ci.yaml

name: CI

on:
  push:
    branches: [ main ]
    tags: 
      - "*"
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  python-collect-sdist:
    name: "Collect Python sdist"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the code
        uses: actions/checkout@v3

      - name: Install Python 3.10
        uses: actions/setup-python@v4
        id: cpy310
        with:
          python-version: "3.10"
          architecture: x64

      - name: Install build
        run: pip install build

      - name: Collect sdist
        run: python -m build -o dist --sdist synapse

      - name: Upload sdist
        uses: actions/upload-artifact@v3
        with:
          name: sdist
          path: dist


  python-build-wheels:
    name: "Build Python wheels"
    strategy:
      fail-fast: false
      matrix:
        target:
          - x86_64-apple-darwin
          - aarch64-apple-darwin
          - x86_64-unknown-linux-gnu
          - aarch64-unknown-linux-gnu
          - x86_64-unknown-linux-musl
          - aarch64-unknown-linux-musl

    runs-on: ubuntu-latest
    steps:
      - name: Checkout the code
        uses: actions/checkout@v3

      - name: Install Python 3.10
        uses: actions/setup-python@v4
        id: cpy310
        with:
          python-version: "3.10"
          architecture: x64
          update-environment: false

      - name: Install maturin
        run: |
          mkdir -p "${HOME}/.local/bin"
          curl -sL https://github.com/PyO3/maturin/releases/download/v0.14.3/maturin-x86_64-unknown-linux-musl.tar.gz | tar xzf - -C "${HOME}/.local/bin"
          echo "$HOME/.local/bin" >> "${GITHUB_PATH}"

      - name: Setup Zig
        uses: goto-bus-stop/setup-zig@v2
        with:
          version: 0.10.1

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
          target: ${{ matrix.target }}

      - name: Setup Rust build cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ${{ matrix.target }}

      - name: Build wheels
        run: |
          if [[ "${{ matrix.target }}" == *-linux-gnu ]]; then
            EXTRA_FLAG="--compatibility manylinux2014"
          elif [[ "${{ matrix.target }}" == *-linux-musl ]]; then
            EXTRA_FLAG="--compatibility musllinux_1_2"
          fi

          maturin build \
            --release \
            --out dist \
            --manifest-path synapse/Cargo.toml \
            -i ${{ steps.cpy310.outputs.python-path }} \
            ${EXTRA_FLAG} \
            --target ${{ matrix.target }} \
            --zig

      - name: Upload wheels
        uses: actions/upload-artifact@v3
        with:
          name: wheels
          path: dist


  rust-rustfmt:
    name: Check Rust style
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@v3

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly
          components: rustfmt

      - name: Check style
        uses: actions-rs/cargo@v1
        with:
          command: fmt
          args: --all -- --check


  rust-clippy:
    name: Run Clippy
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@v3

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: 1.67.1
          components: clippy

      - name: Setup cache
        uses: Swatinem/rust-cache@v2

      - name: Run Clippy
        run: cargo clippy --workspace -- -D warnings


  rust-test:
    name: Run test suite with Rust ${{ matrix.toolchain }}
    needs: [rust-rustfmt, rust-clippy]
    runs-on: ubuntu-latest

    permissions:
      contents: read

    strategy:
      fail-fast: false # Continue other jobs if one fails to help filling the cache
      matrix:
        toolchain:
          - "1.64.0" # MSRV
          - stable

    steps:
      - name: Checkout the code
        uses: actions/checkout@v3

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.toolchain }}

      - name: Setup cache
        uses: Swatinem/rust-cache@v2

      - name: Test
        run: cargo test --workspace


  rust-coverage:
    name: Rust code coverage
    needs: [rust-rustfmt, rust-clippy]
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@v3

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Setup cache
        uses: Swatinem/rust-cache@v2

      - name: Download grcov
        run: |
          mkdir -p "${HOME}/.local/bin"
          curl -sL https://github.com/mozilla/grcov/releases/download/v0.8.13/grcov-x86_64-unknown-linux-gnu.tar.bz2 | tar jxf - -C "${HOME}/.local/bin"
          echo "$HOME/.local/bin" >> "${GITHUB_PATH}"

      - name: Run test suite with profiling enabled
        run: cargo test --no-fail-fast --workspace
        env:
          CARGO_INCREMENTAL: '0'
          RUSTFLAGS: '-Cinstrument-coverage'
          LLVM_PROFILE_FILE: "cargo-test-%p-%m.profraw"

      - name: Build grcov report
        run: |
          mkdir -p target/coverage
          grcov . --binary-path ./target/debug/deps/ -s . -t lcov --branch --ignore-not-existing --ignore '../*' --ignore "/*" -o target/coverage/tests.lcov

      - name: Upload to codecov.io
        uses: codecov/codecov-action@v3
        with:
          files: target/coverage/*.lcov
          flags: unit


  cratesio-publish:
    name: Publish on crates.io
    needs: [rust-rustfmt, rust-clippy, rust-test, rust-coverage]
    runs-on: ubuntu-latest

    # Publish on tags
    if: startsWith(github.ref, 'refs/tags/')

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@v3

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Publish matrix-http-rendezvous on crates.io
        run: cargo publish -p matrix-http-rendezvous
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

      - name: Publish matrix-http-rendezvous-server on crates.io
        run: cargo publish -p matrix-http-rendezvous-server
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}


  pypi-upload:
    name: "Upload to PyPI"
    runs-on: ubuntu-latest

    permissions: {}
    if: startsWith(github.ref, 'refs/tags')

    needs: [python-collect-sdist, python-build-wheels, cratesio-publish]
    steps:
      - name: Download wheels
        uses: actions/download-artifact@v3
        with:
          name: wheels
          path: dist

      - name: Download sdist
        uses: actions/download-artifact@v3
        with:
          name: sdist
          path: dist

      - name: Publish distribution to PyPI
        if: startsWith(github.ref, 'refs/tags')
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}


  build-image:
    name: Build and push Docker image
    needs: [rust-rustfmt]
    runs-on: ubuntu-latest
    env:
      IMAGE: ghcr.io/matrix-org/rust-matrix-http-rendezvous-server

    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Checkout the code
        uses: actions/checkout@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: "${{ env.IMAGE }}"
          bake-target: docker-metadata-action
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha

      - name: Docker meta (debug variant)
        id: meta-debug
        uses: docker/metadata-action@v4
        with:
          images: "${{ env.IMAGE }}"
          bake-target: docker-metadata-action-debug
          flavor: |
            latest=auto
            suffix=-debug,onlatest=true
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha

      - name: Setup Cosign
        uses: sigstore/cosign-installer@v2.8.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
        with:
          config-inline: |
            [registry."docker.io"]
              mirrors = ["mirror.gcr.io"]

      - name: Login to GitHub Container Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # For pull-requests, only read from the cache, do not try to push to the
      # cache or the image itself
      # We only build for the amd64 platform in pull-requests to speed-up CI
      - name: Build
        uses: docker/bake-action@v2
        if: github.event_name == 'pull_request'
        with:
          files: |
            docker-bake.hcl
            ${{ steps.meta.outputs.bake-file }}
            ${{ steps.meta-debug.outputs.bake-file }}
          set: |
            base.context=https://github.com/${{ github.repository }}.git#${{ github.ref }}
            base.platform=linux/amd64
            base.cache-from=type=registry,ref=${{ env.IMAGE }}:buildcache

      - name: Build and push
        uses: docker/bake-action@v2
        if: github.event_name != 'pull_request'
        id: bake
        with:
          files: |
            docker-bake.hcl
            ${{ steps.meta.outputs.bake-file }}
            ${{ steps.meta-debug.outputs.bake-file }}
          set: |
            base.context=https://github.com/${{ github.repository }}.git#${{ github.ref }}
            base.output=type=image,push=true
            base.cache-from=type=registry,ref=${{ env.IMAGE }}:buildcache
            base.cache-to=type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max

      - name: Sign the images with GitHub Actions provided token
        # Only sign on tags and on commits on main branch
        if: |
          github.event_name != 'pull_request'
          && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')

        run: |
          cosign sign \
            "${{ env.IMAGE }}@${{ fromJSON(steps.bake.outputs.metadata).regular['containerimage.digest'] }}" \
            "${{ env.IMAGE }}@${{ fromJSON(steps.bake.outputs.metadata).debug['containerimage.digest'] }}"
        env:
          COSIGN_EXPERIMENTAL: 1


  tests-done:
    name: Tests done
    if: ${{ always() }}
    needs:
      - rust-rustfmt
      - rust-clippy
      - rust-test
      - python-collect-sdist
      - python-build-wheels
      - build-image
    runs-on: ubuntu-latest

    steps:
      - uses: matrix-org/done-action@v2
        with:
          needs: ${{ toJSON(needs) }}