# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt

name: "Build Provider"

on:
  workflow_call:
    inputs:
      version:
        required: true
        type: string
        description: Version of the provider to build
      matrix:
        required: false
        type: string
        default: |
          {
            "platform": [
              {"os": "linux",   "arch": "amd64"},
              {"os": "linux",   "arch": "arm64"},
              {"os": "darwin",  "arch": "amd64"},
              {"os": "darwin",  "arch": "arm64"},
              {"os": "windows", "arch": "amd64"},
              {"os": "windows", "arch": "arm64"}
            ]
          }

jobs:
  build_provider:
    name: Build ${{ matrix.platform.os }}-${{ matrix.platform.arch }}
    runs-on: ubuntu-latest
    env:
      PROVIDER_VERSION: ${{ inputs.version }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    strategy:
      fail-fast: true
      matrix: ${{ fromJSON(inputs.matrix) }}
    permissions:
      contents: read
      id-token: write # For ESC secrets.
    steps:
      - name: Checkout Repo
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false      
      - id: esc-secrets
        name: Map environment to ESC outputs
        uses: ./.github/actions/esc-action
      # Without ldid cross-compiling Node binaries on a Linux worker intended to work on darwin-arm64 fails to sign the
      # binaries properly and they do not work as expected. See https://github.com/pulumi/pulumi-awsx/issues/1490
      - uses: MOZGIII/install-ldid-action@d5ab465f3a66a4d60a59882b935eb30e18e8d043 # v1
        with:
          tag: v2.1.5-procursus2
      - name: Setup mise
        uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
        env:
          MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
        with:
          version: 2025.11.6
          github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
          # only saving the cache in the prerequisites job
          cache_save: false
      # Based on https://github.com/actions/cache/blob/main/examples.md#go---modules
      - name: Get GOCACHE
        id: gocache
        shell: bash
        run: |
          echo "path=$(go env GOCACHE)" >> "${GITHUB_OUTPUT}"
      - name: Get GOMODCACHE
        id: gomodcache
        shell: bash
        run: |
          echo "path=$(go env GOMODCACHE)" >> "${GITHUB_OUTPUT}"
      - name: Go Cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: |
            ${{ steps.gocache.outputs.path }}
            ${{ steps.gomodcache.outputs.path }}
          key: go-provider-${{ matrix.platform.os }}-${{ matrix.platform.arch }}-${{ hashFiles('provider/go.sum') }}
          restore-keys: |
            go-provider-${{ matrix.platform.os }}-${{ matrix.platform.arch }}-
      - name: Prepare local workspace before restoring previously built
        run: make prepare_local_workspace
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Restore prerequisites
        uses: ./.github/actions/download-prerequisites
      - name: Restore makefile progress
        # This mirrors the targets completed in the prerequisites job
        run: make --touch provider schema

      - name: Build provider
        run: make "provider-${{ matrix.platform.os }}-${{ matrix.platform.arch }}"
        env:
          AZURE_SIGNING_CLIENT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID }}
          AZURE_SIGNING_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET }}
          AZURE_SIGNING_TENANT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID }}
          AZURE_SIGNING_KEY_VAULT_URI: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI }}
          SKIP_SIGNING: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID == '' && secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }}

      - name: Package provider
        run: make provider_dist-${{ matrix.platform.os }}-${{ matrix.platform.arch }}

      - name: Upload artifacts
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: pulumi-resource-incus-v${{ inputs.version }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}.tar.gz
          path: bin/pulumi-resource-incus-v${{ inputs.version }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}.tar.gz
          retention-days: 30