config.yml

version: 2.1

# Our CircleCI dependencies
orbs:
  rust: circleci/rust@1.6.1
  gh: circleci/github-cli@2.3.0
  secops: apollo/circleci-secops-orb@2.0.7

# These filters are used to determine which package to release
any_release: &any_release
  filters:
    branches:
      ignore: /.*/
    tags:
      only : /(apollo-federation-types@v.*)|(router-bridge@v.*)|(composition@v.*)/

# These filters are used to determine which package to release
crate_release: &crate_release
  filters:
    branches:
      ignore: /.*/
    tags:
      only : /(apollo-federation-types@v.*)|(router-bridge@v.*)/

# These filters are used to determine which package to release
composition_release: &composition_release
  filters:
    branches:
      ignore: /.*/
    tags:
      only : /(composition@v.*)/

parameters:
  # we can't easily pin on osx, and we chose not to on windows.
  linux_cmake_version:
    type: string
    default: '3.27.3'

# The main workflows executed for federation-rs
workflows:
  lint:
    jobs:
      - xtask:
          name: Lint
          matrix:
            parameters:
              platform: [amd_linux]
              rust_channel: [stable]
              command: [lint]
  test:
    jobs:
      - xtask:
          name: Run cargo tests (<< matrix.rust_channel >> rust on << matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_linux, arm_ubuntu, amd_macos, arm_macos, amd_windows]
              rust_channel: [stable]
              command: [test]
              
      - check_for_github_action:
          name: Check to ensure Github Action has completed successfully (<< matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_macos]
          requires:
            - "Run cargo tests (stable rust on amd_macos)"

  release:
    jobs:
      - xtask:
          name: Run cargo tests (<< matrix.rust_channel >> rust on << matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_linux, arm_ubuntu, amd_macos, arm_macos, amd_windows]
              rust_channel: [stable]
              command: [test]
          <<: *any_release
      - xtask:
          name: Build and bundle release artifacts (<< matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_linux, arm_ubuntu, amd_macos, arm_macos, amd_windows]
              rust_channel: [stable]
              command: [package]
          requires:
            - "Run cargo tests (stable rust on amd_linux)"
            - "Run cargo tests (stable rust on arm_ubuntu)"
            - "Run cargo tests (stable rust on amd_macos)"
            - "Run cargo tests (stable rust on arm_macos)"
            - "Run cargo tests (stable rust on amd_windows)"
          <<: *composition_release

      - check_for_github_action:
          name: Check to ensure Github Action has completed successfully (<< matrix.platform >>)
          matrix:
            parameters:
              platform: [amd_macos]
          requires:
            - "Run cargo tests (stable rust on amd_macos)"
          <<: *any_release

      - publish_release:
          name: Publish to crates.io and create a GitHub release
          matrix:
            parameters:
              platform: [minimal_linux]
          requires:
            - "Build and bundle release artifacts (amd_linux)"
            - "Build and bundle release artifacts (arm_ubuntu)"
            - "Build and bundle release artifacts (amd_macos)"
            - "Build and bundle release artifacts (arm_macos)"
            - "Build and bundle release artifacts (amd_windows)"
            - "Check to ensure Github Action has completed successfully (amd_macos)"
          <<: *composition_release

      - publish_release:
          name: Publish to crates.io
          matrix:
            parameters:
              platform: [minimal_linux]
          requires:
            - "Run cargo tests (stable rust on amd_linux)"
            - "Run cargo tests (stable rust on arm_ubuntu)"
            - "Run cargo tests (stable rust on amd_macos)"
            - "Run cargo tests (stable rust on arm_macos)"
            - "Run cargo tests (stable rust on amd_windows)"
          <<: *crate_release

  security-scans:
    jobs:
      - secops/gitleaks:
          context:
            - platform-docker-ro
            - github-orb
            - secops-oidc
          git-base-revision: <<#pipeline.git.base_revision>><<pipeline.git.base_revision>><</pipeline.git.base_revision >>
          git-revision: << pipeline.git.revision >>

      - secops/semgrep:
          context:
            - secops-oidc
            - github-orb
          git-base-revision: <<#pipeline.git.base_revision>><<pipeline.git.base_revision>><</pipeline.git.base_revision >>
jobs:
  xtask:
    parameters:
      rust_channel:
        type: enum
        enum: ["stable", "nightly"]
        default: stable
      platform:
        type: executor
      command:
        type: enum
        enum: [lint, test, publish, package, dist]
      options:
        type: string
        default: ""
    executor: << parameters.platform >>
    steps:
      - checkout
      - install_system_deps:
          platform: << parameters.platform >>
          rust_channel: << parameters.rust_channel >>
      - exec_xtask:
          platform: << parameters.platform >>
          command: << parameters.command >>
          options: << parameters.options >>

  publish_release:
    parameters:
      platform:
        type: executor
    executor: << parameters.platform >>
    steps:
      - checkout
      # we persisted the artifacts from `cargo xtask package`
      # across all of our architectures earlier
      - attach_workspace:
          at: artifacts
      - install_system_deps:
          platform: << parameters.platform >>
          rust_channel: stable
      - compute_checksums
      # this is run in order to create the JavaScript bundles
      # that are needed by `cargo xtask publish`
      - exec_xtask:
          platform: << parameters.platform >>
          command: dist
          options: --debug
     # this should be run before the GitHub release is created
     # because it ensures that all of the files it needs
     # are in place before proceeding.
      - exec_xtask:
          platform: << parameters.platform >>
          command: publish
      - gh_release

  check_for_github_action:
    parameters:
      platform:
        type: executor
    executor: << parameters.platform >>
    steps:
      - run_check_for_github_action

# The machines we use to run our workflows on
executors:
  amd_macos: &amd_macos_executor
    macos:
      xcode: "14.2"
    resource_class: macos.m1.large.gen1
    environment:
      XTASK_TARGET: "x86_64-apple-darwin"
      RUSTUP_TARGET: "x86_64-apple-darwin" # cross-compile, because there are no native x86 macos runners
      APPLE_TEAM_ID: "YQK948L752"
      APPLE_USERNAME: "opensource@apollographql.com"
      MACOS_PRIMARY_BUNDLE_ID: com.apollographql.supergraph

  arm_macos: &arm_macos_executor
    macos:
      xcode: "14.2"
    resource_class: macos.m1.medium.gen1
    environment:
      XTASK_TARGET: "aarch64-apple-darwin"
      APPLE_TEAM_ID: "YQK948L752"
      APPLE_USERNAME: "opensource@apollographql.com"
      MACOS_PRIMARY_BUNDLE_ID: com.apollographql.supergraph

  amd_windows: &amd_windows_executor
    machine:
      image: 'windows-server-2019-vs2019:2022.08.1'
    resource_class: windows.xlarge
    shell: powershell.exe -ExecutionPolicy Bypass
    environment:
      XTASK_TARGET: "x86_64-pc-windows-msvc"

  amd_linux: &amd_linux_executor
    docker:
      # This image is used for building Python Wheels but it has what we need for Rust compilation and crucially
      # glibc 2.17.
      - image: quay.io/pypa/manylinux2014_x86_64:2024.07.02-0
    resource_class: xlarge
    environment:
     XTASK_TARGET: "x86_64-unknown-linux-gnu"
  arm_ubuntu: &arm_ubuntu_executor
    machine:
      image: ubuntu-2004:2022.04.1
    resource_class: arm.large
    environment:
      XTASK_TARGET: "aarch64-unknown-linux-gnu"

  minimal_linux:
    docker:
      - image: cimg/base:stable
    resource_class: small
    environment:
      XTASK_TARGET: "x86_64-unknown-linux-gnu"

# reusable command snippets can be referred to in any `steps` object
commands:
  install_system_deps:
    parameters:
      platform:
        type: executor
      rust_channel:
        type: enum
        enum: ["stable", "nightly"]
    steps:
      - when:
          condition:
            equal: [ *amd_linux_executor, << parameters.platform >> ]
          steps:
            - run:
                name: Update and upgrade yum packages
                command: yum -y update && yum -y upgrade
            - run:
                name: Install development tools
                command: yum groupinstall -y "Development Tools"
            - run:
                name: Install gcc
                command: yum -y install perl-core gcc
            - run:
                name: Install CMake
                command: |
                  cd /usr/local/src
                  curl -LO https://github.com/Kitware/CMake/releases/download/v<< pipeline.parameters.linux_cmake_version >>/cmake-<< pipeline.parameters.linux_cmake_version >>-linux-x86_64.tar.gz
                  tar -xvf cmake-<< pipeline.parameters.linux_cmake_version >>-linux-x86_64.tar.gz
                  mv cmake-<< pipeline.parameters.linux_cmake_version >>-linux-x86_64 /usr/local/cmake
                  echo 'export PATH="/usr/local/cmake/bin:$PATH"' >> $BASH_ENV
                  source $BASH_ENV
            - run:
                name: Check glibc version
                command: ldd --version

      - when:
          condition:
            or:
              - equal: [ *amd_macos_executor, << parameters.platform >> ]
              - equal: [ *arm_macos_executor, << parameters.platform >> ]
          steps:
            - run:
                name: Skip homebrew update
                command: echo "HOMEBREW_NO_AUTO_UPDATE=1" >> $BASH_ENV
            - run:
                name: Install CMake
                command: |
                  brew install cmake

      - install_rust_toolchain:
          rust_channel: << parameters.rust_channel >>
          platform: << parameters.platform >>

      - install_volta:
          platform: << parameters.platform >>

  install_volta:
    parameters:
      platform:
        type: executor
    steps:
      - unless:
          condition:
            or:
              - equal: [ *amd_windows_executor, << parameters.platform >> ]
              - equal: [ *arm_ubuntu_executor, << parameters.platform >> ]
          steps:
            - run:
                name: Install volta
                command: |
                  curl https://get.volta.sh | bash -s -- --skip-setup
                  echo 'export VOLTA_HOME=$HOME/.volta' >> $BASH_ENV
                  echo 'export PATH=$VOLTA_HOME/bin:$PATH' >> $BASH_ENV

      - when:
          condition:
            equal: [ *arm_ubuntu_executor, << parameters.platform >> ]
          steps:
            - run:
                name: Install volta
                # The install script seems to fail with a message saying:
                # Releases for non x64 architectures are not currently supported
                # However, this is just a constraint of the pre-built binaries.
                # Therefore, we just compile and install it and it's effectively
                # the same, albeit quite a bit slower.  This may have been a
                # regression in the installer script because I think this worked
                # in the past.
                command: |
                  VOLTA_VERSION=$(curl --silent "https://volta.sh/latest-version")
                  git clone https://github.com/volta-cli/volta --branch "v${VOLTA_VERSION}"
                  cd volta
                  cargo install --path . --locked

      - when:
          condition:
            equal: [ *amd_windows_executor, << parameters.platform >> ]
          steps:
            - run:
                name: Install volta
                command: |
                  $installer_dir = "$Env:TEMP".Path
                  $latest_version = ((Invoke-WebRequest -URI https://volta.sh/latest-version).Content -split '\n')[0]
                  $download_url = "https://github.com/volta-cli/volta/releases/download/v$latest_version/volta-$latest_version-windows-x86_64.msi"
                  echo "Downloading volta"
                  $msi_path = "$installer_dir\volta-init.msi"
                  (New-Object System.Net.WebClient).DownloadFile("$download_url", "$msi_path")
                  echo "Installing volta"
                  msiexec.exe /i "$msi_path" /qn
                  exit $LASTEXITCODE
            - run:
                name: Install CMake
                command: |
                  choco install cmake.install -y --installargs 'ADD_CMAKE_TO_PATH=User'
                  exit $LASTEXITCODE

      - run:
          name: Install default versions of npm and node
          command: |
            volta install node@16
            volta install npm@8


  install_rust_toolchain:
    parameters:
      rust_channel:
        type: enum
        enum: ["stable", "nightly"]
      platform:
        type: executor
    steps:
      - unless:
          condition:
            equal: [ *amd_windows_executor, << parameters.platform >> ]
          steps:
            - rust/install:
                version: << parameters.rust_channel >>
            - run:
                name: Adds rust target
                command: rustup target add $XTASK_TARGET
            - run:
                name: Set default rustc version
                # Should match the version pinned in rust-toolchain.toml
                command: |
                  rustup install 1.76.0
                  rustup default 1.76.0
      - when:
          condition:
            equal: [ *amd_windows_executor, << parameters.platform >> ]
          steps:
            - run:
                name: Install rustup
                environment:
                  # Override auto-detection of RAM for rustc install.
                  # https://github.com/rust-lang/rustup/issues/2229#issuecomment-585855925
                  RUSTUP_UNPACK_RAM: "21474836480"
                command: |
                  $installer_dir = "$Env:TEMP"
                  echo "Downloading rustup"
                  (New-Object System.Net.WebClient).DownloadFile("https://win.rustup.rs/x86_64", "$installer_dir\rustup-init.exe")
                  echo "Installing rustup"
                  & $installer_dir\rustup-init.exe --profile minimal -y
                  exit $LASTEXITCODE
            - run:
                name: Configure cargo for Windows
                command: |
                  Add-Content -path "${Env:USERPROFILE}\.cargo\config.toml" @"
                  [net]
                  git-fetch-with-cli = true
                  "@

  exec_xtask:
    parameters:
      command:
        type: enum
        enum: [lint, test, publish, package, dist]
      options:
        type: string
        default: ""
      platform:
        type: executor
      working_directory:
        type: string
        default: ./
    steps:
      # After burning two release versions due to caching misbehavior, we've
      # decided to disable target/ caching for now, since this repository
      # publishes builds relatively infrequently, and correctness is much more
      # important than build speed. If build speed does become a problem in the
      # future, it should be safe to uncomment the restore_cache and save_cache
      # steps below, since we bumped v2 to v3 and added {{ .Branch }} in PR #476
      # but never published anything using these rules.

      # - restore_cache:
      #     keys:
      #       - &target-cache-key rust-target-v3-<< parameters.platform >>-{{ .Branch }}-{{ checksum "Cargo.lock" }}

      - run:
          command: cargo xtask << parameters.command >> << parameters.options >>
          working_directory: << parameters.working_directory >>

      # - save_cache:
      #     key: *target-cache-key
      #     paths:
      #       - target/

      - when:
          condition:
            equal: [ package, << parameters.command >> ]
          steps:
            - persist_to_workspace:
                root: artifacts
                paths:
                  - "*"

  compute_checksums:
    steps:
      - when:
          condition:
            matches:
              pattern: "/(composition@v.*)/"
              value: << pipeline.git.tag >>
          steps:
            - run:
                name: Compute SHA256 checksums
                command: >
                  cd artifacts && sha256sum *.tar.gz > sha256sums.txt
            - run:
                name: Compute md5 checksums
                command: >
                  cd artifacts && md5sum *.tar.gz > md5sums.txt
            - run:
                name: Compute SHA1 checksums
                command: >
                  cd artifacts && sha1sum *.tar.gz > sha1sums.txt
  gh_release:
    steps:
      - when:
          condition:
            matches:
              pattern: "/(composition@v.*)/"
              value: << pipeline.git.tag >>
          steps:
            - gh/setup
            - run:
                name: Create GitHub release
                environment:
                  RELEASE_NAME: "$(echo << pipeline.git.tag >> | sed s/composition/supergraph/)"
                command: |
                  RELEASE_NAME="$(echo $CIRCLE_TAG | sed s/composition/supergraph/)" && gh release create $RELEASE_NAME \
                  --title $RELEASE_NAME \
                  --notes 'This release was automatically created by [CircleCI](./.circleci/config.yml).

                  If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.

                  Binaries built for MacOS are signed, notarized, and automatically verified with [Gatekeeper](https://support.apple.com/guide/deployment-reference-macos/using-gatekeeper-apd02b925e38/web).' \
                  artifacts/*

  run_check_for_github_action:
    steps:
      - run:
          name: Check Intel Mac test completed successfully
          command: |
            max_attempts=40 # max wait for 10 minutes
            attempt=0
            echo SHA is $CIRCLE_SHA1
            while [ $attempt -lt $max_attempts ]; do
              RESULT=`curl -s -H "Authorization: token $GITHUB_TOKEN" \
                -H "Accept: application/vnd.github.v3+json" \
                "https://api.github.com/repos/apollographql/federation-rs/actions/runs?head_sha=$CIRCLE_SHA1" | jq -r '.workflow_runs[] | {conclusion,name} | select(.name == "Mac_x86_tests").conclusion' | head -1` 

              echo "Attempt $((attempt+1)) of $max_attempts: RESULT is $RESULT"

              if [ "$RESULT" == "success" ]; then
                echo "Success condition met."
                exit 0  # Success exit code
              elif [ "$RESULT" == "failure" ]; then
                echo "Failure condition detected."
                exit 1  # Failure exit code
              fi

              attempt=$((attempt + 1))
              sleep 15  # Wait for 15 seconds before the next check
            done

            echo "Maximum attempts reached without success."
            exit 1  # Indicates failure to meet success condition within the allowed attempts