ci.yaml

name: CI
on:
  push:
    tags:
      - "v*.*.*"
    branches:
      - main
      # Long-lived maintenance branches for shipped major.minor lines,
      # e.g. `1.5.x`. The wildcard means a new `1.6.x` branch starts running
      # CI on push automatically when it is created.
      - "[0-9]+.[0-9]+.x"
    # Skip the heavy Rust/Docker/etc. CI when only docs/ changes were pushed.
    # Documentation has its own workflow in .github/workflows/docs.yaml.
    # NOTE: this also applies to tag pushes — if a tag points at a commit that
    # only touches docs/, this workflow won't run. Tag releases normally bump
    # version files outside docs/, so this is rarely an issue in practice.
    paths-ignore:
      - "docs/**"
  pull_request:
    paths-ignore:
      - "docs/**"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  checks: write
  pull-requests: write
  actions: read
  contents: read

env:
  BUILD_TARGET: "x86_64-unknown-linux-gnu"
  WASM_RQUICKJS_VERSION: "0.4.4"
  MOONBIT_INSTALL_VERSION: "0.10.11+6ff76a5f9"
  WASI_SDK_VERSION: "25"
  WASI_SDK_PATH: /opt/wasi-sdk
  NPM_CONFIG_AUDIT: 'false'

jobs:
  build-and-store:
    env:
      CARGO_BUILD_JOBS: 20
    runs-on: blacksmith-32vcpu-ubuntu-2204
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          cache-save-if: 'true'
          install-protoc: 'true'
      # Test the build tooling (dev-tools/) first so a broken tool fails fast
      - name: Test build tools (dev-tools)
        run: cargo make --profile ci dev-tools-tests
      - uses: taiki-e/install-action@v2
        with:
          tool: nextest
      - name: Building all executables
        env:
          QUIET: true
        run: cargo make --profile ci build-all-bins-including-tests
        timeout-minutes: 30
      - name: Packaging all binaries with cargo-nextest
        run: |
          mkdir -pv tmp
          cargo nextest -v archive --archive-file tmp/golem-binaries.tar.zst --zstd-level -7 --cargo-profile dev-ci
        timeout-minutes: 5

      - name: Extract archive
        run: |
          mkdir tmp/golem-binaries
          tar --zstd -xvf tmp/golem-binaries.tar.zst -C tmp/golem-binaries
        timeout-minutes: 5
      - name: Save packaged binaries to cache
        uses: actions/cache/save@v5
        with:
          path: tmp/golem-binaries
          key: golem-binaries-${{ github.run_id }}

  check-clippy-and-format:
    env:
      CARGO_BUILD_JOBS: 10
    runs-on: blacksmith-8vcpu-ubuntu-2204
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          install-protoc: 'true'

      - name: Check formatting and clippy rules
        run: cargo make --profile ci check

  unit-tests-and-checks:
    env:
      CARGO_BUILD_JOBS: 10
    runs-on: blacksmith-8vcpu-ubuntu-2204
    needs: build-and-store
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          use-cache: 'false'
          install-cargo-binstall: 'true'
          install-protoc: 'true'
      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17
      - name: Setup SBT
        uses: sbt/setup-sbt@v1
      - uses: ./.github/actions/restore-binaries
        with:
          run-id: ${{ github.run_id }}
          copy-to-target: 'true'
      # Bun is needed by check-openapi (which depends on check-docs-openapi)
      # and by check-docs-skills to regenerate docs from the in-tree
      # sources and detect drift.
      - name: Setup Bun (for docs drift checks)
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - name: Cache Bun install (docs/)
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('docs/bun.lockb') }}
          restore-keys: |
            ${{ runner.os }}-bun-
      - name: Check openapi is up to date (includes docs/src/content/rest-api/)
        run: cargo make --profile ci check-openapi
      - name: Check how-to-guides docs are in sync with golem-skills/
        run: cargo make --profile ci check-docs-skills
      - name: Check configs are up to date
        run: cargo make --profile ci check-configs
      - name: Check WIT deps are synced
        run: cargo make --profile ci check-wit
      - name: Unit tests
        run: cargo make --profile ci unit-tests
      - uses: ./.github/actions/publish-test-report
        if: always()
        with:
          artifact-name: unit-tests-report
          github-token: ${{ secrets.GITHUB_TOKEN }}

  worker-tests:
    env:
      CARGO_BUILD_JOBS: 10
    runs-on: blacksmith-8vcpu-ubuntu-2204
    needs:
      - build-and-store
      - merge-test-components
    strategy:
      fail-fast: false
      matrix:
        group:
          - name: misc
          - name: group1
          - name: group2
          - name: group3
          - name: group4
    name: worker-tests-${{ matrix.group.name }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          use-cache: 'false'
          install-cargo-binstall: 'true'
      - name: Setup Redis
        uses: shogo82148/actions-setup-redis@v1.49.0
        with:
          redis-version: latest
          auto-start: false
      - uses: ./.github/actions/restore-binaries
        with:
          run-id: ${{ github.run_id }}
      - uses: ./.github/actions/restore-test-components
        with:
          run-id: ${{ github.run_id }}

      - name: Worker Executor integration tests
        run: cargo make --profile ci worker-executor-tests-${{ matrix.group.name }}
        timeout-minutes: 20
      - uses: ./.github/actions/publish-test-report
        if: always()
        with:
          artifact-name: worker-executor-tests-${{ matrix.group.name }}-report
          github-token: ${{ secrets.GITHUB_TOKEN }}

  managed-xfs-tests:
    name: managed-xfs-tests
    runs-on: blacksmith-8vcpu-ubuntu-2404
    needs:
      - build-and-store
      - merge-test-components
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          use-cache: 'false'
          install-cargo-binstall: 'true'
      - uses: ./.github/actions/restore-binaries
        with:
          run-id: ${{ github.run_id }}
          fail-on-cache-miss: 'true'
      - uses: ./.github/actions/restore-test-components
        with:
          run-id: ${{ github.run_id }}
      - name: Set up Lima
        id: lima
        env:
          GH_TOKEN: ${{ github.token }}
          LIMA_VERSION: v2.2.0
        run: |
          sudo sed -i -E 's#http://(([a-z]{2}\.)?archive\.ubuntu\.com|security\.ubuntu\.com)/ubuntu#https://\1/ubuntu#g' \
            /etc/apt/sources.list.d/ubuntu.sources \
            /etc/apt/blacksmith-ubuntu-mirrors.txt
          sudo apt-get update -qq
          sudo apt-get install -qqy --no-install-recommends ovmf qemu-system-x86 qemu-utils
          test -c /dev/kvm
          sudo chown "$(whoami)" /dev/kvm
          archive="lima-${LIMA_VERSION#v}-Linux-x86_64.tar.gz"
          curl -fOSL "https://github.com/lima-vm/lima/releases/download/${LIMA_VERSION}/${archive}"
          gh attestation verify --owner lima-vm "${archive}"
          sudo tar -C /usr/local -xzf "${archive}"
          rm "${archive}"
          echo "version=${LIMA_VERSION}" >> "${GITHUB_OUTPUT}"
      - name: Cache Lima images
        uses: actions/cache@v5
        with:
          path: ~/.cache/lima
          key: lima-${{ runner.os }}-${{ steps.lima.outputs.version }}
      - name: Run managed XFS suite
        env:
          GOLEM_MANAGED_XFS_REUSE_TEST_BINARIES: 1
          GOLEM_MANAGED_XFS_TARGET_DIR: ${{ github.workspace }}/target
          GOLEM_MANAGED_XFS_CARGO_TEST_R: ${{ github.workspace }}/target/cargo-test-r
        run: |
          cp "$(command -v cargo-test-r)" "${GOLEM_MANAGED_XFS_CARGO_TEST_R}"
          integration-tests/scripts/managed-filesystem/run-lima.sh

  build-cli-test-bins:
    env:
      CARGO_BUILD_JOBS: 20
      GOLEM_CLI_TEST_BIN_PROFILE: dev-release-ci
    runs-on: blacksmith-32vcpu-ubuntu-2204
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          cache-shared-key: 'cli-dev-release-ci'
          cache-save-if: 'true'
          install-protoc: 'true'
      - name: Build CLI test binaries
        env:
          QUIET: true
        run: cargo make --profile ci build-cli-test-bins
        timeout-minutes: 20
      - name: Package CLI test binaries
        run: |
          mkdir -pv tmp/golem-cli-test-binaries
          cp target/dev-release-ci/golem target/dev-release-ci/golem-cli tmp/golem-cli-test-binaries/
          find tmp/golem-cli-test-binaries -type f | sort
        timeout-minutes: 2
      - name: Save CLI test binaries to cache
        uses: actions/cache/save@v5
        with:
          path: tmp/golem-cli-test-binaries
          key: golem-cli-test-binaries-${{ github.run_id }}

  it:
    env:
      CARGO_BUILD_JOBS: 10
    runs-on: ${{ matrix.group.runner || 'blacksmith-8vcpu-ubuntu-2204' }}
    needs:
      - build-and-store
      - build-golem-ts
      - merge-test-components
    strategy:
      fail-fast: false
      matrix:
        group:
          - name: integration-tests-group1
            description: "IT #1"
          - name: integration-tests-group2
            description: "IT #2"
          - name: integration-tests-group3
            description: "IT #3"
          - name: integration-tests-group4
            description: "IT #4"
          - name: integration-tests-group5
            description: "IT #5"
          - name: integration-tests-group6-coordinated
            description: "IT #6a"
          - name: integration-tests-group6-rest
            description: "IT #6b"
          - name: integration-tests-group7
            description: "IT #7"
          - name: integration-tests-group8
            description: "IT #8"
          - name: integration-tests-group9
            description: "IT #9"
          - name: integration-tests-group10
            description: "IT #10"
          - name: integration-tests-group11
            description: "IT #11"
          - name: integration-tests-group12
            description: "IT #12"
          - name: integration-tests-group13
            description: "IT #13"

    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: actions/setup-node@v5
        if: ${{ matrix.group.name == 'integration-tests-group10' || matrix.group.name == 'integration-tests-group11' }}
        with:
          node-version: 'lts/*'
      - uses: ./.github/actions/setup-rust
        with:
          use-cache: 'false'
          rust-targets: 'wasm32-wasip1 wasm32-wasip2'
          install-cargo-binstall: 'true'
      - name: Setup Redis
        uses: shogo82148/actions-setup-redis@v1.49.0
        with:
          redis-version: latest
          auto-start: false

      - uses: ./.github/actions/restore-binaries
        with:
          run-id: ${{ github.run_id }}
          copy-to-target: 'true'
      - uses: ./.github/actions/restore-test-components
        with:
          run-id: ${{ github.run_id }}

      - name: ${{ matrix.group.description }}
        env:
          QUIET: true
        run: cargo make --profile ci ${{ matrix.group.name }}
        timeout-minutes: 45
      - uses: ./.github/actions/publish-test-report
        if: always()
        with:
          artifact-name: '${{ matrix.group.name }}-report'
          github-token: ${{ secrets.GITHUB_TOKEN }}

  it-cli:
    name: it-cli (${{ matrix.group.shard }})
    env:
      CARGO_BUILD_JOBS: 10
      GOLEM_CLI_TEST_BIN_PROFILE: dev-release-ci
    runs-on: blacksmith-32vcpu-ubuntu-2204
    needs:
      - build-and-store
      - build-golem-effect
      - build-golem-ts
      - build-cli-test-bins
      - build-golem-scala
      - merge-test-components
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        group:
          - { name: cli-integration-tests-agents, shard: agents }
          - { name: cli-integration-tests-agents-guest-bridge, shard: agents_guest_bridge }
          - { name: cli-integration-tests-agents-streaming, shard: agents_streaming }
          - { name: cli-integration-tests-bridge, shard: bridge_gen }
          - { name: cli-integration-tests-bridge-rust, shard: bridge_gen_rust }
          - { name: cli-integration-tests-deploy, shard: deploy }
          - { name: cli-integration-tests-core, shard: core }
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          use-cache: 'false'
          rust-targets: 'wasm32-wasip1 wasm32-wasip2'
          install-cargo-binstall: 'true'
      - name: Setup Redis
        uses: shogo82148/actions-setup-redis@v1.49.0
        with:
          redis-version: latest
          auto-start: false

      - name: Install wasm-tools
        run: cargo binstall --force --locked wasm-tools@1.248.0
      - name: Install wit-bindgen
        run: cargo binstall --force --locked wit-bindgen-cli@0.40.0

      - name: Setup Node
        uses: ./.github/actions/setup-js-wasm-tools
        with:
          wasm-rquickjs-version: ${{ env.WASM_RQUICKJS_VERSION }}
          wasi-sdk-version: ${{ env.WASI_SDK_VERSION }}
          wasi-sdk-path: ${{ env.WASI_SDK_PATH }}

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - name: Setup SBT
        uses: sbt/setup-sbt@v1

      # Warm the coursier cache for the bridge shard's Scala deps.
      - name: Cache scala dependencies
        uses: coursier/cache-action@v8

      - name: Setup MoonBit
        uses: hustcer/setup-moonbit@v1
        with:
          version: ${{ env.MOONBIT_INSTALL_VERSION }}
          core-version: ${{ env.MOONBIT_INSTALL_VERSION }}

      - name: Install MoonBit SDK tools dependencies
        working-directory: sdks/moonbit/golem_sdk_tools
        run: moon update

      - name: Sync WIT dependencies
        run: cargo make wit

      - name: Restore Scala guest runtime WASMs (built by build-golem-scala)
        uses: actions/download-artifact@v8
        with:
          name: agent-guest-wasm
          path: tmp/sdk-artifacts
      - name: Extract Scala guest runtime WASMs
        run: tar -xzf tmp/sdk-artifacts/agent-guest-wasm.tar.gz

      - name: Restore Scala SDK ivy local repo (published by build-golem-scala)
        uses: actions/download-artifact@v8
        with:
          name: scala-sdk-ivy-local
          path: tmp/sdk-artifacts
      - name: Extract Scala SDK ivy local repo
        run: |
          mkdir -p ~/.ivy2
          tar -xzf tmp/sdk-artifacts/scala-sdk-ivy-local.tar.gz -C ~/.ivy2

      - name: Restore built TS SDK
        uses: actions/download-artifact@v8
        with:
          name: golem-ts-sdk
          path: tmp/sdk-artifacts
      - name: Extract built TS SDK
        run: tar -xzf tmp/sdk-artifacts/golem-ts-sdk.tar.gz

      - name: Install TS SDK dependencies
        working-directory: sdks/ts
        run: pnpm install --frozen-lockfile

      - name: Restore built Effect SDK
        uses: actions/download-artifact@v8
        with:
          name: golem-effect-sdk
          path: tmp/sdk-artifacts
      - name: Extract built Effect SDK
        run: tar -xzf tmp/sdk-artifacts/golem-effect-sdk.tar.gz

      - name: Install Effect SDK dependencies
        working-directory: sdks/effect
        run: npm ci

      - uses: ./.github/actions/restore-binaries
        with:
          run-id: ${{ github.run_id }}
          copy-to-target: 'true'

      - name: Restore CLI test binaries
        uses: actions/cache/restore@v5
        with:
          path: tmp/golem-cli-test-binaries
          key: golem-cli-test-binaries-${{ github.run_id }}
          fail-on-cache-miss: true
      - name: Install CLI test binaries
        run: |
          mkdir -pv target/dev-release-ci
          cp tmp/golem-cli-test-binaries/* target/dev-release-ci/
          chmod +x target/dev-release-ci/*

      - name: Restore streaming test components
        if: matrix.group.shard == 'agents_streaming'
        uses: ./.github/actions/restore-test-components
        with:
          run-id: ${{ github.run_id }}

      - name: it-cli ${{ matrix.group.shard }}
        env:
          QUIET: true
          GOLEM_CLI_TEST_SERVER_LOG_DIR: ${{ github.workspace }}/tmp/golem-cli-test-server-logs
        run: cargo make --profile ci ${{ matrix.group.name }}
        timeout-minutes: 30
      - name: Upload golem server logs
        if: failure()
        uses: actions/upload-artifact@v6
        with:
          name: '${{ matrix.group.name }}-server-logs-attempt${{ github.run_attempt }}'
          path: tmp/golem-cli-test-server-logs
          if-no-files-found: ignore
          retention-days: 7
      - uses: ./.github/actions/publish-test-report
        if: always()
        with:
          artifact-name: '${{ matrix.group.name }}-report'
          github-token: ${{ secrets.GITHUB_TOKEN }}

  consolidate-test-reports:
    name: consolidate-test-reports
    if: ${{ always() }}
    runs-on: ubuntu-latest
    needs:
      - unit-tests-and-checks
      - worker-tests
      - it
      - it-cli
    steps:
      - name: Download test reports for this attempt
        uses: actions/download-artifact@v8
        with:
          pattern: '*-report-attempt${{ github.run_attempt }}'
          path: tmp/test-reports
          merge-multiple: false
      - name: Preserve the source artifact name for a single report
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if [[ -f tmp/test-reports/ctrf-report.json ]]; then
            mapfile -t artifact_names < <(
              gh api --paginate "/repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/artifacts?per_page=100" \
                --jq ".artifacts[].name | select(endswith(\"-report-attempt${GITHUB_RUN_ATTEMPT}\"))"
            )
            if [[ "${#artifact_names[@]}" -ne 1 ]]; then
              echo "Expected one report artifact for attempt ${GITHUB_RUN_ATTEMPT}, found ${#artifact_names[@]}" >&2
              exit 1
            fi
            mkdir -p "tmp/test-reports/${artifact_names[0]}"
            mv tmp/test-reports/ctrf-report.json "tmp/test-reports/${artifact_names[0]}/"
          fi
      - name: Upload consolidated test reports
        uses: actions/upload-artifact@v6
        with:
          name: ci-test-reports-attempt${{ github.run_attempt }}
          path: tmp/test-reports
          if-no-files-found: error
          retention-days: 35

  scala-sdk-integration-tests:
    runs-on: blacksmith-8vcpu-ubuntu-2204
    needs:
      - build-and-store
      - build-golem-ts
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          use-cache: 'false'
          rust-targets: 'wasm32-wasip2'
          install-cargo-binstall: 'true'

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - name: Setup SBT
        uses: sbt/setup-sbt@v1

      - name: Cache scala dependencies
        uses: coursier/cache-action@v8

      - uses: ./.github/actions/setup-js-wasm-tools
        with:
          wasi-sdk-version: ${{ env.WASI_SDK_VERSION }}
          wasi-sdk-path: ${{ env.WASI_SDK_PATH }}
          wasm-rquickjs-version: ${{ env.WASM_RQUICKJS_VERSION }}

      - name: Sync WIT dependencies
        run: cargo make wit

      - name: Build Scala guest runtime WASMs
        working-directory: sdks/scala
        run: ./scripts/generate-agent-guest-wasm.sh

      - uses: ./.github/actions/restore-binaries
        with:
          run-id: ${{ github.run_id }}
          copy-to-target: 'true'

      - name: Restore built TS SDK
        uses: actions/download-artifact@v8
        with:
          name: golem-ts-sdk
          path: tmp/sdk-artifacts
      - name: Extract built TS SDK
        run: tar -xzf tmp/sdk-artifacts/golem-ts-sdk.tar.gz

      - name: Install TS SDK dependencies
        working-directory: sdks/ts
        run: pnpm install --frozen-lockfile

      - name: Add golem to PATH
        run: echo "${{ github.workspace }}/target/debug" >> $GITHUB_PATH

      - name: Publish Scala SDK locally
        working-directory: sdks/scala
        run: |
          sbt -batch '++3.8.2; set ThisBuild / version := "0.0.0-SNAPSHOT"; set ThisBuild / packageDoc / publishArtifact := false; set every (publish / skip) := false; modelJVM/publishLocal; modelJS/publishLocal; macros/publishLocal; core/publishLocal; codegen/publishLocal; ++2.12.21; codegen/publishLocal; sbtPlugin/publishLocal'

      - name: Run Scala SDK integration tests
        working-directory: sdks/scala
        env:
          GOLEM_TS_PACKAGES_PATH: ${{ github.workspace }}/sdks/ts/packages
          RUST_BACKTRACE: 1
        run: sbt -batch "++3.8.2; integrationTests/test"
        timeout-minutes: 20

      - name: Upload Scala integration server log
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: scala-sdk-integration-server-log
          path: sdks/scala/target/scala-integration/golem-server.log
          if-no-files-found: warn
          retention-days: 7

  golem-schema-guest:
    runs-on: blacksmith
    env:
      CARGO_BUILD_JOBS: 10
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          rust-targets: 'wasm32-wasip2'
      - name: Prepare WIT dependencies
        run: cargo make wit
      - name: Build golem-schema in guest mode
        run: cargo build --target wasm32-wasip2 -p golem-schema --no-default-features --features guest
      - name: Test owned typed values in guest mode
        run: cargo test -p golem-schema --no-default-features --features guest --test owned_typed_wit -- --nocapture --report-time

  golem-client:
    runs-on: blacksmith
    env:
      CARGO_BUILD_JOBS: 10
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          install-cargo-binstall: 'true'
      - name: Prepare WIT dependencies
        run: cargo make wit
      - name: Build golem-client (dependencies in features=client mode)
        run: cargo build -p golem-client

  build-golem-scala:
    runs-on: blacksmith-8vcpu-ubuntu-2204
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v5

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - name: Setup SBT
        uses: sbt/setup-sbt@v1

      - name: Cache scala dependencies
        uses: coursier/cache-action@v8

      - uses: ./.github/actions/setup-rust
        with:
          use-cache: 'false'
          rust-targets: 'wasm32-wasip2'
          install-cargo-binstall: 'true'

      - uses: ./.github/actions/setup-wasm-component-tools
        with:
          wasi-sdk-version: ${{ env.WASI_SDK_VERSION }}
          wasi-sdk-path: ${{ env.WASI_SDK_PATH }}
          wasm-rquickjs-version: ${{ env.WASM_RQUICKJS_VERSION }}

      - name: Sync WIT dependencies
        run: cargo make wit

      - name: Build Scala guest runtime WASMs
        working-directory: sdks/scala
        run: ./scripts/generate-agent-guest-wasm.sh

      - name: Verify Scala WIT d.ts files are committed
        uses: ./.github/actions/check-scala-sdk-generated

      - name: Run Golem tests (Scala 3.8.2)
        working-directory: sdks/scala
        run: sbt -mem 4096 "++3.8.2; modelJVM/test; modelJS/test; core/test; macros/test; codegen/test"

      - name: Compile sbt plugin
        working-directory: sdks/scala
        run: sbt "++2.12.21!; sbtPlugin/compile"

      # Published for the it-cli shards to restore. Must run after the guest role runtimes are built,
      # since the sbt plugin jar embeds them.
      - name: Publish Scala SDK locally
        working-directory: sdks/scala
        run: |
          sbt -batch '++3.8.2; set ThisBuild / version := "0.0.0-SNAPSHOT"; set ThisBuild / packageDoc / publishArtifact := false; set every (publish / skip) := false; modelJVM/publishLocal; modelJS/publishLocal; macros/publishLocal; core/publishLocal; codegen/publishLocal; ++2.12.21; codegen/publishLocal; sbtPlugin/publishLocal'

      - name: Package Scala guest runtime WASMs for it-cli
        run: |
          tar -czf "$RUNNER_TEMP/agent-guest-wasm.tar.gz" \
            sdks/scala/sbt/src/main/resources/golem/wasm/*.wasm \
            sdks/scala/mill/resources/golem/wasm/*.wasm \
            sdks/scala/wit/dts
      - name: Upload Scala guest runtime WASMs for it-cli
        uses: actions/upload-artifact@v6
        with:
          name: agent-guest-wasm
          path: ${{ runner.temp }}/agent-guest-wasm.tar.gz
          if-no-files-found: error
          overwrite: true
          retention-days: 7

      - name: Package Scala SDK ivy local repo for it-cli
        run: tar -czf "$RUNNER_TEMP/scala-sdk-ivy-local.tar.gz" -C ~/.ivy2 local
      - name: Upload Scala SDK ivy local repo for it-cli
        uses: actions/upload-artifact@v6
        with:
          name: scala-sdk-ivy-local
          path: ${{ runner.temp }}/scala-sdk-ivy-local.tar.gz
          if-no-files-found: error
          overwrite: true
          retention-days: 7

  build-golem-moonbit:
    runs-on: blacksmith
    steps:
      - uses: actions/checkout@v5
      - name: Setup MoonBit
        uses: hustcer/setup-moonbit@v1
        with:
          version: ${{ env.MOONBIT_INSTALL_VERSION }}
          core-version: ${{ env.MOONBIT_INSTALL_VERSION }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Update MoonBit workspace dependencies
        run: moon update
        working-directory: sdks/moonbit
      - name: Check SDK
        run: find . -name moon.pkg -exec dirname {} \; | xargs moon check --target wasm
        working-directory: sdks/moonbit/golem_sdk
      - name: Test SDK
        run: ./scripts/run-sdk-tests.sh
        working-directory: sdks/moonbit/golem_sdk
      - name: Check tools
        run: moon check cmd lib
        working-directory: sdks/moonbit/golem_sdk_tools
      - name: Test tools
        run: moon test cmd lib
        working-directory: sdks/moonbit/golem_sdk_tools

  # The Rust SDK test suite is dominated by three integration test targets that each shell out to
  # cargo (tool: one `cargo check` per test, tool_middleware_component: a full wasm component
  # build, ui: trybuild). They run as separate matrix entries; the `check` entry runs lint and every
  # other test target and fails if a test target is added without being assigned to an entry.
  build-golem-rust:
    name: build-golem-rust (${{ matrix.part.name }})
    runs-on: blacksmith-16vcpu-ubuntu-2204
    strategy:
      fail-fast: false
      matrix:
        part:
          - name: check
            test-args: --lib --bins --test agent --test http_router --test tool_canonical --test schema_reexport --test reflection_recipe_compile
          - name: tool
            test-args: --test tool
          - name: tool-middleware-component
            test-args: --test tool_middleware_component
          - name: ui
            test-args: --test ui
    steps:
      - uses: actions/checkout@v5
      - uses: ./.github/actions/setup-rust
        with:
          rust-targets: 'wasm32-wasip2'
          cache-prefix-key: 'v2-golem-rust'
          install-cargo-make: 'false'
          install-cargo-binstall: 'true'
      - name: Install wasm-tools
        run: cargo binstall --force --locked wasm-tools@1.248.0
      - name: Check formatting
        if: matrix.part.name == 'check'
        run: cargo fmt -- --check
        working-directory: sdks/rust
      - name: Clippy
        if: matrix.part.name == 'check'
        run: cargo clippy -- -Dwarnings
        working-directory: sdks/rust
      - name: Check that every test target is covered by the matrix
        if: matrix.part.name == 'check'
        working-directory: sdks/rust
        run: |
          expected='agent
          http_router
          reflection_recipe_compile
          schema_reexport
          tool
          tool_canonical
          tool_middleware_component
          ui'
          actual=$(cargo metadata --no-deps --format-version 1 \
            | jq -r '.packages[].targets[] | select(.kind | index("test")) | .name' | sort)
          if [ "$actual" != "$expected" ]; then
            echo "Test targets of sdks/rust changed; update the build-golem-rust matrix in ci.yaml:"
            diff <(echo "$expected") <(echo "$actual") || true
            exit 1
          fi
      - name: Tests
        run: cargo test --all-features ${{ matrix.part.test-args }}
        working-directory: sdks/rust
      - name: Doc tests
        if: matrix.part.name == 'check'
        run: cargo test --all-features --doc
        working-directory: sdks/rust

  build-golem-ts:
    runs-on: blacksmith
    env:
      NODE_OPTIONS: --max-old-space-size=4096
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          use-cache: 'false'
          rust-targets: 'wasm32-wasip2'
          install-cargo-make: 'false'
          install-cargo-binstall: 'true'

      - uses: ./.github/actions/setup-js-wasm-tools
        with:
          wasi-sdk-version: ${{ env.WASI_SDK_VERSION }}
          wasi-sdk-path: ${{ env.WASI_SDK_PATH }}
          wasm-rquickjs-version: ${{ env.WASM_RQUICKJS_VERSION }}

      - name: Install dependencies
        working-directory: sdks/ts
        run: |
          pnpm install

      - name: Check code quality
        working-directory: sdks/ts
        run: |
          pnpm run lint || (
            echo "Linting issues found. Please fix them before proceeding. `npm run lint:fix` may help"
            exit 1
          )

      - name: Check code formatting
        working-directory: sdks/ts
        run: |
          pnpm run format:check || (
            echo "Code formatting issues found. Please run 'npm run format' to fix them."
            exit 1
          )

      - name: Build the package
        working-directory: sdks/ts
        run: |
          pnpm run build

      - name: Verify golem-ts-sdk types are committed
        working-directory: sdks/ts
        run: |
          if ! git diff --exit-code packages/golem-ts-sdk/types; then
            echo "❌ The files in packages/golem-ts-sdk/types differ from the committed version."
            echo "Please run 'pnpm run build' and commit the updated files."
            exit 1
          fi

      - name: Build the agent template WASM binary
        working-directory: sdks/ts
        run: pnpm run build-agent-template

      - name: Check packed SDK HTTP contract
        working-directory: sdks/ts
        run: pnpm --filter @golemcloud/golem-ts-sdk run check:package

      - name: Run tests
        working-directory: sdks/ts
        run: |
          pnpm run test

      - name: Package built TS SDK for dependent jobs
        run: |
          tar -czf "$RUNNER_TEMP/golem-ts-sdk.tar.gz" \
            sdks/ts/packages/golem-ts-sdk/dist \
            sdks/ts/packages/golem-ts-sdk/types \
            sdks/ts/packages/golem-ts-sdk/wasm \
            sdks/ts/packages/golem-ts-bridge/dist \
            sdks/ts/packages/golem-ts-repl/dist
      - name: Upload built TS SDK for dependent jobs
        uses: actions/upload-artifact@v6
        with:
          name: golem-ts-sdk
          path: ${{ runner.temp }}/golem-ts-sdk.tar.gz
          if-no-files-found: error
          overwrite: true
          retention-days: 7

  build-golem-effect:
    runs-on: blacksmith
    env:
      NODE_OPTIONS: --max-old-space-size=4096
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          use-cache: 'false'
          rust-targets: 'wasm32-wasip2'
          install-cargo-make: 'false'
          install-cargo-binstall: 'true'

      - uses: ./.github/actions/setup-js-wasm-tools
        with:
          wasi-sdk-version: ${{ env.WASI_SDK_VERSION }}
          wasi-sdk-path: ${{ env.WASI_SDK_PATH }}
          wasm-rquickjs-version: ${{ env.WASM_RQUICKJS_VERSION }}

      - name: Install dependencies
        working-directory: sdks/effect
        run: npm ci

      - name: Check code quality
        working-directory: sdks/effect
        run: npm run lint

      - name: Check code formatting
        working-directory: sdks/effect
        run: npm run format:check

      - name: Typecheck
        working-directory: sdks/effect
        run: npm run typecheck

      - name: Build the package and agent template
        working-directory: sdks/effect
        run: |
          npm test
          npm run build
          npm run build-agent-template
          npm run check:dts
          npm run check:contracts
          npm run check:artifacts
          npm run check:package

      - name: Package built Effect SDK for CLI integration tests
        run: |
          tar -czf "$RUNNER_TEMP/golem-effect-sdk.tar.gz" \
            sdks/effect/dist sdks/effect/wasm sdks/effect/golem-types
      - name: Upload built Effect SDK for CLI integration tests
        uses: actions/upload-artifact@v6
        with:
          name: golem-effect-sdk
          path: ${{ runner.temp }}/golem-effect-sdk.tar.gz
          if-no-files-found: error
          overwrite: true
          retention-days: 7

      - name: Upload Effect SDK for Windows package checks
        uses: actions/upload-artifact@v4
        with:
          name: golem-effect-sdk-windows
          path: |
            sdks/effect/dist
            sdks/effect/wasm
            sdks/effect/golem-types
          if-no-files-found: error

  check-golem-effect-package-windows:
    runs-on: windows-latest
    needs: build-golem-effect
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: sdks/effect/package-lock.json
      - name: Install dependencies
        working-directory: sdks/effect
        run: npm ci
      - name: Download built Effect SDK
        uses: actions/download-artifact@v4
        with:
          name: golem-effect-sdk-windows
          path: sdks/effect
      - name: Build package declarations
        working-directory: sdks/effect
        run: npm run build
      - name: Smoke-test cross-platform package tooling
        working-directory: sdks/effect
        run: npm run check:package

  list-test-component-groups:
    runs-on: blacksmith
    outputs:
      matrix: ${{ steps.generate.outputs.matrix }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - name: Generate matrix from build-components.sh
        id: generate
        run: |
          matrix=$(cd test-components && bash build-components.sh list-groups)
          echo "matrix={\"chunk\":$matrix}" >> "$GITHUB_OUTPUT"
          echo "Generated matrix: $matrix"

  build-test-components:
    runs-on: blacksmith-8vcpu-ubuntu-2204
    # Test components only need a `golem-cli` binary, so they are built from the optimized CLI
    # produced by build-cli-test-bins rather than waiting for the full build-and-store job. This
    # lets the component builds finish while build-and-store is still compiling test binaries.
    needs:
      - build-cli-test-bins
      - build-golem-ts
      - build-golem-scala
      - list-test-component-groups
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.list-test-component-groups.outputs.matrix) }}
    name: build-test-components-${{ matrix.chunk.name }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          use-cache: 'false'
          rust-targets: 'wasm32-wasip1 wasm32-wasip2'
          install-cargo-make: 'false'
          install-cargo-binstall: 'true'
      - name: Restore CLI test binaries
        uses: actions/cache/restore@v5
        with:
          path: tmp/golem-cli-test-binaries
          key: golem-cli-test-binaries-${{ github.run_id }}
          fail-on-cache-miss: true
      - name: Install golem-cli
        run: chmod +x tmp/golem-cli-test-binaries/golem-cli

      - name: Setup MoonBit
        if: matrix.chunk.needs-moonbit
        uses: hustcer/setup-moonbit@v1
        with:
          version: ${{ env.MOONBIT_INSTALL_VERSION }}
          core-version: ${{ env.MOONBIT_INSTALL_VERSION }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Update MoonBit workspace dependencies
        if: matrix.chunk.needs-moonbit
        run: moon update
        working-directory: sdks/moonbit

      - name: Install wasm-tools
        if: matrix.chunk.needs-moonbit
        run: cargo binstall --force --locked wasm-tools@1.248.0

      - name: Restore built TS SDK
        if: matrix.chunk.needs-node
        uses: actions/download-artifact@v8
        with:
          name: golem-ts-sdk
          path: tmp/sdk-artifacts
      - name: Extract built TS SDK
        if: matrix.chunk.needs-node
        run: tar -xzf tmp/sdk-artifacts/golem-ts-sdk.tar.gz

      - name: Setup JS and WASM build tools
        if: matrix.chunk.needs-node
        uses: ./.github/actions/setup-js-wasm-tools
        with:
          wasi-sdk-version: ${{ env.WASI_SDK_VERSION }}
          wasi-sdk-path: ${{ env.WASI_SDK_PATH }}
          wasm-rquickjs-version: ${{ env.WASM_RQUICKJS_VERSION }}

      - name: Setup WASM build tools for Scala components
        if: matrix.chunk.needs-scala
        uses: ./.github/actions/setup-wasm-component-tools
        with:
          wasi-sdk-version: ${{ env.WASI_SDK_VERSION }}
          wasi-sdk-path: ${{ env.WASI_SDK_PATH }}
          wasm-rquickjs-version: ${{ env.WASM_RQUICKJS_VERSION }}

      - name: Setup Java for Scala components
        if: matrix.chunk.needs-scala
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - name: Setup SBT for Scala components
        if: matrix.chunk.needs-scala
        uses: sbt/setup-sbt@v1

      - name: Cache Scala dependencies
        if: matrix.chunk.needs-scala
        uses: coursier/cache-action@v8

      - name: Restore Scala SDK ivy local repo
        if: matrix.chunk.needs-scala
        uses: actions/download-artifact@v8
        with:
          name: scala-sdk-ivy-local
          path: tmp/sdk-artifacts
      - name: Extract Scala SDK ivy local repo
        if: matrix.chunk.needs-scala
        run: |
          mkdir -p ~/.ivy2
          tar -xzf tmp/sdk-artifacts/scala-sdk-ivy-local.tar.gz -C ~/.ivy2

      - name: Update MoonBit fixture dependencies
        if: matrix.chunk.needs-moonbit
        working-directory: test-components/tool-streaming-moonbit
        run: moon update

      - name: Install TS SDK dependencies
        if: matrix.chunk.needs-node
        working-directory: sdks/ts
        run: pnpm install --frozen-lockfile

      - name: Remove any pre-existing WASMs
        run: find test-components -maxdepth 1 -name '*.wasm' -delete

      - name: Build test components
        working-directory: test-components
        env:
          GOLEM_TS_PRESET: quick
          GOLEM_CLI: ${{ github.workspace }}/tmp/golem-cli-test-binaries/golem-cli
        run: ./build-components.sh ${{ matrix.chunk.name }}

      - name: Collect built WASMs
        env:
          EXPECTED_ARTIFACT: ${{ matrix.chunk.expected-artifact }}
        run: |
          mkdir -p tmp/test-components-wasm
          if [[ -n "$EXPECTED_ARTIFACT" ]]; then
            test -s "test-components/$EXPECTED_ARTIFACT"
            cp "test-components/$EXPECTED_ARTIFACT" tmp/test-components-wasm/
          else
            cp test-components/*.wasm tmp/test-components-wasm/ 2>/dev/null || true
          fi
          count=$(find tmp/test-components-wasm -maxdepth 1 -name '*.wasm' | wc -l)
          echo "Built $count WASM files in chunk ${{ matrix.chunk.name }}"
          test "$count" -gt 0

      - name: Upload chunk WASMs
        uses: actions/upload-artifact@v6
        with:
          name: test-components-${{ matrix.chunk.name }}
          path: tmp/test-components-wasm/*.wasm
          retention-days: 1

  merge-test-components:
    runs-on: blacksmith
    needs: build-test-components
    steps:
      - name: Download all chunk WASMs
        uses: actions/download-artifact@v8
        with:
          pattern: test-components-*
          path: tmp/test-components-wasm
          merge-multiple: true

      - name: Verify merged WASMs
        run: |
          echo "Merged WASM files:"
          ls -1 tmp/test-components-wasm/*.wasm | sort
          count=$(find tmp/test-components-wasm -maxdepth 1 -name '*.wasm' | wc -l)
          echo "Total: $count WASM files"

      - name: Save merged WASMs to cache
        uses: actions/cache/save@v5
        with:
          path: tmp/test-components-wasm
          key: golem-test-components-${{ github.run_id }}

  detect-skill-changes:
    name: Detect golem-skills changes
    runs-on: ubuntu-latest
    outputs:
      skills_changed: ${{ github.event_name == 'push' && 'true' || steps.filter.outputs.skills }}
    steps:
      - uses: actions/checkout@v5
      - uses: dorny/paths-filter@v3
        id: filter
        if: github.event_name == 'pull_request'
        with:
          filters: |
            skills:
              - 'golem-skills/**'

  skill-harness-unit-tests:
    name: Skill Harness Unit Tests
    runs-on: blacksmith-8vcpu-ubuntu-2204
    needs: detect-skill-changes
    if: needs.detect-skill-changes.outputs.skills_changed == 'true'
    steps:
      - uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 'lts/*'
          cache: 'npm'
          cache-dependency-path: golem-skills/tests/harness/package.json

      - name: Install and Build
        working-directory: golem-skills/tests/harness
        run: |
          npm install
          npm run build

      - name: Check Formatting
        working-directory: golem-skills/tests/harness
        run: npm run format:check

      - name: Run Unit Tests
        working-directory: golem-skills/tests/harness
        run: npm test

  docker-targets-build:
    env:
      CARGO_BUILD_JOBS: 10
    runs-on: blacksmith-16vcpu-ubuntu-2204
    if: github.event_name == 'push' && github.ref_type == 'tag'
    strategy:
      fail-fast: false
      matrix:
        platform:
          - platform: linux/amd64
            name: linux/amd64
            target: x86_64-unknown-linux-gnu
            rustflags_env: CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS
            rustflags: "-C target-cpu=x86-64-v3"
          - platform: linux/arm64
            name: linux/arm64
            target: aarch64-unknown-linux-gnu
            cross: true
            rustflags_env: CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS
            rustflags: "-C target-feature=+neon,+crc,+lse,+aes,+sha2,+dotprod"
    name: docker-targets-build (${{ matrix.platform.platform }})
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          fetch-tag: 'true'
          rust-targets: ${{ matrix.platform.target }}
          install-protoc: 'true'

      - name: Prepare
        run: |
          platform=${{ matrix.platform.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
          # Target-scoped rustflags pin the instruction-set baseline for the
          # published images: x86-64-v3 on amd64 and Neoverse N1's stable
          # optional target features on arm64. The per-target
          # CARGO_TARGET_*_RUSTFLAGS form is used because plain RUSTFLAGS is
          # ignored when cross-compiling; CARGO_-prefixed vars are also passed
          # through into the cross container automatically.
          echo "${{ matrix.platform.rustflags_env }}=${{ matrix.platform.rustflags }}" >> $GITHUB_ENV

      - run: cargo install cross
        if: ${{ matrix.platform.cross }}
      - name: Build executables
        run: cargo make --profile ci build-release
        env:
          PLATFORM_OVERRIDE: ${{ matrix.platform.name }}

      - name: Prepare Targets
        env:
          PLATFORM_OVERRIDE: ${{ matrix.platform.name }}
        run: cargo make --profile ci package-release
      - uses: actions/upload-artifact@v6
        name: Upload Targets
        with:
          name: docker-targets-build-${{ env.PLATFORM_PAIR }}
          path: target/${{ matrix.platform.target }}.tar

  docker-publish-1:
    runs-on: blacksmith
    needs:
      - docker-targets-build
    if: github.event_name == 'push' && github.ref_type == 'tag'
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/docker-publish-setup
        with:
          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - uses: ./.github/actions/docker-build-push-service
        with:
          image-name: golemservices/golem-worker-executor
          dockerfile: ./golem-worker-executor/docker/Dockerfile
          platforms: ${{ env.PLATFORMS }}
      - uses: ./.github/actions/docker-build-push-service
        with:
          image-name: golemservices/golem-shard-manager
          dockerfile: ./golem-shard-manager/docker/Dockerfile
          platforms: ${{ env.PLATFORMS }}

  docker-publish-2:
    runs-on: blacksmith
    needs:
      - docker-targets-build
    if: github.event_name == 'push' && github.ref_type == 'tag'
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/docker-publish-setup
        with:
          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - uses: ./.github/actions/docker-build-push-service
        with:
          image-name: golemservices/registry-service
          dockerfile: ./golem-registry-service/docker/Dockerfile
          platforms: ${{ env.PLATFORMS }}
      - uses: ./.github/actions/docker-build-push-service
        with:
          image-name: golemservices/golem-worker-service
          dockerfile: ./golem-worker-service/docker/Dockerfile
          platforms: ${{ env.PLATFORMS }}
      - uses: ./.github/actions/docker-build-push-service
        with:
          image-name: golemservices/golem-component-compilation-service
          dockerfile: ./golem-component-compilation-service/docker/Dockerfile
          platforms: ${{ env.PLATFORMS }}

  publish:
    needs:
      - check-clippy-and-format
      - unit-tests-and-checks
      - golem-schema-guest
      - worker-tests
      - managed-xfs-tests
      - it
      - it-cli
    if: "startsWith(github.ref, 'refs/tags/v')"
    env:
      CARGO_BUILD_JOBS: 20
    runs-on: blacksmith-32vcpu-ubuntu-2204
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          fetch-tag: 'true'
          cache-shared-key: 'release'
          cache-save-if: 'true'
          install-protoc: 'true'
      - id: get_version
        uses: battila7/get-version-action@v2
      - name: Publish all packages
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
          VERSION: ${{ steps.get_version.outputs.version-without-v }}
        run: cargo make --profile ci publish

  publish-binaries:
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'golemcloud/golem'
    strategy:
      fail-fast: false
      matrix:
        project:
          - golem-cli
          - golem
        cfg:
          - rust-target: x86_64-unknown-linux-gnu
            os: blacksmith-32vcpu-ubuntu-2204
          - rust-target: aarch64-unknown-linux-gnu
            os: blacksmith-32vcpu-ubuntu-2204
            cross: true
          - rust-target: x86_64-apple-darwin
            os: macos-latest
          - rust-target: aarch64-apple-darwin
            os: macos-latest
          - rust-target: x86_64-pc-windows-msvc
            os: windows-latest
    name: Publish binaries of ${{ matrix.project }}
    runs-on: ${{ matrix.cfg.os }}
    permissions:
      contents: write
    env:
      CARGO_BUILD_JOBS: 10
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup-rust
        with:
          fetch-tag: 'true'
          rust-targets: ${{ matrix.cfg.rust-target }}
          cache-shared-key: 'release-${{ matrix.cfg.rust-target }}'
          cache-save-if: 'true'
          install-protoc: 'true'
      - id: get_version
        uses: battila7/get-version-action@v2
      - name: Set version for all packages
        env:
          VERSION: ${{ steps.get_version.outputs.version-without-v }}
        run: cargo make --profile ci set-version

      - run: cargo install cross
        if: ${{ matrix.cfg.cross }}
      - uses: ilammy/setup-nasm@v1

      - run: cargo build -p ${{ matrix.project }} --release --target ${{ matrix.cfg.rust-target }}
        if: ${{ ! matrix.cfg.cross }}
      - run: cross build -p ${{ matrix.project }} --release --target ${{ matrix.cfg.rust-target }}
        if: ${{ matrix.cfg.cross }}

      - run: mv ./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}.exe ./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}.exe
        if: matrix.cfg.os == 'windows-latest'
      - run: mv ./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }} ./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}
        if: matrix.cfg.os != 'windows-latest'

      - name: Import Code Signing Certificate
        if: contains(matrix.cfg.rust-target, 'apple-darwin')
        env:
          CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          # Create temporary keychain
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          # Create and unlock keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # Import certificate - use -T to allow codesign access
          CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
          echo "$CERTIFICATE_BASE64" | base64 --decode > "$CERTIFICATE_PATH"
          security import "$CERTIFICATE_PATH" \
            -P "$CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign \
            -T /usr/bin/security \
            -f pkcs12 \
            -k "$KEYCHAIN_PATH"

          # Add keychain to search list (prepend to existing list)
          security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychain -d user | tr -d '"')

          # Set partition list to allow codesign to access the certificate
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # Verify certificate was imported
          echo "Imported certificates:"
          security find-identity -v -p codesigning "$KEYCHAIN_PATH"

          # Save keychain path for cleanup
          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> $GITHUB_ENV

      - name: Create entitlements
        if: contains(matrix.cfg.rust-target, 'apple-darwin')
        run: |
          ENTITLEMENTS_PATH=$RUNNER_TEMP/entitlements.plist

          cat > $ENTITLEMENTS_PATH << 'EOF'
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN">
          <plist version="1.0">
            <dict>
              <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
              <true/>
            </dict>
          </plist>
          EOF

          echo "ENTITLEMENTS_PATH=$ENTITLEMENTS_PATH" >> $GITHUB_ENV

      - name: Code Sign Binary
        if: contains(matrix.cfg.rust-target, 'apple-darwin')
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          BINARY_PATH=./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}

          # Sign with hardened runtime
          codesign --force \
            --options runtime \
            --timestamp \
            --entitlements "$ENTITLEMENTS_PATH" \
            --sign "$APPLE_SIGNING_IDENTITY" \
            "$BINARY_PATH"

          # Verify signature
          codesign --verify --verbose "$BINARY_PATH"
          codesign --display --verbose=4 --entitlements - "$BINARY_PATH"

      - name: Create Notarization Archive
        if: contains(matrix.cfg.rust-target, 'apple-darwin')
        run: |
          BINARY_PATH=./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}
          ZIP_PATH=./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}.zip

          # Create zip for notarization
          zip -j "$ZIP_PATH" "$BINARY_PATH"

      - name: Submit for Notarization
        if: contains(matrix.cfg.rust-target, 'apple-darwin')
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
        run: |
          ZIP_PATH=./target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}.zip

          # Submit for notarization (no --wait, returns immediately)
          xcrun notarytool submit "$ZIP_PATH" \
            --apple-id "$APPLE_ID" \
            --team-id "$APPLE_TEAM_ID" \
            --password "$APPLE_APP_PASSWORD"

      - name: Cleanup Keychain
        if: contains(matrix.cfg.rust-target, 'apple-darwin') && always()
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          security delete-keychain "$KEYCHAIN_PATH" || true

      - name: Login GH CLI
        shell: bash
        run: gh auth login --with-token < <(echo ${{ secrets.GITHUB_TOKEN }})
      - run: gh release upload -R golemcloud/golem --clobber ${{ github.ref_name }} target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}.exe
        if: matrix.cfg.os == 'windows-latest'
      - run: gh release upload -R golemcloud/golem --clobber ${{ github.ref_name }} target/${{ matrix.cfg.rust-target }}/release/${{ matrix.project }}-${{ matrix.cfg.rust-target }}
        if: matrix.cfg.os != 'windows-latest'

  publish-slack-notification:
    needs:
      - publish
      - docker-publish-1
      - docker-publish-2
    if: ${{ always() && startsWith(github.ref, 'refs/tags/v') }}
    runs-on: blacksmith
    steps:
      - name: Publish Slack Notification
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_COLOR: ${{ needs.publish.result }}
          SLACK_ICON: https://uploads-ssl.webflow.com/64721eeec7cd7ef4f6f1683e/64831138b73a996d0e831773_32.png
          SLACK_TITLE: "Release Notification"
          SLACK_MESSAGE: "Publish - cargo result: `${{ needs.publish.result }}`, docker-1 result: `${{ needs.docker-publish-1.result }}`, docker-2 result: `${{ needs.docker-publish-2.result }}`"
          SLACK_USERNAME: CI
          SLACK_WEBHOOK: ${{ secrets.SLACK_ALERT_URL }}