.github/workflows/npm-publication.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: npm publication
run-name: Unofficial experimental Rust preview (${{ github.ref_name }})

on:
  workflow_dispatch:
    inputs:
      publish:
        description: Publish an unofficial experimental preview (not an ASF release) to rust-preview
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  source:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    outputs:
      version: ${{ steps.source.outputs.version }}
      build_id: ${{ steps.source.outputs.build_id }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
      - id: source
        name: Freeze one source archive for every platform
        run: |
          node --input-type=module <<'JS'
          import { readFileSync, appendFileSync } from 'node:fs';
          import { createSourceCandidate } from './scripts/asf-source-release.mjs';
          const { version } = JSON.parse(readFileSync('package.json', 'utf8'));
          await createSourceCandidate({ revision: process.env.GITHUB_SHA, version });
          appendFileSync(process.env.GITHUB_OUTPUT, 'version=' + version + '\n' +
            'build_id=' + process.env.GITHUB_RUN_ID + '.' + process.env.GITHUB_RUN_ATTEMPT + '\n');
          JS
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: native-preview-source
          path: release/asf/*
          if-no-files-found: error

  build:
    needs: source
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 180
    strategy:
      fail-fast: false
      matrix:
        include:
          # Computer Use's Swift bindings require the macOS 26 SDK.
          - runner: macos-26
            target: darwin-arm64
          - runner: ubuntu-24.04
            target: linux-x64-gnu
          - runner: windows-2025
            target: win32-x64
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/target
      NATIVE_TARGET: ${{ matrix.target }}
      SOURCE_VERSION: ${{ needs.source.outputs.version }}
      BUILD_ID: ${{ needs.source.outputs.build_id }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
      - name: Update Rust
        run: rustup update stable --no-self-update
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: '3.12'
      - name: Select the checked-in npm toolchain
        shell: bash
        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
      - name: Install the Linux baseline linker
        if: runner.os == 'Linux'
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
        with:
          version: 0.16.0
      - name: Install native build dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y pkg-config libx11-dev libxi-dev libxtst-dev libxext-dev libxcb1-dev libxkbcommon-dev libxkbcommon-x11-dev libfontconfig1-dev libfreetype6-dev libwayland-dev libglib2.0-dev libclang-19-dev
          echo 'LIBCLANG_PATH=/usr/lib/llvm-19/lib' >> "$GITHUB_ENV"
      - name: Select libclang on macOS
        if: runner.os == 'macOS'
        run: echo "LIBCLANG_PATH=$(xcode-select -p)/Toolchains/XcodeDefault.xctoolchain/usr/lib" >> "$GITHUB_ENV"
      - name: Install cargo-zigbuild
        if: runner.os == 'Linux'
        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
        with:
          tool: cargo-zigbuild@0.23.4
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: native-preview-source
          path: source
      - id: v8-key
        name: Identify the V8 build inputs
        shell: bash
        run: |
          v8_key=$(node scripts/rust/build-v8.mjs --cache-key)
          echo "key=$v8_key" >> "$GITHUB_OUTPUT"
      - id: v8-cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: target/v8/${{ steps.v8-key.outputs.key }}
          key: maka-v8-${{ matrix.target }}-${{ steps.v8-key.outputs.key }}
      - name: Build verified source and exercise the native executables
        env:
          V8_CACHE_KEY: ${{ steps.v8-key.outputs.key }}
        shell: bash
        run: |
          node --input-type=module <<'JS'
          import { releaseNativeCli } from './scripts/rust/release-cli.mjs';
          import { rustTarget } from './scripts/rust/build-cli.mjs';
          import { packV8 } from './scripts/rust/v8-prebuilt.mjs';
          import { readFileSync } from 'node:fs';
          const target = process.env.NATIVE_TARGET;
          await releaseNativeCli({
            source: 'source/apache-maka-' + process.env.SOURCE_VERSION + '-incubating-src.tar.gz',
            target, buildId: process.env.BUILD_ID, output: 'native-preview',
          });
          const pins = JSON.parse(readFileSync('scripts/rust/v8-prebuilts.json', 'utf8'));
          if (!Object.hasOwn(pins, process.env.V8_CACHE_KEY)) {
            await packV8({
              directory: process.env.CARGO_TARGET_DIR + '/v8',
              key: process.env.V8_CACHE_KEY, target: rustTarget(), output: 'v8-preview',
              verifiedBy: { commit: process.env.GITHUB_SHA,
                run: 'https://github.com/' + process.env.GITHUB_REPOSITORY + '/actions/runs/' + process.env.GITHUB_RUN_ID },
            });
          }
          JS
      # A later Maka build failure does not invalidate a completed V8 dependency.
      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        if: ${{ !cancelled() && steps.v8-cache.outputs.cache-hit != 'true' && hashFiles(format('target/v8/{0}/receipt.json', steps.v8-key.outputs.key)) != '' }}
        with:
          path: target/v8/${{ steps.v8-key.outputs.key }}
          key: maka-v8-${{ matrix.target }}-${{ steps.v8-key.outputs.key }}
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: native-preview-${{ matrix.target }}
          path: native-preview/*
          if-no-files-found: error
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ hashFiles('v8-preview/*.json') != '' }}
        with:
          name: v8-prebuilt-${{ matrix.target }}
          path: v8-preview/*
          if-no-files-found: error

  prepare:
    needs: build
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
      - name: Select the checked-in npm toolchain
        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: native-preview-*
          merge-multiple: true
          path: native-preview
      - name: Package the launcher from the verified source
        run: node scripts/rust/pack-launcher.mjs native-preview
      - name: Validate the complete release
        run: node scripts/rust/publish-cli.mjs native-preview
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-release
          path: native-preview/*
          if-no-files-found: error

  verify:
    needs: prepare
    strategy:
      fail-fast: false
      matrix:
        runner: [macos-15, ubuntu-24.04, windows-2025]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
      - name: Select the checked-in npm toolchain
        shell: bash
        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-release
          path: native-preview
      - name: Install offline and exercise the packaged launcher
        run: node scripts/rust/verify-release.mjs native-preview

  publish:
    needs: verify
    if: inputs.publish && github.repository == 'M4n5ter/maka-agent' && github.ref == 'refs/heads/feat/runtime-host-rust'
    concurrency:
      group: npm-publication-rust-preview
      cancel-in-progress: false
    environment: npm-rust-preview
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          registry-url: https://registry.npmjs.org
      - name: Select the checked-in npm toolchain
        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-release
          path: native-preview
      - name: Publish the verified release
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: node scripts/rust/publish-cli.mjs native-preview --publish --provenance