archival 0.17.0

on:
  push:
    branches:
      - main
    tags:
      - "*"
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  SCCACHE_GHA_ENABLED: true
  RUSTC_WRAPPER: sccache
  SCCACHE_LOG: info
  SCCACHE_S3_USE_SSL: true
  SCCACHE_REGION: us-east-1

name: CI
jobs:
  lint:
    name: Lint
    runs-on: ubuntu-22.04
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - uses: actions/checkout@v3
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown
          components: rustc-dev, clippy, rustfmt
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9

      - name: check rustfmt
        run: cargo fmt -- --check --color always

      - run: cargo fetch
      - name: cargo clippy
        run: cargo clippy --all-features --all-targets -- --no-deps -D warnings

  test:
    name: Tests
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    strategy:
      matrix:
        os: [macos-latest, windows-2022, ubuntu-22.04]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v3
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown
          components: rustc-dev, clippy, rustfmt
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9

      - run: cargo fetch
      - name: cargo test build
        run: cargo build --tests --release
      - name: run tests
        run: ./test.sh

  msrv-check:
    name: Minimum Stable Rust Version Check
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v3
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.80.0"
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9
      - run: cargo fetch
      - name: cargo check
        run: cargo check --all-targets

  build-aarch64-apple-darwin:
    name: Build aarch64-apple-darwin
    runs-on: macos-latest
    env:
      TRIPLE: aarch64-apple-darwin
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - uses: actions/checkout@v3
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ env.TRIPLE }}
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9

      - run: cargo fetch --target ${{ env.TRIPLE }}
      - run: cargo build --release --target ${{ env.TRIPLE }}

  # deny-check:
  #   name: cargo-deny
  #   runs-on: ubuntu-22.04
  #   steps:
  #     - uses: actions/checkout@v3
  #     - uses: arduino/setup-protoc@v3
  #     - uses: EmbarkStudios/cargo-deny-action@v1

  # check-self:
  #   name: archival
  #   runs-on: ubuntu-22.04
  #   steps:
  #     - uses: actions/checkout@v3
  #     - uses: arduino/setup-protoc@v3
  #     - uses: dtolnay/rust-toolchain@stable
  #       with:
  #         targets: x86_64-unknown-linux-musl
  #     - run: sudo apt install -y musl-tools
  #     - uses: Swatinem/rust-cache@v2
  #     - run: cargo run --release --target x86_64-unknown-linux-musl -- generate --fail about.hbs

  publish-check:
    name: Publish Check
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    runs-on: ubuntu-22.04
    container: ghcr.io/cross-rs/aarch64-unknown-linux-musl:edge
    strategy:
      matrix:
        include:
          - target: aarch64-unknown-linux-musl
    steps:
      - uses: actions/checkout@v3
      - name: Install unzip in container
        run: apt-get update && apt-get install -y unzip
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          target: ${{ matrix.target }}
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9

      - run: apt-get update && apt-get --assume-yes install libssl-dev
      - run: cargo fetch
      - name: cargo publish
        run: cargo publish --dry-run --all-features --target ${{ matrix.target }}

  create_release:
    name: Create Release
    runs-on: ubuntu-22.04
    if: ${{ startsWith(github.ref, 'refs/tags/') && needs.publish-check.result == 'success' }}
    needs: publish-check
    outputs:
      upload_url: ${{ steps.create_release.outputs.upload_url }}
    steps:
      - name: Create GitHub Release
        id: create_release
        uses: softprops/action-gh-release@v1
        with:
          draft: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release:
    name: Release
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    if: ${{ startsWith(github.ref, 'refs/tags/') && needs.publish-check.result == 'success' }}
    needs: [publish-check, create_release]
    strategy:
      matrix:
        include:
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-musl
          - os: ubuntu-22.04
            target: aarch64-unknown-linux-musl
            container: ghcr.io/cross-rs/aarch64-unknown-linux-musl:edge
          - os: windows-2022
            target: x86_64-pc-windows-msvc
          - os: macos-latest
            target: x86_64-apple-darwin
          - os: macos-latest
            target: aarch64-apple-darwin
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    steps:
      - uses: dtolnay/rust-toolchain@stable
        with:
          target: ${{ matrix.target }}
      - name: Checkout
        uses: actions/checkout@v3
      - name: Install musl tools
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: sudo apt install -y musl-tools
      - name: Install unzip tools
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: |
          apt-get update
          apt-get install -y unzip
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9
      - name: cargo fetch
        run: cargo fetch --target ${{ matrix.target }}
      - name: Release build
        run: cargo build --release --target ${{ matrix.target }}
      - name: Package
        shell: bash
        env:
          NAME: archival
          TARGET: ${{ matrix.target }}
        run: .github/scripts/package.sh
      - name: Upload Assets
        uses: softprops/action-gh-release@v1
        with:
          files: "archival*"
          draft: true
          upload_url: ${{ needs.create_release.outputs.upload_url }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Publish Release
        if: matrix.os == 'ubuntu-22.04' && matrix.target == 'x86_64-unknown-linux-musl'
        uses: softprops/action-gh-release@v1
        with:
          draft: false
          upload_url: ${{ needs.create_release.outputs.upload_url }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-npm:
    name: Publish npm package
    if: startsWith(github.ref, 'refs/tags/')
    needs: [release]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Required for npm trusted publishing (OIDC)
      id-token: write
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v4
        with:
          # npm >= 11.5.1 is required for trusted publishing; node 24 bundles npm 11
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      - name: Verify versions match
        run: |
          CARGO_VERSION=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
          NPM_VERSION=$(node -e "console.log(require('./package.json').version)")
          TAG_VERSION=${GITHUB_REF#refs/tags/v}
          if [ "$CARGO_VERSION" != "$NPM_VERSION" ] || [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
            echo "Version mismatch: Cargo.toml=$CARGO_VERSION package.json=$NPM_VERSION tag=v$TAG_VERSION"
            exit 1
          fi
      - name: Publish to npm
        run: npm publish