config.yml

version: 2.1

# Our CircleCI dependencies
orbs:
  rust: circleci/rust@1.6.1
  gh: circleci/github-cli@2.3.0
  node: circleci/node@5.2.0
  secops: apollo/circleci-secops-orb@2.0.7

# These filters are used in all of the jobs for our release workflow
run_release: &run_release
  filters:
    branches:
      ignore: /.*/
    tags:
      only: /v.*/

# You can uncomment the following alias, and comment the above alias when testing,
# just make sure to update the branch name to the one you're testing on so they run.
# You can bypass the tests if you don't update those steps.
#
# run_release: &run_release
#   filters:
#     branches:
#       only: /avery/test-release-process/
#     tags:
#       ignore: /.*/

# The machines we use to run our workflows on
executors:
  amd_manylinux: &amd_manylinux_executor
    docker:
      # This image is used for building Python Wheels but it has what we need for Rust compilation and crucially
      # glibc 2.17.
      - image:  quay.io/pypa/manylinux2014_x86_64:2024.07.02-0
    resource_class: xlarge
    environment:
      XTASK_TARGET: "x86_64-unknown-linux-gnu"
      CHECK_GLIBC: "true"
      LATEST_FED_VERSION_JSON_KEY: "latest-2"


  arm_ubuntu: &arm_ubuntu_executor
    machine:
      image: ubuntu-2004:2022.04.1
    resource_class: arm.large
    environment:
      XTASK_TARGET: "aarch64-unknown-linux-gnu"
      CHECK_GLIBC: "true"
      LATEST_FED_VERSION_JSON_KEY: "latest-2"

  amd_musl: &amd_musl_executor
    docker:
      - image: cimg/base:stable
    resource_class: xlarge
    environment:
      XTASK_TARGET: "x86_64-unknown-linux-musl"
      LATEST_FED_VERSION_JSON_KEY: "latest-2"

  amd_macos: &amd_macos_executor
    macos:
      xcode: "14.2"
    resource_class: macos.m1.large.gen1
    environment:
      XTASK_TARGET: "x86_64-apple-darwin"
      APPLE_TEAM_ID: "YQK948L752"
      APPLE_USERNAME: "opensource@apollographql.com"

  # this is the exact same executor as amd_macos_executor (except $XTASK_TARGET)
  # until there is official support for building on real ARM Macs
  arm_macos: &arm_macos_executor
    macos:
      xcode: "14.2"
    resource_class: macos.m1.large.gen1
    environment:
      XTASK_TARGET: "aarch64-apple-darwin"
      APPLE_TEAM_ID: "YQK948L752"
      APPLE_USERNAME: "opensource@apollographql.com"
      LATEST_FED_VERSION_JSON_KEY: "latest-2"

  amd_windows: &amd_windows_executor
    machine:
      image: "windows-server-2019-vs2019:2022.08.1"
    resource_class: windows.xlarge
    shell: powershell.exe -ExecutionPolicy Bypass
    environment:
      XTASK_TARGET: "x86_64-pc-windows-msvc"
      LATEST_FED_VERSION_JSON_KEY: "latest-2"

  # This is only used to run supergraph-demo since you can't run Docker from Docker
  amd_ubuntu: &amd_ubuntu_executor
    machine:
      image: ubuntu-2004:2022.04.1
    resource_class: xlarge
    environment:
      XTASK_TARGET: "x86_64-unknown-linux-gnu"
      CAN_RUN_DOCKER: "true"

  # This is used for any xtask command that needs volta installed
  volta: &volta_executor
    docker:
      - image: cimg/base:stable
    resource_class: medium
    environment:
      XTASK_TARGET: "x86_64-unknown-linux-gnu"

  node_js:
    docker:
      - image: node:lts
    resource_class: medium


tag_matches_prerelease: &tag_matches_prerelease
  matches:
    pattern: "^.*(beta|alpha|rc|prerelease|draft|test).*$"
    value: << parameters.release_tag >>

# reusable parameters that can be used across jobs and workflows
parameters:
  cache_version:
    type: string
    # increment this version to invalidate all caches
    default: v2.{{ checksum "rust-toolchain.toml" }}

# The main workflows executed for Rover
workflows:
  lint:
    jobs:
      - xtask:
          name: Lint
          matrix:
            parameters:
              platform: [volta]
              rust_channel: [stable]
              command: [lint]
  security_checks:
    jobs:
      - xtask:
          name: Security Checks
          platform: amd_ubuntu
          rust_channel: stable
          command: security-checks
  test:
    jobs:
      - xtask:
          name: Run cargo tests + studio integration tests (<< matrix.rust_channel >> rust on << matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_manylinux, amd_musl, arm_macos, amd_windows]
              rust_channel: [stable]
              command: [test]

      - xtask:
          name: Run studio integration tests in GitHub Actions (amd_macos)
          context:
            - github-orb
          matrix:
            parameters:
              platform: [amd_ubuntu]
              rust_channel: [stable]
              command: [github-actions]
              options: 
              - |
                --workflow-name 'tests-mac-x86.yml' --branch "<< pipeline.git.branch >>" --commit-id "<< pipeline.git.revision >>"

      - xtask:
          name: Run supergraph-demo tests (<< matrix.rust_channel >> rust on << matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_ubuntu]
              rust_channel: [stable]
              command: [integration-test]
      - install_js:
          name: Test installation for Javascript Package Managers (<< matrix.package_manager >>)
          matrix:
            parameters:
              package_manager: [npm, npm_global, pnpm]
      - node/test:
          name: Test NPM Installer Scripts
          app-dir: "~/project/installers/npm"
          test-results-for: jest
          override-ci-command: npm install --ignore-scripts

  release:
    jobs:
      - xtask:
          name: Run cargo tests + studio integration tests (<< matrix.rust_channel >> rust on << matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_manylinux, amd_musl, arm_macos, amd_windows]
              rust_channel: [stable]
              command: [test]
          <<: *run_release

      - xtask:
          name: Run supergraph-demo tests (<< matrix.rust_channel >> rust on << matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_ubuntu]
              rust_channel: [stable]
              command: [integration-test]
          <<: *run_release

      - xtask:
          name: Run studio integration tests in GitHub Actions (amd_macos)
          context:
            - github-orb
          matrix:
            parameters:
              platform: [ amd_ubuntu ]
              rust_channel: [ stable ]
              command: [ github-actions ]
              options:
                - |
                  --workflow-name 'tests-mac-x86.yml' --branch "<< pipeline.git.branch >>" --commit-id "<< pipeline.git.revision >>"
          <<: *run_release

      - install_js:
          name: Test installation for Javascript Package Managers (<< matrix.package_manager >>)
          matrix:
            parameters:
              package_manager: [ npm, npm_global, pnpm ]
          <<: *run_release

      - node/test:
          name: Test NPM Installer Scripts
          app-dir: "~/project/installers/npm"
          test-results-for: jest
          override-ci-command: npm install --ignore-scripts
          <<: *run_release

      - xtask:
          name: Build and bundle release artifacts (<< matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_manylinux, amd_musl, arm_ubuntu, amd_macos, arm_macos, amd_windows]
              rust_channel: [stable]
              command: [package]
              options: ["--rebuild"]
          requires:
            - "Run cargo tests + studio integration tests (stable rust on amd_manylinux)"
            - "Run cargo tests + studio integration tests (stable rust on amd_musl)"
            - "Run cargo tests + studio integration tests (stable rust on arm_macos)"
            - "Run cargo tests + studio integration tests (stable rust on amd_windows)"
            - "Run studio integration tests in GitHub Actions (amd_macos)"
            - "Run supergraph-demo tests (stable rust on amd_ubuntu)"
            - "Test installation for Javascript Package Managers (npm)"
            - "Test installation for Javascript Package Managers (npm_global)"
            - "Test installation for Javascript Package Managers (pnpm)"
            - "Test NPM Installer Scripts"
          <<: *run_release

      - publish_release:
          name: Publish GitHub release and release to npm
          matrix:
            parameters:
              platform: [volta]
          requires:
            - "Build and bundle release artifacts (amd_manylinux)"
            - "Build and bundle release artifacts (arm_ubuntu)"
            - "Build and bundle release artifacts (amd_musl)"
            - "Build and bundle release artifacts (amd_macos)"
            - "Build and bundle release artifacts (arm_macos)"
            - "Build and bundle release artifacts (amd_windows)"
          <<: *run_release
  security-scans:
    jobs:
      - secops/gitleaks:
          context:
            - platform-docker-ro
            - github-orb
            - secops-oidc
          git-base-revision: <<#pipeline.git.base_revision>><<pipeline.git.base_revision>><</pipeline.git.base_revision >>
          git-revision: << pipeline.git.revision >>

      - secops/semgrep:
          context:
            - secops-oidc
            - github-orb
          git-base-revision: <<#pipeline.git.base_revision>><<pipeline.git.base_revision>><</pipeline.git.base_revision >>
jobs:
  xtask:
    parameters:
      rust_channel:
        type: enum
        enum: ["stable", "nightly"]
        default: stable
      platform:
        type: executor
      command:
        type: enum
        enum: [lint, unit-test, integration-test, test, package, security-checks, github-actions]
      options:
        type: string
        default: ""
    executor: << parameters.platform >>
    steps:
      - setup:
          rust_channel: << parameters.rust_channel >>
          platform: << parameters.platform >>
      - when:
          condition:
            equal: ["security-checks", << parameters.command >>]
          steps:
            - run: cargo install --locked --version 0.14.21 cargo-deny
      - when:
          condition:
            and:
              # this wouldn't _have_ to be the macos executor, we just need
              # to copy the schema exactly one time and not worry about it
              # in other instances
              - equal: [*amd_macos_executor, << parameters.platform >>]
              - equal: ["package", << parameters.command >>]
          steps:
            - exec_xtask:
                platform: << parameters.platform >>
                command: << parameters.command >>
                options: << parameters.options >> --copy-schema
      - unless:
          condition:
            and:
              - equal: [*amd_macos_executor, << parameters.platform >>]
              - equal: ["package", << parameters.command >>]
          steps:
            - exec_xtask:
                platform: << parameters.platform >>
                command: << parameters.command >>
                options: << parameters.options >>

  publish_release:
    parameters:
      platform:
        type: executor
    executor: << parameters.platform >>
    steps:
      - setup:
          platform: << parameters.platform >>
          rust_channel: stable
      - attach_workspace:
          at: artifacts
      - gh/setup
      - compute_checksums
      - gh_release
      - npm_publish

  install_js:
    parameters:
      package_manager:
        type: enum
        enum: ["npm", "npm_global", "pnpm"]
    executor: node_js
    steps:
      - checkout:
          path: "rover"
      - run:
          name: "Invoke Install Scripts"
          command: |
            cd rover/.circleci/scripts
            ./install_<< parameters.package_manager >>.sh

# reusable command snippets can be referred to in any `steps` object
commands:
  setup:
    parameters:
      rust_channel:
        type: enum
        enum: ["stable", "nightly"]
        default: stable
      platform:
        type: executor
    steps:
      - install_system_deps:
          platform: << parameters.platform >>
      - checkout:
          directory: "rover"
      - install_rust_toolchain:
          platform: << parameters.platform >>
          rust_channel: << parameters.rust_channel >>
  install_system_deps:
    parameters:
      platform:
        type: executor
    steps:
      - when:
          condition:
            or:
              - equal: [*amd_ubuntu_executor, << parameters.platform >>]
              - equal: [*arm_ubuntu_executor, << parameters.platform >>]
              - equal: [*amd_musl_executor, << parameters.platform >>]
              - equal: [*volta_executor, << parameters.platform >>]
          steps:
            - run:
                name: Update apt repositories
                command: sudo apt-get update
            - run:
                name: Check glibc version
                command: ldd --version
            - run:
                name: Install OpenSSL
                command: sudo apt-get install -y libssl-dev

      - when:
          condition:
            equal: [*amd_manylinux_executor, << parameters.platform >>]
          steps:
            - run:
                name: Update and upgrade yum packages
                command: yum -y update && yum -y upgrade
            - run:
                name: Install development tools
                command: yum groupinstall -y "Development Tools"
            - run:
                name: Install gcc, OpenSSL, and git
                command: yum -y install perl-core gcc openssl-devel openssl git
            - run:
                name: Check glibc version
                command: ldd --version

      - when:
          condition:
              equal: [*amd_musl_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install musl-tools and bash
                command: sudo apt-get install -y musl-tools bash

      - when:
          condition:
            or:
              - equal: [*amd_macos_executor, << parameters.platform >>]
              - equal: [*arm_macos_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install OpenSSL@1.1
                command: brew install openssl@1.1
            - run:
                name: Install p7zip
                command: brew install p7zip
            - run:
                name: Install curl
                # we need to override the system curl because of outdated CA certificates
                # on the base macos image
                command: |
                  brew install curl
                  echo 'export PATH="/usr/local/opt/curl/bin:$PATH"' >> $BASH_ENV
            - run:
                name: Install Rosetta 2
                command: |
                  if [ "$(uname -m)" = "arm64" ]; then
                    /usr/sbin/softwareupdate --install-rosetta --agree-to-license
                  else
                    echo "Rosetta 2 can only be installed on Apple Silicon!"
                    exit 1
                  fi

      - install_volta:
          platform: << parameters.platform >>

  install_volta:
    parameters:
      platform:
        type: executor
    steps:
      - unless:
          condition:
            or:
              - equal: [*amd_windows_executor, << parameters.platform >>]
              - equal: [*arm_ubuntu_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install volta
                command: |
                  curl https://get.volta.sh | bash -s -- --skip-setup
                  echo 'export VOLTA_HOME=$HOME/.volta' >> $BASH_ENV
                  echo 'export PATH=$VOLTA_HOME/bin:$PATH' >> $BASH_ENV

      - when:
          condition:
            equal: [*amd_windows_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install volta
                command: |
                  choco install volta -y

      - unless:
          condition:
            equal: [*arm_ubuntu_executor, << parameters.platform >>]
          steps:
            - run:
                name: Install default versions of npm and node
                command: |
                  volta install node@16
                  volta install npm@7

  install_rust_toolchain:
    parameters:
      rust_channel:
        type: enum
        enum: ["stable", "nightly"]
      platform:
        type: executor
    steps:
      - restore_cache:
          keys:
            - rust-<< pipeline.parameters.cache_version >>-<< parameters.platform >>-{{ checksum "Cargo.lock" }}
            - rust-<< pipeline.parameters.cache_version >>-<< parameters.platform >>
      - unless:
          condition:
            equal: [*amd_windows_executor, << parameters.platform >>]
          steps:
            - rust/install:
                version: << parameters.rust_channel >>
            - run:
                name: Install specific rust toolchain
                command: rustup target add $XTASK_TARGET
            - run:
                name: Unset rustup override
                command: rustup override unset
      - when:
          condition:
            equal: [*amd_windows_executor, << parameters.platform >>]

          steps:
            - run:
                name: Install rustup
                environment:
                  # Override auto-detection of RAM for rustc install.
                  # https://github.com/rust-lang/rustup/issues/2229#issuecomment-585855925
                  RUSTUP_UNPACK_RAM: "21474836480"
                command: |
                  $installer_dir = "$Env:TEMP"
                  echo "Downloading rustup"
                  (New-Object System.Net.WebClient).DownloadFile("https://win.rustup.rs/x86_64", "$installer_dir\rustup-init.exe")
                  echo "Installing rustup"
                  & $installer_dir\rustup-init.exe --profile minimal -y
                  exit $LASTEXITCODE
            - run:
                name: Configure cargo for Windows
                command: |
                  Set-Content -path "${Env:USERPROFILE}\.cargo\config.toml" @"
                  [net]
                  git-fetch-with-cli = true
                  "@

  exec_xtask:
    parameters:
      command:
        type: enum
        enum: [lint, integration-test, unit-test, test, package, security-checks, github-actions]
      options:
        type: string
      platform:
        type: executor
    steps:
      - run:
          command: |
            export GITHUB_ACTIONS_TOKEN="$(echo "$GH_BOT_KEY_B64" | base64 -d)"
            curl -L \
              -H "Accept: application/vnd.github+json" \
              -H "Authorization: Bearer $GITHUB_ACTIONS_TOKEN" \
              -H "X-GitHub-Api-Version: 2022-11-28" \
              https://api.github.com/user
            cargo xtask << parameters.command >> << parameters.options >>

      - unless:
          condition:
            equal: [*amd_windows_executor, << parameters.platform >>]
          steps:
            - save_cache:
                key: rust-<< pipeline.parameters.cache_version >>-<< parameters.platform >>-{{ checksum "Cargo.lock" }}-{{ checksum "rust-toolchain.toml" }}
                paths:
                  - ~/.cargo/

      - when:
          condition:
            equal: [*amd_windows_executor, << parameters.platform >>]
          steps:
            - save_cache:
                key: rust-<< pipeline.parameters.cache_version >>-<< parameters.platform >>-{{ checksum "Cargo.lock" }}-{{ checksum "rust-toolchain.toml" }}
                paths:
                  - C:\\Users\\circleci\.cargo

      - when:
          condition:
            equal: [package, << parameters.command >>]
          steps:
            - persist_to_workspace:
                root: artifacts
                paths:
                  - "*"
  gh_release:
    steps:
      - unless:
          condition: << pipeline.git.tag >>
          steps:
            - run:
                command: >
                  mkdir -p artifacts && cd artifacts && echo "this release is part of a test, please ignore." >> this_is_a_fake_release.txt
            - exec_gh_release:
                release_tag: << pipeline.git.branch >>
                extra_options: "--draft"
      - when:
          condition: << pipeline.git.tag >>
          steps:
            - exec_gh_release

  exec_gh_release:
    parameters:
      release_tag:
        type: string
        default: << pipeline.git.tag >>
      extra_options:
        type: string
        default: ""
    steps:
      - when:
          condition:
            <<: *tag_matches_prerelease
          steps:
            - run:
                name: Create GitHub prerelease
                command: |
                  gh release create << parameters.release_tag >> \
                  --prerelease \
                  --title << parameters.release_tag >> \
                  << parameters.extra_options >> \
                  --notes '<!-- changelog -->
                  ---
                  This release was automatically created by [CircleCI](./.circleci/config.yml).

                  If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.

                  Binaries built for MacOS are signed, notarized, and automatically verified with [Gatekeeper](https://support.apple.com/guide/deployment-reference-macos/using-gatekeeper-apd02b925e38/web).' \
                  artifacts/*
      - unless:
          condition:
            <<: *tag_matches_prerelease
          steps:
            - run:
                name: Create GitHub release
                command: |
                  gh release create << parameters.release_tag >> \
                  --title << parameters.release_tag >> \
                  << parameters.extra_options >> \
                  --notes '<!-- changelog -->
                  ---
                  This release was automatically created by [CircleCI](./.circleci/config.yml).

                  If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.

                  Binaries built for MacOS are signed, notarized, and automatically verified with [Gatekeeper](https://support.apple.com/guide/deployment-reference-macos/using-gatekeeper-apd02b925e38/web).' \
                  artifacts/*
  compute_checksums:
    steps:
      - run:
          name: Compute SHA256 checksums
          command: >
            cd artifacts && sha256sum *.tar.gz > sha256sums.txt
      - run:
          name: Compute md5 checksums
          command: >
            cd artifacts && md5sum *.tar.gz > md5sums.txt
      - run:
          name: Compute SHA1 checksums
          command: >
            cd artifacts && sha1sum *.tar.gz > sha1sums.txt
  npm_publish:
    steps:
      - unless:
          condition: << pipeline.git.tag >>
          steps:
            - exec_npm_publish:
                options: "--dry-run"
                release_tag: << pipeline.git.branch >>
      - when:
          condition: << pipeline.git.tag >>
          steps:
            - exec_npm_publish

  exec_npm_publish:
    parameters:
      options:
        type: string
        default: ""
      npm_dir:
        type: string
        default: "./installers/npm"
      release_tag:
        type: string
        default: << pipeline.git.tag >>
    steps:
      - run:
          name: Create .npmrc for publishing
          command: |
            cat \<<'EOF' > ~/.npmrc
            //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
            EOF
      - unless:
          condition:
            <<: *tag_matches_prerelease
          steps:
            - run:
                name: Publish to npm (stable)
                command: cd << parameters.npm_dir >> && npm publish << parameters.options >>
      - when:
          condition:
            <<: *tag_matches_prerelease
          steps:
            - run:
                name: Publish to npm (beta)
                command: cd << parameters.npm_dir >> && npm publish --tag beta << parameters.options >>