Repository navigation
feat: multi-version :scheme ZIP export, JS loadMany, envelope-aware J… #1113
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Baboon Build | |
| on: | |
| push: | |
| branches: [ main ] | |
| tags: [ 'v*' ] | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| workflow_dispatch: | |
| inputs: {} | |
| permissions: | |
| contents: write | |
| id-token: write | |
| jobs: | |
| build-linux: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # 1) don't forget about os entry in prepare-release | |
| # 2) see : https://github.com/actions/runner-images | |
| include: | |
| - target: linux-amd64 | |
| os: ubuntu-latest | |
| runs-on: [ ] | |
| - target: linux-aarch64 | |
| os: ubuntu-24.04-arm | |
| runs-on: [ ] | |
| #runs-on: [ "ARM64" ] | |
| #preconfigured: true | |
| #nix-cache-disabled: true | |
| name: build-${{ matrix.target }} | |
| runs-on: | |
| - ${{ matrix.os }} | |
| - ${{ matrix.runs-on }} | |
| steps: | |
| # The native-image build plus all nine language toolchains realized into the | |
| # nix store exhaust the ~14 GB ubuntu runner ("No space left on device" while | |
| # realizing store paths). Reclaim space before anything fills the disk. | |
| - name: Free disk space | |
| uses: jlumbroso/free-disk-space@main | |
| with: | |
| tool-cache: true | |
| large-packages: true | |
| - uses: 7mind/github-env@minimal | |
| with: | |
| setup-nix: ${{ matrix.preconfigured != true }} | |
| - name: Allow unprivileged user namespaces (bwrap) | |
| # Ubuntu 24.04 AppArmor restricts unprivileged user namespaces by | |
| # default. Our flake's `appleSwift` output wraps the Apple toolchain | |
| # in `pkgs.buildFHSEnv` (bubblewrap-based), which needs them; without | |
| # this `bwrap: setting up uid map: Permission denied` kills any | |
| # action that touches Swift. | |
| run: | | |
| if [[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]]; then | |
| echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns | |
| fi | |
| - name: Check deps and build | |
| if: startsWith(github.ref, 'refs/tags/') | |
| run: nix develop --command mdl --github-actions :build :test | |
| - name: Refresh deps and build | |
| if: ${{ !startsWith(github.ref, 'refs/tags/') }} | |
| run: nix develop --command mdl --github-actions :flake-refresh :build :test | |
| - name: Validate binary portability (outside Nix) | |
| # Deliberately inline (no `mdl :smoke`): the whole point of this step | |
| # is to verify the binary runs without nix-shell environment leakage, | |
| # and mdl is provisioned inside the nix shell. Source of truth for | |
| # equivalent commands lives in `.mdl/defs/actions.md` action `smoke`; | |
| # locally `mdl :smoke` runs the same shape. | |
| run: | | |
| chmod +x baboon-compiler/.jvm/target/graalvm-native-image/baboon | |
| echo "=== file ===" | |
| file baboon-compiler/.jvm/target/graalvm-native-image/baboon | |
| echo "=== ldd ===" | |
| ldd baboon-compiler/.jvm/target/graalvm-native-image/baboon 2>&1 || true | |
| echo "=== smoke test ===" | |
| baboon-compiler/.jvm/target/graalvm-native-image/baboon \ | |
| --model-dir ./test/conv-test \ | |
| :cs --output /tmp/baboon-validate-cs \ | |
| :scala --output /tmp/baboon-validate-sc | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: baboon-${{ matrix.target }} | |
| path: | | |
| baboon-compiler/.jvm/target/graalvm-native-image/** | |
| build-macos: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # 1) don't forget about os entry in prepare-release | |
| # 2) see : https://github.com/actions/runner-images | |
| include: | |
| - target: macos-amd64-13 | |
| os: macos-15-intel | |
| runs-on: [ ] | |
| java-version: '23' | |
| - target: macos-aarch64-14 | |
| os: macos-14 # yes, this is aarch64 | |
| runs-on: [ ] | |
| java-version: '23' | |
| name: build-${{ matrix.target }} | |
| runs-on: | |
| - ${{ matrix.os }} | |
| - ${{ matrix.runs-on }} | |
| steps: | |
| - uses: 7mind/github-env@minimal | |
| with: | |
| setup-nix: false | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| # Same as the windows job: the kt service stubs pin Gradle's jvmToolchain(21). | |
| - name: Set up JDK 21 (Gradle toolchain for kt service stubs) | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: '21' | |
| - name: Set up GraalVM (Java ${{ matrix.java-version }}) | |
| uses: graalvm/setup-graalvm@v1 | |
| with: | |
| java-version: '${{ matrix.java-version }}' | |
| distribution: 'graalvm-community' | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| cache: 'sbt' | |
| native-image-job-reports: true | |
| - name: Set up SBT | |
| uses: sbt/setup-sbt@v1 | |
| with: | |
| # The action's post step caches the sbt 2.x disk cache | |
| # ($HOME/Library/Caches/sbt), which sbt 1.x never writes -- see | |
| # project/build.properties. Building its key costs a whole-workspace | |
| # hashFiles('**/*.sbt', '**/*.properties'), which by teardown has to walk every | |
| # backend's generated code plus node_modules / cargo target / .dart_tool / | |
| # Swift .build. That exceeds the 120s expression limit on the Intel runner (the | |
| # slowest of the matrix at ~2h40m) and fails the job AFTER build, tests and | |
| # artifact upload have all succeeded. Dependency caching is unaffected: | |
| # graalvm/setup-graalvm above already does it via `cache: 'sbt'`. | |
| disk-cache: false | |
| - name: Set up Dart SDK | |
| uses: dart-lang/setup-dart@v1 | |
| - name: Install mudyla | |
| run: pip install git+https://github.com/7mind/mudyla.git | |
| - name: Build (macOS) | |
| run: mdl --github-actions --without-nix :build :test | |
| - name: Validate binary portability | |
| run: mdl --github-actions --without-nix :smoke | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: baboon-${{ matrix.target }} | |
| path: | | |
| baboon-compiler/.jvm/target/graalvm-native-image/** | |
| test-editors: | |
| name: test-editors | |
| runs-on: | |
| - ubuntu-latest | |
| steps: | |
| - uses: 7mind/github-env@minimal | |
| with: | |
| setup-nix: true | |
| - name: Init submodules | |
| run: git submodule update --init --recursive | |
| - name: Test editor grammars | |
| run: nix develop --command mdl --github-actions :test-editors | |
| acceptance-tests: | |
| name: acceptance-tests | |
| runs-on: | |
| - ubuntu-latest | |
| steps: | |
| - uses: 7mind/github-env@minimal | |
| with: | |
| setup-nix: true | |
| - name: Allow unprivileged user namespaces (bwrap) | |
| # Ubuntu 24.04 AppArmor restricts unprivileged user namespaces; the | |
| # flake's FHS-wrapped Apple Swift toolchain uses bwrap and needs them. | |
| run: | | |
| if [[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]]; then | |
| echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns | |
| fi | |
| # `:test-acceptance` and `:test-service-acceptance` each `dep action.build`, | |
| # so mdl handles the binary build once and reuses it across both actions. | |
| # Plain `nix develop --command` (no `--ignore-environment`): runner-injected | |
| # env carries TLS trust chain that sbt-launcher needs for upstream Maven | |
| # resolution. See defects.md [PR-29P.2-D01] for full root cause. | |
| - name: Run acceptance tests | |
| run: nix develop --command mdl --github-actions :test-acceptance | |
| - name: Run service acceptance tests | |
| run: nix develop --command mdl --github-actions :test-service-acceptance | |
| - name: Write step summary | |
| if: always() | |
| run: | | |
| if [ -f ./target/acceptance/acceptance-summary.md ]; then | |
| cat ./target/acceptance/acceptance-summary.md >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| if [ -f ./target/service-acceptance/service-summary.md ]; then | |
| cat ./target/service-acceptance/service-summary.md >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| - name: Upload acceptance report | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: acceptance-report | |
| path: | | |
| target/acceptance/acceptance-report.html | |
| target/acceptance/acceptance-results.json | |
| target/acceptance/acceptance-summary.md | |
| target/service-acceptance/service-report.html | |
| target/service-acceptance/service-results.json | |
| target/service-acceptance/service-summary.md | |
| validate-flake: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: linux-aarch64 | |
| os: ubuntu-24.04-arm | |
| runs-on: [ ] | |
| name: check-flake-runs-${{ matrix.target }} | |
| runs-on: | |
| - ${{ matrix.os }} | |
| - ${{ matrix.runs-on }} | |
| steps: | |
| - uses: 7mind/github-env@minimal | |
| with: | |
| setup-nix: ${{ matrix.preconfigured != true }} | |
| - name: Check deps and build | |
| run: nix run . -- --model-dir ./test/conv-test :cs --output ./test/conv-test-cs/ConvTest/Generated :scala --output ./test/conv-test-sc/src/main/scala/generated-main | |
| build-windows: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: windows-amd64 | |
| os: windows-2022 | |
| runs-on: [ ] | |
| java-version: '23' | |
| name: build-${{ matrix.target }} | |
| runs-on: | |
| - ${{ matrix.os }} | |
| - ${{ matrix.runs-on }} | |
| steps: | |
| - uses: 7mind/github-env@minimal | |
| with: | |
| setup-nix: false | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| # The kt service stubs (test/services/kt*) pin Gradle's jvmToolchain(21); the runner | |
| # otherwise has only GraalVM 23, so Gradle can't resolve a Java 21 toolchain. Install | |
| # JDK 21 BEFORE GraalVM (which then sets the primary JAVA_HOME=23 for native-image); | |
| # Gradle auto-detects the 21 toolchain via JAVA_HOME_21_X64. | |
| - name: Set up JDK 21 (Gradle toolchain for kt service stubs) | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: '21' | |
| - name: Set up GraalVM (Java ${{ matrix.java-version }}) | |
| uses: graalvm/setup-graalvm@v1 | |
| with: | |
| java-version: '${{ matrix.java-version }}' | |
| distribution: 'graalvm-community' | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| cache: 'sbt' | |
| native-image-job-reports: true | |
| - name: Install rsync | |
| # `choco install` exits 0 even when the community feed is unavailable | |
| # (e.g. 503), leaving the runner without rsync; the failure only | |
| # surfaces ~5 min later inside `mdl :test`. Retry on transient errors | |
| # and verify the binary is actually on PATH before declaring success. | |
| shell: pwsh | |
| run: | | |
| $maxRetries = 5 | |
| for ($i = 1; $i -le $maxRetries; $i++) { | |
| Write-Host "rsync install attempt $i/$maxRetries" | |
| choco install rsync -y --no-progress | |
| if (Get-Command rsync -ErrorAction SilentlyContinue) { | |
| rsync --version | |
| exit 0 | |
| } | |
| Start-Sleep -Seconds 10 | |
| } | |
| Write-Error "rsync not on PATH after $maxRetries attempts" | |
| exit 1 | |
| - name: Set up Dart SDK | |
| uses: dart-lang/setup-dart@v1 | |
| - name: Install mudyla | |
| shell: bash | |
| run: pip install git+https://github.com/7mind/mudyla.git | |
| # Git Bash's C:\Program Files\Git\usr\bin holds a GNU coreutils `link.exe` that | |
| # shadows the MSVC linker, so the Rust `...-pc-windows-msvc` cargo lanes | |
| # (test-gen-compat-rust) link with the wrong `link.exe` and fail. msvc-dev-cmd puts | |
| # the real MSVC linker on PATH; an in-shell PATH tweak does NOT survive because mdl | |
| # spawns fresh login bash shells per action that re-prioritize /usr/bin. So remove the | |
| # GNU shim outright (in pwsh, not subject to bash's reshuffle) — `link.exe` then | |
| # resolves to the MSVC one for every subsequent action. | |
| - name: Set up MSVC developer environment | |
| uses: ilammy/msvc-dev-cmd@v1 | |
| with: | |
| arch: x64 | |
| - name: Remove Git Bash link.exe shim (shadows the MSVC linker) | |
| shell: pwsh | |
| run: Remove-Item "C:\Program Files\Git\usr\bin\link.exe" -Force -ErrorAction SilentlyContinue | |
| - name: Build (windows) | |
| shell: bash | |
| run: mdl --github-actions --without-nix :build :test | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: baboon-${{ matrix.target }} | |
| path: | | |
| baboon-compiler/.jvm/target/graalvm-native-image/** | |
| publish-scala: | |
| runs-on: | |
| - ubuntu-latest | |
| needs: | |
| - build-linux | |
| - build-macos | |
| - build-windows | |
| - validate-flake | |
| steps: | |
| - uses: 7mind/github-env@minimal | |
| with: | |
| setup-nix: true | |
| - name: Download All Artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: binaries | |
| pattern: baboon-* | |
| - name: Prepare layout | |
| run: nix develop --command mdl --github-actions --mkdist-source=./binaries --mkdist-target=. :build :mkdist | |
| - uses: softprops/action-gh-release@v2 | |
| id: create-release | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: | | |
| ./dist-bin/** | |
| ./dist-zip/** | |
| - uses: bitwarden/sm-action@v2 | |
| with: | |
| access_token: ${{ secrets.TOKEN_BITWARDEN_SM }} | |
| secrets: | | |
| 994f97a2-97a4-4fe1-806a-b1930104435f > SONATYPE_CREDENTIALS_FILE | |
| 749f4227-9f11-4ceb-9121-b1930110c3a9 > OPENSSL_KEY | |
| a2fe5b5b-5f3f-47f8-961c-b1930110cea7 > OPENSSL_IV | |
| - name: Build and Publish to Sonatype | |
| env: | |
| SCALA_VERSION: ${{ matrix.scala }} | |
| JAVA_VERSION: ${{ matrix.java }} | |
| SONATYPE_SECRET: .secrets/credentials.sonatype-nexus.properties | |
| run: | | |
| mkdir .secrets | |
| echo "$SONATYPE_CREDENTIALS_FILE" > "$SONATYPE_SECRET" | |
| openssl aes-256-cbc -K ${OPENSSL_KEY} -iv ${OPENSSL_IV} -in secrets.tar.enc -out secrets.tar -d | |
| tar xvf secrets.tar | |
| nix develop --command mdl --github-actions :gen-js :publish-scala | |
| publish-npm: | |
| name: publish-npm | |
| if: startsWith(github.ref, 'refs/tags/') | |
| runs-on: | |
| - ubuntu-24.04-arm | |
| needs: | |
| - build-linux | |
| - build-macos | |
| - build-windows | |
| - validate-flake | |
| env: | |
| CI_BRANCH_TAG: ${{ github.ref_name }} | |
| CI_PULL_REQUEST: ${{ github.event_name == 'pull_request' && 'true' || 'false' }} | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - uses: 7mind/github-env@minimal | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "24" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Publish npm package | |
| run: nix develop --command mdl --github-actions :publish-npm |