# builds.sr.ht manifest for artifacts.sr.ht. The reasoning behind every task
# lives in docs/ci.md, not here: builds.sr.ht stores the submitted manifest in a
# varchar(16384) and counts comments too, so a manifest over that ceiling is
# never submitted at all. Add paragraphs to docs/ci.md and a pointer here.
image: alpine/edge
packages:
  - abuild
  - curl
  - docker
  - git
  - go
  - postgresql
  - postgresql-client
  - postgresql-contrib   # pg_trgm, for migration 0004. docs/ci.md#packages
  - sassc
  - minify
secrets:
  - 7dde4219-0783-4581-a67d-c94749de3600   # ~/.s3-cache-key-id
  - 0e5b3530-6f19-4f30-9b73-9339dd382e46   # ~/.s3-cache-key-secret
  - c7968415-1a6d-4ca0-a188-150fb7f57b65   # ~/.srht-token. docs/ci.md#secrets
sources:
  - https://git.srht.bigb.es/~bigbes/sr-ht-monorepo#34b36f6f82667abbb496eecaafcb6fa11e5b645c
environment:
  # A package build must not depend on the workspace. GOWORK=off makes this job
  # resolve lib/core, lib/ecore and lib/thistle from the pseudo-versions in this
  # module's own go.mod — the versions the released apk is actually built from —
  # instead of from whatever is in the tree. It also stops the build writing to
  # go.work.sum, which is what stamped fedgw's binary <sha>-dirty and failed its
  # check-version. Workspace compatibility is the dispatcher's job: it smoke-
  # builds every project against the tree on each push.
  GOWORK: "off"
  # What ci/lib/*.sh needs to know about this project.
  REPO: sr-ht-monorepo
  PROJECT: artifacts
  DIR: services/artifacts
  PROJDIR: sr-ht-monorepo/services/artifacts
  PG_DB: artifactsrht
  CORE_VER: "0.84.7"
  BOOTSTRAP_REV: 779ad9f174ea5ab7e755f6df0ec9e5912d67dd16
  # cacher or art: which binary drives the CI cache. docs/ci.md#cache_setup
  #
  # art now, like the rest of the family. This is the one project that must not
  # fetch the art binary from the artifacts service the way the others do — it
  # builds art from this very checkout, and a cache that depends on the service
  # being up to build the client that reaches the service is a loop. Its
  # cache_setup handles that itself.
  CACHE_BACKEND: art
  CACHE_NS: sr-ht-artifacts
  CACHE_SUBPREFIX: deps
  # Where publish sends the apk, and the only place it goes. docs/ci.md#publish
  # A branch build tests and does not publish: ci/lib/dispatch.sh rewrites this
  # to "yes" for a master or tag push and for nothing else. docs/ci.md#publish
  PUBLISH: "no"
  ARTIFACTS_ENDPOINT: https://artifacts.srht.bigb.es
  ARTIFACTS_CHANNEL: "~bigbes/main"
  ARTIFACTS_DIST: v3.22
  # Pinned suite, and whether its failure is fatal. docs/ci.md#conformance
  CONFORMANCE_REV: v1.1.1
  CONFORMANCE_MODE: report
  # Both names are the sources: URL above, owner and all. docs/ci.md#coverage
  COVER_ORIGIN: https://cov.srht.bigb.es
  COVER_REPO: "~bigbes/sr-ht-artifacts"
  BENCH_ORIGIN: https://bench.srht.bigb.es
  BENCH_REPO: "~bigbes/sr-ht-artifacts"
# Literal paths relative to $HOME, and not a fallback for the two uploads: a
# build handed no secrets still leaves both files behind. docs/ci.md#artifacts
artifacts:
  - cover.out
  - bench.txt
submitter:
  git.sr.ht:
    allow-refs:
      - refs/heads/master
      - "refs/tags/v*"
tasks:
  - cache_setup: |
      # Leaves $CACHE and $CACHE_KEY_PREFIX behind. docs/ci.md#cache_setup
      case "$CACHE_BACKEND" in
      cacher)
        curl -sSL https://bigbes.pages.srht.bigb.es/ci-cacher/install.sh | sh
        # install.sh's PATH line reaches only LATER tasks, hence the repeat.
        export PATH="$HOME/.local/bin:$PATH"
        cacher init \
          --endpoint https://s3.bigb.es \
          --region garage \
          --bucket docker-cache \
          --prefix "$CACHE_NS/$CACHE_SUBPREFIX" \
          --key-file ~/.s3-cache-key-id \
          --secret-file ~/.s3-cache-key-secret
        echo 'export CACHE="cacher" CACHE_KEY_PREFIX=""' >> ~/.buildenv
        ;;
      art)
        if [ ! -r ~/.srht-token ]; then
          echo "CACHE_BACKEND=art needs the working token at ~/.srht-token" >&2
          exit 1
        fi
        mkdir -p ~/.local/bin
        (cd "$PROJDIR" && CGO_ENABLED=0 go build -o ~/.local/bin/art ./cmd/art)
        echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.buildenv
        export PATH="$HOME/.local/bin:$PATH"
        art init \
          --endpoint "$ARTIFACTS_ENDPOINT" \
          --cache-ns "$CACHE_NS" \
          --token-file ~/.srht-token
        echo "export CACHE=\"art cache\" CACHE_KEY_PREFIX=\"$CACHE_SUBPREFIX/\"" >> ~/.buildenv
        ;;
      *)
        echo "CACHE_BACKEND must be cacher or art, got '$CACHE_BACKEND'" >&2
        exit 1
        ;;
      esac
  - scss: |
      "$HOME/$REPO"/ci/lib/scss.sh
  - keygen: |
      "$HOME/$REPO"/ci/lib/keygen.sh
  - version: |
      "$HOME/$REPO"/ci/lib/version.sh
  - cache_restore: |
      "$HOME/$REPO"/ci/lib/cache.sh restore
  - postgres: |
      "$HOME/$REPO"/ci/lib/postgres.sh
  - test_env: |
      # Without this, 23 tests skip and the build is green. docs/ci.md#test_env
      if ! docker version >/dev/null 2>&1; then
        sudo service docker start
        until sudo docker version >/dev/null 2>&1; do sleep 1; done
        sudo chmod 0666 /var/run/docker.sock
      fi
      # Both images out of the cache, not Docker Hub. docs/ci.md#test_env
      #
      # The .art in the key is deliberate. Directory tarballs are byte-identical
      # between the two backends, so the dependency caches survived the switch
      # untouched — but whether their zstd framing interoperates for a docker
      # image has never been measured, and being wrong about that is not a miss:
      # it is `docker load` failing on a hit. A distinct key costs one cold pull
      # and cannot be wrong.
      $CACHE docker download "${CACHE_KEY_PREFIX}img/garage-2.3.0.art.tar.zst" dxflrs/garage:v2.3.0 --pull
      $CACHE docker download "${CACHE_KEY_PREFIX}img/dind-29.art.tar.zst" docker:29-dind --pull
      cat >> ~/.buildenv <<'EOF'
      export ARTIFACTSRHT_TEST_S3=1
      export ARTIFACTSRHT_TEST_INTEGRATION=1
      export ARTIFACTSRHT_TEST_DOCKER=1
      EOF
      GARAGE_RPC_SECRET=$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')
      GARAGE_ADMIN_TOKEN=$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')
      GARAGE_ACCESS_KEY=GK$(head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n')
      GARAGE_SECRET_KEY=$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')
      cat > /tmp/garage.toml <<EOF
      metadata_dir = "/tmp/meta"
      data_dir = "/tmp/data"
      db_engine = "sqlite"
      replication_factor = 1
      rpc_bind_addr = "[::]:3901"
      rpc_public_addr = "127.0.0.1:3901"
      rpc_secret = "$GARAGE_RPC_SECRET"

      [s3_api]
      s3_region = "garage"
      api_bind_addr = "[::]:3900"
      root_domain = ".s3.garage.localhost"

      [admin]
      api_bind_addr = "[::]:3903"
      admin_token = "$GARAGE_ADMIN_TOKEN"
      EOF
      docker run -d --name artifacts-test-garage \
        -v /tmp/garage.toml:/etc/garage.toml:ro \
        -e GARAGE_DEFAULT_ACCESS_KEY="$GARAGE_ACCESS_KEY" \
        -e GARAGE_DEFAULT_SECRET_KEY="$GARAGE_SECRET_KEY" \
        -e GARAGE_DEFAULT_BUCKET=artifacts \
        -p 127.0.0.1:3900:3900 \
        dxflrs/garage:v2.3.0 /garage server --single-node --default-bucket
      # --default-bucket lands AFTER the server listens, so this has to wait.
      deadline=$(($(date +%s) + 120))
      until docker exec artifacts-test-garage /garage bucket list 2>/dev/null | grep -q artifacts; do
        if [ "$(date +%s)" -ge "$deadline" ]; then
          docker logs artifacts-test-garage
          echo "garage did not create its default bucket" >&2
          exit 1
        fi
        sleep 1
      done
      cat >> ~/.buildenv <<EOF
      export ARTIFACTSRHT_TEST_S3_ENDPOINT=http://127.0.0.1:3900
      export ARTIFACTSRHT_TEST_S3_BUCKET=artifacts
      export ARTIFACTSRHT_TEST_S3_ACCESS_KEY=$GARAGE_ACCESS_KEY
      export ARTIFACTSRHT_TEST_S3_SECRET_KEY=$GARAGE_SECRET_KEY
      EOF
  - test: |
      # check-pg carries the test-env guard itself; TESTFLAGS makes that same
      # gate write the profile instead of a second full run. docs/ci.md#test
      cd "$PROJDIR"
      make check-pg TESTFLAGS="-covermode=atomic -coverprofile=$HOME/cover.out"
      go tool cover -func="$HOME/cover.out" | tail -1
  - e2e: |
      cd "$PROJDIR"
      if ! docker version >/dev/null 2>&1; then
        sudo service docker start
        until sudo docker version >/dev/null 2>&1; do sleep 1; done
        sudo chmod 0666 /var/run/docker.sock
      fi
      ARTIFACTS_E2E_PULL=1 go test -tags e2e -count=1 -timeout 40m ./e2e
  - conformance: |
      # Known gaps and what flipping to enforce needs: docs/ci.md#conformance
      cd "$PROJDIR"
      case "$CONFORMANCE_MODE" in
      report|enforce) ;;
      *) echo "CONFORMANCE_MODE must be report or enforce, got '$CONFORMANCE_MODE'" >&2; exit 1 ;;
      esac
      if ! docker version >/dev/null 2>&1; then
        sudo service docker start
        until sudo docker version >/dev/null 2>&1; do sleep 1; done
        sudo chmod 0666 /var/run/docker.sock
      fi
      git clone -q --depth 1 --branch "$CONFORMANCE_REV" \
        https://github.com/opencontainers/distribution-spec /tmp/distribution-spec
      (cd /tmp/distribution-spec/conformance && \
        GOMODCACHE=/tmp/conformance-gomodcache go test -c -o /tmp/conformance.test .)
      if ARTIFACTS_E2E_PULL=1 ARTIFACTS_E2E_CONFORMANCE=/tmp/conformance.test \
        go test -tags e2e -v -count=1 -timeout 20m -run TestOCIConformance ./e2e \
        > /tmp/conformance.log 2>&1
      then status=0; else status=1; fi
      cat /tmp/conformance.log
      # A run that never reached the suite must not read as a known gap.
      if ! grep -q "Specs in" /tmp/conformance.log; then
        echo "the conformance suite did not run to a summary" >&2
        exit 1
      fi
      if [ "$status" -ne 0 ] && [ "$CONFORMANCE_MODE" = enforce ]; then
        echo "conformance failed and CONFORMANCE_MODE is enforce" >&2
        exit 1
      fi
      if [ "$status" -ne 0 ]; then
        echo "conformance failed; CONFORMANCE_MODE is report, see the summary above"
      fi
  - build: |
      cd "$PROJDIR"
      REPODEST=$HOME/packages abuild -d
      find "$HOME/packages" -name '*.apk'
  - publish: |
      "$HOME/$REPO"/ci/lib/publish.sh
  - publish_client: |
      # linux/amd64 art for the sibling builds. docs/ci.md#publish_client
      #
      # Gated on PUBLISH like the apk, and for a sharper reason: the blob path
      # is deliberately overwritable, so a branch build would hand every
      # sibling's next build a client built from that branch.
      if [ "${PUBLISH:-no}" != yes ]; then
        echo "PUBLISH=${PUBLISH:-no}: this build tests, the client is not published"
        exit 0
      fi
      if [ ! -r ~/.srht-token ]; then
        echo "no ~/.srht-token: the client was not published"
        exit 0
      fi
      cd "$PROJDIR"
      CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /tmp/art ./cmd/art
      /tmp/art --endpoint "$ARTIFACTS_ENDPOINT" --token-file ~/.srht-token \
        blob push "$ARTIFACTS_CHANNEL" /tmp/art --to art/art-linux-amd64
  - cache_save: |
      "$HOME/$REPO"/ci/lib/cache.sh save
  - coverage: |
      # The test task's profile, to this instance's own cov.sr.ht. Last, after
      # everything that could strand an apk. docs/ci.md#coverage
      cd "$PROJDIR"
      if [ ! -r ~/.srht-token ]; then
        echo "no ~/.srht-token; the profile is still this build's cover.out"
        exit 0
      fi
      test -s "$HOME/cover.out" || { echo "test wrote no cover.out" >&2; exit 1; }
      ref="${GIT_REF#refs/heads/}"; ref="${ref#refs/tags/}"
      url="$COVER_ORIGIN/api/v1/repos/$COVER_REPO/reports"
      url="$url?commit=$(git rev-parse HEAD)&ref=$ref&key=$JOB_ID&job_url=$JOB_URL"
      echo "uploading cover.out to $url"
      set +x   # the Authorization header must not reach the log
      curl -sS --fail-with-body -X POST \
        -H "Authorization: Bearer $(cat ~/.srht-token)" \
        --data-binary "@$HOME/cover.out" "$url"
      echo
  - bench: |
      # This build's own benchmarks, to this instance's own bench.sr.ht. The
      # DSN guard and the name list are load-bearing: docs/ci.md#bench
      cd "$PROJDIR"
      if [ -z "$ARTIFACTSRHT_TEST_PG" ]; then
        echo "ARTIFACTSRHT_TEST_PG is unset: the PostgreSQL benchmark would" >&2
        echo "skip and this build would upload a short file silently." >&2
        exit 1
      fi
      make -s bench > "$HOME/bench.txt"
      cat "$HOME/bench.txt"
      for name in $(make -s bench-names); do
        grep -q "^$name" "$HOME/bench.txt" || \
          { echo "$name produced no result line" >&2; exit 1; }
      done
      if [ ! -r ~/.srht-token ]; then
        echo "no ~/.srht-token; the results are above and are bench.txt"
        exit 0
      fi
      ref="${GIT_REF#refs/heads/}"; ref="${ref#refs/tags/}"
      url="$BENCH_ORIGIN/api/v1/repos/$BENCH_REPO/runs"
      url="$url?commit=$(git rev-parse HEAD)&ref=$ref&key=$JOB_ID&job_url=$JOB_URL"
      url="$url&visibility=public"
      echo "uploading bench.txt to $url"
      set +x   # the Authorization header must not reach the log
      curl -sS --fail-with-body -X POST \
        -H "Authorization: Bearer $(cat ~/.srht-token)" \
        --data-binary "@$HOME/bench.txt" "$url"
      echo