build.yml

name: Build

on: [push, pull_request]

jobs:
  linux:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64
      - uses: docker/setup-buildx-action@v3
        with:
          platforms: linux/amd64,linux/arm64
      - uses: docker/build-push-action@v5
        id: docker_build_amd64
        with:
          context: .
          platforms: amd64
          cache-from: type=gha
          cache-to: type=gha
          load: true
      - uses: docker/build-push-action@v5
        id: docker_build_arm64
        with:
          context: .
          platforms: arm64
          cache-from: type=gha
          cache-to: type=gha
          load: true
      - uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
        if: github.event_name == 'push'
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ${{ vars.DOCKERHUB_USERNAME }}/fishnet
          tags: |
            type=ref,event=branch
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{version}}
          labels: |
            org.opencontainers.image.licenses=GPL-3.0-or-later
        if: github.event_name == 'push'
      - uses: docker/build-push-action@v5
        id: docker_push
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
        if: github.event_name == 'push'
      - run: docker cp "$(docker create ${{ steps.docker_build_amd64.outputs.imageid }}):/fishnet" fishnet-x86_64-unknown-linux-musl
      - run: docker cp "$(docker create ${{ steps.docker_build_arm64.outputs.imageid }}):/fishnet" fishnet-aarch64-unknown-linux-musl
      - uses: actions/upload-artifact@v4
        with:
          name: fishnet-x86_64-unknown-linux-musl
          path: fishnet-x86_64-unknown-linux-musl
      - uses: actions/upload-artifact@v4
        with:
          name: fishnet-aarch64-unknown-linux-musl
          path: fishnet-aarch64-unknown-linux-musl
  windows-x86-64:
    runs-on: windows-2019
    defaults:
      run:
        shell: msys2 {0}
    steps:
      - uses: msys2/setup-msys2@v2
        with:
          msystem: mingw64
          update: true
          install: mingw-w64-x86_64-gcc mingw-w64-x86_64-rust mingw-w64-x86_64-make tar
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: actions/checkout@v4
        with:
          repository: lichess-org/intel-sde
          ssh-key: ${{ secrets.ID_RSA_INTEL_SDE }}
          ref: main
          path: intel-sde
        id: sde
        continue-on-error: true
      - run: tar xf intel-sde/sde-external-9.0.0-2021-11-07-win.tar.xz && echo SDE_PATH=$(cygpath -u $GITHUB_WORKSPACE)/sde-external-9.0.0-2021-11-07-win/sde.exe | tee $GITHUB_ENV
        if: steps.sde.outcome == 'success'
      - run: cargo build --release --target x86_64-pc-windows-gnu -vv
      - run: mv target/x86_64-pc-windows-gnu/release/fishnet.exe fishnet-x86_64-pc-windows-gnu-unsigned.exe
      - uses: actions/upload-artifact@v4
        id: upload-unsigned-artifact
        with:
          name: fishnet-x86_64-pc-windows-gnu-unsigned
          path: fishnet-x86_64-pc-windows-gnu-unsigned.exe
      - uses: signpath/github-action-submit-signing-request@v0.4
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
          project-slug: 'fishnet'
          signing-policy-slug: ${{ startsWith(github.ref, 'refs/tags/v') && 'release-signing' || 'test-signing' }}
          github-artifact-id: ${{ steps.upload-unsigned-artifact.outputs.artifact-id }}
          wait-for-completion: true
          wait-for-completion-timeout-in-seconds: 7200
          output-artifact-directory: signed
      - run: mv signed/fishnet-x86_64-pc-windows-gnu-unsigned.exe signed/fishnet-x86_64-pc-windows-gnu.exe
      - uses: actions/upload-artifact@v4
        with:
          name: fishnet-x86_64-pc-windows-gnu
          path: signed
  macos-x86-64:
    runs-on: macos-13
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo install --force cargo-auditable
      - run: cargo auditable build --release -vv
      - run: mv target/release/fishnet fishnet-x86_64-apple-darwin
      - uses: actions/upload-artifact@v4
        with:
          name: fishnet-x86_64-apple-darwin
          path: fishnet-x86_64-apple-darwin
  macos-aarch64:
    runs-on: macos-12
    env:
      CXXFLAGS: -target arm64-apple-macos11
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin
      - run: cargo install --force cargo-auditable
      - run: cargo auditable build --release --target aarch64-apple-darwin -vv
      - run: mv target/aarch64-apple-darwin/release/fishnet fishnet-aarch64-apple-darwin
      - uses: actions/upload-artifact@v4
        with:
          name: fishnet-aarch64-apple-darwin
          path: fishnet-aarch64-apple-darwin
  github_release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs:
      - linux
      - windows-x86-64
      - macos-x86-64
      - macos-aarch64
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
        id: get_version
      - uses: actions/download-artifact@v4
        with:
          merge-multiple: true
      - run: sha256sum fishnet-*
      - uses: softprops/action-gh-release@v1
        with:
          name: fishnet ${{ steps.get_version.outputs.VERSION }}
          body: |
            Downloads:

            * [fishnet-x86_64-unknown-linux-musl](https://fishnet-releases.s3.dualstack.eu-west-3.amazonaws.com/${{ steps.get_version.outputs.VERSION }}/fishnet-x86_64-unknown-linux-musl)
            * [fishnet-x86_64-pc-windows-gnu.exe](https://fishnet-releases.s3.dualstack.eu-west-3.amazonaws.com/${{ steps.get_version.outputs.VERSION }}/fishnet-x86_64-pc-windows-gnu.exe)
            * [fishnet-x86_64-apple-darwin](https://fishnet-releases.s3.dualstack.eu-west-3.amazonaws.com/${{ steps.get_version.outputs.VERSION }}/fishnet-x86_64-apple-darwin)
            * [fishnet-aarch64-unknown-linux-musl](https://fishnet-releases.s3.dualstack.eu-west-3.amazonaws.com/${{ steps.get_version.outputs.VERSION }}/fishnet-aarch64-unknown-linux-musl)
            * [fishnet-aarch64-apple-darwin](https://fishnet-releases.s3.dualstack.eu-west-3.amazonaws.com/${{ steps.get_version.outputs.VERSION }}/fishnet-aarch64-apple-darwin)
          generate_release_notes: true
          draft: true
          files: fishnet-*
          fail_on_unmatched_files: true
  s3_release:
    runs-on: ubuntu-latest
    environment:
      name: s3
    needs: github_release
    steps:
      - run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
        id: get_version
      - uses: actions/download-artifact@v4
        with:
          merge-multiple: true
      - run: sha256sum fishnet-*
      - uses: shallwefootball/s3-upload-action@bcd7c2408245fd6cd19b5512a473b1a7a8b48a35
        with:
          aws_key_id: ${{ secrets.AWS_KEY_ID }}
          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws_bucket: fishnet-releases
          source_dir: .
          destination_dir: ${{ steps.get_version.outputs.VERSION }}