// OxygenHub's pipeline (OxygenFlow, docs in the oxygenflow repository).
// Every push to a bookmark on OxygenHub runs it in Firecracker microVMs on
// Earth; the jobs appear as checks on the change. oxygen and oxygenflow come
// from the pinned subrepos in deps/, which the runner puts in the workspace.
schema-version 1

// Cheap checks on the WASM tier (oxygenflow#96): OxygenFlow's checks module,
// copied from oxygenflow/.flow/checks.wasm (built there from
// crates/flow-checks; copy it again when it changes). No image and no KVM,
// so any runner with the WASM tier takes it: a phone, plex, windows-1.
sandbox "wasm" {
    runtime "wasm"
    memory-limit "64MiB"
}

// The changelog's shape, and a section for the version Cargo.toml says, so a
// release never finds its notes missing.
job "changelog" {
    sandbox "wasm"
    scope "CHANGELOG.md" "Cargo.toml" ".flow/checks.wasm"
    exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "Cargo.toml"
}

// The OxygenFlow build image: Rust with rustfmt and clippy, Node, every
// crate of Cargo.lock vendored, and this workspace's dependencies prebuilt
// in /opt/warm/oxygenhub, which .flow/warm-target.sh copies onto a job's
// target disk (oxygenflow/images/rust). Rebuild and re-pin it when
// Cargo.lock changes; until then only the changed crates are compiled.
sandbox "rust" {
    runtime "microvm"
    rootfs "cas://blob/57aa0b34c0cadd541cfe90ac2711200be46879ac9968778e3a3417eca04357e3"
    memory-limit "8GiB"
    cpu-limit 4
    // Tests serve and connect on 127.0.0.1; nothing leaves the guest.
    network "loopback"
}

sandbox "rust-small" {
    runtime "microvm"
    rootfs "cas://blob/57aa0b34c0cadd541cfe90ac2711200be46879ac9968778e3a3417eca04357e3"
    memory-limit "1GiB"
    cpu-limit 1
    network "isolated"
}

job "fmt" {
    sandbox "rust-small"
    // Only this workspace's packages: --all would also check the path
    // dependencies in deps/, which follow their own formatting.
    exec "cargo" "fmt" "--check" "-p" "oxygenhub" "-p" "hub-api" "-p" "oh"
}

job "clippy" {
    sandbox "rust"
    depends-on "fmt"
    mount {
        source "ephemeral://disk"
        target "/src/target"
        size "24GiB"
    }
<<<<<<< oxy conflict 1 of 2, side 1 of 2: change 6532b323 "oxygen and oxygenflow as pinned subrepos in deps/ (make pins moves them), and an OxygenFlow pipeline: fmt of this workspace, then clippy, tests and a release build against the pins"
    env {
        CARGO_INCREMENTAL "0"
    }
======= oxy conflict 1 of 2, side 2 of 2: change bce3997c "CI starts from the build image's prebuilt dependencies"
    exec "sh" ".flow/warm-target.sh" "cargo" "clippy" "--workspace" "--all-targets" "--locked" "--" "-D" "warnings"
>>>>>>> oxy conflict 1 of 2 end
}

job "test" {
    sandbox "rust"
    depends-on "fmt"
    mount {
        source "ephemeral://disk"
        target "/src/target"
        size "24GiB"
    }
<<<<<<< oxy conflict 2 of 2, side 1 of 2: change 6532b323 "oxygen and oxygenflow as pinned subrepos in deps/ (make pins moves them), and an OxygenFlow pipeline: fmt of this workspace, then clippy, tests and a release build against the pins"
    env {
        CARGO_INCREMENTAL "0"
    }
======= oxy conflict 2 of 2, side 2 of 2: change 28570ce2 "A test report and coverage from the hub's CI (closes #307)"
    // Under cargo-nextest (#307): a JUnit report for the hub's Tests tab,
    // kept whether or not the tests pass.
    exec "sh" ".flow/warm-target.sh" "cargo" "nextest" "run" "--workspace" "--locked" "--profile" "ci"
    output {
        artifact "junit" {
            path "/src/target/nextest/ci/junit.xml"
            when "always"
        }
    }
}

// Line coverage (#307) for the Coverage tab: the tests again, instrumented,
// in a job of its own beside `test`, so neither waits for the other and the
// instrumented build keeps its own cached target. Not a required check.
job "coverage" {
    sandbox "rust"
    depends-on "fmt"
    mount {
        source "ephemeral://disk"
        target "/src/target"
        size "48GiB"
        cache "coverage-target"
        key "Cargo.lock"
    }
    exec "cargo" "llvm-cov" "nextest" "--workspace" "--locked" "--profile" "ci" "--lcov" "--output-path" "/src/target/lcov.info"
    output {
        artifact "coverage" {
            path "/src/target/lcov.info"
        }
    }
>>>>>>> oxy conflict 2 of 2 end
}

// The hub's tests again on PostgreSQL (#211, docs/postgres.md), against a
// server the job starts in its own guest.
job "test-postgres" {
    sandbox "rust"
    depends-on "fmt"
    mount {
        source "ephemeral://disk"
        target "/src/target"
        size "24GiB"
        cache "target"
        key "Cargo.lock"
    }
    exec "sh" ".flow/test-postgres.sh"
}

job "build" {
    sandbox "rust"
    depends-on "fmt"
    mount {
        source "ephemeral://disk"
        target "/src/target"
        size "24GiB"
    }
    env {
        CARGO_INCREMENTAL "0"
    }
    exec "sh" ".flow/warm-target.sh" "cargo" "build" "--release" "--locked"
}

// Release files for every platform (oxygen#59): scripts/dist.sh in the
// build image's cross toolchains. A push runs it only when it touches
// these paths (a release moves Cargo.toml's version); "Run pipeline" and
// reruns always do. The files are kept as this run's artifacts, named by
// its signed receipt, and attached to the release from there, so the
// release's trust page shows each as built here.
job "dist" {
    sandbox "rust"
    depends-on "fmt"
    scope "Cargo.toml" "scripts/dist.sh" "packaging/**"
    mount {
        source "ephemeral://disk"
        target "/src/target"
        size "24GiB"
    }
    env {
        DIST_FLAT "/src/target/dist-flat"
        ZIG_GLOBAL_CACHE_DIR "/src/target/zig-cache"
    }
    exec "bash" "scripts/dist.sh"
    output {
        artifact "oh-linux-x86_64.tar.gz" {
            path "/src/target/dist-flat/oh-linux-x86_64.tar.gz"
        }
        artifact "oh-linux-arm64.tar.gz" {
            path "/src/target/dist-flat/oh-linux-arm64.tar.gz"
        }
        artifact "oh-linux-riscv64.tar.gz" {
            path "/src/target/dist-flat/oh-linux-riscv64.tar.gz"
        }
        artifact "oh-macos-x86_64.tar.gz" {
            path "/src/target/dist-flat/oh-macos-x86_64.tar.gz"
        }
        artifact "oh-macos-arm64.tar.gz" {
            path "/src/target/dist-flat/oh-macos-arm64.tar.gz"
        }
        artifact "oh-windows-x86_64.zip" {
            path "/src/target/dist-flat/oh-windows-x86_64.zip"
        }
        artifact "oh_amd64.deb" {
            path "/src/target/dist-flat/oh_amd64.deb"
        }
        artifact "oh_arm64.deb" {
            path "/src/target/dist-flat/oh_arm64.deb"
        }
        artifact "oh_riscv64.deb" {
            path "/src/target/dist-flat/oh_riscv64.deb"
        }
        artifact "SHA256SUMS" {
            path "/src/target/dist-flat/SHA256SUMS"
        }
    }
}