# Steps run in file order, in one container, sharing /ci/build.
# Alpine, so the published binary is the same static musl build the
# Containerfile ships.

image = "docker.io/rust:1.98-alpine3.24"
work_dir = "/ci/build"
clone_project_to = "/ci/build/project"

# busybox ash, which does support `set -o pipefail`.
shell = ["/bin/sh", "-c"]

# CARGO_TARGET_DIR must stay outside clone_project_to: the checkout is
# extracted over that directory, so a cache inside it would be overwritten.
shell_setup = """
set -euo pipefail
export CARGO_TARGET_DIR=/ci/cache/target
"""

timeout = 5400
memory_limit = "6g"

# Caps are a safety valve against unbounded growth, not a budget: hitting one
# costs a full rebuild. Sized roughly twice the working set. A local target
# holding all three profiles measures 26G, of which debug is 22G.
cache = [
  { path = "/ci/cache/target", max_size = "20g" },
  { path = "/usr/local/cargo/registry", max_size = "4g" },
  { path = "/root/.bun/install/cache", max_size = "2g" },
]

[on]
push = ["master"]
tag = true

# bun publishes no musl installer, so take the binary from the official image.
# This mirrors the Containerfile's COPY --from. The -alpine tag is required:
# the glibc build will not run here. bun also needs libstdc++, which setup
# installs before anything executes it.
[[copy]]
image = "docker.io/oven/bun:1.4.2-alpine"
from = "/usr/local/bin/bun"
to = "/usr/local/bin"

[variables]

  [variables.TRUNK_VERSION]
  default = "0.21.14"
  description = "Trunk release that builds the wasm frontend. Matches the Containerfile."

# ── toolchain ────────────────────────────────────────────────────────────────
# binaryen supplies wasm-opt. Without it trunk downloads a glibc build that
# cannot run on musl. just comes from apk here, so no install script.
[[steps]]
name = "setup"
timeout = 900
run_sh = """
# openssl-dev + openssl-libs-static: webauthn-rs links OpenSSL, and this is
# a static musl build. make builds jemalloc. Mirrors the Containerfile's
# build stage.
apk add --no-cache musl-dev binaryen just curl libstdc++ podman-remote make \
  openssl-dev openssl-libs-static pkgconfig

# The official rust images use rustup's minimal profile, so rustfmt and
# clippy are absent. `just lint` needs both.
rustup component add rustfmt clippy
rustup target add wasm32-unknown-unknown

url="https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-musl.tar.gz"
curl -fsSL -o /tmp/trunk.tar.gz "$url"
curl -fsSL "$url.sha256" | awk '{print $1 "  /tmp/trunk.tar.gz"}' | sha256sum -c -
tar xzf /tmp/trunk.tar.gz -C /usr/local/bin
rm -f /tmp/trunk.tar.gz

just --version && bun --version && trunk --version
cargo fmt --version && cargo clippy --version
"""

# ── checks ───────────────────────────────────────────────────────────────────
# Formatting and clippy findings are reported, not gated. The pinned CI
# toolchain can lag local machines, and clippy disagrees across versions.
[[steps]]
name = "lint"
run_sh = "cd project && just lint"
warn_on_fail = true

# `just test` covers server and api-types only, hence the extra web run.
[[steps]]
name = "test"
run_sh = "cd project && just test && cargo test -p web"

# ── build ────────────────────────────────────────────────────────────────────
[[steps]]
name = "build"
timeout = 2400
run_sh = "cd project && just build"
publish_file = ["/ci/cache/target/release/dovenest"]

# `just e2e` would rebuild the frontend. The build step already staged
# server/dist, so run the embedded suite against it directly.
[[steps]]
name = "e2e"
run_sh = "cd project && cargo test -p server --features embedded"

# ── release ──────────────────────────────────────────────────────────────────
[[steps]]
name = "release"
run_if = 'test -n "${CI_COMMIT_TAG}"'
run_sh = """
cd project
install -Dm755 "${CARGO_TARGET_DIR}/release/dovenest" \
  "dist/dovenest-${CI_COMMIT_TAG}-x86_64-linux-musl"
"""
publish_gzip = ["/ci/build/project/dist/"]

# ── image ────────────────────────────────────────────────────────────────────
# Packages the binary the build step made, so the image ships exactly what
# e2e tested. The Containerfile's build stage is skipped via BIN_STAGE.
# engine_socket hands this step the host engine, which is Podman on this
# server (needs CI_ENGINE_SOCKET=1). REGISTRY_PASSWORD is a CI secret with the
# admin password. CI_REGISTRY is "<host>/<repo>" on the built-in registry.
# Tags: every run pushes the short sha and "edge"; a tag run also pushes the
# tag and "latest".
[[steps]]
name = "image"
engine_socket = true
timeout = 900
run_sh = """
cd project
mkdir -p ci-bin
cp "${CARGO_TARGET_DIR}/release/dovenest" ci-bin/dovenest

echo "$REGISTRY_PASSWORD" | podman-remote login "${CI_REGISTRY%%/*}" -u admin --password-stdin

# A remote build sends a seccomp profile path that the server opens. Alpine
# ships one at /etc/containers/seccomp.json and podman picks it over the
# /usr/share copy, but the server has only the latter. Ask the server for its
# own path. An empty answer means no profile can be named, so the build runs
# unconfined rather than failing.
prof=$(podman-remote info --format '{{.Host.Security.SECCOMPProfilePath}}' 2>/dev/null || true)
if [ -n "$prof" ]; then
  seccomp="seccomp=$prof"
else
  seccomp="seccomp=unconfined"
fi

img="$CI_REGISTRY:$CI_COMMIT_SHORT_SHA"
podman-remote build --security-opt "$seccomp" \
  -f Containerfile -t "$img" --build-arg BIN_STAGE=prebuilt .
podman-remote push "$img"

if [ -n "${CI_COMMIT_TAG:-}" ]; then
  tags="$CI_COMMIT_TAG latest"
else
  tags="edge"
fi
for t in $tags; do
  podman-remote tag "$img" "$CI_REGISTRY:$t"
  podman-remote push "$CI_REGISTRY:$t"
done
"""