days: 1

  snap:
    strategy:
      matrix:
        image: [ ubuntu-24.04, ubuntu-24.04-arm ]
    runs-on: ${{ matrix.image }}
    steps:
      - uses: actions/checkout@v4
      - uses: snapcore/action-build@v1
        id: snapcraft
      - uses: actions/upload-artifact@v4
        with:
          name: snap-${{ matrix.image }}
          path: ${{ steps.snapcraft.outputs.snap }}
          retention-days: 1

  publish:
    needs: [ package, snap ]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          path: build/out/
          pattern: "*"
          merge-multiple: true

      # Generate signed checksums for all pre-built binaries
      # while avoiding "build/out/" in the checksum file.
      - run: sha256sum --tag *.zip *.snap >CHECKSUMS.txt
        working-directory: build/out/
      - run: cat CHECKSUMS.txt
        working-directory: build/out/
      - run: |
          echo "$GPG_KEY_PRIVATE" | gpg --batch --import
          gpg --list-keys
          gpg --batch --yes --pinentry-mode loopback --trust-model always --armor \
            --passphrase "$GPG_KEY_PASS" --local-user "$GPG_KEY_FINGERPRINT" \
            --output build/out/CHECKSUMS.txt.asc --detach-sign build/out/CHECKSUMS.txt
          curl --silent --show-error --location 'https://www.sourcemeta.com/gpg.asc' | gpg --import
          gpg --verify build/out/CHECKSUMS.txt.asc build/out/CHECKSUMS.txt
        env:
          GPG_KEY_PRIVATE: ${{ secrets.GPG_KEY_PRIVATE }}
          GPG_KEY_PASS: ${{ secrets.GPG_KEY_PASS }}
          GPG_KEY_FINGERPRINT: ${{ secrets.GPG_KEY_FINGERPRINT }}

      - run: tree build

      - run: gh config set prompt disabled
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Perform Continuous Release
        run: |
          gh release delete continuous --cleanup-tag --yes || true
          gh release create continuous --prerelease --draft=false --title continuous --target "$GITHUB_SHA" --generate-notes
          gh release upload --clobber continuous build/out/*.zip build/out/CHECKSUMS.txt build/out/CHECKSUMS.txt.asc
        if: github.ref_type == 'branch'
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Perform Tag Release
        run: |
          gh release create ${{ github.ref_name }} --draft=false --title ${{ github.ref_name }} --target "$GITHUB_SHA" --generate-notes
          gh release upload --clobber ${{ github.ref_name }} build/out/*.zip build/out/*.snap build/out/CHECKSUMS.txt build/out/CHECKSUMS.txt.asc
        if: github.ref_type == 'tag'
        env:
          GH_TOKEN: ${{ github.token }}

  publish-npm:
    needs: publish
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - run: sudo npm install --global npm@11.6.4
      - run: npm --version
      - run: make npm-pack npm-publish

  publish-pypi:
    needs: publish
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v4
        with:
          python-version: '3.x'
      - run: python -m pip install --upgrade pip setuptools twine
      - name: Publish to PyPI
        run: ./pip-deploy.sh ${{ github.ref_name }}
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}

  publish-snap:
    needs: publish
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: build/out/
          pattern: "snap-*"
          merge-multiple: true
      - name: Publish to Snap
        run: |
          sudo snap install snapcraft --classic
          snapcraft whoami
          snapcraft upload build/out/jsonschema_*_amd64.snap --release stable
          snapcraft upload build/out/jsonschema_*_arm64.snap --release stable
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}

  publish-docker:
    needs: publish
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
        id: meta-cli
        with:
          images: ghcr.io/${{ github.repository_owner }}/jsonschema
      - uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
        id: push-cli
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta-cli.outputs.tags }}
          labels: ${{ steps.meta-cli.outputs.labels }}