build.yml

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch: {}

name: Build and Test

permissions:
  contents: write
  pull-requests: write
  id-token: write

jobs:
  host_builds:
    strategy:
      matrix:
        os: [macos-11, macos-latest, windows-2019]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - name: Build ${{ matrix.os }} Prebuild
        run: node .github/scripts/libmongocrypt.mjs ${{ runner.os == 'Windows' && '--build' || '' }}
        shell: bash

      - name: Test ${{ matrix.os }}
        shell: bash
        run: npm run test

      - id: upload
        name: Upload prebuild
        uses: actions/upload-artifact@v4
        with:
          name: build-${{ matrix.os }}
          path: prebuilds/
          if-no-files-found: 'error'
          retention-days: 1
          compression-level: 0

  container_builds:
    outputs:
      artifact_id: ${{ steps.upload.outputs.artifact-id }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        linux_arch: [s390x, arm64, amd64]
    steps:
      - uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Run Buildx
        run: |
          docker buildx create --name builder --bootstrap --use
          docker buildx build --platform linux/${{ matrix.linux_arch }} --output type=local,dest=./prebuilds,platform-split=false -f ./.github/docker/Dockerfile.glibc .

      - id: upload
        name: Upload prebuild
        uses: actions/upload-artifact@v4
        with:
          name: build-linux-${{ matrix.linux_arch }}
          path: prebuilds/
          if-no-files-found: 'error'
          retention-days: 1
          compression-level: 0

  release_please:
    needs: [host_builds, container_builds]
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
    steps:
      - id: release
        uses: googleapis/release-please-action@v4

  sign_and_upload:
    needs: [release_please]
    if: ${{ needs.release_please.outputs.release_created }}
    runs-on: ubuntu-latest
    environment: release
    steps:
      - uses: actions/checkout@v4
      - name: actions/setup
        uses: ./.github/actions/setup
      - name: actions/sign_and_upload_package
        uses: ./.github/actions/sign_and_upload_package
        with: 
          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
          aws_region_name: 'us-east-1'
          aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
          npm_package_name: 'mongodb-client-encryption'
      - run: npm publish --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}