release.yml

name: build-test-release

# DFTools per-image release pipeline, independent of the DFHDL library release.
#
#   detect (which images changed)
#     -> build-test (only affected images x arch; per-image self-test)
#     -> dfhdl-gate (DFHDL latest release + main, against the freshly built images)
#     -> publish (only on a version tag or manual dispatch, and only if the gate passed)
#
# Bumping a pin in pins.env rebuilds only the image(s) that contain that tool.

on:
  push:
    branches: [ main ]
    paths: [ 'pins.env', 'images/**', 'build/**', 'scripts/**', '.github/workflows/release.yml' ]
    tags: [ 'v*' ]
  workflow_dispatch:
    inputs:
      images:
        description: 'Space-separated images to build (empty = all)'
        required: false
      publish:
        description: 'Publish a release from this run'
        type: boolean
        default: false
      version:
        description: 'Release version tag (e.g. v0.1.0); required when publish=true'
        required: false

permissions:
  contents: write

jobs:
  detect:
    runs-on: ubuntu-24.04
    outputs:
      images: ${{ steps.set.outputs.images }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - id: set
        run: |
          set -euo pipefail
          if [ -n "${{ github.event.inputs.images }}" ]; then
            list="${{ github.event.inputs.images }}"
          elif [ "${{ github.event_name }}" = "workflow_dispatch" ] || [ "${{ github.ref_type }}" = "tag" ]; then
            list="$(sh scripts/affected-images.sh)"          # all
          else
            list="$(sh scripts/affected-images.sh '${{ github.event.before }}' '${{ github.sha }}')"
          fi
          json=$(printf '%s\n' $list | jq -R . | jq -cs .)
          echo "images=$json" >> "$GITHUB_OUTPUT"
          echo "affected images: $list"

  build-test:
    needs: detect
    if: needs.detect.outputs.images != '[]'
    strategy:
      fail-fast: true
      matrix:
        image: ${{ fromJson(needs.detect.outputs.images) }}
        arch: [ linux-x64, linux-arm64 ]
        include:
          - arch: linux-x64
            runs-on: ubuntu-24.04
          - arch: linux-arm64
            runs-on: ubuntu-24.04-arm
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@v7
      - name: Free up disk space
        uses: jlumbroso/free-disk-space@main
        with: { tool-cache: true, large-packages: true, docker-images: true }
      # Official upstream PPA — covers both amd64 and arm64 on noble and tracks the
      # current 1.5.x (matches what we build/run with locally). The setup-apptainer
      # action only ships an amd64 .deb and fails on the arm64 runner.
      - name: Setup Apptainer
        run: |
          set -eux
          sudo add-apt-repository -y ppa:apptainer/ppa
          sudo apt-get update
          sudo apt-get install -y apptainer
          apptainer --version
      - name: Setup JDK + Scala CLI
        uses: VirtusLab/scala-cli-setup@v1
        with: { jvm: 'temurin:21' }
      - name: Build image
        run: |
          set -euo pipefail
          scala-cli run scripts/build.sc -- ${{ matrix.image }} dftools-${{ matrix.image }}-${{ matrix.arch }}.sif
          sha256sum dftools-${{ matrix.image }}-${{ matrix.arch }}.sif > dftools-${{ matrix.image }}-${{ matrix.arch }}.sif.sha256
      - name: Probe image
        run: scala-cli run scripts/test.sc -- probe ${{ matrix.image }} dftools-${{ matrix.image }}-${{ matrix.arch }}.sif
      - uses: actions/upload-artifact@v7
        with:
          name: dftools-${{ matrix.image }}-${{ matrix.arch }}
          path: |
            dftools-${{ matrix.image }}-${{ matrix.arch }}.sif
            dftools-${{ matrix.image }}-${{ matrix.arch }}.sif.sha256
            dftools-${{ matrix.image }}-${{ matrix.arch }}.MANIFEST.txt
          retention-days: 7

  dfhdl-gate:
    needs: build-test
    strategy:
      matrix:
        arch: [ linux-x64, linux-arm64 ]
        include:
          - arch: linux-x64
            runs-on: ubuntu-24.04
          - arch: linux-arm64
            runs-on: ubuntu-24.04-arm
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@v7
      # Official upstream PPA — covers both amd64 and arm64 on noble and tracks the
      # current 1.5.x (matches what we build/run with locally). The setup-apptainer
      # action only ships an amd64 .deb and fails on the arm64 runner.
      - name: Setup Apptainer
        run: |
          set -eux
          sudo add-apt-repository -y ppa:apptainer/ppa
          sudo apt-get update
          sudo apt-get install -y apptainer
          apptainer --version
      # DFHDL builds on JDK 17 with sbt + bloop (see dfhdl/.github/workflows/build.yml).
      # scala-cli is added only to run this repo's gate driver (scripts/test.sc), which
      # then invokes `sbt testApps` inside the DFHDL checkout on the same JAVA_HOME.
      - name: Setup Scala
        uses: coursier/setup-action@v3
        with:
          jvm: temurin:1.17.0.14
          apps: sbt bloop scala-cli
      - name: Download freshly built images (this arch)
        uses: actions/download-artifact@v8
        with:
          pattern: dftools-*-${{ matrix.arch }}
          path: dist
          merge-multiple: true
      # TEMPORARY: while the DFHDL DFTools integration lives on the `dftools` branch, gate
      # only against that branch. Restore the latest-release + main gate once it is merged.
      - name: Check out DFHDL (dftools branch)
        run: git clone --branch dftools --depth 1 https://github.com/DFiantHDL/dfhdl.git dfhdl-dftools
      # Sifs are named dftools-<image>-<arch>.sif; test.sc maps each to the per-image override.
      # Images not rebuilt in this run fall back to DFHDL's published-release resolution.
      - name: Gate against DFHDL dftools branch
        run: scala-cli run scripts/test.sc -- dfhdl dist dfhdl-dftools

  publish:
    # TEMPORARY: the DFHDL gate is decoupled from publishing while we iron out gate issues,
    # so freshly built images can be released and used to debug. Publish depends only on a
    # successful build-test; the dfhdl-gate still runs for visibility but does not block.
    # Restore `needs: dfhdl-gate` once the gate is green.
    needs: build-test
    if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.publish)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/download-artifact@v8
        with: { path: dist, merge-multiple: true }
      - id: ver
        run: |
          if [ "${{ github.ref_type }}" = "tag" ]; then echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT";
          else echo "tag=${{ inputs.version }}" >> "$GITHUB_OUTPUT"; fi
      - name: Setup JDK + Scala CLI
        uses: VirtusLab/scala-cli-setup@v1
        with: { jvm: 'temurin:21' }
      # Rename the built sifs to immutable, content-addressed asset names and (re)generate the
      # lockfile mapping each image+arch to its sha256 + asset. Seeded from the prior lockfile on
      # the tag, so a partial re-publish carries unchanged images forward.
      - name: Build lockfile + immutable asset names
        run: scala-cli run scripts/lockfile.sc -- ${{ steps.ver.outputs.tag }} dist
      # Attach the immutable per-image sifs + the lockfile to the release tag. Immutable names never
      # collide across builds, so previously published assets on the same tag are left intact; the
      # lockfile (stable name) is overwritten to point at the current digest set.
      - name: Publish image assets to release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.ver.outputs.tag }}
          name: DFTools ${{ steps.ver.outputs.tag }}
          files: |
            dist/*.sif
            dist/*.sif.sha256
            dist/*.MANIFEST.txt
            dist/dftools.lock.json