build.yml

name: Build

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  packages: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUSTC_WRAPPER: sccache
  SCCACHE_GHA_ENABLED: "true"

jobs:
  lint:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies (Linux)
        timeout-minutes: 25
        run: |
          # lbug's C++ bridge needs <format> (C++20): jammy's gcc-11 is too old.
          sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
          # LLVM repo for libomp matching the icebug prebuilt binaries.
          wget -qO- --timeout=60 --tries=3 https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/llvm-snapshot.asc
          echo "deb http://apt.llvm.org/jammy llvm-toolchain-jammy-20 main" | sudo tee /etc/apt/sources.list.d/llvm20.list
          # Apache Arrow repo (icebug's cxx bridge needs arrow headers).
          # Pinned to 26.0.0 to match the Linux icebug 13.5 prebuilt, which
          # links libarrow.so.2600 (macOS/Windows 13.5 builds link
          # libarrow.2500, so they stay on the Arrow 25 setup).
          wget --timeout=60 --tries=3 https://apache.jfrog.io/artifactory/arrow/ubuntu/apache-arrow-apt-source-latest-jammy.deb
          sudo apt-get install -y ./apache-arrow-apt-source-latest-jammy.deb
          # Bound mirror stalls: fail fast instead of hanging the run for hours.
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=60 -o Acquire::https::Timeout=60 update
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=60 -o Acquire::https::Timeout=60 install -y --no-install-recommends gcc-13 g++-13 cmake pkg-config libssl-dev libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libarrow-dev=26.0.0-1 libarrow2600=26.0.0-1 libomp-20-dev
          echo "CC=gcc-13" >> "$GITHUB_ENV"
          echo "CXX=g++-13" >> "$GITHUB_ENV"

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      - name: Resolve lbug version from Cargo.toml
        shell: bash
        run: |
          # Single source of truth is the lbug dependency in Cargo.toml;
          # do not hard-code the version here. grep (not sed), so this
          # works identically on Linux/macOS/Windows runners (incl. git-bash).
          VERSION=$(grep -E '^lbug *=.*version *=' Cargo.toml | head -n1 | grep -oE '"[^"]+"' | head -n1 | tr -d '"')
          if [ -z "$VERSION" ]; then
            echo "could not resolve lbug version from Cargo.toml" >&2
            exit 1
          fi
          echo "LBUG_VERSION=$VERSION" >> "$GITHUB_ENV"
          echo "Resolved lbug version: $VERSION"

      - name: Run sccache
        uses: mozilla/sccache-action@v0.0.9

      - name: Cache prebuilt liblbug
        uses: actions/cache@v4
        with:
          # lbug's build script downloads the static lib here on every
          # clean cargo registry; keep it across runs keyed by version+OS.
          path: ~/.cargo/registry/src/**/lbug-*/.cache
          key: lbug-prebuilt-${{ env.LBUG_VERSION }}-${{ runner.os }}
          restore-keys: lbug-prebuilt-

      - name: Download icebug prebuilt
        run: bash scripts/download_icebug.sh

      - name: Download shared liblbug
        run: bash scripts/download-liblbug.sh

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: lint

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Run clippy
        run: cargo clippy --all-targets -- -D warnings

      - name: Run tests
        run: cargo test

  build:
    needs: lint
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            target: aarch64-apple-darwin
            binary: bugscope
          - platform: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            binary: bugscope
          - platform: windows-2022
            target: x86_64-pc-windows-msvc
            binary: bugscope.exe

    runs-on: ${{ matrix.platform }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Resolve lbug version from Cargo.toml
        shell: bash
        run: |
          # Single source of truth is the lbug dependency in Cargo.toml;
          # do not hard-code the version here. grep (not sed), so this
          # works identically on Linux/macOS/Windows runners (incl. git-bash).
          VERSION=$(grep -E '^lbug *=.*version *=' Cargo.toml | head -n1 | grep -oE '"[^"]+"' | head -n1 | tr -d '"')
          if [ -z "$VERSION" ]; then
            echo "could not resolve lbug version from Cargo.toml" >&2
            exit 1
          fi
          echo "LBUG_VERSION=$VERSION" >> "$GITHUB_ENV"
          echo "Resolved lbug version: $VERSION"

      - name: Install dependencies (macOS)
        if: matrix.platform == 'macos-latest'
        run: brew install libomp cmake openssl

      - name: Install Apache Arrow 25 (macOS)
        if: matrix.platform == 'macos-latest'
        # The icebug prebuilt links libarrow.2500.dylib (Arrow 25.x) but
        # Homebrew only ships latest (26.x); see scripts/install-arrow25-macos.sh.
        run: bash scripts/install-arrow25-macos.sh

      - name: Install dependencies (Linux)
        timeout-minutes: 25
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          # lbug's C++ bridge needs <format> (C++20): jammy's gcc-11 is too old.
          sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
          # LLVM repo for libomp matching the icebug prebuilt binaries.
          wget -qO- --timeout=60 --tries=3 https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/llvm-snapshot.asc
          echo "deb http://apt.llvm.org/jammy llvm-toolchain-jammy-20 main" | sudo tee /etc/apt/sources.list.d/llvm20.list
          # Apache Arrow repo (icebug's cxx bridge needs arrow headers).
          # Pinned to 26.0.0 to match the Linux icebug 13.5 prebuilt, which
          # links libarrow.so.2600 (macOS/Windows 13.5 builds link
          # libarrow.2500, so they stay on the Arrow 25 setup).
          wget --timeout=60 --tries=3 https://apache.jfrog.io/artifactory/arrow/ubuntu/apache-arrow-apt-source-latest-jammy.deb
          sudo apt-get install -y ./apache-arrow-apt-source-latest-jammy.deb
          # Bound mirror stalls: fail fast instead of hanging the run for hours.
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=60 -o Acquire::https::Timeout=60 update
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=60 -o Acquire::https::Timeout=60 install -y --no-install-recommends gcc-13 g++-13 cmake pkg-config libssl-dev libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libarrow-dev=26.0.0-1 libarrow2600=26.0.0-1 libomp-20-dev
          echo "CC=gcc-13" >> "$GITHUB_ENV"
          echo "CXX=g++-13" >> "$GITHUB_ENV"

      - name: Install OpenSSL (Windows)
        if: matrix.platform == 'windows-2022'
        run: |
          choco install openssl.light --no-progress -y
          $root = 'C:\Program Files\OpenSSL'
          echo "OPENSSL_DIR=$root" >> "$env:GITHUB_ENV"
          # Shining Light nests import libs under lib\VC\x64\MD (DLL) and
          # lib\VC\x64\MT (static); pick the first dir that exists.
          $lib = @('lib\VC\x64\MD', 'lib\VC\x64\MT', 'lib') |
            ForEach-Object { Join-Path $root $_ } |
            Where-Object { Test-Path (Join-Path $_ 'libssl.lib') } |
            Select-Object -First 1
          if (-not $lib) { Get-ChildItem $root | Select-Object FullName; exit 1 }
          echo "Windows OpenSSL lib dir: $lib"
          # Stage the import libs somewhere space-free: MSVC silently
          # mishandles the 'C:\Program Files\...' LIB entry (see the
          # truncated 'LIBPATH:C:\Program' in the link line).
          $stage = "$env:GITHUB_WORKSPACE\openssl-lib"
          New-Item -ItemType Directory -Force -Path $stage | Out-Null
          Copy-Item (Join-Path $lib 'libssl.lib') $stage
          Copy-Item (Join-Path $lib 'libcrypto.lib') $stage
          Get-ChildItem $stage | Select-Object Name, Length
          echo "LIB=$stage" >> "$env:GITHUB_ENV"

      - name: Create vcpkg manifest (Windows)
        if: matrix.platform == 'windows-2022'
        shell: bash
        run: |
          cat > vcpkg.json << 'EOF'
          {
            "name": "bugscope-deps",
            "version": "1.0.0",
            "dependencies": [
              "arrow",
              "pkgconf"
            ]
          }
          EOF

      - name: Setup vcpkg (Windows)
        if: matrix.platform == 'windows-2022'
        uses: lukka/run-vcpkg@v11
        with:
          vcpkgGitCommitId: '14d83b1c34655a6af6f044aa1679f668c0b0b70e'

      - name: Authenticate vcpkg NuGet (Windows)
        if: matrix.platform == 'windows-2022'
        shell: pwsh
        run: |
          # NOTE: must be a classic PAT with write:packages (repo secret
          # VCPKG_NUGET_PAT), SSO-authorized if the org enforces SAML.
          # GITHUB_TOKEN 403s on push: repo-scoped tokens cannot publish
          # new, unlinked packages to the org-level feed, so the cache
          # could never populate and every build rebuilt from source.
          $nuget = & $env:VCPKG_ROOT/vcpkg fetch nuget | Out-String
          $nuget = $nuget.Trim()
          & $nuget sources add -Source "https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json" -Name "GitHubPackages" -Username "${{ github.repository_owner }}" -Password "${{ secrets.VCPKG_NUGET_PAT }}" -StorePasswordInClearText -Verbosity detailed
          & $nuget setapikey "${{ secrets.VCPKG_NUGET_PAT }}" -Source "https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json"

      - name: Install vcpkg packages (Windows)
        if: matrix.platform == 'windows-2022'
        shell: pwsh
        run: |
          & $env:VCPKG_ROOT/vcpkg install --recurse --clean-after-build --triplet x64-windows
        env:
          VCPKG_BINARY_SOURCES: 'clear;nuget,https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json,readwrite'

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Run sccache
        uses: mozilla/sccache-action@v0.0.9

      - name: Cache prebuilt liblbug
        uses: actions/cache@v4
        with:
          path: ~/.cargo/registry/src/**/lbug-*/.cache
          key: lbug-prebuilt-${{ env.LBUG_VERSION }}-${{ runner.os }}-${{ matrix.target }}
          restore-keys: lbug-prebuilt-

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Download icebug prebuilt
        shell: bash
        run: bash scripts/download_icebug.sh

      - name: Download shared liblbug
        shell: bash
        run: bash scripts/download-liblbug.sh

      - name: Vendor arrow/openmp runtimes (macOS/Linux)
        if: matrix.platform != 'windows-2022'
        shell: bash
        # The INSTALL'd algo extension references @rpath/libarrow, resolved
        # against our rpaths: vendor the system libs next to libnetworkit.
        run: bash scripts/vendor_arrow.sh

      - name: Configure macOS build env
        if: matrix.platform == 'macos-latest'
        shell: bash
        run: |
          # Apple clang doesn't search Homebrew libomp without this (icebug's
          # cxx bridge includes networkit headers needing omp.h). Mirrors
          # ../bugscope's CXXFLAGS on its macOS build step.
          echo "CXXFLAGS=-I/opt/homebrew/opt/libomp/include" >> "$GITHUB_ENV"

      - name: Configure Windows build env
        if: matrix.platform == 'windows-2022'
        shell: bash
        run: |
          echo "PKG_CONFIG_PATH=$GITHUB_WORKSPACE/vcpkg_installed/x64-windows/lib/pkgconfig" >> "$GITHUB_ENV"
          echo "CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/vcpkg_installed/x64-windows" >> "$GITHUB_ENV"
          echo "CXXFLAGS=/std:c++20" >> "$GITHUB_ENV"
          # pkgconf itself must be on PATH: the icebug crate probes arrow via
          # pkg-config (mirrors ../bugscope's PATH setup on its build step).
          # Convert the whole list with cygpath -p: appending a Windows entry
          # to bash's Unix-form PATH would leave later pwsh steps with an
          # unresolvable PATH (cargo not found).
          echo "PATH=$(cygpath -w "$GITHUB_WORKSPACE/vcpkg_installed/x64-windows/tools/pkgconf");$(cygpath -wp "$PATH")" >> "$GITHUB_ENV"

      - name: Test GDS_PAGE_RANK
        shell: bash
        run: |
          # The test INSTALLs the algo extension from the official repo and
          # LOADs it at runtime: its libarrow dep resolves via our rpaths
          # (vendored above) on Unix, via PATH (vcpkg) on Windows.
          if [ "$RUNNER_OS" = "Windows" ]; then
            # NB: networkit_state.dll lives in the icebug/lib/networkit
            # subdir (the win prebuilt splits GlobalState out of the static
            # networkit.lib); the loader needs that dir on PATH too.
            export PATH="$(cygpath -w "$GITHUB_WORKSPACE/icebug/lib");$(cygpath -w "$GITHUB_WORKSPACE/icebug/lib/networkit");$(cygpath -w "$GITHUB_WORKSPACE/liblbug");$(cygpath -w "$GITHUB_WORKSPACE/vcpkg_installed/x64-windows/bin");$PATH"
            export PKG_CONFIG_PATH="$GITHUB_WORKSPACE/vcpkg_installed/x64-windows/lib/pkgconfig"
            export CXXFLAGS="/std:c++20"
          else
            export LD_LIBRARY_PATH="$GITHUB_WORKSPACE/icebug/lib:$GITHUB_WORKSPACE/liblbug${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
          fi
          # --lib --test selects only these targets so the GUI binary
          # itself is not linked here (it gets built in the next step).
          # The served 0.22.0 extension needs NetworKit symbols + Arrow 26:
          # satisfiable on Linux (icebug 13.5 prebuilt + apt libarrow2600).
          # macOS/Windows stay on the Arrow 25-era stack, where the extension
          # can't LOAD (clean failure, but it fails the gate all the same),
          # so those platforms skip the extension tests.
          SKIP_ARGS="--skip gds_page_rank_star --skip gds_page_rank_stale_projection_serves_live_storage"
          if [ "$RUNNER_OS" = "Linux" ]; then SKIP_ARGS=""; fi
          # shellcheck disable=SC2086
          cargo test --release --target ${{ matrix.target }} --lib --test gds_page_rank -- $SKIP_ARGS

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Package (macOS)
        if: matrix.platform == 'macos-latest'
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          # Ship a zipped .app bundle (disktree-style): raw binaries lose
          # their exec bit and Gatekeeper attributes on download. Ad-hoc
          # signed; a downloaded copy needs "Open Anyway" once unless a
          # Developer ID signature + notarization is added later.
          version="${VERSION#v}"
          # PR builds have ref_name like 1/merge; slashes break archive paths.
          version="${version//\//-}"
          rm -rf dist
          mkdir -p dist/Bugscope.app/Contents/MacOS dist/Bugscope.app/Contents/Resources
          cp "target/${{ matrix.target }}/release/${{ matrix.binary }}" dist/Bugscope.app/Contents/MacOS/bugscope
          sed "s|@VERSION@|${version}|g" packaging/macos/Info.plist > dist/Bugscope.app/Contents/Info.plist
          # Bundle icebug shared libs + algo extension (GDS_* via Cypher).
          bash scripts/stage_macos_bundle.sh dist/Bugscope.app
          codesign --deep --force -s - dist/Bugscope.app
          archive="dist/bugscope-${version}-${{ matrix.target }}-macos.zip"
          ditto -c -k --keepParent dist/Bugscope.app "$archive"
          (cd dist && shasum -a 256 "$(basename "$archive")" > "$(basename "$archive").sha256")

      - name: Package (Linux)
        if: matrix.platform == 'ubuntu-22.04'
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          # Ship a tarball: tar preserves the exec bit, unlike a bare binary.
          version="${VERSION#v}"
          # PR builds have ref_name like 1/merge; slashes break archive paths.
          version="${version//\//-}"
          name="bugscope-${version}-${{ matrix.target }}-linux"
          rm -rf dist && mkdir -p "dist/$name"
          cp "target/${{ matrix.target }}/release/${{ matrix.binary }}" "dist/$name/"
          strip "dist/$name/${{ matrix.binary }}"
          # Bundle icebug shared libs + algo extension (GDS_* via Cypher).
          # $ORIGIN/icebug/lib and $ORIGIN are baked rpaths (see .cargo/config.toml).
          mkdir -p "dist/$name/icebug" "dist/$name/liblbug"
          cp -r icebug/lib "dist/$name/icebug/"
          cp liblbug/liblbug.so* "dist/$name/liblbug/"
          # Best-effort: vendor every non-system shared dep (libarrow and its
          # transitive closure: aws-sdk, brotli, lz4, snappy, zstd, ... — the
          # same class of bug as macOS #10 where only the top-level libs
          # were staged) so the tarball runs without system installs (the
          # exe uses RPATH, not RUNPATH, so transitive deps resolve from
          # these dirs too).
          for dep in $(ldd "dist/$name/${{ matrix.binary }}" | grep -oE '/[^ ]+\.so[^ ]*' | sort -u); do
            case "$dep" in
              /lib/*|/usr/lib/*|/lib64/*|/usr/lib64/*) continue ;;
              linux-vdso*|ld-linux*) continue ;;
            esac
            cp -f -n "$dep" "dist/$name/icebug/lib/" 2>/dev/null || true
          done
          for lib in "dist/$name/icebug/lib"/*.so* "dist/$name/liblbug"/*.so*; do
            [ -f "$lib" ] || continue
            for dep in $(ldd "$lib" 2>/dev/null | grep -oE '/[^ ]+\.so[^ ]*' | sort -u); do
              case "$dep" in
                /lib/*|/usr/lib/*|/lib64/*|/usr/lib64/*) continue ;;
                linux-vdso*|ld-linux*) continue ;;
              esac
              cp -f -n "$dep" "dist/$name/icebug/lib/" 2>/dev/null || true
            done
          done
          cp README.md "dist/$name/"
          echo "$version" > "dist/$name/VERSION"
          tar -C dist -czf "dist/$name.tar.gz" "$name"
          (cd dist && sha256sum "$name.tar.gz" > "$name.tar.gz.sha256")

      - name: Package (Windows)
        if: matrix.platform == 'windows-2022'
        shell: pwsh
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          $version = $env:VERSION -replace '^v',''
          # PR builds have ref_name like 1/merge; slashes break archive paths.
          $version = $version -replace '/', '-'
          $name = "bugscope-$version-${{ matrix.target }}-windows"
          if (Test-Path dist) { Remove-Item -Recurse -Force dist }
          New-Item -ItemType Directory -Force "dist/$name" | Out-Null
          Copy-Item "target/${{ matrix.target }}/release/${{ matrix.binary }}", README.md "dist/$name/"
          # Windows has no RPATH: the loader only looks next to the exe, in
          # System32, and on PATH — never in our icebug/lib + liblbug
          # subdirs. stage_windows_bundle.sh copies every runtime DLL flat
          # next to the exe (lbug_shared, networkit_state, arrow AND its
          # bz2/brotli/lz4/... family from vcpkg, plus OpenSSL when
          # dynamically linked) and fails the build if a known dep is
          # missing. See https://github.com/LadybugDB/bugscope/issues/5.
          $vcpkgBin = Join-Path $env:GITHUB_WORKSPACE 'vcpkg_installed\x64-windows\bin'
          $osslBin = Join-Path $env:OPENSSL_DIR 'bin'
          bash scripts/stage_windows_bundle.sh "dist/$name" "$vcpkgBin" "$osslBin" "$env:OPENSSL_DIR"
          Get-ChildItem "dist/$name" -Filter *.dll | Select-Object Name, Length
          Compress-Archive -Path "dist/$name" -DestinationPath "dist/$name.zip"
          $hash = (Get-FileHash "dist/$name.zip" -Algorithm SHA256).Hash.ToLower()
          [IO.File]::WriteAllText("dist/$name.zip.sha256", "$hash  $name.zip`n")

      - name: Assert macOS well-known rpaths
        if: matrix.platform == 'macos-latest'
        shell: bash
        run: |
          # The runtime-downloaded algo extension resolves its @rpath deps
          # against this binary's LC_RPATHs: fail if the Homebrew / system
          # fallbacks are missing (no DYLD_LIBRARY_PATH in the field).
          rpaths="$(otool -l dist/Bugscope.app/Contents/MacOS/bugscope | grep -A 2 LC_RPATH | grep 'path ')"
          echo "$rpaths"
          missing=0
          for want in /opt/homebrew/lib /opt/homebrew/opt/apache-arrow/lib /opt/homebrew/opt/libomp/lib /usr/local/lib; do
            if ! echo "$rpaths" | grep -Fq "path $want "; then
              echo "missing LC_RPATH: $want" >&2
              missing=1
            fi
          done
          exit $missing

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: bugscope-${{ matrix.target }}
          # Archives only: the dist/ staging dirs (Bugscope.app, the
          # tar/zip source dirs) must not become release assets.
          path: |
            dist/*.zip
            dist/*.tar.gz
            dist/*.sha256

  release:
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Create Release
        uses: softprops/action-gh-release@v1
        with:
          files: artifacts/**/*
          draft: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}