action.yml

name: Create a binary artifact
description: |
  Create a binary artifact for a cargo crate
author: "rustic-rs maintainers"
inputs:
  toolchain:
    description: |
      The rust toolchain to use
    required: true
  target:
    description: |
      The target to build for
    required: true
  use-cross:
    description: |
      Use cross to build the binary
    required: false
    default: "false"
  describe-tag-suffix:
    description: |
      Suffix for the git describe tag
    required: false
    default: ""
  binary-postfix:
    description: |
      Postfix for the binary name
    required: false
    default: ""
  os:
    description: |
      The operating system to build for
    required: true
  binary-name:
    description: |
      The name of the binary
    required: true
  package-secondary-name:
    description: |
      The secondary name for the package
    required: true
  github-token:
    description: |
      The github token to use
    required: true
  gpg-release-private-key:
    description: |
      The private key to use for signing the release
    required: false
  gpg-passphrase:
    description: |
      The passphrase to use for signing the release
    required: false
  architecture:
    description: |
      The architecture to build for
    required: false
    default: ""
  sign-release:
    description: |
      Sign the release
    required: true
    default: "false"
  hash-release:
    description: |
      Hash the release
    required: true
    default: "false"
  github-ref:
    description: |
      The github ref in use
    required: true
  use-project-version:
    description: |
      Get the project version
    required: false
    default: "false"
  use-release-profile:
    description: |
      Use the release profile to build the binary
    required: false
    default: "false"
  rsign-release-private-key:
    description: |
      The rsign private key to use for signing the release
    required: false
  rsign-passphrase:
    description: |
      The rsign passphrase to use for signing the release
    required: false
  use-tag-version:
    description: |
      Use the tag as version in filename for a release
    required: false
    default: "false"
  extra-cargo-build-args:
    description: |
      Extra arguments to pass to the cargo build command
    required: false
    default: ""

runs:
  using: "composite"
  steps:
    - name: Install Rust toolchain
      uses: dtolnay/rust-toolchain@1482605bfc5719782e1267fd0c0cc350fe7646b8 # v1
      with:
        toolchain: ${{ inputs.toolchain }}
        targets: ${{ inputs.target }}

    - name: install just command runner
      uses: taiki-e/install-action@5d427d86f088a6cedcddb92b3ad038d30721b52f # v2
      with:
        tool: just,toml-cli

    - name: Check if default dependencies just recipe exists
      shell: bash
      id: check-recipe
      run: |
        if ! just -f ${GITHUB_WORKSPACE:?}/build-dependencies.just -s install-default-${{ inputs.target }}; then
          echo "Failed to install default dependencies, recipe doesn't exist"
          echo "exists=false" >> $GITHUB_OUTPUT
        fi

    - name: Install default dependencies
      shell: bash
      if: steps.check-recipe.outputs.exists != 'false'
      run: |
        just -f ${GITHUB_WORKSPACE:?}/build-dependencies.just install-default-${{ inputs.target }}

    # FIXME: Brew compilation doesn't work currently?
    # - name: install compiler on macos
    #   shell: bash
    #   if: inputs.target == 'x86_64-apple-darwin' && inputs.use-cross == 'false'
    #   run: |
    #     brew install michaeleisel/zld/zld

    # Doesn't work with cargo auditable build
    # - name: install mold linker on linux gnu
    #   if: inputs.target == 'x86_64-unknown-linux-gnu' && inputs.use-cross == 'false'
    #   uses: rui314/setup-mold@v1

    - name: install cargo-auditable for non-cross builds
      if: inputs.use_cross != true
      uses: taiki-e/install-action@5d427d86f088a6cedcddb92b3ad038d30721b52f # v2
      with:
        tool: cargo-auditable,cargo-audit

    - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2
      with:
        key: ${{ inputs.target }}

    - name: install rsign2 for signing binaries
      uses: taiki-e/install-action@5d427d86f088a6cedcddb92b3ad038d30721b52f # v2
      if: inputs.sign-release == 'true'
      with:
        tool: rsign2

    - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2
      with:
        key: ${{ inputs.target }}

    - name: Get additional features specified in platform-settings.toml
      shell: bash
      id: additional-features
      run: |
        # Exit gracefully if the platform-settings.toml doesn't have additional features
        if ! toml get ${GITHUB_WORKSPACE:?}/platform-settings.toml platforms.${{ inputs.target }}.additional-features; then
          echo "features=false" >> $GITHUB_OUTPUT
          exit 0
        else 
          features=$(toml get ${GITHUB_WORKSPACE:?}/platform-settings.toml platforms.${{ inputs.target }}.additional-features | jq -r 'join(" ")')
          echo "features=$features" >> $GITHUB_OUTPUT
        fi

    - name: Install feature dependencies with just command runner
      shell: bash
      if: steps.additional-features.outputs.features != 'false'
      run: |
        target=${{ inputs.target }}
        features=${{ steps.additional-features.outputs.features }}

        for feature in $features; do
          # check if recipe is existing
          if ! just -f ${GITHUB_WORKSPACE:?}/build-dependencies.just -s install-$feature-$target; then
            echo "Failed to install $feature dependencies, recipe doesn't exist"
            echo "Please make sure, that the recipe exists in the build-dependencies.just file"
            exit 1
          fi

          just -f ${GITHUB_WORKSPACE:?}/build-dependencies.just install-$feature-$target
        done

    - name: Set Version
      if: inputs.use-project-version == 'true'
      shell: bash
      run: |
        echo "PROJECT_VERSION=$(git describe --tags)${{ inputs.describe-tag-suffix }}" >> $GITHUB_ENV

    - name: Use win config
      shell: bash
      if: inputs.target == 'x86_64-pc-windows-msvc'
      run: |
        cp -T ${GITHUB_ACTION_PATH:?}/.config/config-win.toml ${GITHUB_WORKSPACE:?}/.cargo/config.toml

    - name: Use linux config
      shell: bash
      if: inputs.target == 'x86_64-unknown-linux-gnu' && inputs.use-cross == 'false'
      run: |
        cp -T ${GITHUB_ACTION_PATH:?}/.config/config-linux.toml ${GITHUB_WORKSPACE:?}/.cargo/config.toml

    - name: Use darwin config
      shell: bash
      if: inputs.target == 'x86_64-apple-darwin' && inputs.use-cross == 'false'
      run: |
        cp ${GITHUB_ACTION_PATH:?}/.config/config-darwin.toml ${GITHUB_WORKSPACE:?}/.cargo/config.toml

    - name: Get default features specified in platform-settings.toml
      shell: bash
      id: default-features
      run: |
        # Exit gracefully if the platform-settings.toml doesn't have default features
        if ! toml get ${GITHUB_WORKSPACE:?}/platform-settings.toml platforms.defaults.release-features; then
          echo "features=false" >> $GITHUB_OUTPUT
          exit 0
        else 
          features=$(toml get ${GITHUB_WORKSPACE:?}/platform-settings.toml platforms.defaults.release-features | jq -r 'join(" ")')
          echo "features=$features" >> $GITHUB_OUTPUT
        fi

    - name: Collect features for cargo build
      shell: bash
      id: collect-features
      run: |
        if [[ ${{ steps.default-features.outputs.features }} != 'false' ]]; then
          # join the features with a comma
          echo "default_features=-F $(echo ${{ steps.default-features.outputs.features }} | tr ' ' ',')" >> $GITHUB_OUTPUT
        else
          echo "default_features=" >> $GITHUB_OUTPUT
        fi


        if [[ ${{ steps.additional-features.outputs.features }} != 'false' ]]; then
          # join the features with a comma
          echo "additional_features=-F $(echo ${{ steps.additional-features.outputs.features }} | tr ' ' ',')" >> $GITHUB_OUTPUT
        else
          echo "additional_features=" >> $GITHUB_OUTPUT
        fi

    - name: Cargo build
      uses: clechasseur/rs-cargo@8435b10f6e71c2e3d4d3b7573003a8ce4bfc6386 # v2 (attention: this should be double checked for security issues)
      if: inputs.use-cross == 'true'
      with:
        command: build
        use-cross: ${{ inputs.use-cross }}
        toolchain: ${{ inputs.toolchain }}
        args: --release --target ${{ inputs.target }} ${{ steps.collect-features.outputs.default_features }} ${{ steps.collect-features.outputs.additional_features }} ${{ inputs.extra-cargo-build-args }}

    - name: Cargo auditable build
      uses: clechasseur/rs-cargo@8435b10f6e71c2e3d4d3b7573003a8ce4bfc6386 # v2 (attention: this should be double checked for security issues)
      if: inputs.use-cross == 'false'
      with:
        command: auditable
        use-cross: ${{ inputs.use-cross }}
        toolchain: ${{ inputs.toolchain }}
        args: build --release --target ${{ inputs.target }} ${{ steps.collect-features.outputs.default_features }} ${{ steps.collect-features.outputs.additional_features }} ${{ inputs.extra-cargo-build-args }}

    - name: Determining Release name and working dir
      shell: bash
      id: package
      run: |
        if [[ ${{ inputs.use-tag-version }} == 'false' ]]; then
          PACKAGE_NAME=${{ inputs.binary-name }}-${{ inputs.package-secondary-name }}.tar.gz
          WORKING_DIR=${{ inputs.binary-name }}-${{ inputs.target }}         
        else
          PACKAGE_NAME=${{ inputs.binary-name }}-${{ env.PROJECT_VERSION }}-${{ inputs.package-secondary-name }}.tar.gz
          WORKING_DIR=${{ inputs.binary-name }}-${{ env.PROJECT_VERSION }}-${{ inputs.target }}
        fi
          
        echo "name=$PACKAGE_NAME" >> $GITHUB_OUTPUT
        echo "dir=$WORKING_DIR" >> $GITHUB_OUTPUT

    - name: Copy assets
      shell: bash
      run: |
        WORKING_DIR=${{ steps.package.outputs.dir }}

        mkdir -p $WORKING_DIR

        # We need to account for the fact that the scheduler has two binaries
        if [[ ${{ inputs.binary-name }} == 'rustic-scheduler' ]]; then
        cp -a target/${{ inputs.target }}/release/${{ inputs.binary-name }}-server${{ inputs.binary-postfix }} $WORKING_DIR
        cp -a target/${{ inputs.target }}/release/${{ inputs.binary-name }}-client${{ inputs.binary-postfix }} $WORKING_DIR
        else
        cp -a target/${{ inputs.target }}/release/${{ inputs.binary-name }}${{ inputs.binary-postfix }} $WORKING_DIR
        fi

        # Copy configuration files and documentation
        # rustic, rustic-server, and rustic-scheduler all have config/* files
        mkdir -p $WORKING_DIR/config
        cp -a config/ $WORKING_DIR/

        # Download and copy rustic user documentation
        if [[ ${{ inputs.binary-name }} == 'rustic' ]]; then
        mkdir -p $WORKING_DIR/docs
        curl https://rustic.cli.rs/docs/rustic-user-docs.pdf -o $WORKING_DIR/docs/rustic-user-docs.pdf
        fi

    - name: Create package
      shell: bash
      run: |
        RELEASE_NAME=${{ steps.package.outputs.name }}

        # FIXME: This doesn't work with the current version of self-update
        # See https://github.com/jaemk/self_update/issues/122
        # tar czvf $RELEASE_NAME ${{ steps.package.outputs.dir }}/*

        # FIXME: We actually need to implement the fix from above issue, when it's available
        # Then after a few versions we should be able to remove the workaround below.

        # Hacky workaround to only pack the binary and the config without the parent directory
        cd ${{ steps.package.outputs.dir }} && tar czvf ../$RELEASE_NAME * && cd -

    - name: Create SHA256
      shell: bash
      if: inputs.hash-release == 'true'
      run: |
        RELEASE_NAME=${{ steps.package.outputs.name }}
        if [[ ${{ inputs.os }} == 'Windows' ]]; then
        certutil -hashfile $RELEASE_NAME sha256 | grep -E [A-Fa-f0-9]{64} > $RELEASE_NAME.sha256
        else
        shasum -a 256 $RELEASE_NAME > $RELEASE_NAME.sha256
        fi

    - name: Create GPG signature
      shell: bash
      if: inputs.sign-release == 'true'
      run: |
        RELEASE_NAME=${{ steps.package.outputs.name }}
        echo "${{ inputs.gpg-release-private-key }}" > private.key
        echo "${{ inputs.gpg-passphrase }}" | gpg --pinentry-mode=loopback \
          --passphrase-fd 0 --import private.key
        echo "${{ inputs.gpg-passphrase }}" | gpg --pinentry-mode=loopback \
          --passphrase-fd 0 --local-user 12B7166D9FD59124416952E34018C5DE3BF8C081 \
          --armor --output $RELEASE_NAME.asc --detach-sign $RELEASE_NAME

    - name: Create Minisign/rsign2 signature
      shell: bash
      if: inputs.sign-release == 'true'
      run: |
        RELEASE_NAME=${{ steps.package.outputs.name }}
        echo "${{ inputs.rsign-release-private-key }}" > private.key

        ### FIXME: Add password to key when input from stdin is available https://github.com/jedisct1/rsign2/issues/26
        rsign sign -W -t "Signed by rustic Maintainers" -x $RELEASE_NAME.sig -s private.key $RELEASE_NAME

    - name: Storing package as artefact
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
      with:
        name: binary-${{ inputs.target }}
        path: ${{ steps.package.outputs.name }}*