build.yml

name: Build

on:
  workflow_call:
    inputs:
      release_id:
        required: true
        type: string

permissions:
  contents: read

jobs:

  build:
    strategy:
      matrix:
        platform: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.platform }}
    permissions:
      contents: write
      security-events: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0  # Fetches all history and tags

      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.13'

      - name: Install Zig (Windows)
        if: runner.os == 'Windows'
        run: choco install zig --version=0.15.2 -y

      - name: Set up Ruby
        if: ${{ matrix.platform != 'windows-latest' }}
        uses: ruby/setup-ruby@0cb964fd540e0a24c900370abf38a33466142735  #v1.305.0
        with:
          ruby-version: 3.3 # See also devcontainer

      - name: Install fpm
        if: ${{ matrix.platform != 'windows-latest' }}
        run: |
          gem install --no-document fpm --version 1.17.0
          fpm --version

      - name: Add msbuild to PATH
        if: ${{ matrix.platform == 'windows-latest' }}
        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v2
      - name: Install WiX
        if: ${{ matrix.platform == 'windows-latest' }}
        run: |
          dotnet tool install --global wix --version 6.0.2
          echo "$env:USERPROFILE\.dotnet\tools" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          wix --version

      - name: ccache
        uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
        if: ${{ matrix.platform != 'windows-latest' }}
        with:
          key: ${{ github.job }}-${{ matrix.platform }}
          verbose: 1
          create-symlink: true

      - name: Setup cache for clcache
        if: ${{ matrix.platform == 'windows-latest' }}
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ github.workspace }}\.clcache
          key: ${{ github.job }}-${{ matrix.platform }}

      - name: Create sbom, binary & package
        env:
          CCACHE_BASEDIR: ${{ github.workspace }}
          CCACHE_NOHASHDIR: true
          NUITKA_CACHE_DIR_CCACHE: ${{ github.workspace }}/.ccache
          NUITKA_CACHE_DIR_CLCACHE: ${{ github.workspace }}\.clcache
          NUITKA_CCACHE_BINARY: /usr/bin/ccache
        run: |
          pip install .[build]
          python script/create_sbom.py
          python script/build.py
          python script/package.py

      - name: Store the distribution packages
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: binary-distribution-${{ matrix.platform }}
          path: |
              build/dfetch-package/*.deb
              build/dfetch-package/*.rpm
              build/dfetch-package/*.pkg
              build/dfetch-package/*.msi
              build/dfetch-package/*.cdx.json

      - name: Upload installer to release
        if: ${{ inputs.release_id }}
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2.5.0
        with:
          tag_name: ${{ inputs.release_id }}
          files: |
              build/dfetch-package/*.deb
              build/dfetch-package/*.rpm
              build/dfetch-package/*.pkg
              build/dfetch-package/*.msi
              build/dfetch-package/*.cdx.json
          draft: true
          preserve_order: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  test-binary:
    name: Test dfetch from installer
    needs:
    - build
    strategy:
      matrix:
        platform: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.platform }}

    steps:
    - name: Download the binary artifact
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v5
      with:
        name: binary-distribution-${{ matrix.platform }}
        path: .

    - name: Install binary
      if: matrix.platform == 'ubuntu-latest'
      run: |
        sudo dpkg -i dfetch*.deb
        sudo dpkg -L dfetch
        echo "/opt/dfetch" >> $GITHUB_PATH
      shell: bash

    - name: Install binary
      if: matrix.platform == 'macos-latest'
      run: |
        sudo installer -pkg dfetch*.pkg -target / -verboseR
        echo "/opt/dfetch/opt/dfetch" >> $GITHUB_PATH
      shell: bash

    - name: Install binary
      if: matrix.platform == 'windows-latest'
      run: |
        $file = Get-ChildItem dfetch*.msi | Select-Object -First 1
        if (-not $file) { throw "MSI not found" }
        $log = "install.log"
        $procMain = Start-Process "msiexec" "/i `"$file`" /qn /l*! `"$log`"" -NoNewWindow -PassThru
        $procLog = Start-Process "powershell" "Get-Content -Path `"$log`" -Wait" -NoNewWindow -PassThru
        $procMain.WaitForExit()
        $procLog.Kill()
        echo "C:\Program Files (x86)\dfetch" >> $env:GITHUB_PATH
      shell: pwsh

    - run: |
       git init --initial-branch=main
       git config user.name "John Doe"
       git config user.email "john.doe@example.com"
       git add -A
       git commit -m "Initial commit"
    - run: dfetch init
    - run: dfetch environment
    - run: dfetch add https://github.com/dfetch-org/test-repo
    - run: dfetch validate
    - run: dfetch check
    - run: dfetch update
    - run: dfetch update
    - run: |
       git add -A
       git commit -m "Fetched dependencies"
       echo "An extra line" >> test-repo/README.md
       git add test-repo/README.md
       git commit -m "Update README.md"
    - run: dfetch diff test-repo
    - run: |
       echo "    patch: test-repo.patch" >> dfetch.yaml
       git add -A
       git commit -m "Patch test-repo"
    - run: dfetch update-patch
    - run: dfetch format-patch
    - run: dfetch report -t sbom
    - run: dfetch remove test-repo


  build-whl:
    name: Build wheel 📦
    runs-on: ubuntu-latest

    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
      with:
        egress-policy: audit

    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
        fetch-depth: 0  # Fetches all history and tags
    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.13'
    - name: Install dependencies
      run: python -m pip install --upgrade pip build --user
    - name: Build a binary wheel and a source tarball
      run: python3 -m build
    - name: Store the distribution packages
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: python-package-distributions
        path: dist/

  release:
    name: Upload wheel to release 📦
    runs-on: ubuntu-latest
    if: ${{ inputs.release_id }}
    needs: build-whl
    permissions:
      contents: write
      security-events: write
    steps:
    - name: Download all the dists
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v5
      with:
        name: python-package-distributions
        path: dist/
    - name: Upload artifacts to release
      uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2.5.0
      with:
        tag_name: ${{ inputs.release_id }}
        files: dist/*
        draft: true
        preserve_order: true
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}