archival 0.18.3

on:
  push:
    branches:
      - main
    tags:
      - "*"
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  SCCACHE_GHA_ENABLED: true
  RUSTC_WRAPPER: sccache
  SCCACHE_LOG: info
  SCCACHE_S3_USE_SSL: true
  SCCACHE_REGION: us-east-1

name: CI
jobs:
  lint:
    name: Lint
    runs-on: ubuntu-22.04
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - uses: actions/checkout@v3
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown
          components: rustc-dev, clippy, rustfmt
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9

      - name: check rustfmt
        run: cargo fmt -- --check --color always

      - run: cargo fetch
      - name: cargo clippy
        run: cargo clippy --all-features --all-targets -- --no-deps -D warnings

  schemas:
    name: Schemas
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
      # Ajv strict mode - what SchemaStore's own CI gates on. The schemas are
      # also checked against the parsers and the tests/schemas fixtures by
      # `cargo test schema_files`, which runs in the Tests job.
      - name: validate schemas
        run: ./validate-schemas.sh

  test:
    name: Tests
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    strategy:
      matrix:
        os: [macos-latest, windows-2022, ubuntu-22.04]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v3
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown
          components: rustc-dev, clippy, rustfmt
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9

      - run: cargo fetch
      - name: cargo test build
        run: cargo build --tests --release
      - name: run tests
        # Without this, windows runs the script through pwsh, which silently
        # does nothing and reports success.
        shell: bash
        run: ./test.sh

  msrv-check:
    name: Minimum Stable Rust Version Check
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v3
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.80.0"
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9
      - run: cargo fetch
      - name: cargo check
        run: cargo check --all-targets

  build-aarch64-apple-darwin:
    name: Build aarch64-apple-darwin
    runs-on: macos-latest
    env:
      TRIPLE: aarch64-apple-darwin
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - uses: actions/checkout@v3
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ env.TRIPLE }}
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9

      - run: cargo fetch --target ${{ env.TRIPLE }}
      - run: cargo build --release --target ${{ env.TRIPLE }}

  # deny-check:
  #   name: cargo-deny
  #   runs-on: ubuntu-22.04
  #   steps:
  #     - uses: actions/checkout@v3
  #     - uses: arduino/setup-protoc@v3
  #     - uses: EmbarkStudios/cargo-deny-action@v1

  # check-self:
  #   name: archival
  #   runs-on: ubuntu-22.04
  #   steps:
  #     - uses: actions/checkout@v3
  #     - uses: arduino/setup-protoc@v3
  #     - uses: dtolnay/rust-toolchain@stable
  #       with:
  #         targets: x86_64-unknown-linux-musl
  #     - run: sudo apt install -y musl-tools
  #     - uses: Swatinem/rust-cache@v2
  #     - run: cargo run --release --target x86_64-unknown-linux-musl -- generate --fail about.hbs

  publish-check:
    name: Publish Check
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    runs-on: ubuntu-22.04
    container: ghcr.io/cross-rs/aarch64-unknown-linux-musl:edge
    strategy:
      matrix:
        include:
          - target: aarch64-unknown-linux-musl
    steps:
      - uses: actions/checkout@v3
      - name: Install unzip in container
        run: apt-get update && apt-get install -y unzip
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          target: ${{ matrix.target }}
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9

      - run: apt-get update && apt-get --assume-yes install libssl-dev
      - run: cargo fetch
      - name: cargo publish
        run: cargo publish --dry-run --all-features --target ${{ matrix.target }}

  # Gate the whole release pipeline on the versions agreeing. Publishing to
  # crates.io cannot be undone, so this has to fail before anything ships, not
  # after the GitHub release is already public.
  version-check:
    name: Version Check
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Verify versions match
        run: |
          CARGO_VERSION=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
          NPM_VERSION=$(node -e "console.log(require('./package.json').version)")
          TAG_VERSION=${GITHUB_REF#refs/tags/v}
          if [ "$CARGO_VERSION" != "$NPM_VERSION" ] || [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
            echo "Version mismatch: Cargo.toml=$CARGO_VERSION package.json=$NPM_VERSION tag=v$TAG_VERSION"
            exit 1
          fi

  release:
    name: Release
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    if: ${{ startsWith(github.ref, 'refs/tags/') && needs.publish-check.result == 'success' }}
    needs: [publish-check, version-check]
    strategy:
      # Never ship a partial release: if one target fails, no release is created.
      fail-fast: true
      matrix:
        include:
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-musl
          - os: ubuntu-22.04
            target: aarch64-unknown-linux-musl
            container: ghcr.io/cross-rs/aarch64-unknown-linux-musl:edge
          - os: windows-2022
            target: x86_64-pc-windows-msvc
          - os: macos-latest
            target: x86_64-apple-darwin
          - os: macos-latest
            target: aarch64-apple-darwin
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    steps:
      - uses: dtolnay/rust-toolchain@stable
        with:
          target: ${{ matrix.target }}
      - name: Checkout
        uses: actions/checkout@v3
      - name: Install musl tools
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: sudo apt install -y musl-tools
      - name: Install unzip tools
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: |
          apt-get update
          apt-get install -y unzip
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9
      - name: cargo fetch
        run: cargo fetch --target ${{ matrix.target }}
      - name: Release build
        run: cargo build --release --target ${{ matrix.target }}
      - name: Package
        shell: bash
        env:
          NAME: archival
          TARGET: ${{ matrix.target }}
          TAG: ${{ github.ref_name }}
        run: .github/scripts/package.sh
      # Hand the assets off as artifacts rather than letting all five legs race to
      # mutate the release. publish_release below makes the single release call.
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.target }}
          path: |
            archival-*.tar.gz
            archival-*.tar.gz.sha256
          if-no-files-found: error
          retention-days: 1
          # Allow re-running a single failed matrix leg within the same run.
          overwrite: true

  publish_release:
    name: Publish Release
    if: ${{ startsWith(github.ref, 'refs/tags/') }}
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      # Only needed for archival_template.schema.json, which is checked in.
      - name: Checkout
        uses: actions/checkout@v4
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: release-*
          merge-multiple: true
          path: release-assets
      - name: Verify all targets are present
        shell: bash
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          ls -la release-assets
          missing=0
          for target in \
            x86_64-unknown-linux-musl \
            aarch64-unknown-linux-musl \
            x86_64-pc-windows-msvc \
            x86_64-apple-darwin \
            aarch64-apple-darwin
          do
            tarball="release-assets/archival-${TAG}-${target}.tar.gz"
            for f in "$tarball" "$tarball.sha256"; do
              if [ ! -f "$f" ]; then
                echo "::error::missing release asset $f"
                missing=1
              fi
            done
            if [ -f "$tarball" ] && [ -f "$tarball.sha256" ]; then
              # The windows leg writes uppercase hex via PowerShell Get-FileHash.
              want=$(tr -d '\r\n' < "$tarball.sha256" | tr '[:upper:]' '[:lower:]')
              got=$(sha256sum "$tarball" | cut -d' ' -f1)
              if [ "$want" != "$got" ]; then
                echo "::error::checksum mismatch for $tarball ($want != $got)"
                missing=1
              fi
            fi
          done
          exit "$missing"
      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          make_latest: ${{ !contains(github.ref_name, '-') }}
          fail_on_unmatched_files: true
          files: |
            release-assets/archival-*.tar.gz
            release-assets/archival-*.tar.gz.sha256
            archival_template.schema.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Runs after publish_release so the release assets are already downloadable by
  # the time the crate exists - otherwise `cargo binstall archival@<new>` would
  # briefly fall back to building from source.
  publish-crate:
    name: Publish to crates.io
    if: startsWith(github.ref, 'refs/tags/')
    needs: [publish_release]
    env:
      SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    runs-on: ubuntu-22.04
    # Same container/target/flags as publish-check, so the real publish runs the
    # exact command its --dry-run already verified.
    container: ghcr.io/cross-rs/aarch64-unknown-linux-musl:edge
    permissions:
      contents: read
      # Required for crates.io trusted publishing (OIDC)
      id-token: write
    steps:
      - uses: actions/checkout@v3
      - name: Install unzip in container
        run: apt-get update && apt-get install -y unzip
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 33.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          target: aarch64-unknown-linux-musl
      - name: sccache
        uses: mozilla-actions/sccache-action@v0.0.9
      - run: apt-get update && apt-get --assume-yes install libssl-dev
      - run: cargo fetch
      - name: Authenticate with crates.io
        id: crates-auth
        uses: rust-lang/crates-io-auth-action@v1
      - name: cargo publish
        run: cargo publish --all-features --target aarch64-unknown-linux-musl
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-auth.outputs.token }}

  publish-npm:
    name: Publish npm package
    if: startsWith(github.ref, 'refs/tags/')
    needs: [publish_release]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Required for npm trusted publishing (OIDC)
      id-token: write
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v4
        with:
          # npm >= 11.5.1 is required for trusted publishing; node 24 bundles npm 11
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      - name: Verify versions match
        run: ./check-versions.sh "${GITHUB_REF#refs/tags/v}"
      - name: Publish to npm
        run: npm publish