build.yml

name: Compile core extension binaries

on:
  workflow_call:
    inputs:
      attest:
        description: "Whether to generate a signed attestation for compiled artifacts"
        type: boolean
        default: false
      sign-publication:
        description: "Whether to sign the built Android library"
        default: false
        type: boolean
    secrets:
      gpg-key:
        required: false
        description: "The GPG key to use when signing the publication"
      gpg-password:
        required: false
        description: "Password for the GPG key."
    outputs:
      libs_linux:
        description: "Artifact ID of the uploaded linux-library artifact"
        value: ${{ jobs.libs_linux.outputs.artifact_id }}
      libs_macos:
        description: "Artifact ID of the uploaded macos-library artifact"
        value: ${{ jobs.libs_macos.outputs.artifact_id }}
      libs_windows:
        description: "Artifact ID of the uploaded windows-library artifact"
        value: ${{ jobs.libs_windows.outputs.artifact_id }}
      libs_android:
        description: "Artifact ID of the uploaded android-library artifact"
        value: ${{ jobs.libs_android.outputs.artifact_id }}
      libs_android_static:
        description: "Artifact ID of the uploaded android-static artifact"
        value: ${{ jobs.libs_android.outputs.static_artifact_id }}
      libs_wasm:
        description: "Artifact ID of the uploaded wasm-library artifact"
        value: ${{ jobs.libs_wasm.outputs.artifact_id }}
      libs_xcframework:
        description: "Artifact ID of the uploaded xcframework artifact"
        value: ${{ jobs.libs_xcframework.outputs.artifact_id }}
      sbom:
        description: "Artifact ID of the uploaded sbom artifact"
        value: ${{ jobs.attest.outputs.artifact_id }}

permissions: {}

jobs:
  libs_linux:
    name: Building Linux libraries
    runs-on: ubuntu-latest
    outputs:
      artifact_id: ${{ steps.upload.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Install Rust Nightly
        shell: bash
        run:
          rustup install --target aarch64-unknown-linux-gnu,x86_64-unknown-linux-gnu,i686-unknown-linux-gnu,riscv64gc-unknown-linux-gnu,armv7-unknown-linux-gnueabihf
      
      - name: Install cross-compiling GCC
        shell: bash
        run: |
          sudo apt update
          sudo apt install -y gcc-aarch64-linux-gnu gcc-riscv64-linux-gnu gcc-arm-linux-gnueabihf gcc-i686-linux-gnu

      - name: Build binaries
        shell: bash
        run: |
          ./tool/build_linux.sh x64
          ./tool/build_linux.sh aarch64
          ./tool/build_linux.sh x86
          ./tool/build_linux.sh armv7
          ./tool/build_linux.sh riscv64gc

      - uses: actions/upload-artifact@v7
        id: upload
        with:
          name: linux-library
          retention-days: 14
          path: |
            *.so
            *.linux.a

  libs_macos:
    name: Building macOS libraries
    runs-on: macos-latest
    outputs:
      artifact_id: ${{ steps.upload.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Install Rust Nightly
        shell: bash
        run:
          rustup install --target x86_64-apple-darwin,aarch64-apple-darwin
      
      - name: Build binaries
        shell: bash
        run: |
          ./tool/build_macos.sh x64
          ./tool/build_macos.sh aarch64

      - uses: actions/upload-artifact@v7
        id: upload
        with:
          name: macos-library
          retention-days: 14
          path: |
            *.dylib
            *.a

  libs_windows:
    name: Building Windows libraries
    runs-on: windows-latest
    outputs:
      artifact_id: ${{ steps.upload.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install Rust Nightly
        shell: powershell
        run: rustup install --target x86_64-pc-windows-msvc,aarch64-pc-windows-msvc,i686-pc-windows-msvc

      - name: Build binaries
        shell: bash
        run: |
          ./tool/build_windows.sh x64
          ./tool/build_windows.sh aarch64
          ./tool/build_windows.sh x86

      - uses: actions/upload-artifact@v7
        id: upload
        with:
          name: windows-library
          retention-days: 14
          path: |
            *.dll
            *.lib

  libs_android:
    name: Building Android libraries
    runs-on: ubuntu-latest
    outputs:
      artifact_id: ${{ steps.upload.outputs.artifact-id }}
      static_artifact_id: ${{ steps.upload_static.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-java@v5
        with:
          distribution: "temurin"
          java-version: "25"

      - name: Validate Gradle wrapper
        uses: gradle/actions/wrapper-validation@v6

      - name: Setup
        shell: bash
        run: |
          rustup toolchain install nightly-2026-04-10-x86_64-unknown-linux-gnu
          rustup component add rust-src --toolchain nightly-2026-04-10-x86_64-unknown-linux-gnu
          rustup target add \
            aarch64-linux-android \
            armv7-linux-androideabi \
            x86_64-linux-android \
            i686-linux-android
          cargo install cargo-ndk
      
      - name: Build signed library
        shell: bash
        if: ${{ inputs.sign-publication }}
        run: |
          cd android
          ./gradlew build zipPublication  -PgpgKey=${INPUTS_GPG_KEY} -PgpgPassword=${INPUTS_GPG_PASSWORD}
          ls -lh build/outputs/aar
          find build/repository
        env:
          INPUTS_GPG_KEY: ${{ secrets.gpg-key }}
          INPUTS_GPG_PASSWORD: ${{ secrets.gpg-password }}

      - name: Build library without signing
        shell: bash
        if: ${{ !inputs.sign-publication }}
        run: |
          cd android
          ./gradlew build zipPublication -PsignPublication=0
          ls -lh build/outputs/aar
          find build/repository

      - name: Upload binary
        uses: actions/upload-artifact@v7
        id: upload
        with:
          name: android-library
          retention-days: 14
          compression-level: 0 # We're uploading a zip, no need to compress again
          path: android/build/distributions/powersync_android.zip
          if-no-files-found: error

      - name: Build individual libraries for Dart SDK
        shell: bash
        run: |
          cd android
          ./gradlew buildRustStandalone

      - name: Copy individual libraries
        shell: bash
        run: |
          cp android/build/standalone/arm64-v8a/libpowersync.so libpowersync_aarch64.android.so
          cp android/build/standalone/armeabi-v7a/libpowersync.so libpowersync_armv7.android.so
          cp android/build/standalone/x86/libpowersync.so libpowersync_x86.android.so
          cp android/build/standalone/x86_64/libpowersync.so libpowersync_x64.android.so

      - name: Upload individual libraries
        uses: actions/upload-artifact@v7
        id: upload_static
        with:
          name: android-static
          retention-days: 14
          path: |
            *.so

  libs_wasm:
    name: Basic WASM build
    runs-on: ubuntu-latest
    outputs:
      artifact_id: ${{ steps.upload.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install Rust Nightly
        shell: bash
        run: rustup install

      - name: Build WASM
        shell: bash
        run: ./tool/build_wasm.sh

      - uses: actions/upload-artifact@v7
        id: upload
        with:
          name: wasm-library
          retention-days: 14
          path: libpowersync-wasm.a

  libs_xcframework:
    name: Build XCFramework
    runs-on: macos-latest
    outputs:
      artifact_id: ${{ steps.upload.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Setup
        shell: bash
        run: |
          rustup toolchain install nightly-2026-04-10-aarch64-apple-darwin
          rustup component add rust-src --toolchain nightly-2026-04-10-aarch64-apple-darwin
          rustup target add \
            x86_64-apple-darwin \
            aarch64-apple-darwin \
            aarch64-apple-ios \
            aarch64-apple-ios-sim \
            x86_64-apple-ios

      - name: setup-cocoapods
        uses: maxim-lobanov/setup-cocoapods@8e97e1e98e6ccf42564fdf5622c8feec74199377 # v1.4.0
        with:
          version: 1.16.2

      - name: Set up XCode
        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
        with:
          xcode-version: latest-stable
      
      - name: List simulators
        shell: bash
        run: |
          xcrun xctrace list devices

      - name: Build iOS & macOS xcframework
        shell: bash
        run: |
          ./tool/build_xcframework.sh

      - name: Lint pod
        shell: bash
        run: |
          pod lib lint

      - uses: actions/upload-artifact@v7
        id: upload
        with:
          name: xcframework
          retention-days: 14
          compression-level: 0 # We're uploading a zip archive, no need to compress agan
          path: |
            powersync-sqlite-core.xcframework.zip

  attest:
    name: Attest artifacts
    needs:
      [
        libs_linux,
        libs_macos,
        libs_windows,
        libs_android,
        libs_wasm,
        libs_xcframework,
      ]
    runs-on: ubuntu-latest
    outputs:
      artifact_id: ${{ steps.upload_sbom.outputs.artifact-id }}
    permissions:
      id-token: write # Needed to mint the OIDC token used to sign the attestation.
      attestations: write # Needed to publish the attestation.
      artifact-metadata: write # Create artifact storage record.
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: dart-lang/setup-dart@v1

      - name: Install Rust Nightly
        shell: bash
        run: rustup install

      - name: Install Dart dependencies
        working-directory: dart
        run: dart pub get

      - name: Generate SBOM
        working-directory: dart
        run: dart tool/generate_sbom.dart > ../bom.json

      - name: Upload SBOM
        uses: actions/upload-artifact@v7
        id: upload_sbom
        with:
          name: sbom
          retention-days: 14
          path: bom.json

      - name: Download build artifacts
        uses: actions/download-artifact@v8
        if: ${{ inputs.attest }}
        with:
          path: artifacts
          merge-multiple: true
          artifact-ids: >-
            ${{ needs.libs_linux.outputs.artifact_id }},
            ${{ needs.libs_macos.outputs.artifact_id }},
            ${{ needs.libs_windows.outputs.artifact_id }},
            ${{ needs.libs_android.outputs.artifact_id }},
            ${{ needs.libs_android.outputs.static_artifact_id }},
            ${{ needs.libs_wasm.outputs.artifact_id }},
            ${{ needs.libs_xcframework.outputs.artifact_id }}

      - name: List downloaded artifacts
        if: ${{ inputs.attest }}
        run: find artifacts

      - name: Attest artifacts
        if: ${{ inputs.attest }}
        uses: actions/attest@v4
        with:
          subject-path: artifacts/*

      - name: Attest SBOM
        if: ${{ inputs.attest }}
        uses: actions/attest@v4
        with:
          sbom-path: bom.json
          subject-path: artifacts/*