main.yml

# Workflows pertaining to the main branch
name: Main

on:
  merge_group: {}
  pull_request:
    branches: [main, release]
  push:
    branches: [main, release]

env:
  DOTNET_NOLOGO: true
  NODE_OPTIONS: --max-old-space-size=4096

# This workflows currently has the following jobs:
# - build                   : Builds the source tree as-is
#   - test                  : Runs all unit tests against the build result
# - create-release-package  : Prepares a release package with the "real" version
#   - integ-test            : Runs integration tests against the release package

jobs:
  build:
    name: Build
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      # Check out the code
      - name: Check out
        uses: actions/checkout@v4
      # Set up all of our standard runtimes
      - name: Set up .NET 6
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '6.0.x'
      - name: Set up Go 1.18
        uses: actions/setup-go@v5
        with:
          go-version: '1.18'
      - name: Set up Java 8
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '8'
      - name: Set up Node LTS
        uses: actions/setup-node@v4
        with:
          cache: yarn
          node-version: 'lts/*'
      - name: Set up Python 3.8
        uses: actions/setup-python@v5
        with:
          python-version: '3.8'
          cache: pip
      - name: Install python3-venv
        run: sudo apt install -y python3-venv
      - name: Cache
        uses: actions/cache@v4
        with:
          path: |-
            ~/.m2/repository
            !~/.m2/repository/software/amazon/jsii/
            ~/.nuget/packages
            !~/.nuget/packages/amazon.jsii.*
          key: ${{ runner.os }}-${{ hashFiles('**/Directory.Build.targets') }}
          restore-keys: |-
            ${{ runner.os }}-
      # Prepare dependencies and build
      - name: Install Dependencies
        run: |-
          yarn install --frozen-lockfile
      - name: Full Build
        run: |-
          yarn build
      - name: Prepare Artifact
        run: |-
          tar zcvf ${{ runner.temp }}/built-tree.tgz                            \
            --exclude='**/.env'                                                 \
            --exclude='**/.nuget'                                               \
            --exclude='**/node_modules'                                         \
            --exclude='**/project/.m2/repository'                               \
            --exclude-tag-all='pyenv.cfg'                                       \
            --directory=${{ github.workspace }}                                 \
            .
      # Upload artifact (we'll tar it up to save time)
      - name: 'Upload Artifact: built-tree'
        uses: actions/upload-artifact@v3
        with:
          name: built-tree
          path: ${{ runner.temp }}/built-tree.tgz
      # Ensure working directory is clean (build should not change checked in source code)
      - name: 'Assert clean working directory'
        if: runner.os != 'Windows' # Windows will see artificial permission changes, so we ignore it
        run: |-
          # Make sure the index is up-to-date (git diff-index assumes it was done)
          git update-index --refresh
          # Check for modifications in tracked files
          git diff-index --exit-code --stat HEAD
          # Check for new untracked files
          untracked=$(git ls-files --others --exclude-standard)                 \
            && echo "Untracked files: ${untracked:-<none>}"                     \
            && test -z "${untracked}"
        shell: bash

  create-release-package:
    name: Create Release Package
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      # Check out the code
      - name: Check out
        uses: actions/checkout@v4
      # Set up all of our standard runtimes
      - name: Set up .NET 6
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '6.0.x'
      - name: Set up Go 1.18
        uses: actions/setup-go@v5
        with:
          go-version: '1.18'
      - name: Set up Java 8
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '8'
      - name: Set up Node LTS
        uses: actions/setup-node@v4
        with:
          cache: yarn
          node-version: 'lts/*'
      - name: Set up Python 3.8
        uses: actions/setup-python@v5
        with:
          python-version: '3.8'
          cache: pip
      - name: Install python3-venv
        run: sudo apt install -y python3-venv
      - name: Cache
        uses: actions/cache@v4
        with:
          path: |-
            ~/.m2/repository
            !~/.m2/repository/software/amazon/jsii/
            ~/.nuget/packages
            !~/.nuget/packages/amazon.jsii.*
          key: ${{ runner.os }}-${{ hashFiles('**/Directory.Build.targets') }}
          restore-keys: |-
            ${{ runner.os }}-
      # Prepare dependencies and build
      - name: Install Dependencies
        run: yarn install --frozen-lockfile
      # Determine a prerelease version (depending on whether this is a PR or Push event)
      - name: Standard Version (PR)
        if: github.event_name == 'pull_request'
        run: |-
          npx standard-version                                                                                          \
            --compareUrlFormat='{{host}}/{{owner}}/{{repository}}/compare/{{previousTag}}...${{ github.sha }}'          \
            --prerelease=dev.${{ github.event.pull_request.number }}                                                    \
            --skip.commit
      - name: Standard Version (Nightly)
        if: github.event_name == 'push'
        run: |-
          npx standard-version                                                                                          \
            --compareUrlFormat='{{host}}/{{owner}}/{{repository}}/compare/{{previousTag}}...${{ github.sha }}'          \
            --prerelease=dev.$(date -u +'%Y%m%d')                                                                       \
            --skip.commit
      # Now we'll be preparing a release package (with the "real" version)
      - name: Run "align-version.sh"
        run: |-
          ./scripts/align-version.sh
      - name: Full Build
        run: |-
          yarn build
      - name: Package
        run: |-
          yarn package
      # Upload artifacts
      - name: 'Upload Artifact: release-package'
        uses: actions/upload-artifact@v3
        with:
          name: release-package
          path: ${{ github.workspace }}/dist/

  test:
    permissions:
      contents: none
    name: Test (${{ matrix.title }})
    needs: build
    strategy:
      fail-fast: false
      matrix:
        title: ['baseline']
        dotnet: ['6.0.x']
        go: ['1.18']
        java: ['8']
        node: ['18'] # EOL 2025-04-30
        os: [ubuntu-latest]
        python: ['3.8']
        # Add specific combinations to be tested against (to restrict cardinality)
        include:
          # Test using Windows
          - title: 'Windows'
            os: windows-latest
            dotnet: '6.0.x'
            go: '1.18'
            java: '8'
            node: '18'
            python: '3.8'
          # Test using macOS
          - title: 'macOS'
            os: macos-latest
            dotnet: '6.0.x'
            go: '1.18'
            java: '8'
            node: '18'
            python: '3.8'
          # Test alternate Nodes
          - title: 'Node 18'
            java: '8'
            dotnet: '6.0.x'
            go: '1.18'
            node: '18' # EOL 2025-04-30
            os: ubuntu-latest
            python: '3.8'
          - title: 'Node 20'
            java: '8'
            dotnet: '6.0.x'
            go: '1.18'
            node: '20' # EOL 2026-04-30
            os: ubuntu-latest
            python: '3.8'
          - title: 'Node 22'
            java: '8'
            dotnet: '6.0.x'
            go: '1.18'
            node: '22' # EOL 2027-04-30
            os: ubuntu-latest
            python: '3.8'
          # Test alternate .NETs
          - title: '.NET 7.0'
            java: '8'
            dotnet: '7.0.x'
            go: '1.18'
            node: '18'
            os: ubuntu-latest
            python: '3.8'
          # Test alternate Gos
          - title: 'Go 1.19'
            java: '8'
            dotnet: '6.0.x'
            go: '1.19'
            node: '18'
            os: ubuntu-latest
            python: '3.8'
          # Test alternate Javas
          - title: 'Java 11'
            java: '11'
            dotnet: '6.0.x'
            go: '1.18'
            node: '18'
            os: ubuntu-latest
            python: '3.8'
          # Test alternate Pythons
          - title: 'Python 3.8'
            python: '3.8'
            dotnet: '6.0.x'
            go: '1.18'
            java: '8'
            node: '18'
            os: ubuntu-latest
          - title: 'Python 3.9'
            python: '3.9'
            dotnet: '6.0.x'
            go: '1.18'
            java: '8'
            node: '18'
            os: ubuntu-latest
          - title: 'Python 3.10'
            python: '3.10'
            dotnet: '6.0.x'
            go: '1.18'
            java: '8'
            node: '18'
            os: ubuntu-latest
          - title: 'Python 3.11'
            python: '3.11'
            dotnet: '6.0.x'
            go: '1.18'
            java: '8'
            node: '18'
            os: ubuntu-latest

    runs-on: ${{ matrix.os }}

    steps:
      # Check out the code
      - name: Download Artifact
        uses: actions/download-artifact@v3
        with:
          name: built-tree
      - name: Extract Artifact
        run: |-
          echo "::group::Untar Archive"
          tar zxvf built-tree.tgz
          echo "::endgroup"

          rm built-tree.tgz
      # Set up all of our standard runtimes (this is matrix-based)
      - name: Set up .NET ${{ matrix.dotnet }}
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ matrix.dotnet }}
      - name: Set up Go ${{ matrix.go }}
        uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go }}
      - name: Set up Java ${{ matrix.java }}
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: ${{ matrix.java }}
      - name: Set up Node ${{ matrix.node }}
        uses: actions/setup-node@v4
        with:
          cache: yarn
          node-version: ${{ matrix.node }}
      - name: Set up Python ${{ matrix.python }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}
          cache: pip
      - name: 'Linux: Install python3-venv'
        if: runner.os == 'Linux'
        run: sudo apt install -y python3-venv
      - name: Cache
        uses: actions/cache@v4
        with:
          path: |-
            ~/.m2/repository
            !~/.m2/repository/software/amazon/jsii/
            ~/.nuget/packages
            !~/.nuget/packages/amazon.jsii.*
          # Not including .NET / Java in the cache keys, those artifacts are SDK-version-independent
          key: ${{ runner.os }}-${{ hashFiles('**/Directory.Build.targets') }}
          restore-keys: |-
            ${{ runner.os }}-
      # Run the tests
      - name: Install Dependencies
        run: |-
          yarn install --frozen-lockfile
      - name: Test
        run: |-
          yarn test
      # Ensure working directory is clean (tests should not change checked in source code)
      - name: 'Assert clean working directory'
        if: runner.os != 'Windows' # Windows will see artificial permission changes, so we ignore it
        run: |-
          # Make sure the index is up-to-date (git diff-index assumes it was done)
          git update-index --refresh
          # Check for modifications in tracked files
          git diff-index --exit-code --stat HEAD
          # Check for new untracked files
          untracked=$(git ls-files --others --exclude-standard)                 \
            && echo "Untracked files: ${untracked:-<none>}"                     \
            && test -z "${untracked}"
        shell: bash

  test-ok:
    name: Unit Tests
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: OK
        # This is just a join target to simplify branch protection setup
        run: echo OK

  benchmark:
    name: Run benchmark suite
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    needs: build
    steps:
      # Check out the code
      - name: Download Artifact
        uses: actions/download-artifact@v3
        with:
          name: built-tree
      - name: Extract Artifact
        run: |-
          echo "::group::Untar Archive"
          tar zxvf built-tree.tgz
          echo "::endgroup"

          rm built-tree.tgz
      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          cache: yarn
          node-version: 'lts/*'
      - name: Install Dependencies
        run: yarn install --frozen-lockfile
      - name: Run Benchmark
        working-directory: packages/@jsii/benchmarks
        run: yarn bench --output ${{ runner.temp }}/bench-output.json
      - name: Compare Benchmark Results
        if: github.event_name == 'pull_request'
        uses: benchmark-action/github-action-benchmark@v1
        with:
          name: jsii Benchmark Regression
          tool: 'customSmallerIsBetter'
          output-file-path: ${{ runner.temp }}/bench-output.json
          comment-always: true
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fail-on-alert: true
      - name: Upload Benchmark Results
        if: github.event_name == 'push'
        uses: benchmark-action/github-action-benchmark@v1
        with:
          name: jsii Benchmark
          tool: 'customSmallerIsBetter'
          output-file-path: ${{ runner.temp }}/bench-output.json
          github-token: ${{ secrets.PROJEN_GITHUB_TOKEN }}
          auto-push: true

  pacmak-integration-test:
    runs-on: ubuntu-latest
    needs: create-release-package
    strategy:
      fail-fast: false
      matrix:
        rosetta:
          # this will be the 1.x-dev version build in this repo
          - ./jsii-rosetta.tgz
          - 5.2.x
          - 5.3.x
          - 5.4.x
    steps:
      # Check out the code
      - name: Download Artifact
        uses: actions/download-artifact@v3
        with:
          name: release-package
          path: ${{ runner.temp }}/release-package
      # Set up all of our standard runtimes
      - name: Set up .NET 7
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '7.0.x'
      - name: Set up Go 1.20
        uses: actions/setup-go@v5
        with:
          go-version: '1.20'
      - name: Set up Java 20
        uses: actions/setup-java@v4
        with:
          distribution: 'corretto'
          java-version: '20'
      - name: Set up Node 20
        uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Install python3-venv
        run: sudo apt install -y python3-venv
      # Show time!
      - name: Prepare Work Tree
        # 1) Move the locally build version of jsii-rosetta somewhere else
        # 2) Remove @jsii/integ-test because it messed up version dependencies and is not needed
        # 3) Install aws-cdk-lib, and all locally build packages minus jsii-rosetta & @jsii/integ-test,
        #    and the specific version of jsii-rosetta
        #    This ensures we are running jsii-pacmak with the correct peer-dependency
        # 4) Print the jsii-rosetta version for confirmation
        run: |-
          mv ${{ runner.temp }}/release-package/js/jsii-rosetta.tgz ./jsii-rosetta.tgz
          rm ${{ runner.temp }}/release-package/private/@jsii-integ-test.tgz
          npm install --no-save --omit=dev                             \
                      aws-cdk-lib@2                                    \
                      constructs@10                                    \
                      ${{ runner.temp }}/release-package/js/*.tgz      \
                      ${{ runner.temp }}/release-package/private/*.tgz \
                      jsii-rosetta@${{ matrix.rosetta }}
      - name: Display jsii-rosetta version
        run: npx jsii-rosetta --version
      - name: Run jsii-pacmak on aws-cdk-lib
        env:
          NODE_OPTIONS: --max-old-space-size=6144
        # We run with --no-parallel to avoid running out of memory...
        run: |-
          ./node_modules/.bin/jsii-pacmak --no-parallel ./node_modules/aws-cdk-lib
      # Upload artifact only on main and for latest rosetta
      - name: 'Upload Artifact: integtest_aws-cdk-lib'
        if: github.ref == 'ref/head/main' && matrix.rosetta == '5.4.x'
        uses: actions/upload-artifact@v4
        with:
          name: integtest_aws-cdk-lib
          path: ./node_modules/aws-cdk-lib/dist/

  pacmak-integration-test-ok:
    name: Integration test (jsii-pacmak)
    runs-on: ubuntu-latest
    needs: pacmak-integration-test
    steps:
      - name: OK
        # This is just a join target to simplify branch protection setup
        run: echo OK