config.yml

version: 2.1

# Our CircleCI dependencies
orbs:
  rust: circleci/rust@1.6.1
  gh: circleci/github-cli@2.6.0
  node: circleci/node@6.3.0
  secops: apollo/circleci-secops-orb@2.0.7
  slack: circleci/slack@5.1.1

# These filters are used in all of the jobs for our release workflow
run_release: &run_release
  filters:
    branches:
      ignore: /.*/
    tags:
      # This regex is taken verbatim from https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string and
      # ensures we only ever run our release pipeline for Semver tags
      only: /^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/

# You can uncomment the following alias, and comment the above alias when testing,
# just make sure to update the branch name to the one you're testing on so they run.
# You can bypass the tests if you don't update those steps.
#
# run_release: &run_release
#   filters:
#     branches:
#       only: /avery/test-release-process/
#     tags:
#       ignore: /.*/

# The machines we use to run our workflows on
executors:
  amd_manylinux: &amd_manylinux_executor
    docker:
      # This image is used for building Python Wheels but it has what we need for Rust compilation and crucially
      # glibc 2.17.
      - image:  quay.io/pypa/manylinux2014_x86_64:2024.09.09-0
    resource_class: xlarge
    environment:
      XTASK_TARGET: "x86_64-unknown-linux-gnu"
      CHECK_GLIBC: "true"
      LATEST_FED_VERSION_JSON_KEY: "latest-2"


  arm_ubuntu: &arm_ubuntu_executor
    machine:
      image: ubuntu-2004:2024.05.1
    resource_class: arm.large
    environment:
      XTASK_TARGET: "aarch64-unknown-linux-gnu"
      CHECK_GLIBC: "true"
      LATEST_FED_VERSION_JSON_KEY: "latest-2"

  amd_musl: &amd_musl_executor
    docker:
      - image: cimg/base:stable
    resource_class: xlarge
    environment:
      XTASK_TARGET: "x86_64-unknown-linux-musl"
      LATEST_FED_VERSION_JSON_KEY: "latest-2"

  amd_macos: &amd_macos_executor
    macos:
      xcode: "15.0.0"
    resource_class: macos.m1.large.gen1
    environment:
      XTASK_TARGET: "x86_64-apple-darwin"
      APPLE_TEAM_ID: "YQK948L752"
      APPLE_USERNAME: "opensource@apollographql.com"

  # this is the exact same executor as amd_macos_executor (except $XTASK_TARGET)
  # until there is official support for building on real ARM Macs
  arm_macos: &arm_macos_executor
    macos:
      xcode: "15.0.0"
    resource_class: macos.m1.large.gen1
    environment:
      XTASK_TARGET: "aarch64-apple-darwin"
      APPLE_TEAM_ID: "YQK948L752"
      APPLE_USERNAME: "opensource@apollographql.com"
      LATEST_FED_VERSION_JSON_KEY: "latest-2"

  amd_windows: &amd_windows_executor
    machine:
      image: "windows-server-2019-vs2019:2022.08.1"
    resource_class: windows.xlarge
    shell: powershell.exe -ExecutionPolicy Bypass
    environment:
      XTASK_TARGET: "x86_64-pc-windows-msvc"
      LATEST_FED_VERSION_JSON_KEY: "latest-2"

  # This is used for any xtask command that needs volta installed
  volta: &volta_executor
    docker:
      - image: cimg/base:stable
    resource_class: medium
    environment:
      XTASK_TARGET: "x86_64-unknown-linux-gnu"

  node_js_nix:
    docker:
      - image: node:20.18.1
    resource_class: medium

  node_js_windows:
    machine:
      image: "windows-server-2019-vs2019:2022.08.1"
      shell: powershell.exe -ExecutionPolicy Bypass
    resource_class: windows.medium


tag_matches_prerelease: &tag_matches_prerelease
  matches:
    # This regex is adapted from the official one provided by the Semver Standard:
    # https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
    # There is a v appended in the first instance and further everything after the `-` we can ignore hence the
    # simplification.
    pattern: "^v(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)-.+$"
    value: << parameters.release_tag >>

# reusable parameters that can be used across jobs and workflows
parameters:
  cache_version:
    type: string
    # increment this version to invalidate all caches
    default: v2.{{ checksum "rust-toolchain.toml" }}

# The main workflows executed for Rover
workflows:
  lint:
    jobs:
      - xtask:
          name: Lint
          matrix:
            parameters:
              platform: [volta]
              rust_channel: [stable]
              command: [lint]
              options:
                - | 
                  --current-sha << pipeline.git.revision >>
  security_checks:
    jobs:
      - xtask:
          name: Security Checks
          platform: arm_ubuntu
          rust_channel: stable
          command: security-checks
  test:
    jobs:
      - xtask:
          name: Run cargo unit + integration tests (<< matrix.rust_channel >> rust on << matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_manylinux, amd_musl, arm_macos, amd_windows]
              rust_channel: [stable]
              command: [test]

      - install_js:
          name: Test installation for Javascript Package Managers (<< matrix.package_manager >> on << matrix.platform >>)
          matrix:
            parameters:
              package_manager: [npm, npm_global, pnpm]
              platform: [windows, nix]

      - node/test:
          name: Test NPM Installer Scripts
          app-dir: "~/project/installers/npm"
          test-results-for: jest
          override-ci-command: npm install --ignore-scripts
  release:
    jobs:
      - xtask:
          name: Run cargo unit + integration tests (<< matrix.rust_channel >> rust on << matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_manylinux, amd_musl, arm_macos, amd_windows]
              rust_channel: [stable]
              command: [test]
          <<: *run_release

      - install_js:
          name: Test installation for Javascript Package Managers (<< matrix.package_manager >> on << matrix.platform >>)
          matrix:
            parameters:
              package_manager: [ npm, npm_global, pnpm ]
              platform: [windows, nix]
          <<: *run_release

      - node/test:
          name: Test NPM Installer Scripts
          app-dir: "~/project/installers/npm"
          test-results-for: jest
          override-ci-command: npm install --ignore-scripts
          <<: *run_release

      - xtask:
          name: Build and bundle release artifacts (<< matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_manylinux, amd_musl, arm_ubuntu, amd_macos, arm_macos, amd_windows]
              rust_channel: [stable]
              command: [package]
              options: ["--rebuild"]
          requires:
            - "Run cargo unit + integration tests (stable rust on amd_manylinux)"
            - "Run cargo unit + integration tests (stable rust on amd_musl)"
            - "Run cargo unit + integration tests (stable rust on arm_macos)"
            - "Run cargo unit + integration tests (stable rust on amd_windows)"
            - "Test installation for Javascript Package Managers (npm on nix)"
            - "Test installation for Javascript Package Managers (npm_global on nix)"
            - "Test installation for Javascript Package Managers (pnpm on nix)"
            - "Test installation for Javascript Package Managers (npm on windows)"
            - "Test installation for Javascript Package Managers (npm_global on windows)"
            - "Test installation for Javascript Package Managers (pnpm on windows)"
            - "Test NPM Installer Scripts"
          <<: *run_release

      - publish_release:
          name: Publish GitHub release and release to npm
          matrix:
            parameters:
              platform: [volta]
          requires:
            - "Build and bundle release artifacts (amd_manylinux)"
            - "Build and bundle release artifacts (arm_ubuntu)"
            - "Build and bundle release artifacts (amd_musl)"
            - "Build and bundle release artifacts (amd_macos)"
            - "Build and bundle release artifacts (arm_macos)"
            - "Build and bundle release artifacts (amd_windows)"
          <<: *run_release
  security-scans:
    jobs:
      - secops/gitleaks:
          context:
            - platform-docker-ro
            - github-orb
            - secops-oidc
          git-base-revision: <<#pipeline.git.base_revision>><<pipeline.git.base_revision>><</pipeline.git.base_revision >>
          git-revision: << pipeline.git.revision >>

      - secops/semgrep:
          context:
            - secops-oidc
            - github-orb
          git-base-revision: <<#pipeline.git.base_revision>><<pipeline.git.base_revision>><</pipeline.git.base_revision >>
  nightly-lint:
    triggers:
      - schedule:
          cron: "0 0 * * *"
          filters:
            branches:
              only:
                - main
    jobs:
      - xtask:
          name: Lint (Nightly)
          matrix:
            parameters:
              platform: [ volta ]
              rust_channel: [ stable ]
              command: [ lint ]
              options:
                - |
                  --force
      - notify_slack:
          name: Send Slack Notification (On Failure)
          requires:
            - Lint (Nightly)

jobs:
  xtask:
    parameters:
      rust_channel:
        type: enum
        enum: [ "stable", "nightly" ]
        default: stable
      platform:
        type: executor
      command:
        type: enum
        enum: [ lint, test, package, security-checks ]
      options:
        type: string
        default: ""
    executor: << parameters.platform >>
    steps:
      - setup:
          rust_channel: << parameters.rust_channel >>
          platform: << parameters.platform >>
      - when:
          condition:
            equal: [ "security-checks", << parameters.command >> ]
          steps:
            - run: cargo install --locked --version 0.14.21 cargo-deny
      - when:
          condition:
            and:
              # this wouldn't _have_ to be the macos executor, we just need
              # to copy the schema exactly one time and not worry about it
              # in other instances
              - equal: [ *amd_macos_executor, << parameters.platform >> ]
              - equal: [ "package", << parameters.command >> ]
          steps:
            - exec_xtask:
                platform: << parameters.platform >>
                command: << parameters.command >>
                options: << parameters.options >> --copy-schema
      - unless:
          condition:
            and:
              - equal: [ *amd_macos_executor, << parameters.platform >> ]
              - equal: [ "package", << parameters.command >> ]
          steps:
            - exec_xtask:
                platform: << parameters.platform >>
                command: << parameters.command >>
                options: << parameters.options >>

  publish_release:
    parameters:
      platform:
        type: executor
    executor: << parameters.platform >>
    steps:
      - setup:
          platform: << parameters.platform >>
          rust_channel: stable
      - attach_workspace:
          at: artifacts
      - gh/setup
      - compute_checksums
      - gh_release
      - npm_publish

  install_js:
    parameters:
      package_manager:
        type: enum
        enum: [ "npm", "npm_global", "pnpm" ]
      platform:
        type: enum
        enum: [ "nix", "windows" ]
    executor: node_js_<<parameters.platform>>
    steps:
      - checkout:
          path: "rover"
      - when:
          condition:
            equal: [ "nix", <<parameters.platform>> ]
          steps:
            - run:
                name: "Invoke Install Scripts (Unix)"
                command: |
                  cd rover/.circleci/scripts/<<parameters.platform>>
                  ./install_<< parameters.package_manager >>.sh
      - when:
          condition:
            equal: [ "windows", <<parameters.platform>> ]
          steps:
            - run:
                name: "Invoke Install Scripts (Windows)"
                command: |
                  Write-Output "Installing Volta"
                  choco install volta
                  refreshenv
                  Write-Output "Installing Node & NPM"
                  volta install node@20.17.0
                  Write-Output "Checking Node & NPM version"
                  node --version
                  npm --version
                  
                  $script_location=Join-Path rover\.circleci\scripts << parameters.platform >>
                  Set-Location $script_location
                  .\install_<< parameters.package_manager >>.ps1

  notify_slack:
    executor: arm_ubuntu
    steps:
      - slack/notify:
          event: fail
          channel: $LINT_ALERT_CHANNEL
          custom: |
            {
              blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "Nightly lint of `rover` docs has failed. To investigate see linter run here: $CIRCLE_BUILD_URL"
                  }
                }
              ]
            }


# reusable command snippets can be referred to in any `steps` object
commands:
  setup:
    parameters:
      rust_channel:
        type: enum
        enum: ["stable", "nightly"]
        default: stable
      platform:
        type: executor
    steps:
      - install_system_deps:
          platform: << parameters.platform >>
      - checkout:
          directory: "rover"
      - install_rust_toolchain:
          platform: << parameters.platform >>
          rust_channel: << parameters.rust_channel >>
  install_system_deps:
    parameters:
      platform:
        type: executor
    steps:
      - when:
          condition:
            or:
              - equal: [*arm_ubuntu_executor, << parameters.platform >>]
              - equal: [*amd_musl_executor, << parameters.platform >>]
              - equal: [*volta_executor, << parameters.platform >>]
          steps:
            - run:
                name: Update apt repositories
                command: sudo apt-get update
            - run:
                name: Check glibc version
                command: ldd --version
            - run:
                name: Install OpenSSL
                command: sudo apt-get install -y libssl-dev

      - when:
          condition:
            equal: [*amd_manylinux_executor, << parameters.platform >>]
          steps:
            - run:
                name: Update and upgrade yum packages
                command: yum -y update && yum -y upgrade
            - run:
                name: Install development tools
                command: yum groupinstall -y "Development Tools"
            - run:
                name: Install gcc, OpenSSL, and git
                command: yum -y install perl-core gcc openssl-devel openssl git
            - run:
                name: Check glibc version
                command: ldd --version

      - when:
          condition:
              equal: [*amd_musl_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install musl-tools and bash
                command: sudo apt-get install -y musl-tools bash

      - when:
          condition:
            or:
              - equal: [*amd_windows_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install cmake & nasm
                command: choco install cmake nasm

      - when:
          condition:
            or:
              - equal: [*amd_macos_executor, << parameters.platform >>]
              - equal: [*arm_macos_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install OpenSSL
                command: brew install openssl@3
            - run:
                name: Install p7zip
                command: brew install p7zip
            - run:
                name: Install curl
                # we need to override the system curl because of outdated CA certificates
                # on the base macos image
                command: |
                  brew install curl
                  echo 'export PATH="/usr/local/opt/curl/bin:$PATH"' >> $BASH_ENV
            - run:
                name: Install Rosetta 2
                command: |
                  if [ "$(uname -m)" = "arm64" ]; then
                    /usr/sbin/softwareupdate --install-rosetta --agree-to-license
                  else
                    echo "Rosetta 2 can only be installed on Apple Silicon!"
                    exit 1
                  fi

      - install_volta:
          platform: << parameters.platform >>

  install_volta:
    parameters:
      platform:
        type: executor
    steps:
      - unless:
          condition:
            or:
              - equal: [*amd_windows_executor, << parameters.platform >>]
              - equal: [*arm_ubuntu_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install volta
                command: |
                  curl https://get.volta.sh | bash -s -- --skip-setup
                  echo 'export VOLTA_HOME=$HOME/.volta' >> $BASH_ENV
                  echo 'export PATH=$VOLTA_HOME/bin:$PATH' >> $BASH_ENV

      - when:
          condition:
            equal: [*amd_windows_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install volta
                command: |
                  choco install volta -y

      - unless:
          condition:
            equal: [*arm_ubuntu_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install default versions of npm and node
                command: |
                  volta install node@16
                  volta install npm@7

  install_rust_toolchain:
    parameters:
      rust_channel:
        type: enum
        enum: ["stable", "nightly"]
      platform:
        type: executor
    steps:
      - restore_cache:
          keys:
            - rust-<< pipeline.parameters.cache_version >>-<< parameters.platform >>-{{ checksum "Cargo.lock" }}
            - rust-<< pipeline.parameters.cache_version >>-<< parameters.platform >>
      - unless:
          condition:
            equal: [*amd_windows_executor, << parameters.platform >>]
          steps:
            - rust/install:
                version: << parameters.rust_channel >>
            - run:
                name: Install specific rust toolchain
                command: rustup target add $XTASK_TARGET
            - run:
                name: Unset rustup override
                command: rustup override unset
      - when:
          condition:
            equal: [*amd_windows_executor, << parameters.platform >>]

          steps:
            - run:
                name: Install rustup
                environment:
                  # Override auto-detection of RAM for rustc install.
                  # https://github.com/rust-lang/rustup/issues/2229#issuecomment-585855925
                  RUSTUP_UNPACK_RAM: "21474836480"
                command: |
                  $installer_dir = "$Env:TEMP"
                  echo "Downloading rustup"
                  (New-Object System.Net.WebClient).DownloadFile("https://win.rustup.rs/x86_64", "$installer_dir\rustup-init.exe")
                  echo "Installing rustup"
                  & $installer_dir\rustup-init.exe --profile minimal -y
                  exit $LASTEXITCODE
            - run:
                name: Configure cargo for Windows
                command: |
                  Set-Content -path "${Env:USERPROFILE}\.cargo\config.toml" @"
                  [net]
                  git-fetch-with-cli = true
                  "@

  exec_xtask:
    parameters:
      command:
        type: enum
        enum: [lint, test, package, security-checks]
      options:
        type: string
      platform:
        type: executor
    steps:
      - run:
          command: |
            cargo xtask << parameters.command >> << parameters.options >>

      - unless:
          condition:
            equal: [*amd_windows_executor, << parameters.platform >>]
          steps:
            - save_cache:
                key: rust-<< pipeline.parameters.cache_version >>-<< parameters.platform >>-{{ checksum "Cargo.lock" }}-{{ checksum "rust-toolchain.toml" }}
                paths:
                  - ~/.cargo/

      - when:
          condition:
            equal: [*amd_windows_executor, << parameters.platform >>]
          steps:
            - save_cache:
                key: rust-<< pipeline.parameters.cache_version >>-<< parameters.platform >>-{{ checksum "Cargo.lock" }}-{{ checksum "rust-toolchain.toml" }}
                paths:
                  - C:\\Users\\circleci\.cargo

      - when:
          condition:
            equal: [package, << parameters.command >>]
          steps:
            - persist_to_workspace:
                root: artifacts
                paths:
                  - "*"
  gh_release:
    steps:
      - unless:
          condition: << pipeline.git.tag >>
          steps:
            - run:
                command: >
                  mkdir -p artifacts && cd artifacts && echo "this release is part of a test, please ignore." >> this_is_a_fake_release.txt
            - exec_gh_release:
                release_tag: << pipeline.git.branch >>
                extra_options: "--draft"
      - when:
          condition: << pipeline.git.tag >>
          steps:
            - exec_gh_release

  exec_gh_release:
    parameters:
      release_tag:
        type: string
        default: << pipeline.git.tag >>
      extra_options:
        type: string
        default: ""
    steps:
      - when:
          condition:
            <<: *tag_matches_prerelease
          steps:
            - run:
                name: Create GitHub prerelease
                command: |
                  gh release create << parameters.release_tag >> \
                  --prerelease \
                  --title << parameters.release_tag >> \
                  << parameters.extra_options >> \
                  --notes '<!-- changelog -->
                  ---
                  This release was automatically created by [CircleCI](./.circleci/config.yml).

                  If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.

                  Binaries built for MacOS are signed, notarized, and automatically verified with [Gatekeeper](https://support.apple.com/guide/deployment-reference-macos/using-gatekeeper-apd02b925e38/web).' \
                  artifacts/*
      - unless:
          condition:
            <<: *tag_matches_prerelease
          steps:
            - run:
                name: Create GitHub release
                command: |
                  gh release create << parameters.release_tag >> \
                  --title << parameters.release_tag >> \
                  << parameters.extra_options >> \
                  --notes '<!-- changelog -->
                  ---
                  This release was automatically created by [CircleCI](./.circleci/config.yml).

                  If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.

                  Binaries built for MacOS are signed, notarized, and automatically verified with [Gatekeeper](https://support.apple.com/guide/deployment-reference-macos/using-gatekeeper-apd02b925e38/web).' \
                  artifacts/*
  compute_checksums:
    steps:
      - run:
          name: Compute SHA256 checksums
          command: >
            cd artifacts && sha256sum *.tar.gz > sha256sums.txt
      - run:
          name: Compute md5 checksums
          command: >
            cd artifacts && md5sum *.tar.gz > md5sums.txt
      - run:
          name: Compute SHA1 checksums
          command: >
            cd artifacts && sha1sum *.tar.gz > sha1sums.txt
  npm_publish:
    steps:
      - unless:
          condition: << pipeline.git.tag >>
          steps:
            - exec_npm_publish:
                options: "--dry-run"
                release_tag: << pipeline.git.branch >>
      - when:
          condition: << pipeline.git.tag >>
          steps:
            - exec_npm_publish

  exec_npm_publish:
    parameters:
      options:
        type: string
        default: ""
      npm_dir:
        type: string
        default: "./installers/npm"
      release_tag:
        type: string
        default: << pipeline.git.tag >>
    steps:
      - run:
          name: Create .npmrc for publishing
          command: |
            cat \<<'EOF' > ~/.npmrc
            //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
            EOF
      - unless:
          condition:
            <<: *tag_matches_prerelease
          steps:
            - run:
                name: Publish to npm (stable)
                command: cd << parameters.npm_dir >> && npm publish << parameters.options >>
      - when:
          condition:
            <<: *tag_matches_prerelease
          steps:
            - run:
                name: Publish to npm (beta)
                command: cd << parameters.npm_dir >> && npm publish --tag beta << parameters.options >>