pr.yml

name: PR

on:
  pull_request:
    types: [opened, synchronize, reopened, closed]

# Cancel previous runs when the PR is updated.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  mac-arm64:
    if: ${{ github.event_name == 'pull_request' && github.event.action != 'closed' }}
    strategy:
      fail-fast: false
      matrix:
        app: [hostd, renterd, walletd]
    runs-on: macos-latest
    defaults:
      run:
        working-directory: ${{ matrix.app }}
    steps:
      - uses: actions/checkout@v4
      - name: Setup
        uses: ./.github/actions/daemon-setup
        with:
          daemon: ${{ matrix.app }}
          node_version: 20.10.0
      - name: Setup signing
        env:
          APPLE_CERT_ID: ${{ secrets.APPLE_CERT_ID }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_KEY_B64: ${{ secrets.APPLE_KEY_B64 }}
          APPLE_CERT_B64: ${{ secrets.APPLE_CERT_B64 }}
          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
          APPLE_KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
        run: |
          # extract apple cert
          APPLE_CERT_PATH=$RUNNER_TEMP/apple_cert.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          echo -n "$APPLE_CERT_B64" | base64 --decode --output $APPLE_CERT_PATH

          # extract apple key
          mkdir -p ~/private_keys
          APPLE_API_KEY_PATH=~/private_keys/AuthKey_$APPLE_API_KEY.p8
          echo "APPLE_API_KEY_PATH=$APPLE_API_KEY_PATH" >> $GITHUB_ENV
          echo -n "$APPLE_KEY_B64" | base64 --decode --output $APPLE_API_KEY_PATH

          # create temp keychain
          security create-keychain -p "$APPLE_KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security default-keychain -s $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$APPLE_KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import keychain
          security import $APPLE_CERT_PATH -P $APPLE_CERT_PASSWORD -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security find-identity -v $KEYCHAIN_PATH -p codesigning
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $APPLE_KEYCHAIN_PASSWORD $KEYCHAIN_PATH
      - name: Lint
        run: npm run lint
        shell: bash
      - name: Build
        run: npm run build
        shell: bash
      - name: Download daemon binary
        run: npm run download:binary -- --goos=darwin --goarch=arm64
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Package executable bundles, sign and notarize, make distributables
        env:
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY_PATH: ${{ env.APPLE_API_KEY_PATH }}
        run: npm run make -- --arch=arm64
        shell: bash
  linux-arm64:
    if: ${{ github.event_name == 'pull_request' && github.event.action != 'closed' }}
    strategy:
      fail-fast: false
      matrix:
        app: [hostd, renterd, walletd]
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ matrix.app }}
    steps:
      - uses: actions/checkout@v4
      - name: Setup
        uses: ./.github/actions/daemon-setup
        with:
          daemon: ${{ matrix.app }}
          node_version: 20.10.0
      - name: Lint
        run: npm run lint
        shell: bash
      - name: Build
        run: npm run build
        shell: bash
      - name: Download daemon binary
        run: npm run download:binary -- --goos=linux --goarch=arm64
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Package executable bundles, make distributables
        run: npm run make -- --arch=arm64
        shell: bash
  linux-amd64:
    if: ${{ github.event_name == 'pull_request' && github.event.action != 'closed' }}
    strategy:
      fail-fast: false
      matrix:
        app: [hostd, renterd, walletd]
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ matrix.app }}
    steps:
      - uses: actions/checkout@v4
      - name: Setup
        uses: ./.github/actions/daemon-setup
        with:
          daemon: ${{ matrix.app }}
          node_version: 20.10.0
      - name: Lint
        run: npm run lint
        shell: bash
      - name: Build
        run: npm run build
        shell: bash
      - name: Download daemon binary
        run: npm run download:binary -- --goos=linux --goarch=amd64
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Package executable bundles, make distributables
        run: npm run make -- --arch=x64
        shell: bash
  windows-amd64:
    if: ${{ github.event_name == 'pull_request' && github.event.action != 'closed' }}
    strategy:
      fail-fast: false
      matrix:
        app: [hostd, renterd, walletd]
    runs-on: windows-latest
    defaults:
      run:
        working-directory: ${{ matrix.app }}
    steps:
      - uses: actions/checkout@v4
      - name: Setup
        uses: ./.github/actions/daemon-setup
        with:
          daemon: ${{ matrix.app }}
          node_version: 20.10.0
      - name: Setup signing
        run: dotnet tool install --global AzureSignTool
      - name: Lint
        run: npm run lint
        shell: bash
      - name: Build
        run: npm run build
        shell: bash
      - name: Download daemon binary
        run: npm run download:binary -- --goos=windows --goarch=amd64
        shell: bash
      - name: Package executable bundles, sign and notarize, make distributables
        run: npm run make -- --arch=x64
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AZURE_KEY_VAULT_URI: ${{ secrets.AZURE_KEY_VAULT_URI }}
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          AZURE_CERT_NAME: ${{ secrets.AZURE_CERT_NAME }}