cli.yml

name: CLI

on:
  push:
    branches:
      - main
    paths:
      - "cli/TuistCacheEE"
      - "cli/TuistCacheEE/**"
      - "cli/Sources/**"
      - "cli/Tests/**"
      - "cli/Templates/**"
      - "*.swift"
      - ".github/workflows/cli.yml"
      - "mise/tasks/cli/lint.sh"
      - "mise/tasks/cli/ee.sh"
      - "mise.toml"
      - "mise.lock"
      - "examples/xcode/**"
      - "Tuist/**"
      - ".xcode-version"
      - ".swiftpm/**"
      - "Package.swift"
      - "Package.resolved"
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - "cli/TuistCacheEE"
      - "cli/TuistCacheEE/**"
      - "cli/Sources/**"
      - "cli/Tests/**"
      - "cli/Templates/**"
      - "*.swift"
      - ".github/workflows/cli.yml"
      - "mise/tasks/cli/lint.sh"
      - "mise/tasks/cli/ee.sh"
      - "mise.toml"
      - "mise.lock"
      - "examples/xcode/**"
      - "Tuist/**"
      - ".xcode-version"
      - ".swiftpm/**"
      - "Package.swift"
      - "Package.resolved"

permissions:
  id-token: write
  contents: read

env:
  MISE_VERSION: "2026.4.18"
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  MISE_GITHUB_TOKEN: ${{ secrets.TUIST_CLI_GITHUB_TOKEN || github.token }}
  TUIST_GITHUB_TOKEN: ${{ secrets.TUIST_CLI_GITHUB_TOKEN }}
  TUIST_EE: ${{ github.event.pull_request.head.repo.fork != true && '1' || '' }}
  TUIST_ENABLE_CACHING: ${{ github.event.pull_request.head.repo.fork != true }}
  MISE_GITHUB_ATTESTATIONS: 0
  MISE_LOCKED: 1

concurrency:
  group: cli-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  cli-lint:
    name: Lint
    runs-on: macos-26
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.TUIST_CLI_GITHUB_TOKEN || github.token }}
      - name: Initialize TuistCacheEE submodule
        if: github.event.pull_request.head.repo.fork != true
        run: bash mise/tasks/cli/ee.sh
      - name: Select Xcode
        run: sudo xcode-select -switch /Applications/Xcode_$(cat .xcode-version).app
      - uses: actions/cache/restore@v4
        id: cache
        with:
          path: .build
          key: ${{ runner.os }}-cli-${{ hashFiles('.xcode-version') }}-${{ hashFiles('Package.resolved') }}
      - uses: jdx/mise-action@v4.0.1
        with:
          version: ${{ env.MISE_VERSION }}
          install_args: "tuist swiftlint swiftformat"
          cache: "false"
          github_token: ${{ env.MISE_GITHUB_TOKEN }}
      - name: Authenticate with Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist auth login
      - name: Setup Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist setup
      - name: Install Tuist dependencies
        if: steps.cache.outputs.cache-matched-key == ''
        run: tuist install
      - name: Lint
        run: |
          mise x swiftformat -- swiftformat cli/ app/ --lint
          mise x swiftlint -- swiftlint lint --quiet --config .swiftlint.yml cli/Sources
          tuist inspect dependencies --only implicit

  cli-spm-build:
    name: SwiftPM Build
    runs-on: macos-26
    timeout-minutes: 30
    if: github.event.pull_request.draft == false || github.event_name != 'pull_request'
    steps:
      - uses: actions/checkout@v4
      - name: Select Xcode
        run: sudo xcode-select -switch /Applications/Xcode_$(cat .xcode-version).app
      - uses: actions/cache/restore@v4
        id: cache
        with:
          path: .build
          key: ${{ runner.os }}-cli-${{ hashFiles('.xcode-version') }}-${{ hashFiles('Package.resolved') }}
      - uses: jdx/mise-action@v4.0.1
        with:
          version: ${{ env.MISE_VERSION }}
          install_args: "tuist"
          cache: "false"
          github_token: ${{ env.MISE_GITHUB_TOKEN }}
      - name: Authenticate with Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist auth login
      - name: Setup Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist setup
      - name: Install Tuist dependencies
        if: steps.cache.outputs.cache-matched-key == ''
        run: tuist install
      - name: Build
        run: swift build --configuration debug --replace-scm-with-registry --force-resolved-versions

  cli-cache:
    name: Cache
    runs-on: macos-26
    timeout-minutes: 60
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.TUIST_CLI_GITHUB_TOKEN || github.token }}
      - name: Initialize TuistCacheEE submodule
        if: github.event.pull_request.head.repo.fork != true
        run: bash mise/tasks/cli/ee.sh
      - name: Select Xcode
        run: sudo xcode-select -switch /Applications/Xcode_$(cat .xcode-version).app
      - name: Restore cache
        id: cache-restore
        uses: actions/cache/restore@v4
        with:
          path: .build
          key: ${{ runner.os }}-cli-${{ hashFiles('.xcode-version') }}-${{ hashFiles('Package.resolved') }}
      - uses: jdx/mise-action@v4.0.1
        with:
          version: ${{ env.MISE_VERSION }}
          install_args: "tuist"
          github_token: ${{ env.MISE_GITHUB_TOKEN }}
      - name: Authenticate with Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist auth login
      - name: Setup Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist setup
      - name: Install Tuist dependencies
        if: steps.cache-restore.outputs.cache-matched-key == ''
        run: tuist install
      - name: Cache
        run: tuist cache
      - name: Save cache
        id: cache-save
        uses: actions/cache/save@v4
        with:
          path: .build
          key: ${{ steps.cache-restore.outputs.cache-primary-key }}

  cli-unit-tests:
    name: Unit Tests
    runs-on: namespace-profile-default-macos
    timeout-minutes: 30
    if: github.event.pull_request.draft == false || github.event_name != 'pull_request'
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.TUIST_CLI_GITHUB_TOKEN || github.token }}
      - name: Initialize TuistCacheEE submodule
        if: github.event.pull_request.head.repo.fork != true
        run: bash mise/tasks/cli/ee.sh
      - name: Select Xcode
        run: sudo xcode-select -switch /Applications/Xcode_$(cat .xcode-version).app
      - uses: namespacelabs/nscloud-cache-action@v1
        with:
          cache: mise
      - uses: actions/cache/restore@v4
        id: cache
        with:
          path: .build
          key: ${{ runner.os }}-cli-${{ hashFiles('.xcode-version') }}-${{ hashFiles('Package.resolved') }}
      - uses: jdx/mise-action@v4.0.1
        with:
          version: ${{ env.MISE_VERSION }}
          install_args: "tuist"
          cache: "false"
          github_token: ${{ env.MISE_GITHUB_TOKEN }}
      - name: Authenticate with Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist auth login
      - name: Setup Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist setup
      - name: Install Tuist dependencies
        if: steps.cache.outputs.cache-matched-key == ''
        run: tuist install
      - name: Run tests
        run: tuist test TuistUnitTests -- -retry-tests-on-failure -test-iterations 4

  cli-acceptance-tests-build:
    name: Build Acceptance Tests
    runs-on: namespace-profile-default-macos
    timeout-minutes: 60
    if: (github.event.pull_request.draft == false || github.event_name != 'pull_request') && github.event.pull_request.head.repo.fork != true
    outputs:
      matrix: ${{ steps.shard.outputs.matrix }}
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.TUIST_CLI_GITHUB_TOKEN || github.token }}
      - name: Initialize TuistCacheEE submodule
        if: github.event.pull_request.head.repo.fork != true
        run: bash mise/tasks/cli/ee.sh
      - name: Select Xcode
        run: sudo xcode-select -switch /Applications/Xcode_$(cat .xcode-version).app
      - uses: namespacelabs/nscloud-cache-action@v1
        with:
          cache: mise
      - uses: actions/cache/restore@v4
        id: cache
        with:
          path: .build
          key: ${{ runner.os }}-cli-${{ hashFiles('.xcode-version') }}-${{ hashFiles('Package.resolved') }}
      - uses: jdx/mise-action@v4.0.1
        with:
          version: ${{ env.MISE_VERSION }}
          install_args: "tuist"
          cache: "false"
          github_token: ${{ env.MISE_GITHUB_TOKEN }}
      - name: Authenticate with Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist auth login
      - name: Setup Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist setup
      - name: Install Tuist dependencies
        if: steps.cache.outputs.cache-matched-key == ''
        run: tuist install
      - name: Skip Xcode Macro Fingerprint Validation
        run: defaults write com.apple.dt.Xcode IDESkipMacroFingerprintValidation -bool YES
      - name: Skip Xcode Package Validation
        run: defaults write com.apple.dt.Xcode IDESkipPackagePluginFingerprintValidation -bool YES
      - name: Download Metal Toolchain
        run: xcodebuild -downloadComponent MetalToolchain
      - name: Build tests
        id: shard
        run: tuist test --build-only --shard-total 2 --shard-granularity suite TuistAcceptanceTests

  cli-acceptance-tests:
    name: Acceptance Tests
    runs-on: namespace-profile-default-macos
    timeout-minutes: 60
    needs: cli-acceptance-tests-build
    if: toJSON(fromJSON(needs.cli-acceptance-tests-build.outputs.matrix).shard) != '[]'
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.cli-acceptance-tests-build.outputs.matrix) }}
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.TUIST_CLI_GITHUB_TOKEN || github.token }}
      - name: Initialize TuistCacheEE submodule
        if: github.event.pull_request.head.repo.fork != true
        run: bash mise/tasks/cli/ee.sh
      - name: Select Xcode
        run: sudo xcode-select -switch /Applications/Xcode_$(cat .xcode-version).app
      - uses: namespacelabs/nscloud-cache-action@v1
        with:
          cache: mise
      - uses: actions/cache/restore@v4
        id: cache
        with:
          path: .build
          key: ${{ runner.os }}-cli-${{ hashFiles('.xcode-version') }}-${{ hashFiles('Package.resolved') }}
      - uses: jdx/mise-action@v4.0.1
        with:
          version: ${{ env.MISE_VERSION }}
          install_args: "tuist"
          cache: "false"
          github_token: ${{ env.MISE_GITHUB_TOKEN }}
      - name: Authenticate with Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist auth login
      - name: Setup Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist setup
      - name: Install Tuist dependencies
        if: steps.cache.outputs.cache-matched-key == ''
        run: tuist install
      - name: Skip Xcode Macro Fingerprint Validation
        run: defaults write com.apple.dt.Xcode IDESkipMacroFingerprintValidation -bool YES
      - name: Skip Xcode Package Validation
        run: defaults write com.apple.dt.Xcode IDESkipPackagePluginFingerprintValidation -bool YES
      - name: Set up new keychain
        run: |
          TMP_DIRECTORY=$(mktemp -d)
          KEYCHAIN_PATH=$TMP_DIRECTORY/keychain.keychain
          KEYCHAIN_PASSWORD=$(uuidgen)
          security create-keychain -p $KEYCHAIN_PASSWORD $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security default-keychain -s $KEYCHAIN_PATH
          security unlock-keychain -p $KEYCHAIN_PASSWORD $KEYCHAIN_PATH
      - name: Run shard ${{ matrix.shard }}
        run: tuist test --without-building --platform macOS TuistAcceptanceTests -- -retry-tests-on-failure -test-iterations 2
        env:
          TUIST_SHARD_INDEX: ${{ matrix.shard }}

  cli-acceptance-tests-fork:
    name: Acceptance Tests (Fork)
    runs-on: macos-26
    timeout-minutes: 60
    if: (github.event.pull_request.draft == false || github.event_name != 'pull_request') && github.event.pull_request.head.repo.fork == true
    steps:
      - uses: actions/checkout@v4
      - name: Select Xcode
        run: sudo xcode-select -switch /Applications/Xcode_$(cat .xcode-version).app
      - uses: actions/cache/restore@v4
        id: cache
        with:
          path: .build
          key: ${{ runner.os }}-cli-${{ hashFiles('.xcode-version') }}-${{ hashFiles('Package.resolved') }}
      - uses: jdx/mise-action@v4.0.1
        with:
          version: ${{ env.MISE_VERSION }}
          install_args: "tuist"
          cache: "false"
          github_token: ${{ env.MISE_GITHUB_TOKEN }}
      - name: Install Tuist dependencies
        if: steps.cache.outputs.cache-matched-key == ''
        run: tuist install
      - name: Skip Xcode Macro Fingerprint Validation
        run: defaults write com.apple.dt.Xcode IDESkipMacroFingerprintValidation -bool YES
      - name: Skip Xcode Package Validation
        run: defaults write com.apple.dt.Xcode IDESkipPackagePluginFingerprintValidation -bool YES
      - name: Download Metal Toolchain
        run: xcodebuild -downloadComponent MetalToolchain
      - name: Set up new keychain
        run: |
          TMP_DIRECTORY=$(mktemp -d)
          KEYCHAIN_PATH=$TMP_DIRECTORY/keychain.keychain
          KEYCHAIN_PASSWORD=$(uuidgen)
          security create-keychain -p $KEYCHAIN_PASSWORD $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security default-keychain -s $KEYCHAIN_PATH
          security unlock-keychain -p $KEYCHAIN_PASSWORD $KEYCHAIN_PATH
      - name: Run tests
        run: tuist test --platform macOS TuistAcceptanceTests -- -retry-tests-on-failure -test-iterations 2

  cli-linux-build:
    name: Linux Build
    runs-on: ubuntu-latest
    container:
      image: swift:6.2
    timeout-minutes: 30
    if: github.event.pull_request.draft == false || github.event_name != 'pull_request'
    steps:
      - uses: actions/checkout@v4
      - name: Restore cache
        id: cache-restore
        uses: actions/cache/restore@v4
        with:
          path: .build
          key: linux-cli-${{ hashFiles('Package.resolved') }}
      - name: Resolve dependencies
        if: steps.cache-restore.outputs.cache-hit != 'true'
        run: swift package resolve --replace-scm-with-registry
      - name: Build tuist CLI
        run: swift build --target tuist --replace-scm-with-registry --force-resolved-versions
      - name: Save cache
        if: github.ref == 'refs/heads/main'
        id: cache-save
        uses: actions/cache/save@v4
        with:
          path: .build
          key: ${{ steps.cache-restore.outputs.cache-primary-key }}

  cli-linux-unit-tests:
    name: Linux Unit Tests
    runs-on: ubuntu-latest
    container:
      image: swift:6.2
    timeout-minutes: 30
    if: github.event.pull_request.draft == false || github.event_name != 'pull_request'
    steps:
      - uses: actions/checkout@v4
      - name: Restore cache
        id: cache-restore
        uses: actions/cache/restore@v4
        with:
          path: .build
          key: linux-cli-${{ hashFiles('Package.resolved') }}
      - name: Resolve dependencies
        if: steps.cache-restore.outputs.cache-hit != 'true'
        run: swift package resolve --replace-scm-with-registry
      - name: Run unit tests
        run: swift test --replace-scm-with-registry
      - name: Save cache
        if: github.ref == 'refs/heads/main'
        id: cache-save
        uses: actions/cache/save@v4
        with:
          path: .build
          key: ${{ steps.cache-restore.outputs.cache-primary-key }}