image: ubuntu/noble
packages:
  - curl
  - ca-certificates
  - gnupg
  - protobuf-compiler
  - cmake
  - build-essential
  - docker.io
  - unzip
  - zstd
secrets:
  - 7dde4219-0783-4581-a67d-c94749de3600   # ~/.s3-cache-key-id
  - 0e5b3530-6f19-4f30-9b73-9339dd382e46   # ~/.s3-cache-key-secret
sources:
  - https://git.srht.bigb.es/~bigbes/tarantool-protobuf
environment:
  GOPATH: /home/build/go
  GOROOT: /home/build/.local/go
  GO_VERSION: "1.26.3"
  PATH: /home/build/.local/go/bin:/home/build/.local/bin:/home/build/go/bin:/usr/local/bin:/usr/bin:/bin
  AWS_DEFAULT_REGION: garage
  AWS_ENDPOINT_URL: https://s3.bigb.es
  S3_BUCKET: docker-cache
  S3_PREFIX: tarantool-protobuf/conformance-images
submitter:
  git.sr.ht:
    enabled: true
    allow-refs:
      - refs/heads/master
      - "refs/tags/*"
tasks:
  - install_awscli: |
      # awscli was dropped from Ubuntu noble's repos; install v2 from upstream.
      curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" \
        -o /tmp/awscliv2.zip
      unzip -q /tmp/awscliv2.zip -d /tmp
      sudo /tmp/aws/install
      aws --version
  - aws_credentials: |
      mkdir -p ~/.aws
      cat > ~/.aws/config <<EOF
      [default]
      region = $AWS_DEFAULT_REGION
      s3 =
          addressing_style = path
          signature_version = s3v4
      EOF
      # Garage doesn't implement the newer trailing CRC32 checksums that
      # boto3 1.36+ sends by default — switch to "only when required".
      echo 'export AWS_REQUEST_CHECKSUM_CALCULATION=when_required'  >> ~/.buildenv
      echo 'export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required' >> ~/.buildenv
      export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
      export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
      set +x
      # tr strips any trailing whitespace / CR / accidental newlines that
      # $(cat ...) won't (it only chops trailing \n, not \r or spaces).
      export AWS_ACCESS_KEY_ID=$(tr -d '[:space:]' < ~/.s3-cache-key-id)
      export AWS_SECRET_ACCESS_KEY=$(tr -d '[:space:]' < ~/.s3-cache-key-secret)
      {
        printf 'export AWS_ACCESS_KEY_ID=%q\n'     "$AWS_ACCESS_KEY_ID"
        printf 'export AWS_SECRET_ACCESS_KEY=%q\n' "$AWS_SECRET_ACCESS_KEY"
      } >> ~/.buildenv
      # Length-only diagnostics — Garage v2.2 keys are GK + 24 hex (26 chars);
      # secret is typically 40 hex chars. If lengths look odd, the cause is
      # either a registration swap or whitespace contamination upstream of tr.
      echo "key_id_len=${#AWS_ACCESS_KEY_ID} key_id_prefix=${AWS_ACCESS_KEY_ID:0:2}"
      echo "secret_len=${#AWS_SECRET_ACCESS_KEY}"
      set -x
      aws --endpoint-url="$AWS_ENDPOINT_URL" s3 ls "s3://$S3_BUCKET/" >/dev/null
  - install_go: |
      GO_TARBALL="go${GO_VERSION}.linux-amd64.tar.gz"
      GO_KEY="golang/$GO_TARBALL"
      GO_URI="s3://$S3_BUCKET/$GO_KEY"
      mkdir -p ~/.local
      if aws --endpoint-url="$AWS_ENDPOINT_URL" s3api head-object \
           --bucket "$S3_BUCKET" --key "$GO_KEY" >/dev/null 2>&1; then
        echo "Cache HIT — pulling Go from S3"
        aws --endpoint-url="$AWS_ENDPOINT_URL" s3 cp "$GO_URI" - \
          | tar -xz -C ~/.local
      else
        echo "Cache MISS — downloading from go.dev and caching"
        curl -sSL --retry 3 --retry-delay 5 --max-time 300 \
          "https://go.dev/dl/$GO_TARBALL" -o "/tmp/$GO_TARBALL"
        tar -xz -C ~/.local -f "/tmp/$GO_TARBALL"
        aws --endpoint-url="$AWS_ENDPOINT_URL" s3 cp "/tmp/$GO_TARBALL" "$GO_URI"
        rm "/tmp/$GO_TARBALL"
      fi
      go version
  - install_tarantool: |
      curl -L https://tarantool.io/release/3/installer.sh | sudo bash
      sudo apt-get install -y tarantool tarantool-dev tt
  - install_just: |
      JUST_VERSION=1.51.0
      JUST_TARBALL="just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
      JUST_KEY="just/$JUST_TARBALL"
      JUST_URI="s3://$S3_BUCKET/$JUST_KEY"
      mkdir -p ~/.local/bin
      if aws --endpoint-url="$AWS_ENDPOINT_URL" s3api head-object \
           --bucket "$S3_BUCKET" --key "$JUST_KEY" >/dev/null 2>&1; then
        echo "Cache HIT — pulling just from S3"
        aws --endpoint-url="$AWS_ENDPOINT_URL" s3 cp "$JUST_URI" - \
          | tar -xz -C ~/.local/bin just
      else
        echo "Cache MISS — downloading from github and caching"
        curl -sSL --retry 3 --retry-delay 5 --max-time 60 \
          "https://github.com/casey/just/releases/download/${JUST_VERSION}/${JUST_TARBALL}" \
          -o "/tmp/$JUST_TARBALL"
        tar -xz -C ~/.local/bin -f "/tmp/$JUST_TARBALL" just
        aws --endpoint-url="$AWS_ENDPOINT_URL" s3 cp "/tmp/$JUST_TARBALL" "$JUST_URI"
        rm "/tmp/$JUST_TARBALL"
      fi
      just --version
  - install_luatest: |
      cd tarantool-protobuf
      tt rocks install luatest
  - docker_start: |
      sudo systemctl start docker
      sudo usermod -aG docker build
      sudo chmod 666 /var/run/docker.sock
      docker version
  - conformance_image: |
      cd tarantool-protobuf
      HASH=$(sha256sum docker/conformance.Dockerfile | cut -c1-16)
      OBJECT_KEY="$S3_PREFIX/$HASH.tar.zst"
      S3_URI="s3://$S3_BUCKET/$OBJECT_KEY"
      echo "Image hash: $HASH"
      echo "S3 URI:     $S3_URI"
      if aws --endpoint-url="$AWS_ENDPOINT_URL" s3api head-object \
           --bucket "$S3_BUCKET" --key "$OBJECT_KEY" >/dev/null 2>&1; then
        echo "Cache HIT — pulling cached image"
        aws --endpoint-url="$AWS_ENDPOINT_URL" s3 cp "$S3_URI" - \
          | unzstd \
          | docker load
      else
        echo "Cache MISS — building from scratch and uploading"
        docker build -t tarantool-protobuf-conformance:latest \
          -f docker/conformance.Dockerfile docker/
        docker save tarantool-protobuf-conformance:latest \
          | zstd -T0 -3 \
          | aws --endpoint-url="$AWS_ENDPOINT_URL" s3 cp - "$S3_URI"
      fi
      docker image inspect tarantool-protobuf-conformance:latest >/dev/null
  - codegen: |
      cd tarantool-protobuf
      just gen
  - conformance: |
      cd tarantool-protobuf
      docker run --rm -v "$(pwd):/work" -w /work \
        tarantool-protobuf-conformance:latest
  - conformance_c: |
      cd tarantool-protobuf
      docker run --rm -v "$(pwd):/work" -w /work -e PB_ENABLE_C=1 \
        --entrypoint bash tarantool-protobuf-conformance:latest -c '
          set -e
          make -C runtime/pb/c clean >/dev/null
          make -C runtime/pb/c >/dev/null
          conformance_test_runner --enforce_recommended \
            --failure_list test/conformance/known_failures.txt \
            --text_format_failure_list test/conformance/known_failures_text.txt \
            /usr/bin/tarantool cmd/conformance-runner.lua
          rc=$?
          make -C runtime/pb/c clean >/dev/null
          exit $rc
        '