runtime-ci.yml

name: runtime CI

on:
  push:
    branches:
      - main
      - release/**
      
  pull_request:
    types: [opened, synchronize, reopened, closed]
    branches:
      - main
      - release/**

env:
  DOTNETRUNTIME_COMMIT: 081d220c0a773ffb7c6bea6b48727833576a65ef
  DOTNETSDK_VERSION: 10.0.100
  ADDITIONAL_BUILD_ARGS: '/p:MonoEnableAssertMessages=true /p:WasmEnableES6=true /p:WasmExceptionHandling=true'
  NBGV_VERSION: 3.9.50

concurrency: 
  group: ${{github.workflow}} - ${{github.ref}} - ${{github.event_name}}
  cancel-in-progress: true

jobs:
  ##
  ## Windows AOT Cross
  ##
  build_aot_windows_job:
    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
    runs-on: windows-latest

    strategy:
      matrix:
       BUILD_CONFIGURATION: [Release]

    steps:
    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: ${{ env.DOTNETSDK_VERSION }}

    - uses: actions/checkout@v4
      with:
        submodules: true
        fetch-depth: 0

    - name: Update variables
      run: |
        echo "BUILD_CONFIGURATION=${{ matrix.BUILD_CONFIGURATION }}" >> $env:GITHUB_ENV

    - name: Clone dotnet/runtime
      run: |
        git clone --recursive https://github.com/dotnet/runtime -c core.longpaths=true 

    - run: ./scripts/apply-patches.ps1
      name: Apply uno-specific patches
      shell: pwsh

    - name: Build Wasm Runtime
      run: |
        $env:MonoEnableAssertMessages=true # enable emsdk assert messages
        cd runtime
        .\build.cmd mono.runtime -arch wasm -os browser /p:RuntimeFlavor=Mono -c $env:BUILD_CONFIGURATION $env:ADDITIONAL_BUILD_ARGS /p:TestAssemblies=false /p:CrossBuild=false /bl:ci-artifacts\msbuild.binlog

    - name: Create NuGet Package
      run: |
        New-Item -ItemType Directory -Force -Path $env:GITHUB_WORKSPACE/nuget/tools
        New-Item -ItemType Directory -Force -Path $env:GITHUB_WORKSPACE/ci-output

        # Move cross compiler to appropriate location 
        move $env:GITHUB_WORKSPACE\runtime\artifacts\bin\mono\Browser.wasm.Release\cross $env:GITHUB_WORKSPACE/nuget/tools

        cd $env:GITHUB_WORKSPACE/nuget
        dotnet pack Uno.NETCore.App.Runtime.AOT.Cross.browser-wasm.csproj /p:OutputPath=$env:GITHUB_WORKSPACE\ci-output

    - uses: actions/upload-artifact@v4
      if: ${{ always() }}
      with:
        name: nuget-aot-windows
        path: ci-output

  ##
  ## Build Linux AOT Cross
  ##
  build_aot_linux_job:
    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
    runs-on: ubuntu-latest
    container: 'mcr.microsoft.com/dotnet/sdk:10.0-noble'

    strategy:
      matrix:
       BUILD_CONFIGURATION: [Release]

    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true
        fetch-depth: 0

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: 10.0.100

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version:  ${{ env.DOTNETSDK_VERSION }}

    - name: Install dependencies
      run: |
        set -e
        apt-get update
        apt-get install -y sudo
        sudo apt-get install -y python3-pip locales p7zip-full zip
        sudo apt-get install -y lsb-release wget software-properties-common gnupg
        sudo apt-get install -y unzip zip libc6 ninja-build \
          libtool build-essential curl git \
          libunwind8 libunwind8-dev gettext libicu-dev liblttng-ust-dev \
          libssl-dev libnuma-dev libkrb5-dev zlib1g-dev locales
        sudo locale-gen en_US.UTF-8

    - name: Install LLVM
      run: |
        set -e
        wget https://apt.llvm.org/llvm.sh
        chmod u+x llvm.sh
        sudo ./llvm.sh 18

    - name: Trust My Directory
      run: git config --global --add safe.directory /__w/Uno.DotnetRuntime.WebAssembly/Uno.DotnetRuntime.WebAssembly

    - name: Set Variable from current Commit
      run: |
        set -e
        echo "BUILD_CONFIGURATION=${{ matrix.BUILD_CONFIGURATION }}" >> $GITHUB_ENV

    - name: Clone dotnet/runtime
      run: |
        git clone --recursive https://github.com/dotnet/runtime

    - run: ./scripts/apply-patches.ps1
      name: Apply uno-specific patches
      shell: pwsh

    - name: Install cmake
      run: |
        set -e
        wget -qO- https://github.com/Kitware/CMake/releases/download/v3.27.2/cmake-3.27.2-linux-x86_64.tar.gz | \
        sudo tar --strip-components=1 -xz -C /usr/local

    - name: Build Wasm Runtime
      run: |
        set -e
        cd runtime
        ./build.sh mono.runtime -arch wasm -os browser -c $BUILD_CONFIGURATION $ADDITIONAL_BUILD_ARGS /p:TestAssemblies=false

    - name: Create NuGet Package
      run: |
        mkdir -p $GITHUB_WORKSPACE/nuget/tools
        mkdir -p $GITHUB_WORKSPACE/ci-output

        # Mark AOT generation binaries executable
        chmod -R +x $GITHUB_WORKSPACE/runtime/artifacts/bin/mono/browser.wasm.Release/cross/browser-wasm/*

        # Move cross compiler to appropriate location
        cp -R $GITHUB_WORKSPACE/runtime/artifacts/bin/mono/browser.wasm.Release/cross/browser-wasm/* $GITHUB_WORKSPACE/nuget/tools

        cd $GITHUB_WORKSPACE/nuget
        dotnet pack Uno.NETCore.App.Runtime.AOT.Cross.browser-wasm.csproj /p:OutputPath=$GITHUB_WORKSPACE/ci-output

    - uses: actions/upload-artifact@v4
      if: ${{ always() }}
      with:
        name: nuget-aot-linux
        path: ci-output

  ##
  ## Build Job
  ##
  build_linux_job:
    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
    runs-on: ubuntu-latest
    container: 'mcr.microsoft.com/dotnet/sdk:10.0-noble'

    strategy:
      matrix:
       BUILD_CONFIGURATION: [Release]
       MONO_WASM_THREADS: ['multithread', 'singlethread']

    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true
        fetch-depth: 0

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: 10.0.100

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version:  ${{ env.DOTNETSDK_VERSION }}

    - name: Install dependencies
      run: |
        set -e
        apt-get update
        apt-get install -y sudo
        sudo apt-get install -y python3-pip locales p7zip-full zip
        sudo apt-get install -y unzip zip libc6 ninja-build
        sudo apt-get install -y lsb-release wget software-properties-common gnupg
        sudo apt-get install -y unzip zip libc6 ninja-build \
          libtool build-essential curl git \
          libunwind8 libunwind8-dev gettext libicu-dev liblttng-ust-dev \
          libssl-dev libnuma-dev libkrb5-dev zlib1g-dev locales
        sudo locale-gen en_US.UTF-8

    - name: Install LLVM
      run: |
        set -e
        wget https://apt.llvm.org/llvm.sh
        chmod u+x llvm.sh
        sudo ./llvm.sh 18

    - name: Trust My Directory
      run: git config --global --add safe.directory /__w/Uno.DotnetRuntime.WebAssembly/Uno.DotnetRuntime.WebAssembly

    - name: Set Variable from current Commit
      run: |
        set -e
        echo "BUILD_CONFIGURATION=${{ matrix.BUILD_CONFIGURATION }}" >> $GITHUB_ENV
        echo "MONO_WASM_THREADS=${{ matrix.MONO_WASM_THREADS }}" >> $GITHUB_ENV

    - name: Clone dotnet/runtime
      run: |
        git clone --recursive https://github.com/dotnet/runtime

    - run: ./scripts/apply-patches.ps1
      name: Apply uno-specific patches
      shell: pwsh

    - name: Install cmake
      run: |
        set -e
        wget -qO- https://github.com/Kitware/CMake/releases/download/v3.27.2/cmake-3.27.2-linux-x86_64.tar.gz | \
        sudo tar --strip-components=1 -xz -C /usr/local

    - name: Build Wasm Runtime
      run: |
        set -e
        cd runtime
        ./build.sh -arch wasm -os browser -c $BUILD_CONFIGURATION $ADDITIONAL_BUILD_ARGS /p:TestAssemblies=false "/p:MonoWasmBuildVariant=$MONO_WASM_THREADS"

    - name: Create artifact structure
      run: |
        set -e
        cd ./runtime/artifacts/packages/Release/Shipping
        rm *.symbols.nupkg
        rm *.Templates.*.nupkg
        rm -f *ToolChain.net6.Manifest*.nupkg
        rm -f *ToolChain.net7.Manifest*.nupkg
        rm -f *ToolChain.net8.Manifest*.nupkg
        rm -f *ToolChain.net9.Manifest*.nupkg
        rm -f *ToolChain.net10.Manifest*.nupkg
        unzip -o '*.nupkg' -d uno
        cd uno
        rm *.nuspec

        # remove unused assets that are part of the official SDK
        rm -fR _rels
        rm -fR package
        rm -fR analyzers
        rm -fR ref
        rm -f \[Content_Types\].xml
        rm -f Icon.png
        rm -f LICENCE.TXT
        find data ! -name 'RuntimeList.xml' -type f -exec rm -f {} +

    - name: Zip Archive
      run: |
        ARTIFACTS_FOLDER=`pwd`/ci-artifacts
        mkdir -p $ARTIFACTS_FOLDER
        cd ./runtime/artifacts/packages/Release/Shipping/uno
        /usr/bin/zip -r $ARTIFACTS_FOLDER/sdk-${{ matrix.MONO_WASM_THREADS }}.zip *

    - uses: actions/upload-artifact@v4
      if: ${{ always() }}
      with:
        name: wasm-sdk-${{ matrix.MONO_WASM_THREADS }}
        path: ci-artifacts

  package_job:
    needs: [build_linux_job]
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true
        fetch-depth: 0

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: 10.0.100

    - name: Install nbgv
      run: |
        dotnet tool uninstall --global nbgv || true
        dotnet tool install --global nbgv --version ${{ env.NBGV_VERSION }}

    - name: Get version
      id: nbgv
      run: |
        echo "SemVer2=$(nbgv get-version -v SemVer2)" >> $GITHUB_OUTPUT

    - name: Download package
      uses: actions/download-artifact@v4
      with:
          pattern: wasm-sdk-*
          path: nuget
          merge-multiple: true

    - name: Create NuGet SDK Packages
      run: |
        cd nuget

        # Adjust version numbers for target files
        sed -i "s/\\\$buildversion\\\$/${{ steps.nbgv.outputs.SemVer2 }}/g" runtime/buildTransitive/*

        # Unzip all packages in separate folders
        find . -name '*.zip' -exec sh -c 'unzip -d "${1%.*}" "$1"' _ {} \;

        dotnet pack Uno.NETCore.App.Runtime.Mono.browser-wasm.csproj /p:OutputPath=$GITHUB_WORKSPACE/ci-output

    - uses: actions/upload-artifact@v4
      if: ${{ always() }}
      with:
        name: nuget-sdk
        path: ci-output

  sign:
    name: Sign Package
    if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) }}
    runs-on: windows-latest

    permissions:
      id-token: write # Required for requesting the JWT

    needs: [package_job,build_aot_windows_job,build_aot_linux_job]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download Artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: nuget-*
          path: artifacts
          merge-multiple: true

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.x'

      # Install the code signing tool
      - name: Install Sign CLI tool
        run: dotnet tool install --tool-path . sign --version 0.9.1-beta.25278.1

      # Login to Azure using a ServicePrincipal configured to authenticate against a GitHub Action
      - name: 'Az CLI login'
        uses: azure/login@v1
        with:
          allow-no-subscriptions: true
          client-id: ${{ secrets.SIGN_AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.SIGN_AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.SIGN_AZURE_SUBSCRIPTION_ID }}

      # Run the signing command
      - name: Sign artifacts
        shell: pwsh
        run: >
          ./sign code azure-key-vault
          artifacts/*.nupkg
          --publisher-name "Uno.DotnetRuntime.WebAssembly"
          --description "Uno.DotnetRuntime.WebAssembly"
          --description-url "https://github.com/${{ github.repository }}"
          --azure-key-vault-managed-identity true
          --azure-key-vault-url "${{ secrets.SIGN_KEY_VAULT_URL }}"
          --azure-key-vault-certificate "${{ secrets.SIGN_KEY_VAULT_CERTIFICATE_ID }}"
          --verbosity information

      - name: Upload Signed Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: nuget-signed
          path: .\artifacts

  publish_dev:
    name: Publish Dev
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
    runs-on: windows-latest

    needs:
      - sign

    steps:
      - name: Download Artifacts
        uses: actions/download-artifact@v4
        with:
          name: nuget-signed
          path: artifacts

      - name: NuGet Push
        shell: pwsh
        run: |
          dotnet nuget push artifacts\*.nupkg -s https://api.nuget.org/v3/index.json -k "${{ secrets.NUGET_ORG_API_KEY }}" --skip-duplicate

  publish_prod:
    name: Publish Production
    if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/heads/release/') }}
    runs-on: windows-latest
    environment: Production

    needs:
      - sign

    steps:
      - name: Download Artifacts
        uses: actions/download-artifact@v4
        with:
          name: nuget-signed
          path: artifacts

      - name: NuGet Push
        shell: pwsh
        run: |
          dotnet nuget push artifacts\*.nupkg -s https://api.nuget.org/v3/index.json -k "${{ secrets.NUGET_ORG_API_KEY }}" --skip-duplicate