// OxygenFlow's own pipeline (docs/m0.md). Runs in Firecracker microVMs on

// Earth for every push to a bookmark; see the Flow tab on OxygenHub.

schema-version 1

sandbox "alpine" {

    runtime "microvm"

    // Alpine 3.24.2 minirootfs, imported on Earth with `flow rootfs import`.

    rootfs "cas://blob/e95d22fb2380b67193f2640a12c2f8c7bae485f6fd14330bdb0c7157faa588dc"

    memory-limit "256MiB"

    cpu-limit 1

    network "isolated"

}

// The cheap checks as one WASI module (#96): crates/flow-checks, built by

// scripts/checks-wasm.sh and committed as .flow/checks.wasm (the fmt job

// fails if it is not what the source builds). No image and no KVM, so any

// runner with the WASM tier takes them: the phone, plex, windows-1.

sandbox "wasm" {

    runtime "wasm"

    memory-limit "64MiB"

}

job "layout" {

    sandbox "wasm"

    exec ".flow/checks.wasm" "layout" "Cargo.toml" "docs/m0.md" "crates/flow-core/src/pipeline.rs" "crates/flow-init/src/main.rs" "crates/flow/src/microvm.rs"

}

job "todos" {

    sandbox "wasm"

    scope "crates/**" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "todos" "crates"

}

// The changelog's shape, and a section for the version Cargo.toml says, so

// a release never finds its notes missing.

job "changelog" {

    sandbox "wasm"

    scope "CHANGELOG.md" "Cargo.toml" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "Cargo.toml"

}

job "size" {

    sandbox "wasm"

    scope "crates/**" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "size" "crates"

}

job "isolation" {

    sandbox "alpine"

    exec "sh" "-eu" ".flow/jobs/isolation.sh"

}

// The build image (images/rust): Rust with rustfmt and clippy, Node, and the

// vendored crates. oxygen comes from the pinned subrepo in deps/.

sandbox "rust" {

    runtime "microvm"

    rootfs "cas://blob/e52c41a173956b6bacc270eb81208a1b118b652412b84d15fa24708e6f8ec392"

    memory-limit "8GiB"

    cpu-limit 4

    network "loopback"

    // CI builds are thrown away: no incremental state and no debug info,

    // so less to compile, link and write (as in oxygenhub's pipeline).

    env {

        CARGO_INCREMENTAL "0"

        CARGO_PROFILE_DEV_DEBUG "0"

        CARGO_PROFILE_TEST_DEBUG "0"

        CARGO_PROFILE_RELEASE_DEBUG "0"

    }

}

sandbox "rust-small" {

    runtime "microvm"

    rootfs "cas://blob/e52c41a173956b6bacc270eb81208a1b118b652412b84d15fa24708e6f8ec392"

    memory-limit "1GiB"

    cpu-limit 1

    network "isolated"

}

job "fmt" {

    sandbox "rust-small"

    // This workspace only (--all would reach the pinned oxygen in deps/),

    // and the checks' committed WASI module is what its source builds (#96).

    exec "sh" "-euc" "cargo fmt --check -p flow -p flow-core -p flow-init -p flow-casfs -p flow-checks && sh scripts/checks-wasm.sh --check"

}

job "clippy" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "16GiB"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    }

    // One build identity for every CI state, so the cached target stays

    // fresh from one push to the next (oxygenflow#52).

    env {

        OXY_BUILD "ci"

    }

    exec "sh" ".flow/warm-target.sh" "cargo" "clippy" "--workspace" "--all-targets" "--locked" "--" "-D" "warnings"

}

job "test" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "16GiB"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    }

    // One build identity for every CI state, so the cached target stays

    // fresh from one push to the next (oxygenflow#52).

    env {

        OXY_BUILD "ci"

    }

    // The tests under cargo-nextest and cargo-llvm-cov (#82): a test report

    // (JUnit, kept whether or not they pass) and line coverage (LCOV) from

    // one run, for the hub's Tests and Coverage tabs.

    exec "sh" ".flow/warm-target.sh" "cargo" "llvm-cov" "nextest" "--workspace" "--locked" "--profile" "ci" "--lcov" "--output-path" "/src/target/lcov.info"

    output {

        artifact "junit" {

            path "/src/target/nextest/ci/junit.xml"

            when "always"

        }

        artifact "coverage" {

            path "/src/target/lcov.info"

        }

    }

}

// Runner builds for releases (oxygenhub#322): flow-linux-ARCH for x86_64,

// aarch64 and riscv64, which runners that update themselves are offered.

job "dist" {

    sandbox "rust"

    depends-on "fmt"

    scope "Cargo.toml" "scripts/dist.sh"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "24GiB"

        cache "target"

        key "Cargo.lock"

    }

    env {

        DIST_FLAT "/src/target/dist-flat"

        ZIG_GLOBAL_CACHE_DIR "/src/target/zig-cache"

    }

    exec "bash" "scripts/dist.sh"

    output {

        artifact "flow-linux-x86_64" {

            path "/src/target/dist-flat/flow-linux-x86_64"

        }

        artifact "flow-linux-aarch64" {

            path "/src/target/dist-flat/flow-linux-aarch64"

        }

        artifact "flow-linux-riscv64" {

            path "/src/target/dist-flat/flow-linux-riscv64"

        }

        artifact "flow-windows-x86_64.exe" {

            path "/src/target/dist-flat/flow-windows-x86_64.exe"

        }

        artifact "SHA256SUMS" {

            path "/src/target/dist-flat/SHA256SUMS"

        }

    }

}

job "summary" {

    sandbox "wasm"

    depends-on "layout" "todos" "size" "isolation" "clippy" "test"

    env {

        PROJECT "OxygenFlow"

    }

    exec ".flow/checks.wasm" "summary"

}