ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions: {}

# The exact version the project was verified against. `latest` would let a Bun release change
# bundling or resolution behaviour without a line of this repository changing.
env:
  BUN_VERSION: 1.3.14

jobs:
  check:
    name: Types, lint and tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7.0.1

      - uses: oven-sh/setup-bun@v2.2.0
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Dependencies are pinned to exact versions
        run: bun run scripts/check-pins.ts

      - name: Generate embedded assets
        run: bun run build:assets

      - name: Type check
        run: bunx tsc --noEmit

      - name: Lint and format check
        run: bunx biome ci .

      - name: Install Chromium for the browser tests
        run: bunx playwright install --with-deps chromium

      - name: Test
        run: bun run test

      - name: Test the compiled binary
        # Its own step, not the same process: `bun test` shares one process across all files, and a
        # ~100 MiB compile alongside the tests that spawn a CLI starves them into their timeouts.
        env:
          MAT_BUILD_TEST: '1'
          MAT_CROSS_COMPILE_TEST: '1'
        run: bun test tests/build.test.ts

  notices:
    name: Third-party notices
    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && vars.BFS_APP_BOT_CLIENT_ID != ''
    runs-on: ubuntu-latest
    permissions:
      contents: read
    concurrency:
      group: notices-${{ github.head_ref }}
      cancel-in-progress: true
    steps:
      - name: Mint a token for the notices commit
        id: app-token
        uses: actions/create-github-app-token@v3.2.0
        with:
          client-id: ${{ vars.BFS_APP_BOT_CLIENT_ID }}
          private-key: ${{ secrets.BFS_APP_BOT_PRIVATE_KEY }}
          permission-contents: write

      - uses: actions/checkout@v7.0.1
        with:
          ref: ${{ github.head_ref }}
          token: ${{ steps.app-token.outputs.token }}

      - uses: oven-sh/setup-bun@v2.2.0
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Regenerate the notices
        run: bun run notices

      - name: Commit and push when changed
        run: |
          if git diff --quiet THIRD-PARTY-NOTICES.md; then
            exit 0
          fi
          git config user.name "${{ steps.app-token.outputs.app-slug }}[bot]"
          git config user.email "${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com"
          git add THIRD-PARTY-NOTICES.md
          git commit -m "chore: update third-party notices"
          git push

  build:
    name: ${{ matrix.triple }}
    needs: check
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          # Every target is built *and executed* on its own platform. Cross-compiling the
          # non-darwin targets from one Linux runner is faster, but then nothing ever runs the
          # artefact that ships. darwin has no choice in the matter: `bun build --compile` produces
          # binaries that fail `codesign -v` and die with `Killed: 9` on Apple Silicon unless they
          # are built natively and ad-hoc signed on the spot (oven-sh/bun#32159).
          - { runner: ubuntu-latest, triple: bun-linux-x64, binary: mat-linux-x64 }
          - { runner: ubuntu-24.04-arm, triple: bun-linux-arm64, binary: mat-linux-arm64 }
          - { runner: windows-latest, triple: bun-windows-x64, binary: mat-windows-x64.exe }
          - { runner: macos-latest, triple: bun-darwin-arm64, binary: mat-darwin-arm64 }
    steps:
      - uses: actions/checkout@v7.0.1

      - uses: oven-sh/setup-bun@v2.2.0
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - name: Cache the compile target
        uses: actions/cache@v6.1.0
        with:
          # `bun build --compile` downloads the runtime for the target on first use.
          path: ~/.bun/install/cache
          key: bun-target-${{ matrix.triple }}-${{ env.BUN_VERSION }}

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build
        run: bun run build:assets && bun run scripts/build.ts --target=${{ matrix.triple }}

      - name: Sign
        if: startsWith(matrix.runner, 'macos')
        # Ad-hoc signature. Without it the binary fails `codesign -v` and Gatekeeper kills it.
        run: |
          codesign --force --sign - dist/${{ matrix.binary }}
          codesign --verify --verbose dist/${{ matrix.binary }}

      - name: Run it
        shell: bash
        run: |
          ./dist/${{ matrix.binary }} --version
          ./dist/${{ matrix.binary }} tests/fixtures/torture.md --output - > /dev/null

      - uses: actions/upload-artifact@v7.0.1
        # Only on main, and only briefly. Each of these is a ~104 MiB Bun single-file binary, so
        # the four together park roughly 400 MiB per run; at the default 90-day retention a private
        # repository's Actions storage is gone within a handful of runs. What ships is built fresh
        # by the release workflow anyway — these are a debugging convenience, nothing more.
        if: github.event_name == 'push'
        with:
          name: ${{ matrix.binary }}
          path: dist/${{ matrix.binary }}
          if-no-files-found: error
          retention-days: 5