// OxygenHub's pipeline (OxygenFlow, docs in the oxygenflow repository).

// Every push to a bookmark on OxygenHub runs it in Firecracker microVMs on

// Earth; the jobs appear as checks on the change. oxygen and oxygenflow come

// from the pinned subrepos in deps/, which the runner puts in the workspace.

schema-version 1

// Cheap checks on the WASM tier (oxygenflow#96): OxygenFlow's checks module,

// copied from oxygenflow/.flow/checks.wasm (built there from

// crates/flow-checks; copy it again when it changes). No image and no KVM,

// so any runner with the WASM tier takes it: a phone, plex, windows-1.

sandbox "wasm" {

    runtime "wasm"

    memory-limit "64MiB"

}

// The changelog's shape, and a section for the version Cargo.toml says, so a

// release never finds its notes missing.

job "changelog" {

    sandbox "wasm"

    scope "CHANGELOG.md" "Cargo.toml" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "Cargo.toml"

}

// The OxygenFlow build image: Rust with rustfmt and clippy, Node, every

// crate of Cargo.lock vendored, and this workspace's dependencies prebuilt

// in /opt/warm/oxygenhub, which .flow/warm-target.sh copies onto a job's

// target disk (oxygenflow/images/rust). Rebuild and re-pin it when

// Cargo.lock changes; until then only the changed crates are compiled.

sandbox "rust" {

    runtime "microvm"

    rootfs "cas://blob/836461b613019f62399a960c61a25c482eb74e30054ff2cd44d5594c3305872b"

    memory-limit "8GiB"

    cpu-limit 4

    // Tests serve and connect on 127.0.0.1; nothing leaves the guest.

    network "loopback"

    // CI builds are thrown away: no incremental state, and no debug info

    // (the release profile keeps line tables for the binary Earth runs,

    // which is built outside CI), so less to compile, link and write.

    env {

        CARGO_INCREMENTAL "0"

        CARGO_PROFILE_DEV_DEBUG "0"

        CARGO_PROFILE_TEST_DEBUG "0"

        CARGO_PROFILE_RELEASE_DEBUG "0"

        // One build identity for every CI state, so a cached target stays

        // fresh from one push to the next (oxygenflow#52); dist sets the

        // release's own.

        OXY_BUILD "ci"

    }

}

sandbox "rust-small" {

    runtime "microvm"

    rootfs "cas://blob/836461b613019f62399a960c61a25c482eb74e30054ff2cd44d5594c3305872b"

    memory-limit "1GiB"

    cpu-limit 1

    network "isolated"

}

// The riscv64 build image on narvi-1 (oxygenflow#69): Ubuntu 24.04 riscv64

// with Rust 1.97.1 and the same vendored crates, in the syscall tier (the

// board has no hardware virtualisation, so no microVM). `runs-on` keeps it

// on a RISC-V runner.

sandbox "rust-riscv64" {

    runtime "syscall"

    rootfs "cas://blob/b4edba9173ddf63aa1df46222e6a59b265071b19f2815c89d0153b593835c616"

    runs-on "riscv64"

    memory-limit "4GiB"

    cpu-limit 6

    network "loopback"

    env {

        CARGO_INCREMENTAL "0"

        CARGO_PROFILE_RELEASE_DEBUG "0"

        CARGO_BUILD_JOBS "4"

    }

}

job "fmt" {

    sandbox "rust-small"

    // Only this workspace's packages: --all would also check the path

    // dependencies in deps/, which follow their own formatting.

    exec "cargo" "fmt" "--check" "-p" "oxygenhub" "-p" "hub-api" "-p" "oh"

}

job "clippy" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "24GiB"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    }

    exec "sh" ".flow/warm-target.sh" "cargo" "clippy" "--workspace" "--all-targets" "--locked" "--" "-D" "warnings"

}

job "test" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        // 40 GiB (2026-10-20), as test-postgres: its kept target filled 24 GiB.

        size "40GiB"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    }

    // Under cargo-nextest (#307): a JUnit report for the hub's Tests tab,

    // kept whether or not the tests pass.

    exec "sh" ".flow/warm-target.sh" "cargo" "nextest" "run" "--workspace" "--locked" "--profile" "ci"

    output {

        artifact "junit" {

            path "/src/target/nextest/ci/junit.xml"

            when "always"

        }

    }

}

// Line coverage (#307) for the Coverage tab: the tests again, instrumented,

// in a job of its own beside `test`, so neither waits for the other and the

// instrumented build keeps its own cached target. Not a required check.

job "coverage" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "48GiB"

        cache "coverage-target"

        key "Cargo.lock"

    }

    exec "cargo" "llvm-cov" "nextest" "--workspace" "--locked" "--profile" "ci" "--lcov" "--output-path" "/src/target/lcov.info"

    output {

        artifact "coverage" {

            path "/src/target/lcov.info"

        }

    }

}

// The hub's tests again on PostgreSQL (#211, docs/postgres.md), against a

// server the job starts in its own guest.

job "test-postgres" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        // 40 GiB (2026-10-20): its kept target holds the postgres-feature test

        // binaries beside older ones, and filled 24 GiB (the linker then dies

        // with SIGBUS writing its mmapped output).

        size "40GiB"

        cache "target"

        key "Cargo.lock"

    }

    exec "sh" ".flow/test-postgres.sh"

}

job "build" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "24GiB"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    }

    exec "sh" ".flow/warm-target.sh" "cargo" "build" "--release" "--locked"

}

// Release files for every platform (oxygen#59): scripts/dist.sh in the

// build image's cross toolchains. A push runs it only when it touches

// these paths (a release moves Cargo.toml's version); "Run pipeline" and

// reruns always do. The files are kept as this run's artifacts, named by

// its signed receipt, and attached to the release from there, so the

// release's trust page shows each as built here.

job "dist" {

    sandbox "rust"

    depends-on "fmt"

    scope "Cargo.toml" "scripts/dist.sh" "packaging/**"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "24GiB"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    }

    env {

        DIST_FLAT "/src/target/dist-flat"

        ZIG_GLOBAL_CACHE_DIR "/src/target/zig-cache"

    }

    exec "bash" "scripts/dist.sh"

    output {

        artifact "oh-linux-x86_64.tar.gz" {

            path "/src/target/dist-flat/oh-linux-x86_64.tar.gz"

        }

        artifact "oh-linux-arm64.tar.gz" {

            path "/src/target/dist-flat/oh-linux-arm64.tar.gz"

        }

        artifact "oh-linux-riscv64.tar.gz" {

            path "/src/target/dist-flat/oh-linux-riscv64.tar.gz"

        }

        artifact "oh-macos-x86_64.tar.gz" {

            path "/src/target/dist-flat/oh-macos-x86_64.tar.gz"

        }

        artifact "oh-macos-arm64.tar.gz" {

            path "/src/target/dist-flat/oh-macos-arm64.tar.gz"

        }

        artifact "oh-windows-x86_64.zip" {

            path "/src/target/dist-flat/oh-windows-x86_64.zip"

        }

        artifact "oh_amd64.deb" {

            path "/src/target/dist-flat/oh_amd64.deb"

        }

        artifact "oh_arm64.deb" {

            path "/src/target/dist-flat/oh_arm64.deb"

        }

        artifact "oh_riscv64.deb" {

            path "/src/target/dist-flat/oh_riscv64.deb"

        }

        artifact "oxygenhub-server-linux-x86_64.tar.gz" {

            path "/src/target/dist-flat/oxygenhub-server-linux-x86_64.tar.gz"

        }

        artifact "oh-src.tar.gz" {

            path "/src/target/dist-flat/oh-src.tar.gz"

        }

        artifact "SHA256SUMS" {

            path "/src/target/dist-flat/SHA256SUMS"

        }

    }

}

// The native RISC-V check (oxygenflow#69): oh built and run on narvi-1, a

// real riscv64 board, so each release is known to run there and not only

// to cross-compile (dist). Like dist, a push runs it only when it touches

// these paths; "Run pipeline" and reruns always do. Its target directory

// is cached between passing runs (oxygenflow#70).

job "riscv64" {

    sandbox "rust-riscv64"

    depends-on "fmt"

    scope "Cargo.toml" "scripts/dist.sh" "packaging/**" ".flow/riscv64-check.sh"

    timeout "3h"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "16GiB"

        cache "target"

        key "Cargo.lock"

    }

    exec "sh" ".flow/riscv64-check.sh"

    output {

        artifact "oh-linux-riscv64-native" {

            path "/src/target/release/oh"

        }

    }

}