ci.yml

name: CI
permissions:
  contents: read

on:
  push:
    branches: ["main"]
  pull_request:

jobs:
  rust-core:
    name: Rust Core - Build & Test
    runs-on:
      group: arc-public-large-amd64-runner
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Read rust-toolchain
        id: rust-version
        run: echo "toolchain=$(yq '.toolchain.channel' rust-toolchain.toml)" >> $GITHUB_OUTPUT

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ steps.rust-version.outputs.toolchain }}
          components: rustfmt,clippy

      - name: Cache dependencies
        uses: Swatinem/rust-cache@v2

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Lint with Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Build Rust core
        run: cargo build --release --package idkit-core

      - name: Run Rust tests
        run: cargo test --package idkit-core

  go-server:
    name: Go Server - Build & Test
    runs-on:
      group: arc-public-large-amd64-runner
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go/idkit/go.mod

      - name: Check formatting
        working-directory: go/idkit
        run: |
          if [ -n "$(gofmt -l .)" ]; then
            echo "Go files are not formatted. Run: gofmt -w ."
            gofmt -l .
            exit 1
          fi

      - name: Run Go tests
        working-directory: go/idkit
        run: go test ./...

  go-rust-parity:
    name: Go ↔ Rust Parity Tests
    runs-on:
      group: arc-public-large-amd64-runner
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go/idkit/go.mod

      - name: Read rust-toolchain
        id: rust-version
        run: echo "toolchain=$(yq '.toolchain.channel' rust-toolchain.toml)" >> $GITHUB_OUTPUT

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ steps.rust-version.outputs.toolchain }}

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Build rp-sign-vectors binary
        run: cargo build --release -p idkit-core --bin rp-sign-vectors --features rp-signature

      - name: Run Go parity tests
        working-directory: go/idkit
        run: go test -tags rust_parity -v ./...

  swift-bindings:
    name: Swift Bindings - Build & Test
    runs-on: ${{ matrix.os }}
    needs: rust-core
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-26
            xcode: "26.0.1"
          - os: macos-26
            xcode: "26.1.1"
          - os: macos-26
            xcode: "26.2"
          - os: macos-26
            xcode: "26.3"
          # - os: macos-26
          #   xcode: "26.4"
          # - os: macos-26
          #   xcode: "26.5-beta"
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Set Xcode developer directory
        run: |
          XCODE_APP_VERSION="${{ matrix.xcode }}"
          XCODE_APP_VERSION="${XCODE_APP_VERSION//-/_}"
          echo "DEVELOPER_DIR=/Applications/Xcode_${XCODE_APP_VERSION}.app/Contents/Developer" >> "$GITHUB_ENV"

      - name: Read rust-toolchain
        id: rust-version
        run: echo "toolchain=$(yq '.toolchain.channel' rust-toolchain.toml)" >> $GITHUB_OUTPUT

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ steps.rust-version.outputs.toolchain }}

      - name: Cache dependencies
        uses: Swatinem/rust-cache@v2

      - name: Restore Swift .build cache
        id: restore-swift-build
        uses: actions/cache/restore@v4
        with:
          path: swift/.build
          restore-keys: "swiftpm-build-${{ runner.os }}-${{ matrix.xcode }}-"
          key: "swiftpm-build-${{ runner.os }}-${{ matrix.xcode }}-${{ hashFiles('**/Package.swift', '**/Package.resolved') }}"

      - name: Build Swift artifacts (Rust + XCFramework + Bindings)
        run: bash scripts/package-swift.sh

      - name: Build Swift package
        working-directory: swift
        run: swift build

      - name: Run Swift tests
        working-directory: swift
        run: set -o pipefail; xcodebuild test -scheme IDKit -destination "platform=macOS" | xcbeautify

      - name: Check Swift sample app destinations
        id: check-destinations
        run: |
          xcodebuild -version

          DESTINATIONS=$(xcodebuild -showdestinations \
            -project swift/Examples/IDKitSampleApp/IDKitSampleApp.xcodeproj \
            -scheme IDKitSampleApp 2>&1)
          echo "$DESTINATIONS"
          if echo "$DESTINATIONS" | grep -q "Available destinations"; then
            echo "has_destinations=true" >> $GITHUB_OUTPUT
          else
            echo "has_destinations=false" >> $GITHUB_OUTPUT
            echo "No available destinations — skipping build"
          fi

      - name: Download iOS platform
        if: steps.check-destinations.outputs.has_destinations == 'false'
        run: xcodebuild -downloadPlatform iOS

      - name: Build Swift sample app for iOS
        run: |
          set -o pipefail; xcodebuild \
            -project swift/Examples/IDKitSampleApp/IDKitSampleApp.xcodeproj \
            -scheme IDKitSampleApp \
            -sdk iphoneos \
            -destination "generic/platform=iOS" \
            CODE_SIGNING_ALLOWED=NO \
            build | xcbeautify

      - name: Build Swift sample app for iOS Simulator
        run: |
          set -o pipefail; xcodebuild \
            -project swift/Examples/IDKitSampleApp/IDKitSampleApp.xcodeproj \
            -scheme IDKitSampleApp \
            -sdk iphonesimulator \
            -destination "generic/platform=iOS Simulator" \
            CODE_SIGNING_ALLOWED=NO \
            build | xcbeautify

      - name: Cache Swift .build
        if: steps.restore-swift-build.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: swift/.build
          key: "swiftpm-build-${{ runner.os }}-${{ matrix.xcode }}-${{ hashFiles('**/Package.swift', '**/Package.resolved') }}"

  js-packages:
    name: JavaScript - Build & Test
    runs-on:
      group: arc-public-large-amd64-runner
    needs: rust-core
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9

      - name: Read rust-toolchain
        id: rust-version
        run: echo "toolchain=$(yq '.toolchain.channel' rust-toolchain.toml)" >> $GITHUB_OUTPUT

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ steps.rust-version.outputs.toolchain }}

      - name: Cache dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install wasm-pack
        run: cargo install wasm-pack --locked

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Check formatting
        run: pnpm lint:js

      - name: Build packages
        run: pnpm build

      - name: Run tests
        run: pnpm test

  kotlin-bindings:
    name: Kotlin Bindings - Build (multi-ABI)
    runs-on: ubuntu-latest
    needs: rust-core
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Free disk space
        run: |
          df -h
          sudo rm -rf /opt/hostedtoolcache/CodeQL \
                      /usr/share/dotnet \
                      /opt/ghc || true
          sudo apt-get clean
          docker system prune -af || true
          docker volume prune -f || true
          docker builder prune -af || true
          df -h

      - name: Read rust-toolchain
        id: rust-version
        run: echo "toolchain=$(yq '.toolchain.channel' rust-toolchain.toml)" >> $GITHUB_OUTPUT

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ steps.rust-version.outputs.toolchain }}

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install cross (for Android targets, if not cached)
        run: command -v cross || cargo install cross --git https://github.com/cross-rs/cross --locked

      - name: Build Kotlin bindings (host + Android ABIs)
        run: ./scripts/build-kotlin.sh

      - name: Setup Android SDK
        uses: android-actions/setup-android@v4
        with:
          packages: tools platform-tools platforms;android-35 build-tools;35.0.0

      - name: Run tests
        working-directory: kotlin/
        run: gradle bindings:test

      - name: Build Kotlin sample app
        working-directory: kotlin/Examples/IDKitSampleApp
        run: ./gradlew :app:assembleDebug

      - name: Validate Kotlin Maven publication
        run: |
          set -euo pipefail

          ./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin :bindings:publishToMavenLocal
          ./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin \
            -Pidkit.publish.mavenCentral=true \
            :bindings:publishToMavenCentral --dry-run

          VERSION="$(grep '^version=' kotlin/gradle.properties | cut -d= -f2- | tr -d '[:space:]')"
          ARTIFACT_DIR="$HOME/.m2/repository/com/worldcoin/idkit/$VERSION"
          ARTIFACT_BASE="$ARTIFACT_DIR/idkit-$VERSION"

          for artifact in \
            "$ARTIFACT_BASE.aar" \
            "$ARTIFACT_BASE.pom" \
            "$ARTIFACT_BASE.module" \
            "$ARTIFACT_BASE-sources.jar" \
            "$ARTIFACT_BASE-javadoc.jar"; do
            if [ ! -s "$artifact" ]; then
              echo "::error::Missing Maven publication artifact: $artifact"
              exit 1
            fi
          done

          grep -q '<groupId>com.worldcoin</groupId>' "$ARTIFACT_BASE.pom"
          grep -q '<artifactId>idkit</artifactId>' "$ARTIFACT_BASE.pom"
          grep -q '<packaging>aar</packaging>' "$ARTIFACT_BASE.pom"

          AAR_CONTENTS="$(mktemp)"
          jar tf "$ARTIFACT_BASE.aar" > "$AAR_CONTENTS"
          for abi in arm64-v8a armeabi-v7a x86 x86_64; do
            if ! grep -q "^jni/$abi/libidkit.so$" "$AAR_CONTENTS"; then
              echo "::error::Missing native library in AAR: jni/$abi/libidkit.so"
              exit 1
            fi
          done