build.yaml

name: Build binaries

on:
  pull_request:
  push:
    branches:
      - "master"
      - "dev"
    tags:
      - "v*"

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  build:
    name: Build binary packages
    runs-on: macos-11
    steps:
      - name: Check out code
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          # Check https://github.com/livepeer/go-livepeer/pull/1891
          # for ref value discussion
          ref: ${{ github.event.pull_request.head.sha }}

      - uses: actions/setup-node@v3
        with:
          node-version: "18"
          cache: "yarn"

      - name: Tags
        id: tags
        uses: livepeer/action-gh-release-tags@latest

      - name: restore lerna
        id: cache-lerna
        uses: actions/cache@v3
        with:
          path: "**/node_modules"
          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}

      - name: restore pkg cache
        id: cache-pkg
        uses: actions/cache@v3
        with:
          path: "~/.pkg-cache"
          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}

      - name: yarn install
        run: yarn install --frozen-lockfile --silent

      - name: build pkgs
        # I want to do --parallel here, but the binary downloads conflict with each other
        run: |
          echo RELEASE_PATH="${GITHUB_WORKSPACE}/releases" >> "${GITHUB_ENV}"
          echo BIN_PATH="${GITHUB_WORKSPACE}/bin" >> "${GITHUB_ENV}"
          yarn run lerna-run pkg

      - name: Rename and move built binaries
        run: |
          mkdir -p "${RELEASE_PATH}" "${BIN_PATH}"

          for arch in linux-arm64 linux-x64 macos-arm64 macos-x64 win-x64; do
            package="api"
            in_name="$package-$arch"
            out_name="livepeer-$package"
            archive_name="livepeer-$(echo $in_name | sed -e 's/x64/amd64/;s/win/windows/;s/macos/darwin/')"
            cd ./packages/$package/bin
            case "$arch" in
              win-x64)
                in_name="$in_name.exe"
                out_name="$out_name.exe"
                mv "./$in_name" "./$out_name"
                zip -q9 "${RELEASE_PATH}/${archive_name}.zip" "./$out_name"
                ;;
              linux-*)
                mv "./$in_name" "./$out_name"
                tar -czvf "${RELEASE_PATH}/${archive_name}.tar.gz" "./$out_name"
                ;;
              macos-*)
                mkdir -p "${BIN_PATH}/$arch"
                mv "./$in_name" "${BIN_PATH}/$arch/$out_name"
                ;;
            esac
            cd -
          done

      - name: Upload macos binaries for codesigning (arm64)
        uses: actions/upload-artifact@v3
        with:
          name: macos-arm64
          path: bin/macos-arm64

      - name: Upload macos binaries for codesigning (amd64)
        uses: actions/upload-artifact@v3
        with:
          name: macos-amd64
          path: bin/macos-x64

      - name: Upload artifacts for cutting release
        uses: actions/upload-artifact@v3
        with:
          name: release-artifacts
          path: releases/

  macos:
    strategy:
      fail-fast: true
      matrix:
        arch:
          - amd64
          - arm64
    name: Codesign and archive macOS binaries
    runs-on: macos-11
    needs: build
    steps:
      - name: Setup env
        run: |
          echo ARCH="${{ matrix.arch }}" >> "$GITHUB_ENV"

      - name: Download binaries from build stage
        uses: actions/download-artifact@v3
        with:
          name: macos-${{ matrix.arch }}
          path: bin/

      - name: Fix file permissions
        run: |
          cd bin/
          chmod a+x livepeer-*

      - uses: actions-ecosystem/action-regex-match@v2
        id: match-tag
        with:
          text: ${{ github.ref_name }}
          regex: '^(master|main|v[0-9]+\.\d+\.\d+)$'

      - name: Codesign and notarize binaries
        if: ${{ steps.match-tag.outputs.match != '' }}
        uses: livepeer/action-gh-codesign-apple@latest
        with:
          developer-certificate-id: ${{ secrets.CI_MACOS_CERTIFICATE_ID }}
          developer-certificate-base64:
            ${{ secrets.CI_MACOS_CERTIFICATE_BASE64 }}
          developer-certificate-password:
            ${{ secrets.CI_MACOS_CERTIFICATE_PASSWORD }}
          app-notarization-email: ${{ secrets.CI_MACOS_NOTARIZATION_USER }}
          app-notarization-password:
            ${{ secrets.CI_MACOS_NOTARIZATION_PASSWORD }}
          app-notarization-team-id: ${{ secrets.CI_MACOS_NOTARIZATION_TEAM_ID }}
          binary-path: "bin/"

      - name: Archive built binaries
        run: |
          mkdir -p releases/
          cd bin/
          for file in $(find . -type f -perm -a+x); do
            tar -czf "../releases/${file}-darwin-${ARCH}.tar.gz" "${file}"
          done

      - name: Upload artifacts for cutting release
        uses: actions/upload-artifact@v3
        with:
          name: release-artifacts
          path: releases/

  upload:
    name: Upload artifacts to google bucket
    if:
      ${{ github.event.pull_request.head.repo.full_name ==
      github.event.pull_request.base.repo.full_name }}
    permissions:
      contents: "read"
      id-token: "write"
    runs-on: ubuntu-latest
    needs:
      - build
      - macos
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v3
        with:
          name: release-artifacts
          path: releases/

      - name: Generate sha256 checksum and gpg signatures for release artifacts
        uses: livepeer/action-gh-checksum-and-gpg-sign@latest
        with:
          artifacts-dir: releases
          release-name:
            ${{ github.ref_type == 'tag' && github.ref_name ||
            github.event.pull_request.head.sha || github.sha }}
          gpg-key: ${{ secrets.CI_GPG_SIGNING_KEY }}
          gpg-key-passphrase: ${{ secrets.CI_GPG_SIGNING_PASSPHRASE }}

      - name: Generate branch manifest
        id: branch-manifest
        uses: livepeer/branch-manifest-action@latest
        with:
          project-name: ${{ github.event.repository.name }}
          platform: linux, darwin

      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider:
            ${{ secrets.CI_GOOGLE_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.CI_GOOGLE_SERVICE_ACCOUNT }}

      - name: Upload release archives to Google Cloud
        id: upload-archives
        uses: google-github-actions/upload-cloud-storage@v1
        with:
          path: "releases"
          destination:
            "build.livepeer.live/${{ github.event.repository.name }}/${{
            (github.ref_type == 'tag' && github.ref_name) ||
            github.event.pull_request.head.sha || github.sha }}"
          parent: false

      - name: Upload branch manifest file
        id: upload-manifest
        uses: google-github-actions/upload-cloud-storage@v1
        with:
          path: ${{ steps.branch-manifest.outputs.manifest-file }}
          destination:
            "build.livepeer.live/${{ github.event.repository.name }}/"
          parent: false

      - name: Notify new build upload
        run: curl -X POST https://holy-bread-207a.livepeer.workers.dev