ci.yml

# © Copyright 2025, 2026 Query Farm LLC - https://query.farm

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  # Use Cloudflare's S3-compatible R2 endpoint directly because vcpkg binary
  # archives can exceed the Worker request-size limit. Fork PRs do not receive
  # secrets, so disable the remote cache instead of issuing broken AWS calls.
  VCPKG_BINARY_SOURCES: "${{ secrets.R2_ACCESS_KEY_ID != '' && secrets.R2_SECRET_KEY_ID != '' && secrets.R2_ENDPOINT != '' && 'clear;x-aws,s3://query-farm-duckdb-vcpkg/,readwrite' || 'clear' }}"
  AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_KEY_ID }}
  AWS_ENDPOINT_URL: ${{ secrets.R2_ENDPOINT }}
  AWS_DEFAULT_REGION: auto
  AWS_REQUEST_CHECKSUM_CALCULATION: when_required
  AWS_RESPONSE_CHECKSUM_VALIDATION: when_required

jobs:
  # Seconds, and it fails the run before anything is built: a formatting-only
  # diff arriving on top of a real change is what the formatter exists to stop.
  format:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - name: Install clang-format
        run: pipx install 'clang-format~=22.1'
      - name: Check formatting
        run: ./scripts/format.sh --check

  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            compiler: gcc
          - os: ubuntu-24.04-arm
            compiler: gcc
          - os: macos-14
            compiler: apple-clang

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4

      # The SDK is built from source as a subdirectory, not from an installed
      # copy: the two move together, and an installed one goes stale silently.
      # CMakeLists.txt looks for it beside this repo by default.
      #
      # Pinned to a release: this SDK uses ProtocolBuilder/add_protocol, the
      # error model and AuthUnavailableError, which first shipped in v0.6.0.
      - name: Check out vgi-rpc-cpp
        uses: actions/checkout@v4
        with:
          repository: Query-farm/vgi-rpc-cpp
          ref: v0.11.0
          path: vgi-rpc-c++

      - name: Clone and bootstrap vcpkg
        run: |
          git clone https://github.com/microsoft/vcpkg.git
          git -C vcpkg checkout 2d32fae67c755b665794a0650f5d268979d7807f
          ./vcpkg/bootstrap-vcpkg.sh -disableMetrics
          echo "VCPKG_ROOT=$(pwd)/vcpkg" >> $GITHUB_ENV

      - name: Install newer bison (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install bison
          echo "$(brew --prefix bison)/bin" >> $GITHUB_PATH

      # vcpkg builds libsodium through its autotools script. The runners ship
      # libtool but not the complete autoconf toolset, and the port fails at
      # configure time when any one of these tools is absent.
      - name: Install autotools (libsodium)
        run: |
          if [ "$RUNNER_OS" = "macOS" ]; then
            brew install autoconf autoconf-archive automake libtool
          else
            sudo apt-get update && sudo apt-get install -y autoconf autoconf-archive automake libtool
          fi

      # vcpkg's binary cache covers the dependencies; this covers our own
      # translation units, which vcpkg knows nothing about.
      - name: ccache
        uses: hendrikmuhs/ccache-action@v1.2
        with:
          key: ${{ matrix.os }}-${{ matrix.compiler }}
          max-size: 500M

      - name: Configure
        run: >
          cmake --preset default
          -DVGI_RPC_SOURCE_DIR=${{ github.workspace }}/vgi-rpc-c++
          -DCMAKE_C_COMPILER_LAUNCHER=ccache
          -DCMAKE_CXX_COMPILER_LAUNCHER=ccache

      - name: Build
        run: cmake --build --preset default --parallel 2

      - name: Test (unit)
        run: ctest --test-dir build --output-on-failure

      # The example worker is the deliverable: if it does not start, nothing
      # downstream of it can work. The unit step above already drove it for
      # real -- tests/protocol_routing_test.cpp calls vgi_rpc.Reflection.v1 and
      # a vgi.v2 method on it over stdio, a unix socket and HTTP.
      - name: Smoke — the worker describes itself
        run: |
          python3 -m pip install --quiet 'vgi-rpc[http]' || true
          test -x build/example-worker/vgi-example-worker
          echo "worker built: $(build/example-worker/vgi-example-worker --help 2>&1 | head -1 || true)"

      # vgi-rpc's hosted-protocols group: the worker hosts vgi.v2 and, through
      # Worker::set_hosted_protocols, conformance.Secondary.v1 -- on stdio,
      # a unix socket and HTTP -- and over HTTP opts into vgi_rpc.Identity.v2
      # with the conformance fixture policy.
      - name: Setup Python (reference requires 3.13)
        if: runner.os == 'Linux'
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Hosted protocols (vgi-rpc-test-hosted)
        if: runner.os == 'Linux'
        # The reference is cloned from main, unpinned -- the same pattern
        # vgi-rpc-cpp's CI uses: a reference change that breaks this SDK is
        # meant to turn it red the day it lands.
        run: |
          git clone --depth 1 https://github.com/Query-farm/vgi-rpc-python.git ../vgi-rpc-ref
          python -m venv ../hosted-venv
          ../hosted-venv/bin/python -m pip install --quiet '../vgi-rpc-ref[http,conformance]' pytest pytest-timeout
          export PATH="$PWD/../hosted-venv/bin:$PATH"
          W="$PWD/build/example-worker/vgi-example-worker"
          vgi-rpc-test-hosted --cmd "$W" --expect vgi.v2,conformance.Secondary.v1
          SOCK=/tmp/vgi-hosted.sock
          "$W" --unix "$SOCK" & UNIX_PID=$!
          for _ in $(seq 50); do [ -S "$SOCK" ] && break; sleep 0.1; done
          vgi-rpc-test-hosted --unix "$SOCK" --expect vgi.v2,conformance.Secondary.v1
          kill "$UNIX_PID"
          "$W" --http --host 127.0.0.1 --port 0 --conformance-identity \
            --introspect-principals conformance-introspector > /tmp/vgi-hosted-http.log 2>&1 & HTTP_PID=$!
          PORT=""
          for _ in $(seq 100); do
            PORT=$(grep -m1 -o 'PORT:[0-9]*' /tmp/vgi-hosted-http.log | cut -d: -f2 || true)
            [ -n "$PORT" ] && break; sleep 0.1
          done
          vgi-rpc-test-hosted --url "http://127.0.0.1:$PORT" \
            --expect vgi.v2,conformance.Secondary.v1 --identity
          kill "$HTTP_PID"

  # The integration suite is the definition of done for this repo, and it needs
  # the DuckDB extension built from ~/Development/vgi — a large, separate build
  # that does not belong in this workflow. It runs locally via
  # scripts/run_tests.sh; see CLAUDE.md. Wiring it here needs the extension
  # published as a release artifact first, which is tracked separately.