build-binary.yaml

name: Build binaries

on:
  workflow_call:
    inputs:
      version:
        required: true
        type: string

jobs:

  build:
    name: Build
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        edition: [ "", "-pm" ]
        target:
          - x86_64-unknown-linux-gnu
          - aarch64-unknown-linux-gnu
          - x86_64-unknown-linux-musl
          - aarch64-unknown-linux-musl
          - x86_64-apple-darwin
          - aarch64-apple-darwin
          - x86_64-pc-windows-msvc

        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-22.04
            install: |
              sudo apt install -y libssl-dev
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-22.04
            cross: "true"
            # Cross' Ubuntu container is based on 20.04. Its OpenSSL version is too old for us.
            args: --features vendored

          - target: x86_64-unknown-linux-musl
            os: ubuntu-22.04
            args: --features vendored
            install: |
              sudo apt install -y musl-tools
          - target: aarch64-unknown-linux-musl
            os: ubuntu-22.04
            cross: "true"
            args: --features vendored

          - target: x86_64-apple-darwin
            os: macos-13
          - target: aarch64-apple-darwin
            os: macos-14

          - target: x86_64-pc-windows-msvc
            os: windows-2022
            ext: ".exe"
            archive: zip
            install: |
              git config --system core.longpaths true
              echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" | Out-File -FilePath $env:GITHUB_ENV -Append
              vcpkg install openssl:x64-windows-static-md

    env:
      # name of the binary output by the build
      output_binary_name: "trustd"
      # name of the binary available for download
      download_binary_name: "trustd${{ matrix.edition }}"
      dirname: "trustd${{ matrix.edition }}-${{ inputs.version }}-${{ matrix.target }}"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup | Cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ${{ matrix.target }}-${{ matrix.edition }}

      - name: Export GitHub Actions cache environment variables for vcpkg
        uses: actions/github-script@v7
        if: runner.os == 'Windows'
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
            core.exportVariable('VCPKG_BINARY_SOURCES', 'clear;x-gha,readwrite');

      - name: Install dependencies
        if: matrix.install != ''
        run: ${{ matrix.install }}

      - name: Disable rustup self-update
        # workaround for: https://github.com/rust-lang/rustup/issues/3709
        run: |
          rustup set auto-self-update disable

      - name: Setup Rust target
        run: |
          rustup target add ${{ matrix.target }}

      - name: Setup cargo-binstall (Linux)
        if: runner.os != 'Windows'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash

      - name: Setup cargo-binstall (Windows)
        if: runner.os == 'Windows'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          Set-ExecutionPolicy Unrestricted -Scope Process; iex (iwr "https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.ps1").Content

      - name: Setup Cross
        if: matrix.cross == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cargo binstall cross -y --force

      - run: mkdir -p upload

      - name: Build | Build
        shell: bash
        env:
          POSTGRESQL_VERSION: 16
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # required for retrieving postgres
        run: |
          set -x

          if [[ "${{ matrix.xcode }}" == "true" ]]; then
            export SDKROOT=$(xcrun -sdk macosx --show-sdk-path)
            export MACOSX_DEPLOYMENT_TARGET=$(xcrun -sdk macosx --show-sdk-platform-version)
          fi
          
          CMD="cargo"
          
          if [[ -n "${{ matrix.cross }}" ]]; then
            CMD="cross"
          fi

          # build options

          OPTS="--no-default-features --release"

          if [[ "${{ matrix.edition }}" == "-pm" ]]; then
            OPTS="$OPTS --features pm"
          fi
          
          OPTS="$OPTS ${{ matrix.args }}"
          
          if [[ -n "${{ matrix.target }}" ]]; then
            OPTS="$OPTS --target=${{ matrix.target }}"
          fi

          ${CMD} build ${OPTS}

      - name: Install cargo-cyclonedx
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cargo binstall -y cargo-cyclonedx --force

      - name: Create SBOM
        shell: bash
        run: |
          cargo cyclonedx -v --spec-version 1.5 --format json --describe binaries --target "${{ matrix.target }}"
          
          mv trustd/trustd_bin.cdx.json "upload/${{ env.dirname }}.cdx.json"

      - name: Move binary
        shell: bash
        run: |
          mkdir -p "pack/$dirname"
          
          # if we have an alternate target, there is a sub-directory
          if [[ -f "target/release/${output_binary_name}${{ matrix.ext }}" ]]; then
            SRC="target/release/${output_binary_name}${{ matrix.ext }}"
          elif [[ -f "target/${{ matrix.target }}/release/${output_binary_name}${{ matrix.ext }}" ]]; then
            SRC="target/${{ matrix.target }}/release/${output_binary_name}${{ matrix.ext }}"
          else
            echo "Unable to find output"
            find target
            false # stop build
          fi
          
          # stage for upload
          mv -v "${SRC}" "pack/${dirname}/${download_binary_name}${{ matrix.ext }}"
          cp LICENSE "pack/${dirname}/"

      - name: Archive (zip)
        if: matrix.archive == 'zip'
        working-directory: pack
        run: |
          7z a ../upload/${{ env.dirname }}.zip .

      - name: Archive (tar.gz)
        if: matrix.archive != 'zip'
        working-directory: pack
        run: |
          tar czvf ../upload/${{ env.dirname }}.tar.gz .

      - name: Upload binary
        uses: actions/upload-artifact@v4
        with:
          name: trustd${{ matrix.edition }}-${{ matrix.target }}
          path: upload/*
          if-no-files-found: error