baboon-build.yml

name: Baboon Build

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch:
    inputs: {}

permissions:
  contents: write
  id-token: write

jobs:
  build-linux:
    strategy:
      fail-fast: false
      matrix:
        # 1) don't forget about os entry in prepare-release
        # 2) see : https://github.com/actions/runner-images
        include:
          - target: linux-amd64
            os: ubuntu-latest
            runs-on: [ ]
          - target: linux-aarch64
            os: ubuntu-24.04-arm
            runs-on: [ ]
            #runs-on: [ "ARM64" ]
            #preconfigured: true
            #nix-cache-disabled: true
    name: build-${{ matrix.target }}
    runs-on:
      - ${{ matrix.os }}
      - ${{ matrix.runs-on }}
    steps:
      - uses: 7mind/github-env@minimal
        with:
          setup-nix: ${{ matrix.preconfigured != true }}
      - name: Check deps and build
        if: startsWith(github.ref, 'refs/tags/')
        run: nix develop --command mdl --github-actions :build :test
      - name: Refresh deps and build
        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
        run: nix develop --command mdl --github-actions :flake-refresh :build :test
      - name: Validate binary portability (outside Nix)
        run: |
          chmod +x baboon-compiler/.jvm/target/graalvm-native-image/baboon
          echo "=== file ==="
          file baboon-compiler/.jvm/target/graalvm-native-image/baboon
          echo "=== ldd ==="
          ldd baboon-compiler/.jvm/target/graalvm-native-image/baboon 2>&1 || true
          echo "=== smoke test ==="
          baboon-compiler/.jvm/target/graalvm-native-image/baboon \
            --model-dir ./test/conv-test \
            :cs --output /tmp/baboon-validate-cs \
            :scala --output /tmp/baboon-validate-sc
      - uses: actions/upload-artifact@v4
        with:
          name: baboon-${{ matrix.target }}
          path: |
            baboon-compiler/.jvm/target/graalvm-native-image/**

  build-macos:
    strategy:
      fail-fast: false
      matrix:
        # 1) don't forget about os entry in prepare-release
        # 2) see : https://github.com/actions/runner-images
        include:
          - target: macos-amd64-13
            os: macos-15-intel
            runs-on: [ ]
            java-version: '23'
          - target: macos-aarch64-14
            os: macos-14 # yes, this is aarch64
            runs-on: [ ]
            java-version: '23'
    name: build-${{ matrix.target }}
    runs-on:
      - ${{ matrix.os }}
      - ${{ matrix.runs-on }}
    steps:
      - uses: 7mind/github-env@minimal
        with:
          setup-nix: false
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Set up GraalVM (Java ${{ matrix.java-version }})
        uses: graalvm/setup-graalvm@v1
        with:
          java-version: '${{ matrix.java-version }}'
          distribution: 'graalvm-community'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache: 'sbt'
          native-image-job-reports: true
      - name: Set up SBT
        uses: sbt/setup-sbt@v1
      - name: Set up Dart SDK
        uses: dart-lang/setup-dart@v1
      - name: Install mudyla
        run: pip install git+https://github.com/7mind/mudyla.git
      - name: Build (macOS)
        run: mdl --github-actions --without-nix :build :test
      - name: Validate binary portability
        run: |
          echo "=== file ==="
          file baboon-compiler/.jvm/target/graalvm-native-image/baboon
          echo "=== otool -L ==="
          otool -L baboon-compiler/.jvm/target/graalvm-native-image/baboon
          echo "=== check no nix store references ==="
          if otool -L baboon-compiler/.jvm/target/graalvm-native-image/baboon | grep -q /nix/store; then
            echo "ERROR: binary has Nix store dependencies"
            exit 1
          fi
          echo "=== smoke test ==="
          baboon-compiler/.jvm/target/graalvm-native-image/baboon \
            --model-dir ./test/conv-test \
            :cs --output /tmp/baboon-validate-cs \
            :scala --output /tmp/baboon-validate-sc
      - uses: actions/upload-artifact@v4
        with:
          name: baboon-${{ matrix.target }}
          path: |
            baboon-compiler/.jvm/target/graalvm-native-image/**

  acceptance-tests:
    name: acceptance-tests
    runs-on:
      - ubuntu-latest
    steps:
      - uses: 7mind/github-env@minimal
        with:
          setup-nix: true
      - name: Build baboon binary
        run: |
          nix develop --ignore-environment \
            --keep HOME \
            --keep USER \
            --keep CI \
            --keep GITHUB_ACTIONS \
            --command mdl --github-actions :build
      - name: Run acceptance tests
        run: |
          chmod +x baboon-compiler/.jvm/target/graalvm-native-image/baboon
          nix develop --ignore-environment \
            --keep HOME \
            --keep USER \
            --keep CI \
            --keep GITHUB_ACTIONS \
            --command python3 test/acceptance/run_acceptance.py \
            --baboon baboon-compiler/.jvm/target/graalvm-native-image/baboon \
            --target ./target/acceptance \
            --parallelism "$(nproc)"
      - name: Run service acceptance tests
        run: |
          chmod +x baboon-compiler/.jvm/target/graalvm-native-image/baboon
          nix develop --ignore-environment \
            --keep HOME \
            --keep USER \
            --keep CI \
            --keep GITHUB_ACTIONS \
            --command python3 test/acceptance/run_service_acceptance.py \
            --baboon baboon-compiler/.jvm/target/graalvm-native-image/baboon \
            --target ./target/service-acceptance \
            --parallelism "$(nproc)"
      - name: Write step summary
        if: always()
        run: |
          if [ -f ./target/acceptance/acceptance-summary.md ]; then
            cat ./target/acceptance/acceptance-summary.md >> "$GITHUB_STEP_SUMMARY"
          fi
          if [ -f ./target/service-acceptance/service-summary.md ]; then
            cat ./target/service-acceptance/service-summary.md >> "$GITHUB_STEP_SUMMARY"
          fi
      - name: Upload acceptance report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: acceptance-report
          path: |
            target/acceptance/acceptance-report.html
            target/acceptance/acceptance-results.json
            target/acceptance/acceptance-summary.md
            target/service-acceptance/service-report.html
            target/service-acceptance/service-results.json
            target/service-acceptance/service-summary.md

  validate-flake:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: linux-aarch64
            os: ubuntu-24.04-arm
            runs-on: [ ]
    name: check-flake-runs-${{ matrix.target }}
    runs-on:
      - ${{ matrix.os }}
      - ${{ matrix.runs-on }}
    steps:
      - uses: 7mind/github-env@minimal
        with:
          setup-nix: ${{ matrix.preconfigured != true }}
      - name: Check deps and build
        run: nix run . -- --model-dir ./test/conv-test :cs --output ./test/conv-test-cs/ConvTest/Generated :scala --output ./test/conv-test-sc/src/main/scala/generated-main

  build-windows:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: windows-amd64
            os: windows-2022
            runs-on: [ ]
            java-version: '23'
    name: build-${{ matrix.target }}
    runs-on:
      - ${{ matrix.os }}
      - ${{ matrix.runs-on }}
    steps:
      - uses: 7mind/github-env@minimal
        with:
          setup-nix: false
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Set up GraalVM (Java ${{ matrix.java-version }})
        uses: graalvm/setup-graalvm@v1
        with:
          java-version: '${{ matrix.java-version }}'
          distribution: 'graalvm-community'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache: 'sbt'
          native-image-job-reports: true
      - name: Install rsync
        shell: pwsh
        run: choco install rsync -y
      - name: Set up Dart SDK
        uses: dart-lang/setup-dart@v1
      - name: Install mudyla
        shell: bash
        run: pip install git+https://github.com/7mind/mudyla.git
      - name: Build (windows)
        shell: bash
        run: mdl --github-actions --without-nix :build :test
      - uses: actions/upload-artifact@v4
        with:
          name: baboon-${{ matrix.target }}
          path: |
            baboon-compiler/.jvm/target/graalvm-native-image/**

  publish-scala:
    runs-on:
      - ubuntu-latest
    needs:
      - build-linux
      - build-macos
      - build-windows
      - validate-flake
    steps:
      - uses: 7mind/github-env@minimal
        with:
          setup-nix: true
      - name: Download All Artifacts
        uses: actions/download-artifact@v4
        with:
          path: binaries
          pattern: baboon-*
      - name: Prepare layout
        run: nix develop --command mdl --github-actions --mkdist-source=./binaries --mkdist-target=. :build :mkdist
      - uses: softprops/action-gh-release@v2
        id: create-release
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            ./dist-bin/**
            ./dist-zip/**
      - uses: bitwarden/sm-action@v2
        with:
          access_token: ${{ secrets.TOKEN_BITWARDEN_SM }}
          secrets: |
            994f97a2-97a4-4fe1-806a-b1930104435f > SONATYPE_CREDENTIALS_FILE
            749f4227-9f11-4ceb-9121-b1930110c3a9 > OPENSSL_KEY
            a2fe5b5b-5f3f-47f8-961c-b1930110cea7 > OPENSSL_IV
      - name: Build and Publish to Sonatype
        env:
          SCALA_VERSION: ${{ matrix.scala }}
          JAVA_VERSION: ${{ matrix.java }}
          SONATYPE_SECRET: .secrets/credentials.sonatype-nexus.properties
        run: |
          mkdir .secrets
          echo "$SONATYPE_CREDENTIALS_FILE" > "$SONATYPE_SECRET"
          openssl aes-256-cbc -K ${OPENSSL_KEY} -iv ${OPENSSL_IV} -in secrets.tar.enc -out secrets.tar -d
          tar xvf secrets.tar

          nix develop --command mdl --github-actions :gen-js :publish-scala

  publish-npm:
    name: publish-npm
    if: startsWith(github.ref, 'refs/tags/')
    runs-on:
      - ubuntu-24.04-arm
    needs:
      - build-linux
      - build-macos
      - build-windows
      - validate-flake
    env:
      CI_BRANCH_TAG: ${{ github.ref_name }}
      CI_PULL_REQUEST: ${{ github.event_name == 'pull_request' && 'true' || 'false' }}
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: 7mind/github-env@minimal
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      - name: Publish npm package
        run: nix develop --command mdl --github-actions :publish-npm