go.yml

name: Go package

on:
  push:
    tags:
      - "v*" # push events to tagged commits
    branches:
      - "**"

permissions:
  contents: read
  id-token: write # for GitHub id-token auth

jobs:
  go-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: src/go.mod
          cache-dependency-path: src/go.sum

      - name: Run Go unit tests
        run: go test -test.short -v ./...
        working-directory: src

      - name: Build MacOS binary
        run: GOOS=darwin go build ./cmd/cli
        working-directory: src

      - name: Build Windows binary
        run: GOOS=windows go build ./cmd/cli
        working-directory: src

      - name: Verify Go modules
        working-directory: src
        run: |
          go mod tidy
          git diff --exit-code go.mod go.sum || { echo "Go modules are not up to date"; exit 1; }

  nix-shell-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v26
        with:
          nix_path: nixpkgs=channel:nixos-unstable

      - name: Check nix-shell default.nix
        run: |
          set -o pipefail
          nix-shell --pure -E 'with import <nixpkgs> {}; mkShell { buildInputs = [ (import ./default.nix {}) ]; }' --run defang 2>&1 | sed -u 's|\s\+got:|::error file=pkgs/defang/cli.nix,line=6::Replace the vendorHash with the correct value:|'

  # go-byoc-test:
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: Configure AWS Credentials for CI
  #       uses: aws-actions/configure-aws-credentials@v4
  #       with:
  #         aws-region: us-west-2
  #         output-credentials: true
  #         role-to-assume: arn:aws:iam::488659951590:role/ci-role-d4fe904 # ciRoleArn from defang-io/infrastructure stack

  #     - name: Configure AWS Credentials for Staging
  #       uses: aws-actions/configure-aws-credentials@v4
  #       with:
  #         aws-region: us-west-2
  #         role-duration-seconds: 1200
  #         role-chaining: true
  #         role-to-assume: arn:aws:iam::426819183542:role/admin # adminUserRoleArn from defang-io/bootstrap stack

  #     - uses: actions/checkout@v4

  #     - name: Set up Go
  #       uses: actions/setup-go@v5
  #       with:
  #         go-version-file: src/go.mod
  #         cache-dependency-path: src/go.sum

  #     - name: Run sanity tests
  #       run: go run ./cmd/cli compose up -f tests/compose.yaml
  #       working-directory: src

  go-playground-test:
    runs-on: ubuntu-latest
    needs: go-test
    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: src/go.mod
          cache-dependency-path: src/go.sum

      - name: Login using GitHub token
        run: go run ./cmd/cli login --debug
        working-directory: src

      - name: Add dummy config
        run: echo blah | go run ./cmd/cli config set -n dummy -f tests/sanity/compose.yaml --debug
        working-directory: src

      - name: Run sanity tests UP
        run: go run ./cmd/cli compose up -f tests/sanity/compose.yaml --debug
        working-directory: src

      - name: Run sanity tests DOWN
        run: go run ./cmd/cli compose stop -f tests/sanity/compose.yaml --debug
        working-directory: src

  go-release:
    if: startsWith(github.ref, 'refs/tags/v') # only run this step on tagged commits
    needs: go-test
    runs-on: macos-latest
    permissions:
      contents: write # to upload archives as GitHub Releases
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # for release notes

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: src/go.mod
          cache-dependency-path: src/go.sum

      - name: Download Go dependencies
        run: go mod download
        working-directory: src

      - name: Install Nix (for nix-prefetch-url)
        uses: cachix/install-nix-action@v26

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v5
        with:
          # distribution: goreleaser-pro # either 'goreleaser' (default) or 'goreleaser-pro'
          # version: latest
          args: release --clean
          workdir: src
        env:
          GH_PAT_WINGET: ${{ secrets.GH_PAT_WINGET }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # GITHUB_TOKEN is limited to the current repository
          MACOS_CERTIFICATE_NAME: ${{ secrets.MACOS_CERTIFICATE_NAME }}
          MACOS_P12_BASE64: ${{ secrets.MACOS_P12_BASE64 }}
          MACOS_P12_PASSWORD: ${{ secrets.MACOS_P12_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
          DISCORD_WEBHOOK_ID: ${{ secrets.DISCORD_WEBHOOK_ID }}
          DISCORD_WEBHOOK_TOKEN: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}

      - name: Notarize macOS app
        shell: bash
        run: |
          xcrun notarytool submit src/dist/defang_*_macOS.zip --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_APP_PW"
        env:
          MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
          MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
          MACOS_NOTARIZATION_APP_PW: ${{ secrets.MACOS_NOTARIZATION_APP_PW }}

  post-build:
    runs-on: ubuntu-latest
    needs: go-release

    env:
      NODE_VERSION: "21"
      NPM_REGISTRY_URL: "https://registry.npmjs.org"

    defaults:
      run:
        shell: bash
        working-directory: ./pkgs/npm

    steps:
      - name: Trigger CLI Autodoc
        uses: peter-evans/repository-dispatch@v3
        with:
          token: ${{ secrets.DOCS_ACTION_TRIGGER_TOKEN }}
          repository: DefangLabs/defang-docs
          event-type: cli-autodoc
          client-payload: '{"version": "${{ github.ref_name }}"}'

      - name: Trigger Homebrew Formula Update
        uses: peter-evans/repository-dispatch@v1
        with:
          token: ${{ secrets.HOMEBREW_ACTION_TRIGGER_TOKEN }}
          repository: DefangLabs/homebrew-defang
          event-type: update-homebrew-formula
          client-payload: '{"version": "${{ github.ref_name }}"}'

      - name: Checkout tag
        uses: actions/checkout@v4

      - name: Install node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: ${{ env.NPM_REGISTRY_URL }}

      - name: Publish to NPM
        run: |
          # Get version number without the 'v'
          export version_number=`echo "${{ github.ref_name }}" | cut -c2- `

          echo "Setting version number to ${version_number}"
          # update version placeholder in package.json with version matching binary.
          npm version ${version_number}

          # install dependencies
          npm ci --ignore-scripts

          #b uild
          npm run build

          # make the cli.js executable
          chmod u+x ./bin/cli.js

          # publish the package
          npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPMJS_AUTH_TOKEN }}