ci.yml

name: CI
on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
    tags:
      - '*'
permissions:
  contents: read

env:
  FORCE_COLOR: 1
  PREBUILD_NODE_VERSION: '22'
  DEFAULT_NODE_VERSION: '26'
  ALPINE_VARIANT: 'alpine3.20'

jobs:
  env_vars:
    runs-on: ubuntu-latest
    outputs:
      prebuild_node_version: ${{ env.PREBUILD_NODE_VERSION }}
      default_node_version: ${{ env.DEFAULT_NODE_VERSION }}
    steps:
      - run: echo "exposing environment variables for passing to reusable workflows"

  verify-version:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Verify tag version matches package.json
        run: |
          # Check if we're running on a tag
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            # Extract tag name from GITHUB_REF (e.g., refs/tags/v6.0.2 -> v6.0.2)
            TAG_NAME="${GITHUB_REF#refs/tags/}"
            # Remove 'v' prefix if present to get the version number
            TAG_VERSION="${TAG_NAME#v}"

            # Get version from package.json
            PACKAGE_VERSION=$(node -p "require('./package.json').version")

            echo "Tag version: $TAG_VERSION"
            echo "Package version: $PACKAGE_VERSION"

            if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
              echo "ERROR: Tag version ($TAG_VERSION) does not match package.json version ($PACKAGE_VERSION)"
              echo "Please update package.json or create a new tag with the correct version"
              echo "GitHub release will NOT be created."
              exit 1
            fi

            echo "Version match verified!"
          else
            echo "Skipping version verification - not a tag event"
          fi

  create-release:
    permissions:
      contents: write
    needs: [verify-version]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Create GitHub Release (draft)
        run: |
          TAG_NAME="${GITHUB_REF#refs/tags/}"
          echo "Creating draft release for tag: $TAG_NAME"
          gh release create "$TAG_NAME" --draft --title "$TAG_NAME" --notes "Release $TAG_NAME"
        env:
          GH_TOKEN: ${{ github.token }}

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.DEFAULT_NODE_VERSION }}
      - name: Install dependencies
        run: yarn install --frozen-lockfile --ignore-scripts
      - name: Run lint
        run: yarn lint

  build:
    permissions:
      contents: write
    needs: [verify-version, lint, create-release]
    if: >-
      !cancelled() &&
      (needs.create-release.result == 'success' || needs.create-release.result == 'skipped')
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            host: x64
            target: x64
            platform: macos-x64
            node: 22
          - os: macos-latest
            host: x64
            target: x64
            platform: macos-x64
            node: 26
          - os: ubuntu-24.04
            host: x64
            target: x64
            platform: linux-x64
            node: 22
          - os: ubuntu-24.04
            host: x64
            target: x64
            platform: linux-x64
            node: 26
          - os: windows-latest
            host: x64
            target: x64
            platform: win32-x64
            node: 22
          - os: windows-latest
            host: x64
            target: x64
            platform: win32-x64
            node: 26
          - os: windows-11-arm
            host: arm64
            target: arm64
            platform: win32-arm64
            node: 22
          - os: windows-11-arm
            host: arm64
            target: arm64
            platform: win32-arm64
            node: 26
          - os: macos-latest
            host: arm64
            target: arm64
            platform: macos-arm64
            node: 22
          - os: macos-latest
            host: arm64
            target: arm64
            platform: macos-arm64
            node: 26
          - os: ubuntu-24.04-arm
            host: arm64
            target: arm64
            platform: linux-arm64
            node: 22
          - os: ubuntu-24.04-arm
            host: arm64
            target: arm64
            platform: linux-arm64
            node: 26
    name: ${{ matrix.os }} (node=${{ matrix.node }}, host=${{ matrix.host }}, target=${{ matrix.target }})
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node }}
          architecture: ${{ matrix.host }}

      - name: Add msbuild to PATH
        uses: microsoft/setup-msbuild@v3
        if: contains(matrix.os, 'windows')
        with:
          msbuild-architecture: ${{ matrix.target }}

      - name: Install dependencies
        run: yarn install --frozen-lockfile --ignore-scripts

      - name: Check Node compatibility
        run: node tools/semver-check.js

      - name: Add env vars
        shell: bash
        run: |
          echo "V=1" >> $GITHUB_ENV

          if [ "${{ matrix.target }}" = "x86" ]; then
            echo "TARGET=ia32" >> $GITHUB_ENV
          else
            echo "TARGET=${{ matrix.target }}" >> $GITHUB_ENV
          fi

      - name: Add Linux env vars
        if: contains(matrix.os, 'ubuntu')
        run: |
          echo "CFLAGS=${CFLAGS:-} -include ../src/gcc-preinclude.h" >> $GITHUB_ENV
          echo "CXXFLAGS=${CXXFLAGS:-} -include ../src/gcc-preinclude.h" >> $GITHUB_ENV

      - name: Build binaries
        run: yarn prebuild

      - name: Print binary info
        if: contains(matrix.os, 'ubuntu')
        run: |
          BIN=$(find prebuilds -name "*.node" | head -1)
          ldd "$BIN"
          echo "---"
          nm "$BIN" | grep "GLIBC_" | c++filt || true
          echo "---"
          file "$BIN"

      - name: Debug async hook stack integrity (macOS only, with diagnostic logging)
        if: contains(matrix.os, 'macos')
        shell: bash
        run: |
          SQLITE3_DEBUG_ASYNC_HOOKS=1 npx mocha -R spec --timeout 120000 test/async_hooks_stress.test.js 2>&1

      - name: Run tests
        run: yarn test

      - name: Upload binaries to commit artifacts
        uses: actions/upload-artifact@v7
        if: matrix.node == env.PREBUILD_NODE_VERSION
        with:
          name: prebuilt-binaries-${{ matrix.platform }}
          path: prebuilds/*
          retention-days: 7

      - name: Upload binaries to GitHub Release
        shell: bash
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          for i in 1 2 3; do
            if gh release upload "$TAG" prebuilds/*/*.node --clobber; then
              echo "Upload succeeded on attempt $i"
              break
            else
              echo "Upload failed on attempt $i, retrying in 10s..."
              sleep 10
            fi
          done
        if: matrix.node == env.PREBUILD_NODE_VERSION && startsWith(github.ref, 'refs/tags/')
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v6
        if: matrix.node == env.DEFAULT_NODE_VERSION && matrix.platform == 'linux-x64'
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: gms1/node-sqlite3

  build-musl:
    permissions:
      contents: write
    needs: [verify-version, create-release]
    if: >-
      !cancelled() &&
      (needs.create-release.result == 'success' || needs.create-release.result == 'skipped') &&
      (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/'))
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04-arm
            platform: linux/arm64
            arch: arm64
          - runner: ubuntu-24.04
            platform: linux/amd64
            arch: amd64
    runs-on: ${{ matrix.runner }}
    name: musl ${{ matrix.arch }}
    steps:
      - uses: actions/checkout@v6

      - name: Build binaries and test
        run: |
          docker build \
            --file ./tools/BinaryBuilder.Dockerfile \
            --tag sqlite-builder \
            --no-cache \
            --build-arg VARIANT=${{ env.ALPINE_VARIANT }} \
            --build-arg NODE_VERSION=${{ env.PREBUILD_NODE_VERSION }} \
            .
          CONTAINER_ID=$(docker create -it sqlite-builder)
          docker cp $CONTAINER_ID:/usr/src/build/prebuilds/ ./prebuilds

      - name: Upload binaries to commit artifacts
        uses: actions/upload-artifact@v7
        with:
          name: prebuilt-binaries-musl-${{ matrix.arch }}
          path: prebuilds/*
          retention-days: 7

      - name: Upload binaries to GitHub Release
        shell: bash
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          for i in 1 2 3; do
            if gh release upload "$TAG" prebuilds/*/*.node --clobber; then
              echo "Upload succeeded on attempt $i"
              break
            else
              echo "Upload failed on attempt $i, retrying in 10s..."
              sleep 10
            fi
          done
        if: startsWith(github.ref, 'refs/tags/')
        env:
          GH_TOKEN: ${{ github.token }}

  package:
    needs: [build, build-musl]
    if: >-
      !cancelled() &&
      needs.build.result == 'success' &&
      (needs.build-musl.result == 'success' || needs.build-musl.result == 'skipped')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.PREBUILD_NODE_VERSION }}

      - name: Install dependencies
        run: yarn install --frozen-lockfile --ignore-scripts

      - name: Download all prebuilt binary artifacts
        uses: actions/download-artifact@v8
        with:
          path: prebuilds-artifacts
          merge-multiple: true

      - name: Merge prebuilds into package
        run: |
          mkdir -p prebuilds
          cp -r prebuilds-artifacts/* prebuilds/
          rm -rf prebuilds-artifacts
          find prebuilds -name '*.node' -type f

      - name: Create npm tarball
        run: |
          npm pack
          echo "npm tarball created:"
          ls -la *.tgz

      - name: Upload npm tarball as commit artifact
        uses: actions/upload-artifact@v7
        with:
          name: npm-package-tarball
          path: '*.tgz'
          retention-days: 7

      - name: Upload npm tarball to GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        run: gh release upload ${GITHUB_REF#refs/tags/} *.tgz --clobber
        env:
          GH_TOKEN: ${{ github.token }}

  test-package:
    needs: [package, env_vars]
    if: >-
      !cancelled() &&
      needs.package.result == 'success'
    uses: ./.github/workflows/test-npm-package.yml
    with:
      target_run_id: ${{ github.run_id }}
      node_version: ${{ needs.env_vars.outputs.default_node_version }}