local-release-matrix.sh

#!/usr/bin/env bash
set -euo pipefail

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
fuzz_seconds="${KOMMS_FUZZ_SECONDS:-60}"
android_required="${KOMMS_REQUIRE_ANDROID_APP:-0}"
ios_required="${KOMMS_REQUIRE_IOS_APP:-0}"
service_containers_required="${KOMMS_REQUIRE_SERVICE_CONTAINERS:-0}"

run() {
    printf '\n==> %s\n' "$*"
    "$@"
}

run_in() {
    local directory="$1"
    shift
    printf '\n==> (%s) %s\n' "$directory" "$*"
    (cd "$directory" && "$@")
}

export RUSTFLAGS="${RUSTFLAGS:--D warnings}"

run_in "$root" python3 scripts/check-release-version.py
run_in "$root" python3 scripts/check-docs.py
run_in "$root" python3 scripts/localization.py check
run_in "$root" python3 scripts/check-localization-sources.py
run_in "$root" python3 scripts/test-localization.py
run_in "$root" python3 scripts/check-message-request-accessibility.py
run_in "$root" python3 scripts/check-shell-accessibility.py
run_in "$root" python3 scripts/test-contributor-check.py
run_in "$root" python3 scripts/check-stewardship.py
run_in "$root" python3 scripts/test-stewardship.py
run_in "$root" python3 scripts/check-release-engineering.py
run_in "$root" python3 scripts/test_security_review_package.py
run_in "$root" python3 scripts/security_review_package.py --check
run_in "$root" python3 scripts/test-android-license-evidence.py
run_in "$root" python3 scripts/test-release-evidence.py
run_in "$root" python3 scripts/test-release-qualification.py
run_in "$root" python3 scripts/test-field-qualification.py
run_in "$root" python3 scripts/test-release-signing.py
run_in "$root" python3 scripts/test-stable-beta-readiness.py
run_in "$root" python3 scripts/test-stage-release-artifacts.py
run_in "$root" cargo build --locked -p kult-conformance
run_in "$root" python3 scripts/update-conformance-vectors.py \
    --check --adapter target/debug/kult-conformance
run_in "$root" python3 scripts/build-conformance-kit.py --check
run_in "$root" python3 conformance/v1/run.py \
    --adapter target/debug/kult-conformance
run_in "$root" bash -n scripts/install-xcodegen.sh
run_in "$root" cargo fmt --all -- --check
run_in "$root" cargo clippy --workspace --all-targets --all-features
run_in "$root" cargo test --workspace --all-features
run_in "$root" cargo build -p kult-crypto -p kult-protocol --no-default-features
run_in "$root" cargo deny check
run_in "$root" scripts/store-scale-gate.sh

desktop="$root/apps/desktop/src-tauri"
run_in "$desktop" cargo fmt --all -- --check
run_in "$desktop" cargo clippy --all-targets --all-features
run_in "$desktop" cargo test --all-features
run_in "$desktop" cargo deny check

if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
    revision="$(git -C "$root" rev-parse HEAD)"
    source_date_epoch="$(git -C "$root" show -s --format=%ct HEAD)"
    run_in "$root" docker build \
        --build-arg "KOMMS_SOURCE_REVISION=$revision" \
        --build-arg "SOURCE_DATE_EPOCH=$source_date_epoch" \
        --tag komms-kultd:local-release .
    service_images=(
        "reference-service|deploy/reference-service/Dockerfile|komms-reference-service:local-release|REFERENCE_SERVICE_IMAGE|deploy/reference-service/smoke-test.sh"
        "mailbox-service|deploy/mailbox-service/Dockerfile|komms-mailbox:local-release|MAILBOX_SERVICE_IMAGE|deploy/mailbox-service/smoke-test.sh"
        "wake-gateway|deploy/wake-gateway/Dockerfile|komms-wake:local-release|WAKE_GATEWAY_IMAGE|deploy/wake-gateway/smoke-test.sh"
        "ohttp-relay|deploy/ohttp-relay/Dockerfile|komms-ohttp-relay:local-release|KOMMS_OHTTP_RELAY_IMAGE|deploy/ohttp-relay/smoke-test.sh"
    )
    for entry in "${service_images[@]}"; do
        IFS='|' read -r label dockerfile image image_variable smoke <<<"$entry"
        run_in "$root" docker build \
            --build-arg "KOMMS_SOURCE_REVISION=$revision" \
            --build-arg "SOURCE_DATE_EPOCH=$source_date_epoch" \
            --file "$dockerfile" \
            --tag "$image" .
        printf '\n==> (%s) %s\n' "$root" "$smoke"
        (
            cd "$root"
            export "$image_variable=$image"
            "$smoke"
        )
        printf 'Validated local %s image %s\n' "$label" "$image"
    done
else
    printf '\nDEFERRED: endpoint/service container build and restart gates need an accessible Docker daemon.\n'
    if [[ "$service_containers_required" == "1" ]]; then
        exit 1
    fi
fi

if command -v gradle >/dev/null 2>&1 && java -version >/dev/null 2>&1; then
    run_in "$root/apps/android" gradle :core:build -Pkomms.androidApp=false --rerun-tasks
else
    printf '\nDEFERRED: Android host-core gate needs JDK 17+ and Gradle.\n'
    if [[ "$android_required" == "1" ]]; then
        exit 1
    fi
fi

android_sdk="${ANDROID_SDK_ROOT:-${ANDROID_HOME:-}}"
if [[ -n "$android_sdk" && -d "$android_sdk" ]] && command -v cargo-ndk >/dev/null 2>&1; then
    run_in "$root/apps/android" gradle \
        :app:assemblePlayDebug :app:assembleGoogleFreeDebug \
        :app:testPlayDebugUnitTest :app:testGoogleFreeDebugUnitTest \
        :app:lintPlayDebug :app:lintGoogleFreeDebug \
        -Pkomms.androidApp=true
    run_in "$root" scripts/check-android-google-free.sh
else
    printf '\nDEFERRED: Android APK/lint gate needs Android SDK/NDK and cargo-ndk.\n'
    if [[ "$android_required" == "1" ]]; then
        exit 1
    fi
fi

if command -v swift >/dev/null 2>&1; then
    if [[ -d /Applications/Xcode.app ]]; then
        export DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
        export PATH="$DEVELOPER_DIR/Toolchains/XcodeDefault.xctoolchain/usr/bin:$PATH"
        # The toolchain's clang is invoked directly (not via the /usr/bin
        # shims), so it needs the SDK spelled out or C deps like ring fail
        # with missing system headers.
        SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
        export SDKROOT
    fi
    run_in "$root" "$root/apps/ios/scripts/test-core.sh"
else
    printf '\nDEFERRED: iOS host-core gate needs Swift 5.9+.\n'
    if [[ "$ios_required" == "1" ]]; then
        exit 1
    fi
fi

if [[ -d /Applications/Xcode.app ]] && command -v xcodegen >/dev/null 2>&1; then
    run_in "$root" "$root/apps/ios/scripts/build-xcframework.sh"
    run_in "$root/apps/ios/KommsApp" xcodegen generate
    run_in "$root/apps/ios/KommsApp" xcodebuild -quiet \
        -project KommsApp.xcodeproj -scheme KommsApp -sdk iphonesimulator \
        -configuration Debug CODE_SIGNING_ALLOWED=NO ONLY_ACTIVE_ARCH=YES \
        ARCHS=arm64 build
else
    printf '\nDEFERRED: iOS app gate needs full Xcode and XcodeGen.\n'
    if [[ "$ios_required" == "1" ]]; then
        exit 1
    fi
fi

crypto_fuzz=(
    envelope_decode handshake_decode bundle_decode mnemonic_decode
    attachment_chunk_open device_prekey_decode call_media_open
    group_origin_envelope_decode discovery_decode rendezvous_open
)
for target in "${crypto_fuzz[@]}"; do
    run_in "$root/crates/kult-crypto" cargo +nightly fuzz run "$target" -- \
        "-max_total_time=$fuzz_seconds"
done

protocol_fuzz=(
    protocol_envelope_decode admission_envelope_decode bundle_import
    reassembler_insert content_decode
    capability_decode attachment_manifest_decode attachment_bulk_decode
    attachment_ranges mention_decode edit_decode ephemeral_decode poll_decode
    group_authority_decode group_control_decode device_sync_bundle_decode
    call_control_decode discovery_control_decode rendezvous_decode wake_decode
)
for target in "${protocol_fuzz[@]}"; do
    run_in "$root/crates/kult-protocol" cargo +nightly fuzz run "$target" -- \
        "-max_total_time=$fuzz_seconds"
done

run_in "$root" git diff --check
run_in "$root" git status --short
printf '\nLocal release matrix passed. Review any DEFERRED gates above before publication.\n'