build.yml

name: Build CI

on:
  push:
    branches: [ master ]
  workflow_dispatch: {}
  pull_request:
    branches: [ master ]

jobs:
  # Build the compiler jar file from the submodule
  build-compiler:
    name: Build Compiler
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      FORCE_COLOR: '1'
    steps:
      - name: Setup Java
        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # 5.0.0
        with:
          distribution: adopt-hotspot
          java-version: 21
          java-package: jdk
          architecture: x64
      - name: Setup Bazelisk
        uses: bazel-contrib/setup-bazel@4fd964a13a440a8aeb0be47350db2fc640f19ca8 # 0.15.0
        with:
          # Avoid downloading Bazel every time.
          bazelisk-cache: true
          # Store build cache per workflow.
          disk-cache: ${{ github.workflow }}
          # Share repository cache between workflows.
          repository-cache: true
      - name: Checkout repo
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
        with:
          submodules: recursive
      - name: Fetch submodule tags
        working-directory: compiler
        run: git fetch --tags https://github.com/google/closure-compiler.git
      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # 5.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: yarn
      - name: Install packages
        run: YARN_ENABLE_COLORS=true yarn install
      - name: Build jar
        # unset ANDROID_HOME to prevent bazel from trying to use the Android SDK
        run: unset ANDROID_HOME && ./build-scripts/build-compiler.js
      - name: Tests
        run: YARN_ENABLE_COLORS=true yarn test:root
      - name: Upload contrib folder
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: Contrib folder
          path: compiler/contrib
      - name: Upload externs folder
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: Externs folder
          path: compiler/externs
      - name: Upload compiler jar
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: Compiler.jar
          path: packages/google-closure-compiler-java/compiler.jar

  # Build the native image on Linux
  build-linux:
    name: Build Linux Native Image
    needs: build-compiler
    permissions:
      contents: read
    runs-on: ubuntu-24.04
    env:
      NODE_VERSION: '20.x'
      FORCE_COLOR: '1'
      MUSL_HOME: ${{ github.workspace }}/musl-toolchain
    steps:
      - name: Checkout repo
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
      - name: Checkout musl
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
        with:
          repository: kraj/musl
          ref: c47ad25ea3b484e10326f933e927c0bc8cded3da # patched 1.2.5 version
          path: musl
          clean: false
      - name: Checkout zlib
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
        with:
          repository: madler/zlib
          ref: 04f42ceca40f73e2978b50e93806c2a18c1281fc # v1.2.13
          path: zlib
          clean: false
      - name: Build musl and zlib
        run: |
          # See https://www.graalvm.org/latest/reference-manual/native-image/guides/build-static-executables/
          # We have to build MUSL from source to ensure recent CVEs are patched

          # Build musl from source
          pushd musl
          ./configure --prefix=$MUSL_HOME --static
          sudo make && make install
          popd

          # Install a symlink for use by native-image
          ln -s $MUSL_HOME/bin/musl-gcc $MUSL_HOME/bin/x86_64-linux-musl-gcc

          # Extend the system path and confirm that musl is available by printing its version
          export PATH="$MUSL_HOME/bin:$PATH"
          echo "$path" >> $GITHUB_PATH
          x86_64-linux-musl-gcc --version

          # Build zlib with musl from source and install into the MUSL_HOME directory
          pushd zlib
          CC=musl-gcc ./configure --prefix=$MUSL_HOME --static
          make && make install
          popd
      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # 5.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: yarn
      - name: Install GraalVM
        uses: graalvm/setup-graalvm@e140024fdc2d95d3c7e10a636887a91090d29990 # 1.4.0
        with:
          java-version: 24
          distribution: 'graalvm-community'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          native-image-job-reports: 'true'
      - name: Download compiler jar
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Compiler.jar
          path: packages/google-closure-compiler-java/
      - name: Download contrib folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Contrib folder
          path: packages/google-closure-compiler/contrib
      - name: Download externs folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Externs folder
          path: packages/google-closure-compiler/externs
      - name: Install packages
        run: YARN_ENABLE_COLORS=true yarn install
      - name: Build image
        working-directory: packages/google-closure-compiler-linux
        run: |
          export PATH="$MUSL_HOME/bin:$PATH"
          cp ../google-closure-compiler-java/compiler.jar compiler.jar
          yarn run build
      - name: Tests
        run: FORCE_COLOR=1 yarn workspaces foreach -A --no-private run test
      - name: Upload artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: Linux image
          path: packages/google-closure-compiler-linux/compiler

  # Build the native image on Linux
  # The runner image determines GLIBC compatibility and should not be changed without
  # understanding the impact. See https://github.com/chadkillingsworth/closure-compiler-npm/issues/280
  build-linux-arm64:
    name: Build Linux Native Image for arm processors
    needs: build-compiler
    permissions:
      contents: read
    runs-on: ubuntu-24.04-arm
    env:
      NODE_VERSION: '20.x'
      FORCE_COLOR: '1'
    steps:
      - name: Checkout repo
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # 5.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: yarn
      - name: Setup GraalVM
        uses: graalvm/setup-graalvm@e140024fdc2d95d3c7e10a636887a91090d29990 # 1.4.0
        with:
          java-version: 24
          distribution: 'graalvm-community'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          native-image-job-reports: 'true'
      - name: Download compiler jar
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Compiler.jar
          path: packages/google-closure-compiler-java/
      - name: Download contrib folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Contrib folder
          path: packages/google-closure-compiler/contrib
      - name: Download externs folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Externs folder
          path: packages/google-closure-compiler/externs
      - name: Install packages
        run: YARN_ENABLE_COLORS=true yarn install
      - name: Build image
        working-directory: packages/google-closure-compiler-linux-arm64
        run: |
          cp ../google-closure-compiler-java/compiler.jar compiler.jar
          yarn run build
      - name: Tests
        run: FORCE_COLOR=1 yarn workspaces foreach -A --no-private run test
      - name: Upload artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: Linux arm64 image
          path: packages/google-closure-compiler-linux-arm64/compiler

  # Build the native image on MacOS
  build-macos:
    name: Build MacOS Native Image
    needs: build-compiler
    permissions:
      contents: read
    runs-on: macos-latest
    env:
      NODE_VERSION: '22.x'
      FORCE_COLOR: '1'
    steps:
      - name: Checkout repo
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # 5.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: yarn
      - name: Setup GraalVM
        uses: graalvm/setup-graalvm@e140024fdc2d95d3c7e10a636887a91090d29990 # 1.4.0
        with:
          java-version: 24
          distribution: 'graalvm-community'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          native-image-job-reports: 'true'
      - name: Download compiler jar
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Compiler.jar
          path: packages/google-closure-compiler-java/
      - name: Download contrib folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Contrib folder
          path: packages/google-closure-compiler/contrib
      - name: Download externs folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Externs folder
          path: packages/google-closure-compiler/externs
      - name: Install packages
        run: YARN_ENABLE_COLORS=true yarn install
      - name: Build image
        working-directory: packages/google-closure-compiler-macos
        run: |
          cp ../google-closure-compiler-java/compiler.jar compiler.jar
          yarn run build
      - name: Tests
        run: FORCE_COLOR=1 yarn workspaces foreach -A --no-private run test
      - name: Upload artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: MacOS image
          path: packages/google-closure-compiler-macos/compiler

  # Build the native image on Windows
  build-windows:
    name: Build Windows Native Image
    needs: build-compiler
    permissions:
      contents: read
    runs-on: windows-latest
    env:
      NODE_VERSION: '22.x'
      FORCE_COLOR: '1'
    steps:
      - name: Checkout repo
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # 5.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: yarn
      - name: Setup GraalVM
        uses: graalvm/setup-graalvm@e140024fdc2d95d3c7e10a636887a91090d29990 # 1.4.0
        with:
          java-version: 24
          distribution: 'graalvm-community'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          native-image-job-reports: 'true'
      - name: Download compiler jar
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Compiler.jar
          path: packages/google-closure-compiler-java/
      - name: Download contrib folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Contrib folder
          path: packages/google-closure-compiler/contrib
      - name: Download externs folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Externs folder
          path: packages/google-closure-compiler/externs
      - name: Install packages
        run: yarn install
      - name: Build image
        working-directory: packages/google-closure-compiler-windows
        run: |
          cp ../google-closure-compiler-java/compiler.jar compiler.jar
          yarn run build
      - name: Tests
        shell: cmd
        run: yarn workspaces foreach -A --no-private run test
      - name: Upload artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: Windows image
          path: packages/google-closure-compiler-windows/compiler.exe

  # Publish the packages if needed
  publish-packages:
    name: Publish Packages
    permissions:
      id-token: write  # Required for OIDC
      contents: read
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'schedule' || github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
    env:
      NODE_VERSION: '24.x'
      FORCE_COLOR: '1'
    needs:
      - build-linux
      - build-linux-arm64
      - build-macos
      - build-windows
    steps:
      - name: Checkout repo
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # 5.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: https://registry.npmjs.org/
          cache: yarn
      - name: Download compiler jar
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Compiler.jar
          path: packages/google-closure-compiler-java/
      - name: Download Linux image
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Linux image
          path: packages/google-closure-compiler-linux/
      - name: Download Linux arm64 image
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Linux arm64 image
          path: packages/google-closure-compiler-linux-arm64/
      - name: Download MacOS image
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: MacOS image
          path: packages/google-closure-compiler-macos/
      - name: Download Windows image
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Windows image
          path: packages/google-closure-compiler-windows/
      - name: Download contrib folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Contrib folder
          path: packages/google-closure-compiler/contrib
      - name: Download externs folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # 5.0.0
        with:
          name: Externs folder
          path: packages/google-closure-compiler/externs
      - name: Mark binaries executable
        run: |
          chmod 755 packages/google-closure-compiler-linux/compiler
          chmod 755 packages/google-closure-compiler-linux-arm64/compiler
          chmod 755 packages/google-closure-compiler-macos/compiler
          chmod 755 packages/google-closure-compiler-windows/compiler.exe
      - name: Install packages
        run: YARN_ENABLE_COLORS=true yarn install
      - name: Prepare for publish
        run: ./build-scripts/add-os-restrictions.js
      - name: Publish packages to npm
        run: |
          npm --version
          yarn publish-packages