artifacts:
- bench.txt
- cover.out
environment:
  APK_REPO: alpine/v3.22/bigbes/x86_64
  ARTIFACTS_CHANNEL: ~bigbes/main
  ARTIFACTS_DIST: v3.22
  ARTIFACTS_ENDPOINT: https://artifacts.srht.bigb.es
  BENCH_ORIGIN: https://bench.srht.bigb.es
  BENCH_REPO: ~bigbes/sr-ht-bench
  BOOTSTRAP_REV: 779ad9f174ea5ab7e755f6df0ec9e5912d67dd16
  BUILD_SUBMITTER: git.sr.ht
  CORE_VER: 0.84.5
  COVER_ORIGIN: https://cov.srht.bigb.es
  COVER_REPO: ~bigbes/sr-ht-bench
  GIT_REF: refs/heads/master
  REPO: sr-ht-bench
  S3_BUCKET: repo
  S3_ENDPOINT: https://s3.bigb.es
image: alpine/edge
packages:
- abuild
- go
- git
- curl
- rclone
- sassc
- minify
- postgresql
- postgresql-client
secrets:
- e322d5a2-b6b5-4425-aa37-12b038282461
- 7dde4219-0783-4581-a67d-c94749de3600
- 0e5b3530-6f19-4f30-9b73-9339dd382e46
- c7968415-1a6d-4ca0-a188-150fb7f57b65
sources:
- "https://git.srht.bigb.es/~bigbes/sr-ht-bench#2e7825b21414769e9373ed0753f67029af438376"
submitter:
  git.sr.ht:
    allow-refs:
    - refs/heads/master
    - refs/tags/v*
tasks:
- cacher_install: |
    curl -sSL https://bigbes.pages.srht.bigb.es/ci-cacher/install.sh | sh
- cacher_init: |
    cacher init \
      --endpoint    https://s3.bigb.es \
      --region      garage \
      --bucket      docker-cache \
      --prefix      sr-ht-bench/deps \
      --key-file    ~/.s3-cache-key-id \
      --secret-file ~/.s3-cache-key-secret
- scss: |
    # Assemble the shared sourcehut partials no apk ships, cached by the two
    # pins so an upstream outage can't fail us. --exec runs on a miss and
    # seeds the cache after; it sees exported vars only, hence the inline
    # key. docs/ci.md#scss.
    cacher dir download "scss/${CORE_VER}-${BOOTSTRAP_REV}.tar.zst" ~/scss --exec '
      git clone --depth 1 --branch "$CORE_VER" \
        https://git.sr.ht/~sircmpwn/core.sr.ht /tmp/core
      mkdir -p ~/scss/bootstrap
      cp /tmp/core/scss/*.scss /tmp/core/scss/*.css ~/scss/
      git init -q /tmp/bootstrap
      git -C /tmp/bootstrap remote add origin https://github.com/twbs/bootstrap
      git -C /tmp/bootstrap fetch -q --depth 1 origin "$BOOTSTRAP_REV"
      git -C /tmp/bootstrap checkout -q FETCH_HEAD
      cp -r /tmp/bootstrap/scss ~/scss/bootstrap/scss
    '
    sudo mkdir -p /usr/share/sourcehut
    sudo cp -r ~/scss /usr/share/sourcehut/scss
- keygen: |
    # Throwaway signing key, and -i is not optional: docs/ci.md#keygen.
    SUDO=sudo abuild-keygen -a -n -i -q
- version: |
    # `git describe` translated to a legal apk version, EXPORTED and never
    # sed-ed into the APKBUILD (which reads $PKGVER): rewriting a tracked file
    # would flip Go's VCS stamp to dirty — do not "tidy" it into a sed. The
    # tree is printed because this is the last moment it is provably clean.
    # All of it: docs/ci.md#version.
    cd "$REPO"
    desc=$(git describe --tags --always --dirty)
    base=${desc%-dirty}
    case "$base" in
      v*-g*) n=${base%-g*}; ver="${n%-*}"; ver="${ver#v}_git${n##*-}" ;;
      v*)    ver="${base#v}" ;;
      *)     ver="0.0.$(git rev-list --count HEAD)" ;;
    esac
    echo "export PKGVER=$ver SRHT_VERSION=$desc" >> ~/.buildenv
    echo "building $ver from $desc"
    git status --porcelain
- cache_restore: |
    # Go module and build caches keyed by go.sum; --optional makes a miss a
    # cold build, not an error. abuild re-pins both (docs/ci.md#cache_restore).
    KEY_MOD=$(cacher key "gomod/{hash}.tar.zst" --hash-from "$REPO/go.sum")
    KEY_GOC=$(cacher key "gocache/{hash}.tar.zst" --hash-from "$REPO/go.sum")
    echo "export KEY_MOD=$KEY_MOD KEY_GOC=$KEY_GOC" >> ~/.buildenv
    cacher dir download "$KEY_MOD" ~/go/pkg/mod        --optional
    cacher dir download "$KEY_GOC" ~/.cache/go-build   --optional
    # Repair block for the HALF-restored module cache — the normal failure
    # here, and it reads like a code bug (cover's build #284). Do not remove
    # and do not soften to `|| true`: docs/ci.md#the-half-restored-module-cache.
    cd "$REPO"
    chmod -R u+w ~/go/pkg/mod 2>/dev/null || true
    if ! go mod verify >/dev/null 2>&1; then
      echo "restored module cache did not verify — discarding it"
      rm -rf ~/go/pkg/mod
    fi
    # `go mod download` and NEVER `go mod download all`. `all` APPENDS the
    # test-only sums of dependencies to the TRACKED go.sum — 228 lines here,
    # exit 0, no output — dirtying the checkout for every later `go build`.
    # -mod=readonly does NOT prevent it; build #359 died at check-version for
    # exactly this. docs/ci.md#never-go-mod-download-all.
    go mod download
    go mod verify
    # A dirty tree here is a "-dirty" apk: a fact we check, not a flag we
    # trust. docs/ci.md#cache_restore.
    git status --porcelain
- postgres: |
    # SPEC ch. 15's open question 6, answered: a real Postgres in the VM.
    # Measured: db/ covers 4.5% of its statements without it and 77.2% with
    # it. Every flag below is load-bearing — see docs/ci.md#postgres.
    sudo install -d -o postgres -g postgres /run/postgresql /var/lib/postgresql/data
    sudo -u postgres initdb -D /var/lib/postgresql/data
    sudo -u postgres pg_ctl -D /var/lib/postgresql/data -l /tmp/pg.log -w start \
      -o "-k /run/postgresql -h 127.0.0.1 \
          -c fsync=off -c full_page_writes=off -c synchronous_commit=off"
    sudo -u postgres createuser -s "$(id -un)"
    sudo -u postgres createdb -O "$(id -un)" benchsrht_test
    echo "export BENCHSRHT_TEST_PG='postgresql://$(id -un)@127.0.0.1/benchsrht_test?sslmode=disable'" \
      >> ~/.buildenv
- test: |
    cd "$REPO"
    # An empty DSN would skip every Postgres-backed suite and leave the build
    # green over untested code — the 4.5%-vs-77.2% gap. docs/ci.md#test.
    if [ -z "$BENCHSRHT_TEST_PG" ]; then
      echo "BENCHSRHT_TEST_PG is unset: the postgres task did not export it," >&2
      echo "so every database suite would skip and this build would lie." >&2
      exit 1
    fi
    # A make target and not a bare `go test ./...`: the Makefile names this
    # repository's -timeout (sr-ht-bench-5b8.44) and a second copy of that
    # number here is a second copy to forget. `cover` and not `test`: the same
    # suite, writing the profile the coverage task uploads, in the ONE run
    # that already exists. $HOME is where artifacts look. docs/ci.md#test.
    make -s cover COVERPROFILE="$HOME/cover.out"
    go tool cover -func="$HOME/cover.out" | tail -1
- build: |
    cd "$REPO"
    # -d: makedepends come from `packages:`. The APKBUILD runs `make css`
    # before `make build` and asserts the result twice. docs/ci.md#build.
    REPODEST=$HOME/packages abuild -d
    find "$HOME/packages" -name '*.apk'
- publish: |
    # The gate is the honest answer to a build handed no secrets, not a
    # fallback: the signed apk is in $HOME/packages either way.
    # docs/ci.md#publish.
    if [ ! -r ~/.apk-ci.env ]; then
      echo "no ~/.apk-ci.env: this build has no apk repo credentials"
      echo "the package was built and signed, and is not published"
      exit 0
    fi
    set +x   # never echo the S3 credentials into the build log
    . ~/.apk-ci.env
    export RCLONE_CONFIG_GARAGE_TYPE=s3
    export RCLONE_CONFIG_GARAGE_PROVIDER=Other
    export RCLONE_CONFIG_GARAGE_ENDPOINT="$S3_ENDPOINT"
    export RCLONE_CONFIG_GARAGE_REGION=garage
    export RCLONE_CONFIG_GARAGE_FORCE_PATH_STYLE=true
    export RCLONE_CONFIG_GARAGE_ACCESS_KEY_ID="$APK_CI_S3_ACCESS_KEY"
    export RCLONE_CONFIG_GARAGE_SECRET_ACCESS_KEY="$APK_CI_S3_SECRET_KEY"
    set -x
    # Upload only, never delete. See docs/ci.md#publish.
    find "$HOME/packages" -name '*.apk' -print | while read -r f; do
      rclone copyto "$f" "garage:$S3_BUCKET/$APK_REPO/$(basename "$f")"
      echo "uploaded $(basename "$f")"
    done
    echo "published; apk-mirror on phoebe re-indexes within 15 minutes"
- publish_artifacts: |
    # The same apk into the artifacts.sr.ht channel, beside the S3 copy above
    # and independent of it: its failure never rolls back an upload that
    # already succeeded. docs/ci.md#publish_artifacts.
    if [ ! -r ~/.srht-token ]; then
      echo "no ~/.srht-token: nothing was published to artifacts.sr.ht"
      exit 0
    fi
    count=$(find "$HOME/packages" -name '*.apk' | wc -l)
    test "$count" -gt 0 || { echo "no .apk under $HOME/packages" >&2; exit 1; }
    url="$ARTIFACTS_ENDPOINT/api/v1/pkg/$ARTIFACTS_CHANNEL/apk/$ARTIFACTS_DIST"
    # A `find | while read` would run the body in a subshell under ash and
    # lose $failed with it, so the loop reads a word list instead.
    failed=
    for file in $(find "$HOME/packages" -name '*.apk'); do
      set +x   # the token must not reach the log
      code=$(curl -sS -o /tmp/artifacts.out -w '%{http_code}' -X PUT \
        -H "Authorization: Bearer $(cat ~/.srht-token)" \
        --data-binary "@$file" "$url")
      set -x
      case "$code" in
      200|201)
        echo "published $(basename "$file") -> $code"
        ;;
      409)
        # Same version, other bytes (abuild stamps mtimes into the archive):
        # the published copy stands and the build stays green.
        echo "WARNING: $(basename "$file") already published with other bytes; kept the published copy"
        ;;
      *)
        echo "FAILED $(basename "$file") -> $code" >&2
        cat /tmp/artifacts.out >&2
        echo >&2
        failed=1
        ;;
      esac
    done
    test -z "$failed" || exit 1
    echo "index: $ARTIFACTS_ENDPOINT/$ARTIFACTS_CHANNEL/apk/$ARTIFACTS_DIST/x86_64/APKINDEX.tar.gz"
- cache_save: |
    # AFTER publish so an S3 hiccup cannot strand a good apk, and fatal on
    # purpose. docs/ci.md#cache_save.
    cacher dir upload "$KEY_MOD" ~/go/pkg/mod
    cacher dir upload "$KEY_GOC" ~/.cache/go-build
- coverage: |
    # The other half of the dogfooding cross (SPEC ch. 13): this service's own
    # coverage, uploaded to cov.sr.ht. Before bench and not after, for the
    # reason docs/ci.md#coverage gives.
    cd "$REPO"
    if [ ! -r ~/.srht-token ]; then
      echo "no ~/.srht-token: this build has no cov.sr.ht credentials"
      echo "the profile is still this build's cover.out artifact"
      exit 0
    fi
    # A missing or empty profile is a 400 nobody reads. Say it here instead.
    test -s "$HOME/cover.out" || { echo "cover.out is missing or empty" >&2; exit 1; }
    # GIT_REF is absent on a manual build and ref is optional; key is the
    # idempotency key. Both prefixes: this pipeline builds tags too.
    # docs/ci.md#the-coverage-request.
    ref="${GIT_REF#refs/heads/}"; ref="${ref#refs/tags/}"
    url="$COVER_ORIGIN/api/v1/repos/$COVER_REPO/reports"
    url="$url?commit=$(git rev-parse HEAD)&ref=$ref&key=$JOB_ID&job_url=$JOB_URL"
    echo "uploading cover.out to $url"
    # Tracing off to the end: the header must not reach the log. No
    # Content-Type — the service sniffs the format.
    set +x
    curl -sS --fail-with-body -X POST \
      -H "Authorization: Bearer $(cat ~/.srht-token)" \
      --data-binary "@$HOME/cover.out" \
      "$url"
    echo
- bench: |
    # Dogfooding (SPEC ch. 13): this service's own benchmarks, uploaded to its
    # own instance, parsed by the parser in this very commit. Last and a task
    # of its own on purpose; a VM this small measures a shape rather than a
    # number. docs/ci.md#bench.
    cd "$REPO"
    # BenchmarkSeries needs a database and SKIPS without the DSN, printing no
    # line at all, so the test task's guard stands here too.
    # docs/ci.md#the-dsn-guard-and-the-two-greps.
    if [ -z "$BENCHSRHT_TEST_PG" ]; then
      echo "BENCHSRHT_TEST_PG is unset: BenchmarkSeries would skip silently," >&2
      echo "and this build would upload half a file without saying so." >&2
      exit 1
    fi
    # -s so make does not echo the recipe into the body; a redirect and a cat
    # and NOT `| tee`, which would hand the task tee's exit status and let a
    # failing benchmark pass. docs/ci.md#bench.
    make -s bench > "$HOME/bench.txt"
    cat "$HOME/bench.txt"
    # Both must be in there: `go test -bench` matching nothing prints ok and
    # exits 0, and a body with no results is a 400 (SPEC ch. 4.1).
    grep -q '^BenchmarkIngest' "$HOME/bench.txt"
    grep -q '^BenchmarkSeries' "$HOME/bench.txt"
    if [ ! -r ~/.srht-token ]; then
      echo "no ~/.srht-token: this build has no bench.sr.ht credentials"
      echo "the benchmarks ran and are above; nothing was uploaded"
      echo "the file is this build's bench.txt artifact, and can be POSTed by hand"
      exit 0
    fi
    # GIT_REF is absent on a manual build and ref is optional; key is SPEC
    # ch. 4.1's idempotency key; visibility acts only on the POST that creates
    # $BENCH_REPO. See docs/ci.md#the-request.
    ref="${GIT_REF#refs/heads/}"; ref="${ref#refs/tags/}"
    url="$BENCH_ORIGIN/api/v1/repos/$BENCH_REPO/runs"
    url="$url?commit=$(git rev-parse HEAD)&ref=$ref&key=$JOB_ID&job_url=$JOB_URL"
    url="$url&visibility=public"
    echo "uploading bench.txt to $url"
    # Tracing off to the end: the header must not reach the log.
    # --fail-with-body prints the error and still exits non-zero.
    set +x
    curl -sS --fail-with-body -X POST \
      -H "Authorization: Bearer $(cat ~/.srht-token)" \
      --data-binary "@$HOME/bench.txt" \
      "$url"
    echo