build.yml

name: Build and Release
permissions:
  contents: write
on:
  push:
    branches: [ "main" ]
    tags:
      - "*.*.*"
    paths-ignore:
      - '*.md'
  pull_request:
    branches: [ "main" ]
    paths-ignore:
      - '*.md'

jobs:

  build_linux_agents:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
    - uses: actions/checkout@v5
      with:
        persist-credentials: false

    - name: Set up JDK 21
      uses: actions/setup-java@v5
      with:
        java-version: '21'
        distribution: 'temurin'

    - name: Install Android NDK and build tools
      run: |
        yes | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --licenses || true
        $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --install \
          "ndk;29.0.13113456" \
          "build-tools;36.0.0" \
          "platforms;android-35"
      env:
        ANDROID_HOME: /usr/local/lib/android/sdk

    - name: Build Android agents
      run: make -C agents/android all
      env:
        ANDROID_HOME: /usr/local/lib/android/sdk

    - name: Upload Android agent binaries
      uses: actions/upload-artifact@v7
      with:
        name: android-agents
        path: |
          agents/android/mobilecli-arm64-v8a.so
          agents/android/mobilecli-x86_64.so
          agents/android/mobilecli.dex
        retention-days: 1

  build_ios_agents:
    runs-on: macos-latest
    timeout-minutes: 15
    steps:
    - uses: actions/checkout@v5
      with:
        persist-credentials: false

    - name: Build iOS agents
      run: make -C agents/ios all

    - name: Upload iOS agent binaries
      uses: actions/upload-artifact@v7
      with:
        name: ios-agents
        path: |
          agents/ios/agent-sim.dylib
          agents/ios/agent-dev.dylib
        retention-days: 1

  test:
    runs-on: macos-latest
    timeout-minutes: 15
    needs: [build_linux_agents, build_ios_agents]
    steps:
    - uses: actions/checkout@v5
      with:
        persist-credentials: false

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version-file: go.mod

    - name: Download Android agent binaries
      uses: actions/download-artifact@v8
      with:
        name: android-agents
        path: agents/android/

    - name: Download iOS agent binaries
      uses: actions/download-artifact@v8
      with:
        name: ios-agents
        path: agents/ios/

    - name: Run Unit Tests
      run: |
        CGO_ENABLED=0 go build -ldflags="-s -w"
        go test ./... -v -race

  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v5
      with:
        persist-credentials: false

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version-file: go.mod

    - name: Check formatting
      run: |
        go fmt ./...
        git diff --exit-code

    - name: Create placeholder agent binaries for typecheck
      run: touch agents/android/mobilecli-arm64-v8a.so agents/android/mobilecli-x86_64.so agents/android/mobilecli.dex agents/ios/agent-sim.dylib agents/ios/agent-dev.dylib

    - name: Lint
      uses: golangci/golangci-lint-action@v9
      with:
        version: v2.13.1
        verify: false
      continue-on-error: true

  security:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v5
      with:
        persist-credentials: false

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version-file: go.mod

    - name: Security scan
      run: |
        go install golang.org/x/vuln/cmd/govulncheck@latest
        govulncheck -show verbose ./... || true

  # no cgo anywhere, so one linux runner cross-compiles every platform
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    needs: [build_linux_agents, build_ios_agents]
    steps:
    - uses: actions/checkout@v5
      with:
        persist-credentials: false

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version-file: go.mod

    - name: Download Android agent binaries
      uses: actions/download-artifact@v8
      with:
        name: android-agents
        path: agents/android/

    - name: Download iOS agent binaries
      uses: actions/download-artifact@v8
      with:
        name: ios-agents
        path: agents/ios/

    - name: Set version
      if: github.ref_type == 'tag'
      run: |
        if [[ ! "$GITHUB_REF_NAME" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
          echo "::error::Invalid release tag format: $GITHUB_REF_NAME"
          exit 1
        fi
        sed -i 's/Version = \"dev\"/Version = \"'"$GITHUB_REF_NAME"'\"/' utils/version.go

    - name: Build
      env:
        CGO_ENABLED: 0
      run: |
        for target in darwin/arm64 darwin/amd64 linux/arm64 linux/amd64 windows/amd64 windows/arm64; do
          os="${target%/*}"
          arch="${target#*/}"
          ext=""
          if [ "$os" = "windows" ]; then
            ext=".exe"
          fi
          GOOS="$os" GOARCH="$arch" go build -ldflags="-s -w" -o "mobilecli-$os-$arch$ext"
        done
        ./mobilecli-linux-amd64 --version

    - name: Upload macos build artifact
      uses: actions/upload-artifact@v7
      with:
        name: macos-build
        path: |
          mobilecli-darwin-arm64
          mobilecli-darwin-amd64
        retention-days: 1
        overwrite: true

    - name: Upload linux build artifact
      uses: actions/upload-artifact@v7
      with:
        name: linux-build
        path: |
          mobilecli-linux-arm64
          mobilecli-linux-amd64
        retention-days: 1
        overwrite: true

    - name: Upload windows build artifact
      uses: actions/upload-artifact@v7
      with:
        name: windows-build
        path: |
          mobilecli-windows-amd64.exe
          mobilecli-windows-arm64.exe
        retention-days: 1
        overwrite: true

  e2e_test:
    runs-on: self-hosted
    timeout-minutes: 10
    needs: [build]

    steps:
    - uses: actions/checkout@v5
      with:
        persist-credentials: false

    - name: Download macos build
      uses: actions/download-artifact@v8
      with:
        name: macos-build
        path: .

    - name: Make mobilecli executable
      run: |
        mv mobilecli-darwin-arm64 mobilecli
        chmod +x mobilecli

    - name: npm install
      run: |
        cd test
        npm install --ignore-scripts

    # run the downloaded release binary as-is, never rebuild it here: what we test
    # is what publish ships. MOBILECLI_HOME keeps the daemon away from ~/.mobilecli
    - name: run tests
      env:
        MOBILECLI_HOME: ${{ runner.temp }}/mobilecli-home
      run: |
        mkdir -p "$MOBILECLI_HOME"
        ./mobilecli --version
        ./mobilecli daemon stop || true
        cd test && npx playwright test

    - name: stop daemon
      if: always()
      env:
        MOBILECLI_HOME: ${{ runner.temp }}/mobilecli-home
      run: ./mobilecli daemon stop || true

  publish:
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      id-token: write  # Required for npm trusted publishing with OIDC
      contents: write
    needs: [build, e2e_test, test, lint, security]
    steps:
    - uses: actions/checkout@v5
      with:
        persist-credentials: false

    - uses: actions/setup-node@v5
      with:
        node-version: '24'
        registry-url: 'https://registry.npmjs.org'

    - name: Download darwin build
      uses: actions/download-artifact@v8
      with:
        name: macos-build
        path: mobilecli-darwin

    - name: Download linux build
      uses: actions/download-artifact@v8
      with:
        name: linux-build
        path: mobilecli-linux

    - name: Download windows build
      uses: actions/download-artifact@v8
      with:
        name: windows-build
        path: mobilecli-windows

    - name: Zip builds
      run: |
        if [[ ! "$GITHUB_REF_NAME" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
          echo "::error::Invalid release tag format: $GITHUB_REF_NAME"
          exit 1
        fi

        mkdir dist
        cd dist
        # macos-arm64
        cp ../mobilecli-darwin/mobilecli-darwin-arm64 mobilecli
        zip -9 "../mobilecli-$GITHUB_REF_NAME-macos-arm64.zip" mobilecli
        rm -f mobilecli

        # macos-amd64
        cp ../mobilecli-darwin/mobilecli-darwin-amd64 mobilecli
        zip -9 "../mobilecli-$GITHUB_REF_NAME-macos-amd64.zip" mobilecli
        rm -f mobilecli

        # linux-amd64
        cp ../mobilecli-linux/mobilecli-linux-amd64 mobilecli
        zip -9 "../mobilecli-$GITHUB_REF_NAME-linux-amd64.zip" mobilecli
        rm -f mobilecli

        # linux-arm64
        cp ../mobilecli-linux/mobilecli-linux-arm64 mobilecli
        zip -9 "../mobilecli-$GITHUB_REF_NAME-linux-arm64.zip" mobilecli
        rm -f mobilecli

        # windows-amd64
        cp ../mobilecli-windows/mobilecli-windows-amd64.exe mobilecli.exe
        zip -9 "../mobilecli-$GITHUB_REF_NAME-windows-amd64.zip" mobilecli.exe
        rm -f mobilecli.exe

        # windows-arm64
        cp ../mobilecli-windows/mobilecli-windows-arm64.exe mobilecli.exe
        zip -9 "../mobilecli-$GITHUB_REF_NAME-windows-arm64.zip" mobilecli.exe
        rm -f mobilecli.exe
        cd ..

        ls -l *.zip
        rm -rf dist

    - name: Extract release notes from CHANGELOG.md
      run: awk -v tag="$GITHUB_REF_NAME" '/^## \[/{f = ($0 ~ "^## \\[" tag "\\]")} f' CHANGELOG.md > release-notes.md

    - name: Upload to GitHub Release
      uses: softprops/action-gh-release@v2
      env:
        GITHUB_TOKEN: ${{ secrets.RELEASES_TOKEN }}
      with:
        name: Version ${{ github.ref_name }}
        body_path: release-notes.md
        files: |
          mobilecli-*.zip

    - name: Publish
      run: |
        # publish platform-specific packages
        for platform in darwin-arm64 darwin-amd64 linux-arm64 linux-amd64 windows-amd64 windows-arm64; do
          os="${platform%-*}"
          binary="mobilecli-$platform"
          if [ "$os" = "windows" ]; then
            binary="$binary.exe"
          fi
          cp "mobilecli-$os/$binary" "publish/npm-$platform/"
          chmod +x "publish/npm-$platform/$binary"
          cd "publish/npm-$platform"
          npm version "$GITHUB_REF_NAME" --no-git-tag-version
          npm publish --access public --provenance
          cd ../..
        done

        # publish main package (wrapper)
        cp README.md publish/npm
        cd publish/npm
        npm version "$GITHUB_REF_NAME" --no-git-tag-version
        for platform in darwin-arm64 darwin-amd64 linux-arm64 linux-amd64 windows-amd64 windows-arm64; do
          npm pkg set "optionalDependencies.@mobilenext/mobilecli-$platform=$GITHUB_REF_NAME"
        done
        npm publish --access public --provenance