# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Build Rust Binary
description: Build, verify, package, and upload an auditable Rust binary

inputs:
  package:
    description: Cargo package that owns the binary
    required: true
  binary:
    description: Cargo binary name
    required: true
  triple:
    description: Rust target triple
    required: true
  cargo-version:
    description: Cargo package version embedded in the binary
    required: true
  image-tag:
    description: Default supervisor image tag embedded in the binary
    required: false
    default: ""
  artifact-name:
    description: GitHub artifact name
    required: false
    default: ""
  extra-cargo-flags:
    description: Additional flags passed to cargo build
    required: false
    default: ""

runs:
  using: composite
  steps:
    - name: Hash development shell
      id: dev-shell
      shell: bash
      run: |
        shell_drv=$(nix eval --raw --impure .#devShells --apply 'shells: shells.${builtins.currentSystem}.default.drvPath')
        echo "hash=$(nix hash file --type sha256 --base16 "$shell_drv")" >> "$GITHUB_OUTPUT"

    - name: Cache Rust artifacts
      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      with:
        shared-key: binaries-${{ inputs.binary }}-${{ inputs.triple }}-${{ steps.dev-shell.outputs.hash }}
        cache-on-failure: "true"
        cache-workspace-crates: "true"
        cache-bin: "false"
        cmd-format: nix develop -c {0}

    - name: Set version
      shell: nix develop -c bash -euo pipefail {0}
      env:
        INPUTS_CARGO_VERSION: ${{ inputs.cargo-version }}
      run: sed -i "s/^version = \"0\\.0\\.0\"$/version = \"${INPUTS_CARGO_VERSION}\"/" Cargo.toml

    - name: Build ${{ inputs.binary }}
      shell: nix develop -c bash -euo pipefail {0}
      env:
        GIT_DIR: /nonexistent
        OPENSHELL_IMAGE_TAG: ${{ inputs.image-tag }}
        INPUTS_PACKAGE: ${{ inputs.package }}
        INPUTS_BINARY: ${{ inputs.binary }}
        INPUTS_TRIPLE: ${{ inputs.triple }}
        INPUTS_EXTRA_CARGO_FLAGS: ${{ inputs.extra-cargo-flags }}
      run: cargo auditable build --release --target "${INPUTS_TRIPLE}" --package "${INPUTS_PACKAGE}" --bin "${INPUTS_BINARY}" ${INPUTS_EXTRA_CARGO_FLAGS}

    - name: Verify ${{ inputs.binary }}
      shell: nix develop -c bash -euo pipefail {0}
      env:
        INPUTS_BINARY: ${{ inputs.binary }}
        INPUTS_TRIPLE: ${{ inputs.triple }}
      run: |
        # Confirm the binary runs and reports the expected name.
        target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY} --version | grep -q "^${INPUTS_BINARY} "
        # Confirm Syft can decode the embedded cargo-auditable metadata.
        SYFT_CHECK_FOR_APP_UPDATE=false syft file:target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY} -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null

    - name: Upload ${{ inputs.binary }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
      with:
        name: ${{ inputs.artifact-name || format('{0}-{1}', inputs.binary, inputs.triple) }}
        path: target/${{ inputs.triple }}/release/${{ inputs.binary }}
        compression-level: 0
        retention-days: 5
        if-no-files-found: error