spotify-quickauth/.github/workflows/build.yaml

name: Build

permissions:
  contents: write

on:
  workflow_dispatch:
    inputs:
      fail_fast:
        description: 'Fail fast strategy'
        required: false
        default: 'true'
      verbose:
        description: 'Verbose output'
        required: false
        default: 'false'
  push:
    tags: 
      - 'v*.*.*'
    paths-ignore:
      - README.md
      - .gitignore
      - LICENSE
      - run.sh
  pull_request:
    paths-ignore:
      - README.md
      - .gitignore
      - LICENSE
      - run.sh

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    environment: production
    strategy:
      fail-fast: ${{ startsWith(github.ref, 'refs/tags/') || github.event.inputs.fail_fast == 'true' }}
      
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            tools: musl-tools
            # This will run against GNU target, not MUSL
            test: native
          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            tools: gcc-aarch64-linux-gnu
            test: false
          - os: ubuntu-latest
            target: armv7-unknown-linux-gnueabihf
            tools: gcc-arm-linux-gnueabihf
            test: false
          - os: macos-13
            target: x86_64-apple-darwin
            test: true
          - os: macos-latest
            target: aarch64-apple-darwin
            test: true
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            test: true
          - os: windows-latest
            target: aarch64-pc-windows-msvc
            test: false

    runs-on: ${{ matrix.os }}
    name: release-${{ matrix.target }}

    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: ${{ matrix.target }}

      - name: Cache Rust dependencies
        uses: actions/cache@v4.0.2
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git
            target
          key: ${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.target }}-
  
      - name: Install Linker Tools
        if: matrix.tools
        run: |
          sudo apt-get update
          sudo apt-get install ${{ matrix.tools }}
          # ensure has a newline at the end
          [ "$(tail -c 1 .cargo/config.toml)" != "" ] && echo >> .cargo/config.toml
          cat .cargo/config.github.toml >> .cargo/config.toml

      - name: Build
        run: cargo build ${{ github.event.inputs.verbose == 'true' && '--verbose' || '' }} --release --target ${{ matrix.target }}

      - name: Run tests
        if: matrix.test
        shell: bash
        run: |
          if [ "${{ matrix.test }}" = "native" ]; then
            cargo test ${{ github.event.inputs.verbose == 'true' && '--verbose' || '' }} --release
          else
            cargo test ${{ github.event.inputs.verbose == 'true' && '--verbose' || '' }} --release --target ${{ matrix.target }}
          fi

      - name: Prepare Variables
        run: |
          echo "RELEASE_VERSION=$(grep '^version = ' Cargo.toml | sed 's/version = \"\(.*\)\"/\1/')" >> $GITHUB_ENV
          if ${{ contains(matrix.os, 'windows') }}; then
            echo "ARCHIVE=spotify-quickauth-v${{ env.RELEASE_VERSION }}-${{ matrix.target }}.zip" >> $GITHUB_ENV
          else
            echo "ARCHIVE=spotify-quickauth-v${{ env.RELEASE_VERSION }}-${{ matrix.target }}.tar.gz" >> $GITHUB_ENV
          fi
          echo "ARCHIVE_DIR=target/${{ matrix.target }}/release" >> $GITHUB_ENV
          echo "IS_RELEASE=${{startsWith(github.ref, 'refs/tags/')}}" >> $GITHUB_ENV
        shell: sh
     
      - name: Archive
        if: ${{ !contains(matrix.os, 'windows') }}
        uses: TheDoctor0/zip-release@0.7.6
        with:
          type: tar
          filename: ${{ env.ARCHIVE }}
          directory: ${{ env.ARCHIVE_DIR }}/
          path: |
            spotify-quickauth

      - name: Archive
        if: ${{ contains(matrix.os, 'windows') }}
        uses: TheDoctor0/zip-release@0.7.6
        with:
          type: zip
          filename: ${{ env.ARCHIVE }}
          directory: ${{ env.ARCHIVE_DIR }}/
          path: |
            spotify-quickauth.exe
      
      - name: Install rsign2
        if: env.IS_RELEASE
        uses: taiki-e/install-action@v2
        with:
          tool: rsign2
      
      - name: Sign Archive
        if: env.IS_RELEASE
        env:
          ARCHIVE_PATH: ${{ env.ARCHIVE_DIR }}/${{ env.ARCHIVE }}
        run: |
          echo "{{ secrets.MINISIGN_KEY }}" > minisign.key
          
          ts=$(node -e 'console.log((new Date).toISOString())')
          git=$(git rev-parse HEAD)
          comment="gh=$GITHUB_REPOSITORY git=$git ts=$ts run=$GITHUB_RUN_ID"
          
          rsign sign -W -s minisign.key -x "${{ env.ARCHIVE_PATH }}.sig" -t "$comment" "${{ env.ARCHIVE_PATH }}"
      
      - name: Upload Artifact
        if: !env.IS_RELEASE
        uses: actions/upload-artifact@v4
        with:
          name: spotify-quickauth-v${{ env.RELEASE_VERSION }}-${{ matrix.target }}
          if-no-files-found: error
          retention-days: 7
          path: ${{ env.ARCHIVE_DIR }}/${{ env.ARCHIVE }}

      - name: Release
        uses: softprops/action-gh-release@v2
        if: env.IS_RELEASE
        with:
          files: |
            ${{ env.ARCHIVE_DIR }}/${{ env.ARCHIVE }}
            ${{ env.ARCHIVE_DIR }}/${{ env.ARCHIVE }}.sig
          generate_release_notes: true

      - name: cargo login
        if: env.IS_RELEASE
        run: cargo login ${{ secrets.CRATES_IO_API_TOKEN }}
      
      - name: "cargo release publish"
        if: env.IS_RELEASE
        run: cargo release publish --workspace --all-features --allow-branch HEAD --no-confirm --no-verify --execute