ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "20 4 * * *"
  workflow_dispatch:

permissions:
  contents: read

# Jobs that read the private edgeandnode/amp releases mint a short-lived
# GitHub App token via .github/actions/ci-token, using the org-provided
# AMP_APP_ID variable and AMP_APP_KEY secret (same mechanism as the amp
# repository's own CI).

jobs:
  lint:
    name: Lint (actionlint + shellcheck)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Run actionlint
        # Pinned to the same actionlint version as .github/pre-commit-config.yaml
        run: |
          bash <(curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12
          ./actionlint -color

      - name: Setup just
        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0

      - name: Extract, syntax-check, and shellcheck action scripts
        run: just test-scripts

      - name: Upload extracted scripts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: action-scripts
          path: extracted/

  dry-run:
    name: Script dry-run (${{ matrix.version }})
    runs-on: ubuntu-latest
    needs: lint
    # Fork PRs don't receive the AMP_APP_KEY secret needed to mint a token
    # that can read the private edgeandnode/amp releases; skip rather than
    # fail (lint still runs).
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    strategy:
      fail-fast: false
      matrix:
        # NOTE: 'nightly' is not tested — edgeandnode/amp currently publishes
        # nightly binaries only on draft releases, so published nightly tags
        # have no assets and resolution fails. Re-add once the release
        # pipeline publishes assets on non-draft nightlies.
        version: [stable, latest, none]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Mint CI token
        id: ci-token
        uses: ./.github/actions/ci-token
        with:
          app-id: ${{ vars.AMP_APP_ID }}
          app-key: ${{ secrets.AMP_APP_KEY }}

      - name: Download extracted scripts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: action-scripts
          path: extracted

      - name: Dry-run platform detection
        run: |
          out="$(mktemp)"
          envfile="$(mktemp)"
          GITHUB_OUTPUT="${out}" GITHUB_ENV="${envfile}" bash extracted/platform.sh
          grep -q '^platform=linux$' "${out}"
          grep -q '^arch=x86_64$' "${out}"
          grep -q '^amp-dir=' "${out}"
          grep -q '^AMP_DIR=' "${envfile}"

      - name: Dry-run version resolution (${{ matrix.version }})
        env:
          SETUP_AMP_VERSION: ${{ matrix.version }}
          GITHUB_TOKEN: ${{ steps.ci-token.outputs.token }}
        run: |
          out="$(mktemp)"
          GITHUB_OUTPUT="${out}" bash extracted/version.sh
          case "${SETUP_AMP_VERSION}" in
            nightly) grep -q '^version=nightly-' "${out}" ;;
            none) grep -q '^version=none$' "${out}" ;;
            *) grep -q '^version=v' "${out}" ;;
          esac

      - name: Dry-run version resolution (unknown version)
        env:
          SETUP_AMP_VERSION: v999.999.999
          GITHUB_TOKEN: ${{ steps.ci-token.outputs.token }}
        run: |
          out="$(mktemp)"
          if GITHUB_OUTPUT="${out}" bash extracted/version.sh; then
            echo "Expected version resolution to fail for an unknown version"
            exit 1
          fi

  test:
    name: Install ${{ matrix.version || 'default' }} (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    # Fork PRs cannot read the private edgeandnode/amp releases; see dry-run
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - ubuntu-24.04-arm
          - macos-latest
          - macos-15-intel
        version:
          # Empty string exercises the default version handling.
          # NOTE: 'nightly' is not tested — see the dry-run matrix note.
          - ""
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Mint CI token
        id: ci-token
        uses: ./.github/actions/ci-token
        with:
          app-id: ${{ vars.AMP_APP_ID }}
          app-key: ${{ secrets.AMP_APP_KEY }}

      - name: Run setup-amp
        id: setup
        uses: ./
        with:
          version: ${{ matrix.version }}
          github-token: ${{ steps.ci-token.outputs.token }}

      - name: Check resolved version output
        env:
          VERSION_INPUT: ${{ matrix.version }}
          VERSION_RESOLVED: ${{ steps.setup.outputs.version }}
        run: |
          echo "Resolved: '${VERSION_INPUT}' -> '${VERSION_RESOLVED}'"
          case "${VERSION_INPUT}" in
            nightly)
              case "${VERSION_RESOLVED}" in
                nightly-*) ;;
                *) echo "Expected a nightly-* tag"; exit 1 ;;
              esac
              ;;
            *)
              case "${VERSION_RESOLVED}" in
                v*) ;;
                *) echo "Expected a v* tag"; exit 1 ;;
              esac
              ;;
          esac

      - name: Check binaries are on PATH
        run: |
          command -v ampup
          command -v ampd
          ampd --version
          # ampctl and ampsql are optional per-release binaries
          if command -v ampctl > /dev/null; then
            ampctl --version
          else
            echo "ampctl is not included in this release"
          fi
          if command -v ampsql > /dev/null; then
            ampsql --version
          else
            echo "ampsql is not included in this release"
          fi

  test-explicit-version:
    name: Install explicit version tag
    runs-on: ubuntu-latest
    # Fork PRs cannot read the private edgeandnode/amp releases; see dry-run
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Mint CI token
        id: ci-token
        uses: ./.github/actions/ci-token
        with:
          app-id: ${{ vars.AMP_APP_ID }}
          app-key: ${{ secrets.AMP_APP_KEY }}

      - name: Pick the current stable tag
        id: pick
        env:
          GH_TOKEN: ${{ steps.ci-token.outputs.token }}
        run: echo "tag=$(gh api repos/edgeandnode/amp/releases/latest --jq .tag_name)" >> "$GITHUB_OUTPUT"

      - name: Run setup-amp
        id: setup
        uses: ./
        with:
          version: ${{ steps.pick.outputs.tag }}
          github-token: ${{ steps.ci-token.outputs.token }}

      - name: Check the pinned version was installed
        env:
          EXPECTED: ${{ steps.pick.outputs.tag }}
          RESOLVED: ${{ steps.setup.outputs.version }}
        run: |
          [ "${RESOLVED}" = "${EXPECTED}" ]
          ampd --version

  test-ampup-only:
    name: Install ampup only (version none)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      # No github-token needed: 'none' only bootstraps ampup from its public repo
      - name: Run setup-amp
        id: setup
        uses: ./
        with:
          version: none

      - name: Check only ampup is installed and on PATH
        env:
          VERSION_RESOLVED: ${{ steps.setup.outputs.version }}
          CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
        run: |
          command -v ampup
          ampup --version
          [ "${VERSION_RESOLVED}" = "none" ]
          [ "${CACHE_HIT}" = "false" ]
          if command -v ampd > /dev/null; then
            echo "Expected ampd to NOT be installed with version 'none'"
            exit 1
          fi

  test-cache-save:
    name: Cache (save)
    runs-on: ubuntu-latest
    # Fork PRs cannot read the private edgeandnode/amp releases; see dry-run
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    outputs:
      version: ${{ steps.setup.outputs.version }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Mint CI token
        id: ci-token
        uses: ./.github/actions/ci-token
        with:
          app-id: ${{ vars.AMP_APP_ID }}
          app-key: ${{ secrets.AMP_APP_KEY }}

      - name: Run setup-amp
        id: setup
        uses: ./
        with:
          github-token: ${{ steps.ci-token.outputs.token }}
          # No run_attempt in the key: 'Re-run failed jobs' must be able to
          # restore the cache saved by a previous attempt
          cache-key: setup-amp-ci-cache-test-${{ github.run_id }}

      - run: ampd --version

  test-cache-hit:
    name: Cache (hit)
    runs-on: ubuntu-latest
    needs: test-cache-save
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Mint CI token
        id: ci-token
        uses: ./.github/actions/ci-token
        with:
          app-id: ${{ vars.AMP_APP_ID }}
          app-key: ${{ secrets.AMP_APP_KEY }}

      - name: Run setup-amp
        id: setup
        uses: ./
        with:
          version: ${{ needs.test-cache-save.outputs.version }}
          github-token: ${{ steps.ci-token.outputs.token }}
          cache-key: setup-amp-ci-cache-test-${{ github.run_id }}

      - name: Check the cache was hit
        env:
          CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
        run: |
          [ "${CACHE_HIT}" = "true" ]
          ampd --version

  test-cache-disabled:
    name: Cache (disabled)
    runs-on: ubuntu-latest
    # Fork PRs cannot read the private edgeandnode/amp releases; see dry-run
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Mint CI token
        id: ci-token
        uses: ./.github/actions/ci-token
        with:
          app-id: ${{ vars.AMP_APP_ID }}
          app-key: ${{ secrets.AMP_APP_KEY }}

      - name: Run setup-amp
        id: setup
        uses: ./
        with:
          github-token: ${{ steps.ci-token.outputs.token }}
          cache: false

      - name: Check no cache was used
        env:
          CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
        run: |
          [ "${CACHE_HIT}" = "false" ]
          ampd --version

  test-unsupported-platform:
    name: Fails cleanly on Windows
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      # No token needed: the action fails at platform detection before any
      # release API access
      - name: Run setup-amp (expected to fail)
        id: setup
        continue-on-error: true
        uses: ./

      - name: Check the action failed with a clear error
        shell: bash
        env:
          OUTCOME: ${{ steps.setup.outcome }}
        run: |
          if [ "${OUTCOME}" != "failure" ]; then
            echo "Expected the action to fail on Windows, but the outcome was '${OUTCOME}'"
            exit 1
          fi