main.yaml

# GitHub Workflows file

name: main

defaults:
  run:
    shell: bash --noprofile --norc -euo pipefail {0}

on:
  push:
    branches:
      - main
    tags:
      - 'v*'
  pull_request:
    branches:
      - main
  workflow_dispatch:

env:
  # https://github.com/bazelbuild/bazel/issues/3001
  # MSYS2_ARG_CONV_EXCL: "*"
  # MSYS_NO_PATHCONV: 1
  RUSTFLAGS: -Dwarnings

jobs:

  version:
    name: Current version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      rev: ${{ steps.rev.outputs.rev }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
      - name: Version
        id: version
        run: |
          ./tools/version | tee -a "${GITHUB_OUTPUT}"
      - name: Rev
        id: rev
        run: |
          printf 'rev=%s\n' "$(git rev-parse --short HEAD)" | tee -a "${GITHUB_OUTPUT}"

  bazel_test:
    name: Bazel test
    runs-on: ${{ matrix.os }}

    needs: version

    strategy:
      matrix:
        build:
          - macos
          - ubuntu-20.04
          # - ubuntu-22.04
          # - ubuntu-24.04
          # - windows
        include:
          - build: macos
            os: macos-latest
            buildflags: --features=negotiate
          - build: ubuntu-20.04
            os: ubuntu-20.04
            buildflags: --features=negotiate
          # - build: ubuntu-22.04
          #   os: ubuntu-22.04
          #   buildflags: --features=negotiate
          # - build: ubuntu-24.04
          #   os: ubuntu-24.04
          #   buildflags: --features=negotiate
          # - build: windows
          #   os: windows-latest
          #   buildflags: --features=negotiate

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
      - name: macOS version
        if: ${{ runner.os == 'macOS' }}
        run: |
          printf 'OS_VER=%s\n' "$(sw_vers --productVersion)" | tee -a $GITHUB_ENV
      - name: Linux version
        if: ${{ runner.os == 'Linux' }}
        run: |
          printf 'OS_VER=%s\n' "$(lsb_release --short --release)" | tee -a $GITHUB_ENV
      - name: Bazel cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/bazel_build_cache
            ~/.cache/bazel_repo_cache
          key: ${{ runner.os }}-${{ env.OS_VER }}-bazel-test-${{ hashFiles('Cargo.Bazel.lock', 'WORKSPACE') }}
          restore-keys: |
            ${{ runner.os }}-${{ env.OS_VER }}-bazel-test-
      - name: Setup Windows Bazelrc
        # https://bazel.build/configure/windows
        run: |
          echo "startup --output_user_root=C:/tmp" > ${{ github.workspace }}/user.bazelrc
        shell: cmd
        if: runner.os == 'Windows'
      - name: Install Linux dependency
        run: sudo apt-get install libkrb5-dev
        if: ${{ startswith(matrix.os, 'ubuntu') }}
      - name: Run tests
        run: >
          bazel
          test
          --config=ci
          --//:version=${{ needs.version.outputs.version }}
          --//:rev=${{ needs.version.outputs.rev }}
          ${{ matrix.buildflags }}
          "//..."
        shell: cmd
        if: runner.os == 'Windows'
      - name: Run tests
        run: >
          bazel
          test
          --config=ci
          --//:version=${{ needs.version.outputs.version }}
          --//:rev=${{ needs.version.outputs.rev }}
          ${{ matrix.buildflags }}
          "//..."
        if: runner.os != 'Windows'

  bazel_build:
    name: Package
    runs-on: ${{ matrix.os }}

    needs:
      - bazel_test
      - version

    strategy:
      matrix:
        build:
          - macos-aarch64
          - macos-x86_64
          - ubuntu-20.04
          - ubuntu-22.04
          - ubuntu-24.04
          # - windows
        include:
          - build: macos-aarch64
            os: macos-latest
            buildflags: --features=negotiate --config=aarch64_apple_darwin
            pkgfile: proxydetox-${{ needs.version.outputs.version }}-apple-darwin-aarch64.pkg
          - build: macos-x86_64
            os: macos-latest
            buildflags: --features=negotiate --config=x86_64_apple_darwin
            pkgfile: proxydetox-${{ needs.version.outputs.version }}-apple-darwin-x86_64.pkg
          - build: ubuntu-20.04
            os: ubuntu-20.04
            buildflags: --features=negotiate
            pkgfile: proxydetox-${{ needs.version.outputs.version }}-focal_amd64.deb
          - build: ubuntu-22.04
            os: ubuntu-22.04
            buildflags: --features=negotiate
            pkgfile: proxydetox-${{ needs.version.outputs.version }}-jammy_amd64.deb
          - build: ubuntu-24.04
            os: ubuntu-24.04
            buildflags: --features=negotiate
            pkgfile: proxydetox-${{ needs.version.outputs.version }}-noble_amd64.deb
          # - build: windows
          #   os: windows-latest
          #   buildflags: --features=negotiate
          #   pkgfile: proxydetox-${{ needs.version.outputs.version }}-windows-x86_64.zip

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
      - name: macOS version
        if: ${{ runner.os == 'macOS' }}
        run: |
          printf 'OS_VER=%s\n' "$(sw_vers --productVersion)" | tee -a $GITHUB_ENV
      - name: Linux version
        if: ${{ runner.os == 'Linux' }}
        run: |
          printf 'OS_VER=%s\n' "$(lsb_release --short --release)" | tee -a $GITHUB_ENV
      - name: Bazel cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/bazel_build_cache
            ~/.cache/bazel_repo_cache
          key: ${{ runner.os }}-${{ env.OS_VER }}-bazel-build-${{ hashFiles('Cargo.Bazel.lock', 'WORKSPACE') }}
          restore-keys: |
            ${{ runner.os }}-${{ env.OS_VER }}-bazel-build-
      - name: Setup Windows Bazelrc
        # https://bazel.build/configure/windows
        run: |
          echo "startup --output_user_root=C:/tmp" > ${{ github.workspace }}\user.bazelrc
        shell: cmd
        if: runner.os == 'Windows'
      - name: Install Linux dependency
        run: sudo apt-get install libkrb5-dev
        if: startswith(matrix.os, 'ubuntu')
      - name: Build package
        run: >
          bazel build
          --config=ci
          --config=release
          --//:version=${{ needs.version.outputs.version }}
          --//:rev=${{ needs.version.outputs.rev }}
          ${{ matrix.buildflags }}
          "//pkg"
      - name: Copy package
        run: >
          bazel
          run
          --config=ci
          --config=release
          --//:version=${{ needs.version.outputs.version }}
          --//:rev=${{ needs.version.outputs.rev }}
          ${{ matrix.buildflags }}
          "//pkg:copy"
          --
          ${{ matrix.pkgfile }}
      - name: Upload package artifact
        uses: actions/upload-artifact@v4
        with:
          name: pkg-bazel-${{ matrix.build }}
          path: ./${{ matrix.pkgfile }}

  cargo_build_and_test:
    name: Cargo build and test
    runs-on: windows-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
          profile: minimal
          override: true
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ runner.os }}
      #  see https://github.com/rust-lang/rust-bindgen/issues/1797
      - name: Install Windows dependency (LLVM)
        uses: KyleMayes/install-llvm-action@v2.0.3
        if: startswith(runner.os, 'windows')
        with:
          version: "11.0"
          directory: ${{ runner.temp }}/llvm
      - name: Set LIBCLANG_PATH
        run: echo "LIBCLANG_PATH=$((gcm clang).source -replace "clang.exe")" >> $env:GITHUB_ENV
        shell: pwsh
        if: startswith(runner.os, 'windows')
      - name: Run cargo test
        run: cargo test
      - name: Build Release Package
        id: buildpkg
        run: ./tools/mkzip.ps1
        shell: pwsh
      - name: Upload package artifact
        uses: actions/upload-artifact@v4
        with:
          name: pkg-cargo-windows
          path: ./${{ steps.buildpkg.outputs.pkgfile }}

  mkrelease:
    name: Create Release
    runs-on: ubuntu-latest
    needs:
      - version
      - bazel_build
      - cargo_build_and_test
    steps:
      - name: Download pkg artifact
        uses: actions/download-artifact@v4
        with:
          pattern: pkg-*
          merge-multiple: true
      - name: Show downloaded artifacts
        run: find . -name '*.deb' -o -name '*.pkg' -o -name '*.zip'
      - name: Create Release
        if: ${{ github.event_name == 'push' && startswith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
        run: |
          gh --repo "${REPO}" release create "${VERSION}" --generate-notes *.deb *.pkg *.zip
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          VERSION: v${{ needs.version.outputs.version }}

  format_check:
    name: Rust lint
    runs-on: ubuntu-20.04

    strategy:
      matrix:
        lint: [clippy, fmt]
        include:
          - lint: clippy
            flags: --all
          - lint: fmt
            flags: --all -- --check

    steps:
      - uses: actions/checkout@v4
      - name: Rustup
        run: |
          rustup update --no-self-update stable
          rustup component add clippy rustfmt
      - name: Install Linux dependency
        run: sudo apt-get install libkrb5-dev
        if: ${{ matrix.lint == 'clippy' }}
      - name: Lint check
        run: cargo ${{ matrix.lint }} ${{ matrix.flags }}

  # The success job is here to consolidate the total success/failure state of
  # all other jobs. This job is then included in the GitHub branch protection
  # rule which prevents merges unless all other jobs are passing. This makes
  # it easier to manage the list of jobs via this yml file and to prevent
  # accidentally adding new jobs without also updating the branch protections.
  success:
    name: Success gate
    if: always()
    needs:
      - bazel_build
      - cargo_build_and_test
      - format_check
    runs-on: ubuntu-latest
    steps:
      - run: jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
      - name: Done
        run: exit 0