build-plugin-binary.yml

name: Build Plugin Binary

on:
  workflow_call:
    inputs:
      coretoolkit_ref:
        description: CoreToolkit ref used for the reusable workflow checkout.
        required: false
        default: main
        type: string
      dependency_repos:
        description: Newline-separated plugin repositories that must be exported to Conan before building.
        required: false
        default: ''
        type: string

jobs:
  build:
    name: Build (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            os_slug: linux
            arch_slug: x86_64
          - os: macos-latest
            os_slug: darwin
            arch_slug: arm64
          # windows-2022 (not windows-latest): ConanCenter publishes prebuilt
          # binaries for MSVC 194 (VS 2022). windows-latest has begun moving to
          # newer images whose MSVC (195) has NO prebuilt binaries on ConanCenter,
          # which forced duckdb/boost/fmt/zlib/onetbb/... to all compile from
          # source — and duckdb's bundled fmt fails to compile under MSVC 195,
          # failing the job (so the Conan cache never got saved → every run cold).
          - os: windows-2022
            os_slug: windows
            arch_slug: x86_64
    outputs:
      plugin_key: ${{ steps.bundle.outputs.plugin_key }}
      plugin_version: ${{ steps.bundle.outputs.plugin_version }}
    steps:
      - name: Check out plugin repository
        uses: actions/checkout@v4
        with:
          path: plugin

      - name: Check out CoreToolkit
        uses: actions/checkout@v4
        with:
          repository: ${{ github.repository_owner }}/CoreToolkit
          ref: ${{ inputs.coretoolkit_ref }}
          path: coretoolkit

      - name: Set up MSVC developer shell
        if: runner.os == 'Windows'
        uses: ilammy/msvc-dev-cmd@v1

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install Conan and zstandard
        shell: bash
        run: |
          set -euo pipefail
          python -m pip install --upgrade pip conan zstandard
          conan profile detect --force

      # All third-party deps (duckdb, boost, onetbb, spdlog, fmt, zlib, ...) have
      # prebuilt ConanCenter binaries for these pinned CI toolchains, so a clean
      # run downloads rather than compiling. Persist the Conan package store
      # between runs anyway so warm runs skip even the export/build of CoreToolkit
      # itself. Keyed on CoreToolkit's conanfile so a dependency/option change
      # invalidates the cache; restore-keys give a warm partial hit otherwise.
      # Bump the v1 token to force a clean rebuild.
      - name: Cache Conan packages
        uses: actions/cache@v4
        with:
          path: ~/.conan2/p
          key: conan-v1-${{ matrix.os }}-${{ hashFiles('coretoolkit/conanfile.py') }}
          restore-keys: |
            conan-v1-${{ matrix.os }}-

      - name: Build plugin
        id: build
        shell: bash
        run: |
          set -euo pipefail

          plugin_dir="$PWD/plugin"
          coretoolkit_dir="$PWD/coretoolkit"
          install_dir="$PWD/.ci-install"
          mkdir -p "$install_dir"

          conan export "$coretoolkit_dir"
          coretoolkit_version="$(conan inspect "$coretoolkit_dir" --format=json | python3 -c 'import json,sys; print(json.load(sys.stdin)["version"])')"

          if [[ -n '${{ inputs.dependency_repos }}' ]]; then
            while IFS= read -r dependency_repo; do
              dependency_repo="$(printf '%s' "$dependency_repo" | xargs)"
              [[ -z "$dependency_repo" ]] && continue
              dependency_dir="$PWD/$(basename "$dependency_repo")"
              git clone --depth 1 "https://github.com/${GITHUB_REPOSITORY_OWNER}/${dependency_repo}" "$dependency_dir"
              conan export "$dependency_dir"
            done <<'EOF'
          ${{ inputs.dependency_repos }}
          EOF
          fi

          # Volt's own C++ (CoreToolkit + the plugin) is C++23 and forces that
          # standard through CMake (CMAKE_CXX_STANDARD 23 / cxx_std_23), so it
          # does NOT rely on Conan's cppstd setting. Build the third-party deps
          # at C++17 instead: it clears every dep's minimum on every compiler
          # (including MSVC, whose detected default is 14), and the prebuilt
          # ConanCenter binaries (duckdb, boost, ...) are available at cppstd=17,
          # so they download rather than compiling. CoreToolkit is pinned back to
          # 23 so its own package_id stays honest.
          conan_args=(
            -o "hwloc/*:shared=True"
            --build=missing
            -s build_type=Release
            -s compiler.cppstd=17
            -s "coretoolkit/*:compiler.cppstd=23"
          )

          # boost/*:without_stacktrace=True is a LINUX-ONLY fix. On Linux, boost
          # 1.88 builds libboost_stacktrace_from_exception.a, which interposes
          # __cxa_allocate_exception; linking the plugin with -static-libstdc++
          # then hits "multiple definition of __cxa_allocate_exception" against
          # libstdc++.a, so we drop the stacktrace libs (we only use Boost
          # headers). It must NOT be set on macOS/Windows: ConanCenter ships no
          # prebuilt boost binary with without_stacktrace=True for any OS, so
          # setting it there forces boost to compile from source. macOS/Windows
          # have no -static-libstdc++, so they don't need the fix anyway.
          if [[ '${{ runner.os }}' == 'Linux' ]]; then
            conan_args+=(-o "boost/*:without_stacktrace=True")
          fi

          # On Windows, pin MSVC to 194. ConanCenter only publishes prebuilt
          # binaries for msvc 194 (not 195); if the runner image detects a newer
          # toolset, every dep would compile from source (and duckdb's bundled fmt
          # fails to build under MSVC 195). Do NOT set compiler.update — the
          # published binaries carry no update value, so adding one breaks the
          # package_id match.
          if [[ '${{ runner.os }}' == 'Windows' ]]; then
            conan_args+=(-s "compiler.version=194")
          fi

          conan install --requires="coretoolkit/${coretoolkit_version}" "${conan_args[@]}"
          conan install "$plugin_dir" "${conan_args[@]}" \
            --output-folder "$plugin_dir/build"

          toolchain_path="$(find "$plugin_dir/build" -path '*/generators/conan_toolchain.cmake' | head -n 1)"
          if [[ -z "$toolchain_path" ]]; then
            echo 'Unable to locate conan_toolchain.cmake' >&2
            exit 1
          fi
          build_dir="$(cd "$(dirname "$toolchain_path")/.." && pwd)"

          cmake_args=(
            -S "$plugin_dir"
            -B "$build_dir"
            "-DCMAKE_TOOLCHAIN_FILE=$toolchain_path"
            -DCMAKE_BUILD_TYPE=Release
            "-DCMAKE_INSTALL_PREFIX=$install_dir"
          )
          if [[ '${{ runner.os }}' == 'Linux' ]]; then
            cmake_args+=(
              "-DCMAKE_EXE_LINKER_FLAGS=-static-libstdc++ -static-libgcc -Wl,--disable-new-dtags"
              '-DCMAKE_INSTALL_RPATH=$ORIGIN/../lib'
            )
          elif [[ '${{ runner.os }}' == 'macOS' ]]; then
            cmake_args+=('-DCMAKE_INSTALL_RPATH=@loader_path/../lib')
          fi

          cmake "${cmake_args[@]}"
          cmake --build "$build_dir" --config Release --parallel
          cmake --install "$build_dir" --config Release

          echo "install_dir=$install_dir" >> "$GITHUB_OUTPUT"
          echo "plugin_dir=$plugin_dir" >> "$GITHUB_OUTPUT"

      - name: Bundle plugin
        id: bundle
        shell: bash
        env:
          PLUGIN_DIR: ${{ steps.build.outputs.plugin_dir }}
          INSTALL_DIR: ${{ steps.build.outputs.install_dir }}
          OS_SLUG: ${{ matrix.os_slug }}
          ARCH_SLUG: ${{ matrix.arch_slug }}
        run: |
          set -euo pipefail
          mkdir -p artifacts
          python "$GITHUB_WORKSPACE/coretoolkit/.github/scripts/build_plugin_bundle.py" \
            --plugin-dir "$PLUGIN_DIR" \
            --install-dir "$INSTALL_DIR" \
            --os "$OS_SLUG" \
            --arch "$ARCH_SLUG" \
            --output-dir "$PWD/artifacts"

      - name: Upload bundle artifact
        if: steps.bundle.outputs.plugin_key != ''
        uses: actions/upload-artifact@v4
        with:
          name: bundle-${{ matrix.os_slug }}-${{ matrix.arch_slug }}
          path: artifacts/*
          retention-days: 7
          if-no-files-found: error

  release:
    name: Publish release
    needs: build
    if: needs.build.outputs.plugin_key != '' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download bundles
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          pattern: bundle-*
          merge-multiple: true

      - name: Publish release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.build.outputs.plugin_version }}
          name: ${{ needs.build.outputs.plugin_key }} v${{ needs.build.outputs.plugin_version }}
          files: artifacts/*
          fail_on_unmatched_files: false

  publish:
    name: Publish to registry
    needs: build
    if: needs.build.outputs.plugin_key != '' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    steps:
      - name: Check out plugin repository
        uses: actions/checkout@v4
        with:
          path: plugin

      - name: Download bundles
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          pattern: bundle-*
          merge-multiple: true

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install vpm
        run: npm install -g @voltstack/vpm

      - name: Verify committed vpm.json
        run: test -f plugin/vpm.json || { echo "::error::plugin/vpm.json is required (the registry manifest is no longer generated)"; exit 1; }

      - name: Publish to registry
        env:
          VPM_NO_KEYRING: '1'
          VPM_PUBLISH_TOKEN: ${{ secrets.VPM_PUBLISH_TOKEN }}
        run: |
          vpm publish plugin --token "$VPM_PUBLISH_TOKEN" \
            --bundle linux-x86_64=$(ls artifacts/*-linux-x86_64.tar.zst) \
            --bundle darwin-arm64=$(ls artifacts/*-darwin-arm64.tar.zst) \
            --bundle windows-x86_64=$(ls artifacts/*-windows-x86_64.tar.zst)