chunk/.github/workflows/sdk.yml at main · chunkzero/chunk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: SDK distribution

on:
  pull_request:
    # Drafts skip CI; run the checks locally while iterating. Marking a PR ready runs them here.
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - .github/workflows/sdk.yml
      - .github/actions/rust-cache/**
      - scripts/package-sdk.py
      - scripts/check-sdk.py
      - scripts/install.sh
      - scripts/install-typescript.mjs
      - scripts/rust-notices.py
      - scripts/publish-maven.py
      - scripts/test-publish-maven.py
      - buildSrc/**
      - build.gradle.kts
      - crates/**
      - jvm/**/build.gradle.kts
      - gradle/**
      - gradlew
      - gradlew.bat
      - Cargo.toml
      - Cargo.lock
      - licenses/**
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: sdk-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_BUILD_JOBS: 2
  GRADLE_OPTS: -Dorg.gradle.workers.max=2

jobs:
  package:
    if: ${{ !github.event.pull_request.draft }}
    runs-on: blacksmith-2vcpu-ubuntu-2404
    timeout-minutes: 60
    outputs:
      version: ${{ steps.version.outputs.value }}
      artifact-id: ${{ steps.sdk.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@v5
      - name: Read coordinated SDK version
        id: version
        run: |
          python3 - <<'PY'
          import os, tomllib
          with open('Cargo.toml', 'rb') as source:
              version = tomllib.load(source)['workspace']['package']['version']
          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
              output.write(f'value={version}\n')
          PY
      - run: rustup toolchain install --no-self-update
      - uses: ./.github/actions/rust-cache
        with:
          profile: release
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: pnpm
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 21
      - uses: gradle/actions/setup-gradle@v5
        with:
          gradle-home-cache-includes: |
            caches
            notifications
            jdks
      - run: python3 scripts/test-publish-maven.py
      - run: pnpm install --frozen-lockfile
      - run: cargo build --release --locked -p chunk-cli
      - run: python3 scripts/package-sdk.py --output dist
      - uses: actions/upload-artifact@v4
        id: sdk
        with:
          name: chunk-sdk-linux-x64
          path: |
            dist/*.tar.gz
            dist/*.sha256
            dist/maven/**
            scripts/install.sh
          if-no-files-found: error
          # Cleanup deletes it once used; retention only bounds runs that never reach cleanup.
          retention-days: 1

  verify:
    needs: package
    runs-on: blacksmith-2vcpu-ubuntu-2404
    container: ubuntu:24.04
    timeout-minutes: 20
    steps:
      - name: Install consumer prerequisites
        run: |
          apt-get update -qq
          apt-get install -y --no-install-recommends ca-certificates curl git python3
      - uses: actions/checkout@v5
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            /scripts/check-sdk.py
            /scripts/check-consumers.py
            /scripts/install.sh
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 21
      - uses: actions/download-artifact@v4
        with:
          name: chunk-sdk-linux-x64
          path: artifact
      - name: Verify installed SDK without build-machine sources or caches
        env:
          SDK_VERSION: ${{ needs.package.outputs.version }}
        run: python3 scripts/check-sdk.py "artifact/dist/chunk-$SDK_VERSION-linux-x64.tar.gz" artifact/dist/maven

  # The artifact only hands the SDK between jobs; keeping it counts against Actions storage.
  cleanup:
    if: always() && needs.package.outputs.artifact-id != ''
    needs: [package, verify]
    runs-on: blacksmith-2vcpu-ubuntu-2404
    timeout-minutes: 5
    permissions:
      actions: write
    steps:
      - name: Delete the SDK artifact
        env:
          GH_TOKEN: ${{ github.token }}
          ARTIFACT_ID: ${{ needs.package.outputs.artifact-id }}
        run: gh api --method DELETE "repos/$GITHUB_REPOSITORY/actions/artifacts/$ARTIFACT_ID"