build.yml

name: Build & Release

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      version:
        description: "@photostructure/sqlite release: bump version (current = use package.json)"
        required: false
        type: choice
        default: "current"
        options:
          - current
          - patch
          - minor
          - major

run-name: ${{ github.event_name == 'workflow_dispatch' && format('Release - {0}', github.event.inputs.version) || format('Build - {0}', github.event.head_commit.message || github.event.pull_request.title) }}

jobs:
  lint:
    runs-on: ubuntu-24.04
    timeout-minutes: 30 # Extend timeout to 30 minutes (default is 6 hours for a job)
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - run: sudo apt-get update
      - run: sudo apt-get install -y clang-tidy bear build-essential
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: 20
          cache: "npm"
      - run: npm ci --ignore-scripts
      - run: npm run build:dist
      - run: npm run lint
        timeout-minutes: 20 # Give the lint step more time

  prebuild-mac-x64:
    runs-on: macos-15-intel # Intel x64 runner
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: 20
          cache: "npm"
      - run: npm ci --ignore-scripts
      - run: npm run build:native
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: prebuilds-mac-x64
          path: prebuilds/

  prebuild-mac-arm64:
    runs-on: macos-14 # Apple Silicon ARM64 (macos-14+ are ARM64)
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: 20
          cache: "npm"
      - run: npm ci --ignore-scripts
      - run: npm run build:native
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: prebuilds-mac-arm64
          path: prebuilds/

  prebuild-win-x64:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: 20
          cache: "npm"
      - run: npm ci --ignore-scripts
      - run: npm run build:native
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: prebuilds-win-x64
          path: prebuilds/

  prebuild-win-arm64:
    runs-on: windows-11-arm # Native ARM64 runner (public repos only)
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: 20
          cache: "npm"
      - run: npm ci --ignore-scripts
      - run: npm run build:native
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: prebuilds-win-arm64
          path: prebuilds/

  prebuild-linux-glibc:
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x64
            runner: ubuntu-24.04
          - arch: arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - run: npm ci --ignore-scripts
      - run: TARGET_ARCH=${{ matrix.arch }} npm run build:native:linux
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: prebuilds-linux-${{ matrix.arch }}-glibc
          path: prebuilds/

  prebuild-linux-musl:
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x64
            runner: ubuntu-24.04
            platform: linux/amd64
          - arch: arm64
            runner: ubuntu-24.04-arm
            platform: linux/arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - run: |
          CONTAINER_NAME="node-sqlite-musl-build-$$"
          docker run -d --name "$CONTAINER_NAME" --platform ${{ matrix.platform }} node:20-alpine sleep 3600
          docker cp . "$CONTAINER_NAME:/tmp/project"
          docker exec "$CONTAINER_NAME" sh -c "cd /tmp/project && apk add build-base git python3 py3-setuptools --update-cache && npm ci --ignore-scripts && npm run build:native && cd test/fixtures/test-extension && node build.js --force"
          docker cp "$CONTAINER_NAME:/tmp/project/prebuilds" . 2>/dev/null || true
          docker cp "$CONTAINER_NAME:/tmp/project/build" . 2>/dev/null || true
          docker cp "$CONTAINER_NAME:/tmp/project/test/fixtures/test-extension/test_extension.so" test/fixtures/test-extension/ 2>/dev/null || true
          docker rm -f "$CONTAINER_NAME" >/dev/null
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: prebuilds-linux-${{ matrix.arch }}-musl
          path: prebuilds/
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: test-extension-linux-${{ matrix.arch }}-musl
          path: test/fixtures/test-extension/test_extension.so
          if-no-files-found: warn

  test-mac-win:
    needs:
      - prebuild-mac-x64
      - prebuild-mac-arm64
      - prebuild-win-x64
      - prebuild-win-arm64
    strategy:
      fail-fast: false
      matrix:
        os: [macos-15-intel, macos-14, windows-latest, windows-11-arm]
        node-version: [20, 22, 24, 25]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: ./prebuilds
          merge-multiple: true
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: ${{ matrix.node-version }}
          cache: "npm"
      - run: npm ci
      - run: npm run build:dist
      - run: npm test

  test-ubuntu:
    needs:
      - prebuild-linux-glibc
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, ubuntu-24.04]
        arch: [x64, arm64]
        node-version: [20, 22, 24, 25]
    runs-on: ${{ matrix.arch == 'arm64' && format('{0}-arm', matrix.os) || matrix.os }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: ${{ matrix.node-version }}
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: ./prebuilds
          merge-multiple: true
      - run: npm ci
      - run: npm run build:dist
      - run: npm test

  test-alpine:
    needs:
      - prebuild-linux-musl
    strategy:
      fail-fast: false
      matrix:
        arch: [x64, arm64]
        node-version: [20, 22, 24, 25]
        include:
          - arch: x64
            runner: ubuntu-24.04
            platform: linux/amd64
          - arch: arm64
            runner: ubuntu-24.04-arm
            platform: linux/arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: ./prebuilds
          merge-multiple: true
      - name: Download test extension for this architecture
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: test-extension-linux-${{ matrix.arch }}-musl
          path: ./test/fixtures/test-extension
        continue-on-error: true
      - run: |
          docker run --rm -v $(pwd):/tmp/project --entrypoint /bin/sh --platform ${{ matrix.platform }} node:${{ matrix.node-version }}-alpine -c "\
          apk add build-base git python3 py3-setuptools --update-cache && \
          cd /tmp/project && \
          npm ci && \
          npm run build:dist && \
          npm test"

  # Node.js compatibility tests require --experimental-sqlite flag and Node 22+
  # We test only on Node 24 as the experimental SQLite API may change between versions
  test-api-compatibility:
    needs:
      - prebuild-mac-x64
      - prebuild-mac-arm64
      - prebuild-win-x64
      - prebuild-win-arm64
      - prebuild-linux-glibc

    strategy:
      fail-fast: false # Don't cancel other jobs if one fails
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node-version: [24]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: ./prebuilds
          merge-multiple: true
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: ${{ matrix.node-version }}
          cache: "npm"
      - run: npm ci
      - run: npm run build:dist
      - name: Check API compatibility types (TypeScript compile-time validation)
        run: npm run lint:api
      - name: Run API type compatibility tests (ensures our TypeScript types match node:sqlite)
        run: npm run test:api
      - name: Run behavioral compatibility tests (validates runtime behavior matches node:sqlite)
        run: npm run test:node

  publish:
    if: ${{ github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-24.04
    needs:
      - lint
      - test-mac-win
      - test-ubuntu
      - test-alpine
      - test-api-compatibility
    permissions:
      contents: write
      packages: write
      id-token: write # Required for NPM Trusted Publishing (OIDC)
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Fetch full history for proper git operations
          fetch-depth: 0

      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: ./prebuilds
          merge-multiple: true

      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: lts/*
          cache: "npm"
          registry-url: "https://registry.npmjs.org"

      - uses: photostructure/git-ssh-signing-action@fdd4b062a9ba41473f013258cc9c7eea1640f826 # v1.2.0
        with:
          ssh-signing-key: ${{ secrets.SSH_SIGNING_KEY }}
          git-user-name: ${{ secrets.GIT_USER_NAME }}
          git-user-email: ${{ secrets.GIT_USER_EMAIL }}

      - run: ls -laR ./prebuilds

      - run: npm install -g npm@latest # Ensure latest npm for publishing

      - run: npm ci

      - run: npm run release:prepare

      - name: Version and tag release
        run: |
          # Handle version bump based on input
          if [ "${{ github.event.inputs.version }}" = "current" ]; then
            # Use the version from package.json, stripping any pre-release suffix
            RELEASE_VERSION=$(node -p "require('./package.json').version.replace(/-.*$/, '')")
            npm version $RELEASE_VERSION --message "release: %s"
          else
            # Normal version bump (patch, minor, major)
            npm version ${{ github.event.inputs.version }} --message "release: %s"
          fi

          # Get the new version for later use
          NEW_VERSION=$(node -p "require('./package.json').version")
          # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#environment-files
          echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_ENV

      - name: Publish to npm
        # Uses OIDC token from id-token: write permission (no NPM_TOKEN secret needed)
        # Provenance generates signed attestation linking the package to this workflow
        # See: https://docs.npmjs.com/generating-provenance-statements
        run: npm publish --provenance --access public

      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Push the version commit and tag
          git push origin main --follow-tags

          # Create GitHub release
          gh release create "v$NEW_VERSION" \
            --title "Release v$NEW_VERSION" \
            --generate-notes \
            --verify-tag