ci.yml

# CI — OpenCombineJS
# Issue: #6 (CI modernization — replace dead Swift 5.3/5.4/5.5 wasm lanes)
#
# Two jobs:
#   host  — macOS, Swift 6.3, swift build + swift test (host-runnable tests self-gate
#           wasm-only paths via #if os(WASI))
#   wasm  — Ubuntu, official swift.org wasm SDK; builds all targets and runs the
#           full test suite under Node via JavaScriptKit's PackageToJS plugin (#7)
#
# Action versions verified (2026-06-11):
#   actions/checkout  v6  — https://github.com/actions/checkout/releases (v4 is Node20-deprecated 2026-06-16)
#   actions/cache     v4  — https://github.com/actions/cache/releases (v4 is current major)

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cancel superseded runs on the same ref so PRs don't queue stale builds.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # ---------------------------------------------------------------------------
  # host: macOS build + test
  # swift-tools-version:6.3 requires Swift 6.3 → Xcode 26.x → macos-26 image.
  # (macos-15 ships Xcode 16.x / Swift 6.0-6.1, which cannot parse the manifest.)
  # ---------------------------------------------------------------------------
  host:
    name: Build & Test (macOS / Swift 6.3)
    runs-on: macos-26

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      # Use the newest Xcode on the image (macos-26 ships Xcode 26.x = Swift 6.3).
      - name: Select Xcode (Swift 6.3)
        run: |
          ls /Applications/ | grep -i xcode || true
          LATEST_XCODE=$(ls /Applications/ | grep -E '^Xcode_?[0-9]' | sort -V | tail -1)
          if [ -n "$LATEST_XCODE" ]; then
            sudo xcode-select -s "/Applications/${LATEST_XCODE}/Contents/Developer"
          fi
          swift --version

      # SPM dependency cache keyed on Package.resolved so a resolved-file change
      # automatically invalidates the cache.
      - name: Cache SPM dependencies
        uses: actions/cache@v4
        with:
          path: .build
          key: ${{ runner.os }}-spm-${{ hashFiles('Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-spm-

      - name: Build (host)
        run: swift build

      - name: Test (host)
        # OpenCombineJSTests uses #if os(WASI) guards so wasm-only tests are
        # silently skipped on macOS — this is intentional.
        run: swift test

  # ---------------------------------------------------------------------------
  # wasm: cross-compile library + tests for wasm32-unknown-wasi and RUN the
  # test suite under Node via JavaScriptKit's PackageToJS plugin.
  #
  # Both the toolchain and the wasm Swift SDK are the OFFICIAL swift.org
  # artifacts and MUST be the same version (swift sdk requires an exact
  # toolchain match). Commands below were verified locally on 2026-06-11
  # against Swift 6.3.2 + swift-6.3.2-RELEASE_wasm (62 tests pass under
  # Node v20 via `swift package js test`).
  # ---------------------------------------------------------------------------
  wasm:
    name: Build & Test (wasm32-unknown-wasi / Swift SDK)
    runs-on: ubuntu-latest

    env:
      SWIFT_VERSION: "6.3.2"
      # Official SHA-256 for the 6.3.2 wasm SDK bundle, from
      # https://www.swift.org/api/v1/install/releases.json (platform "wasm-sdk").
      # Bump together with SWIFT_VERSION.
      WASM_SDK_CHECKSUM: "a61f0584c93283589f8b2f42db05c1f9a182b506c2957271402992655591dd7c"

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      # Ubuntu runners ship a system Swift that may lag.  Install the exact
      # swift.org release matching the wasm SDK below.
      - name: Install Swift ${{ env.SWIFT_VERSION }} toolchain
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends \
            binutils git gnupg2 libc6-dev libcurl4-openssl-dev \
            libedit2 libgcc-s1 libpython3-dev libsqlite3-0 libstdc++6 \
            libxml2-dev libz3-dev pkg-config tzdata unzip zlib1g-dev curl

          SWIFT_TAG="swift-${SWIFT_VERSION}-RELEASE"
          # Filename pattern uses "ubuntu24.04" (with dot, no arch suffix for x86_64).
          SWIFT_URL="https://download.swift.org/swift-${SWIFT_VERSION}-release/ubuntu2404/${SWIFT_TAG}/${SWIFT_TAG}-ubuntu24.04.tar.gz"
          echo "Downloading Swift toolchain from ${SWIFT_URL}"
          curl -fsSL "${SWIFT_URL}" -o /tmp/swift.tar.gz
          # F-04: verify the swift.org PGP signature before unpacking.
          curl -fsSL "${SWIFT_URL}.sig" -o /tmp/swift.tar.gz.sig
          # --compressed: swift.org serves the keyring gzip-encoded; without it
          # curl saves raw gzip bytes and gpg rejects them ("no valid OpenPGP data").
          curl -fsSL --compressed https://swift.org/keys/all-keys.asc | gpg --import -
          gpg --verify /tmp/swift.tar.gz.sig /tmp/swift.tar.gz
          sudo tar -xzf /tmp/swift.tar.gz -C /usr/local --strip-components=1
          echo "/usr/local/bin" >> "$GITHUB_PATH"

      - name: Verify Swift and Node versions
        # Node >= 20 is required by the PackageToJS test runner; ubuntu-latest ships it.
        run: |
          swift --version
          node --version

      # Official swift.org wasm Swift SDK, version-matched to the toolchain.
      # Note the .artifactbundle.tar.gz extension — there is no .zip variant.
      # F-04: `swift sdk install --checksum` validates the official SHA-256
      # published in the swift.org releases API.
      - name: Install Swift wasm32-unknown-wasi SDK (official, version-matched)
        run: |
          SWIFT_TAG="swift-${SWIFT_VERSION}-RELEASE"
          SDK_URL="https://download.swift.org/swift-${SWIFT_VERSION}-release/wasm-sdk/${SWIFT_TAG}/${SWIFT_TAG}_wasm.artifactbundle.tar.gz"
          echo "Installing wasm Swift SDK from ${SDK_URL}"
          swift sdk install "${SDK_URL}" --checksum "${WASM_SDK_CHECKSUM}"
          swift sdk list

      - name: Build (wasm32-unknown-wasi, all targets + tests)
        run: swift build --swift-sdk "swift-${SWIFT_VERSION}-RELEASE_wasm" --build-tests

      - name: Test (wasm under Node via JavaScriptKit PackageToJS) # #7
        # --disable-sandbox: the PackageToJS plugin shells out to npm at build time.
        # Note: PackageToJS expects the default scratch path (.build) — do not pass
        # --scratch-path here.
        run: swift package --disable-sandbox --swift-sdk "swift-${SWIFT_VERSION}-RELEASE_wasm" js test