// Oxygen's own pipeline (OxygenFlow, docs in the oxygenflow repository).

// Every push to a bookmark on OxygenHub runs it in Firecracker microVMs on

// Earth; the jobs appear as checks on the change.

schema-version 1

// Cheap checks on the WASM tier (oxygenflow#96): OxygenFlow's checks module,

// copied from oxygenflow/.flow/checks.wasm (built there from

// crates/flow-checks; copy it again when it changes). No image and no KVM,

// so any runner with the WASM tier takes it: a phone, plex, windows-1.

sandbox "wasm" {

    runtime "wasm"

    memory-limit "64MiB"

}

// The changelog's shape, and a section for the version Cargo.toml says, so a

// release never finds its notes missing.

job "changelog" {

    sandbox "wasm"

    scope "CHANGELOG.md" "Cargo.toml" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "Cargo.toml"

}

// The OxygenFlow build image: Rust with rustfmt and clippy, Node, and every

// crate of Cargo.lock vendored (oxygenflow/images/rust). Rebuild and re-pin

// it when Cargo.lock changes.

sandbox "rust" {

    runtime "microvm"

    rootfs "cas://blob/7705d699a4fc06862e4297b7069396cf3b5b35b1d3f15191c46dc2031af17133"

    memory-limit "8GiB"

    cpu-limit 4

    // Tests serve and connect on 127.0.0.1; nothing leaves the guest.

    network "loopback"

}

sandbox "rust-small" {

    runtime "microvm"

    rootfs "cas://blob/7705d699a4fc06862e4297b7069396cf3b5b35b1d3f15191c46dc2031af17133"

    memory-limit "1GiB"

    cpu-limit 1

    network "isolated"

}

job "fmt" {

    sandbox "rust-small"

    exec "cargo" "fmt" "--all" "--check"

}

job "clippy" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "24GiB"

    }

<<<<<<< oxy conflict 1 of 1, side 1 of 2: change 110a6605 "OxygenFlow pipeline: fmt, then clippy -D warnings, tests and a release build in microVMs on Earth, on every push"

    env {

        CARGO_INCREMENTAL "0"

    }

======= oxy conflict 1 of 1, side 2 of 2: change 116da477 "CI starts from the build image's prebuilt dependencies"

    exec "sh" ".flow/warm-target.sh" "cargo" "clippy" "--workspace" "--all-targets" "--locked" "--" "-D" "warnings"

>>>>>>> oxy conflict 1 of 1 end

}

// The tests, run under cargo-nextest and cargo-llvm-cov: a test report

// (JUnit, kept whether or not they pass; #139) for the hub's Tests tab and

// line coverage (LCOV, oxygenhub#113) for its Coverage tab, from one run.

job "test" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "24GiB"

    }

    env {

        CARGO_INCREMENTAL "0"

    }

    exec "cargo" "llvm-cov" "nextest" "--workspace" "--locked" "--profile" "ci" "--lcov" "--output-path" "/src/target/lcov.info"

    output {

        artifact "junit" {

            path "/src/target/nextest/ci/junit.xml"

            when "always"

        }

        artifact "coverage" {

            path "/src/target/lcov.info"

        }

    }

}

job "build" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "24GiB"

    }

    env {

        CARGO_INCREMENTAL "0"

    }

    exec "sh" ".flow/warm-target.sh" "cargo" "build" "--release" "--locked"

}

// Release files for every platform (oxygen#59): scripts/dist.sh in the

// build image's cross toolchains. A push runs it only when it touches

// these paths (a release moves Cargo.toml's version); "Run pipeline" and

// reruns always do. The files are kept as this run's artifacts, named by

// its signed receipt, and attached to the release from there, so the

// release's trust page shows each as built here.

job "dist" {

    sandbox "rust"

    depends-on "fmt"

    scope "Cargo.toml" "scripts/dist.sh" "packaging/**"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "24GiB"

    }

    env {

        DIST_FLAT "/src/target/dist-flat"

        ZIG_GLOBAL_CACHE_DIR "/src/target/zig-cache"

    }

    exec "bash" "scripts/dist.sh"

    output {

        artifact "oxy-linux-x86_64.tar.gz" {

            path "/src/target/dist-flat/oxy-linux-x86_64.tar.gz"

        }

        artifact "oxy-linux-arm64.tar.gz" {

            path "/src/target/dist-flat/oxy-linux-arm64.tar.gz"

        }

        artifact "oxy-linux-riscv64.tar.gz" {

            path "/src/target/dist-flat/oxy-linux-riscv64.tar.gz"

        }

        artifact "oxy-macos-x86_64.tar.gz" {

            path "/src/target/dist-flat/oxy-macos-x86_64.tar.gz"

        }

        artifact "oxy-macos-arm64.tar.gz" {

            path "/src/target/dist-flat/oxy-macos-arm64.tar.gz"

        }

        artifact "oxy-windows-x86_64.zip" {

            path "/src/target/dist-flat/oxy-windows-x86_64.zip"

        }

        artifact "oxy_amd64.deb" {

            path "/src/target/dist-flat/oxy_amd64.deb"

        }

        artifact "oxy_arm64.deb" {

            path "/src/target/dist-flat/oxy_arm64.deb"

        }

        artifact "oxy_riscv64.deb" {

            path "/src/target/dist-flat/oxy_riscv64.deb"

        }

        artifact "oxy-src.tar.gz" {

            path "/src/target/dist-flat/oxy-src.tar.gz"

        }

        artifact "SHA256SUMS" {

            path "/src/target/dist-flat/SHA256SUMS"

        }

    }

}