.gitlab-ci.yml

# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Push a raw SemVer tag, such as `0.1.0` or `0.1.0-alpha.20260515`,
# to run the publishing pipeline.
workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == 'push' && $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == 'push' && $CI_COMMIT_BRANCH
    - when: never

stages:
  - check
  - collect
  - publish

variables:
  NEMO_RELAY_CI_DEBIAN_VERSION: "trixie"
  # Artifactory 7.133 rejects Cargo 1.96's required octet-stream publish header.
  NEMO_RELAY_CI_CARGO_PUBLISH_VERSION: "1.93.0"
  NEMO_RELAY_CI_JUST_VERSION: "1.40.0"
  NEMO_RELAY_CI_NODE_VERSION: "24"
  NEMO_RELAY_CI_PYTHON_VERSION: "3.11"
  NEMO_RELAY_CI_RUST_VERSION: "1.96.1"
  NEMO_RELAY_CI_UV_VERSION: "0.9.28"
  NEMO_RELAY_CI_GITHUB_REPOSITORY: "NVIDIA/NeMo-Relay"
  NEMO_RELAY_CI_GITHUB_WORKFLOW_FILE: "ci.yaml"
  NEMO_RELAY_CI_GITHUB_RUN_WAIT_SECONDS: "7200"
  NEMO_RELAY_CI_GITHUB_RUN_POLL_SECONDS: "60"

check:sonar:
  stage: check
  image:
    name: sonarsource/sonar-scanner-cli:latest
    pull_policy: if-not-present
    entrypoint: [""]
  variables:
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"
    GIT_DEPTH: "0"
  cache:
    key: "${CI_JOB_NAME}"
    paths:
      - .sonar/cache
  rules:
    - if: $CI_PIPELINE_SOURCE == 'push' && $CI_COMMIT_BRANCH
    - when: never
  script:
    - sonar-scanner
  allow_failure: true

collect:github-artifacts:
  stage: collect
  image:
    name: alpine:3.22
    pull_policy: if-not-present
  rules:
    - if: $CI_PIPELINE_SOURCE == 'push' && $CI_COMMIT_TAG
    - when: never
  before_script:
    - apk add --no-cache findutils github-cli unzip
  script:
    - |
      set -eu

      if [ -z "${NEMO_RELAY_CI_GITHUB_TOKEN:-}" ]; then
        echo "Error: NEMO_RELAY_CI_GITHUB_TOKEN is required to download GitHub Actions artifacts." >&2
        exit 1
      fi
      export GH_TOKEN="${NEMO_RELAY_CI_GITHUB_TOKEN}"

      mkdir -p collected/wheels collected/sdists collected/node downloaded

      tag="${CI_COMMIT_TAG:-}"
      if [ -z "$tag" ]; then
        echo "Error: CI_COMMIT_TAG is required to collect GitHub Actions artifacts for publishing." >&2
        exit 1
      fi

      tag_ref="tags/${tag}"
      deadline="$(( $(date -u +%s) + NEMO_RELAY_CI_GITHUB_RUN_WAIT_SECONDS ))"

      echo "Waiting for tag ${tag} in ${NEMO_RELAY_CI_GITHUB_REPOSITORY}"
      while ! gh api "repos/${NEMO_RELAY_CI_GITHUB_REPOSITORY}/git/ref/${tag_ref}" >/dev/null 2>&1; do
        if [ "$(date -u +%s)" -ge "$deadline" ]; then
          echo "Error: tag ${tag} did not appear within ${NEMO_RELAY_CI_GITHUB_RUN_WAIT_SECONDS} seconds." >&2
          exit 1
        fi
        sleep "$NEMO_RELAY_CI_GITHUB_RUN_POLL_SECONDS"
      done

      echo "Waiting for ${NEMO_RELAY_CI_GITHUB_WORKFLOW_FILE} run for tag ${tag}"
      run_id=""
      while [ -z "$run_id" ]; do
        run_id="$(
          gh run list \
            --repo "$NEMO_RELAY_CI_GITHUB_REPOSITORY" \
            --workflow "$NEMO_RELAY_CI_GITHUB_WORKFLOW_FILE" \
            --event push \
            --branch "$tag" \
            --limit 1 \
            --json databaseId \
            --jq '.[0].databaseId // ""'
        )"
        if [ -n "$run_id" ]; then
          break
        fi
        if [ "$(date -u +%s)" -ge "$deadline" ]; then
          echo "Error: no GitHub Actions run found for tag ${tag} within ${NEMO_RELAY_CI_GITHUB_RUN_WAIT_SECONDS} seconds." >&2
          exit 1
        fi
        sleep "$NEMO_RELAY_CI_GITHUB_RUN_POLL_SECONDS"
      done
      if [ -z "$run_id" ]; then
        echo "Error: no GitHub Actions run found for tag ${tag}." >&2
        exit 1
      fi

      run_html_url="$(
        gh run view "$run_id" \
          --repo "$NEMO_RELAY_CI_GITHUB_REPOSITORY" \
          --json url \
          --jq '.url'
      )"
      echo "Watching GitHub Actions run ${run_id} for tag ${tag}: ${run_html_url}"
      if ! timeout "$NEMO_RELAY_CI_GITHUB_RUN_WAIT_SECONDS" \
        gh run watch "$run_id" \
          --repo "$NEMO_RELAY_CI_GITHUB_REPOSITORY" \
          --interval "$NEMO_RELAY_CI_GITHUB_RUN_POLL_SECONDS" \
          --exit-status; then
        echo "Error: GitHub Actions run ${run_id} for tag ${tag} failed, was cancelled, or did not complete within ${NEMO_RELAY_CI_GITHUB_RUN_WAIT_SECONDS} seconds: ${run_html_url}" >&2
        exit 1
      fi

      gh run download "$run_id" --repo "$NEMO_RELAY_CI_GITHUB_REPOSITORY" --pattern 'wheel-*' --dir downloaded/wheels
      gh run download "$run_id" --repo "$NEMO_RELAY_CI_GITHUB_REPOSITORY" --pattern 'cli-python-wheel-*' --dir downloaded/cli-wheels
      gh run download "$run_id" --repo "$NEMO_RELAY_CI_GITHUB_REPOSITORY" --name 'plugin-wheel' --dir downloaded/wheels
      gh run download "$run_id" --repo "$NEMO_RELAY_CI_GITHUB_REPOSITORY" --name 'python-sdist' --dir downloaded/sdists
      gh run download "$run_id" --repo "$NEMO_RELAY_CI_GITHUB_REPOSITORY" --pattern 'node-npm-package-*' --dir downloaded/node

      find downloaded/wheels -type f -name '*.whl' -exec cp {} collected/wheels/ \;
      find downloaded/cli-wheels -type f -name '*.whl' -exec cp {} collected/wheels/ \;
      find downloaded/sdists -type f -name 'nemo_relay-*.tar.gz' -exec cp {} collected/sdists/ \;
      find downloaded/node -type f -name '*.tgz' -exec cp {} collected/node/ \;

      if ! ls collected/wheels/*.whl >/dev/null 2>&1; then
        echo "Error: collected GitHub wheel artifacts did not contain any .whl files." >&2
        exit 1
      fi
      if ! ls collected/sdists/nemo_relay-*.tar.gz >/dev/null 2>&1; then
        echo "Error: collected GitHub Python source distribution artifact did not contain a nemo-relay sdist." >&2
        exit 1
      fi
      if ! ls collected/node/*.tgz >/dev/null 2>&1; then
        echo "Error: collected GitHub Node artifacts did not contain any .tgz files." >&2
        exit 1
      fi

      {
        printf '{\n'
        printf '  "run_id": "%s",\n' "$run_id"
        printf '  "run_url": "%s",\n' "$run_html_url"
        printf '  "workflow": "%s",\n' "$NEMO_RELAY_CI_GITHUB_WORKFLOW_FILE"
        printf '  "tag": "%s"\n' "$tag"
        printf '}\n'
      } > collected/github-run.json
  artifacts:
    name: github-package-artifacts
    when: on_success
    expire_in: 7 days
    paths:
      - collected/wheels/*.whl
      - collected/sdists/nemo_relay-*.tar.gz
      - collected/node/*.tgz
      - collected/github-run.json

publish:artifactory:wheels:
  stage: publish
  image:
    name: ghcr.io/astral-sh/uv:${NEMO_RELAY_CI_UV_VERSION}-${NEMO_RELAY_CI_DEBIAN_VERSION}-slim
    pull_policy: if-not-present
  rules:
    - if: $CI_PIPELINE_SOURCE == 'push' && $CI_COMMIT_TAG
    - when: never
  needs:
    - job: collect:github-artifacts
      artifacts: true
  script:
    - |
      set -eu

      if [ -z "${NEMO_RELAY_CI_ARTIFACTORY_USER:-}" ] || [ -z "${NEMO_RELAY_CI_ARTIFACTORY_KEY:-}" ] || [ -z "${NEMO_RELAY_CI_ARTIFACTORY_PYPI_URL:-}" ]; then
        echo "Error: uploading Python package artifacts to Artifactory requires NEMO_RELAY_CI_ARTIFACTORY_USER, NEMO_RELAY_CI_ARTIFACTORY_KEY, and NEMO_RELAY_CI_ARTIFACTORY_PYPI_URL." >&2
        exit 1
      fi
      if ! ls collected/wheels/*.whl >/dev/null 2>&1 || ! ls collected/sdists/nemo_relay-*.tar.gz >/dev/null 2>&1; then
        echo "Error: no complete set of collected Python package artifacts found." >&2
        exit 1
      fi

      UV_PUBLISH_USERNAME="${NEMO_RELAY_CI_ARTIFACTORY_USER}" \
        UV_PUBLISH_PASSWORD="${NEMO_RELAY_CI_ARTIFACTORY_KEY}" \
        UV_PUBLISH_URL="${NEMO_RELAY_CI_ARTIFACTORY_PYPI_URL}" \
        uv publish --no-progress collected/wheels/*.whl collected/sdists/nemo_relay-*.tar.gz

publish:artifactory:cargo:
  stage: publish
  image:
    name: rust:${NEMO_RELAY_CI_RUST_VERSION}-${NEMO_RELAY_CI_DEBIAN_VERSION}
    pull_policy: if-not-present
  rules:
    - if: $CI_PIPELINE_SOURCE == 'push' && $CI_COMMIT_TAG
    - when: never
  needs:
    - job: collect:github-artifacts
      artifacts: true
  before_script:
    - apt-get update -qq && apt-get install -y --no-install-recommends ca-certificates curl git nodejs && rm -rf /var/lib/apt/lists/*
    - rustup toolchain install --profile minimal "${NEMO_RELAY_CI_CARGO_PUBLISH_VERSION}"
    - cargo install just --version "${NEMO_RELAY_CI_JUST_VERSION}" --locked
    - curl -LsSf https://astral.sh/uv/install.sh -o /tmp/install-uv.sh
    - UV_VERSION="${NEMO_RELAY_CI_UV_VERSION}" sh /tmp/install-uv.sh
    - export PATH="${HOME}/.cargo/bin:${HOME}/.local/bin:${PATH}"
    - uv python install "${NEMO_RELAY_CI_PYTHON_VERSION}"
    - rustc --version
    - just --version
    - uv --version
  script:
    - |
      set -eu

      if [ -z "${NEMO_RELAY_CI_ARTIFACTORY_KEY:-}" ] || [ -z "${NEMO_RELAY_CI_ARTIFACTORY_CARGO_URL:-}" ]; then
        echo "Error: uploading Cargo crates to Artifactory requires NEMO_RELAY_CI_ARTIFACTORY_KEY and NEMO_RELAY_CI_ARTIFACTORY_CARGO_URL." >&2
        exit 1
      fi
      if [ ! -f collected/github-run.json ]; then
        echo "Error: no collected GitHub run metadata found." >&2
        exit 1
      fi

      publish_cargo="$(rustup which --toolchain "${NEMO_RELAY_CI_CARGO_PUBLISH_VERSION}" cargo)"
      publish_rustc="$(rustup which rustc)"
      "$publish_cargo" --version
      "$publish_rustc" --version

      version="$(
        uv run --no-project python - <<'PY'
      import json
      from pathlib import Path

      print(json.loads(Path("collected/github-run.json").read_text()).get("tag", ""))
      PY
      )"

      if [ -z "$version" ]; then
        echo "Error: failed to extract package version from collected GitHub tag metadata." >&2
        exit 1
      fi

      just set-version "$version"

      cargo_home="${CARGO_HOME:-${HOME}/.cargo}"
      mkdir -p "$cargo_home"

      cat > "${cargo_home}/config.toml" <<EOF
      [registry]
      global-credential-providers = ["cargo:token"]
      [registries]
      artifactory = { index = "sparse+${NEMO_RELAY_CI_ARTIFACTORY_CARGO_URL}" }
      EOF
      export CARGO_REGISTRIES_ARTIFACTORY_TOKEN="Bearer ${NEMO_RELAY_CI_ARTIFACTORY_KEY}"
      export NEMO_RELAY_ARTIFACTORY_CRATE_DIRS="types plugin worker-proto worker core adaptive pii-redaction ffi cli"

      crates="$(
        uv run --no-project python - <<'PY'
      import os
      import tomllib
      from pathlib import Path

      manifest = Path("Cargo.toml")
      text = manifest.read_text()
      for crate_dir in os.environ["NEMO_RELAY_ARTIFACTORY_CRATE_DIRS"].split():
          before = f'path = "crates/{crate_dir}"'
          after = f'{before}, registry = "artifactory"'
          if after not in text:
              text = text.replace(before, after)
      manifest.write_text(text)

      for crate_dir in os.environ["NEMO_RELAY_ARTIFACTORY_CRATE_DIRS"].split():
          crate_manifest = Path("crates") / crate_dir / "Cargo.toml"
          print(tomllib.loads(crate_manifest.read_text())["package"]["name"])
      PY
      )"

      for crate in $crates; do
        RUSTC="$publish_rustc" "$publish_cargo" publish --package "$crate" --registry artifactory --allow-dirty
      done

publish:artifactory:npm:
  stage: publish
  image:
    name: node:${NEMO_RELAY_CI_NODE_VERSION}-${NEMO_RELAY_CI_DEBIAN_VERSION}
    pull_policy: if-not-present
  rules:
    - if: $CI_PIPELINE_SOURCE == 'push' && $CI_COMMIT_TAG
    - when: never
  needs:
    - job: collect:github-artifacts
      artifacts: true
  script:
    - |
      set -eu

      if [ -z "${NEMO_RELAY_CI_ARTIFACTORY_USER:-}" ] || [ -z "${NEMO_RELAY_CI_ARTIFACTORY_KEY:-}" ] || [ -z "${NEMO_RELAY_CI_ARTIFACTORY_NPM_URL:-}" ]; then
        echo "Error: uploading npm packages to Artifactory requires NEMO_RELAY_CI_ARTIFACTORY_USER, NEMO_RELAY_CI_ARTIFACTORY_KEY, and NEMO_RELAY_CI_ARTIFACTORY_NPM_URL." >&2
        exit 1
      fi
      if ! ls collected/node/*.tgz >/dev/null 2>&1; then
        echo "Error: no collected split Node package artifacts found." >&2
        exit 1
      fi

      registry_url="${NEMO_RELAY_CI_ARTIFACTORY_NPM_URL%/}/"
      registry_key="${registry_url#https:}"
      npm_auth="$(printf '%s:%s' "${NEMO_RELAY_CI_ARTIFACTORY_USER}" "${NEMO_RELAY_CI_ARTIFACTORY_KEY}" | base64 | tr -d '\n')"
      npm config set registry "$registry_url"
      npm config set "${registry_key}:_auth" "$npm_auth"

      for platform in linux-x64 linux-arm64 linux-x64-musl linux-arm64-musl darwin-arm64 win32-x64 win32-arm64; do
        package="collected/node/nemo-relay-node-npm-${platform}-${CI_COMMIT_TAG}.tgz"
        npm publish --tag dev "$package"
      done
      npm publish --tag dev "collected/node/nemo-relay-node-npm-${CI_COMMIT_TAG}.tgz"