compile_sqlite.yml

name: Download and compile SQLite

on:
  workflow_call:
    inputs:
      attest:
        description: "Whether to generate a signed attestation for compiled artifacts"
        type: boolean
        default: false
    outputs:
      artifact_id:
        description: "ID of the artifact containing prebuilt SQLite libraries"
        value: ${{ jobs.merge_assets.outputs.sqlite_merged }}
      pool_libs_artifact_id:
        description: "ID of the artifact containing libraries for sqlite3_connection_pool"
        value: ${{ jobs.merge_assets.outputs.pool_libs }}
      sanitized_artifact_id:
        description: "ID of the artifact containing libraries compiled with sanitizers"
        value: ${{ jobs.build_with_sanitizers.outputs.libs }}

permissions: {}

jobs:
  download_sqlite:
    runs-on: ubuntu-slim
    name: Download SQLite sources
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/cache@v6
        id: cache_build
        with:
          path: sqlite-src/
          key: sqlite-src-${{ hashFiles('tool/download_sqlite.dart') }}

      - uses: dart-lang/setup-dart@v1
        if: steps.cache_build.outputs.cache-hit != 'true'

      - name: Download sqlite3
        if: steps.cache_build.outputs.cache-hit != 'true'
        run: |
          dart run tool/download_sqlite.dart

      - name: Upload sqlite3 sources
        uses: actions/upload-artifact@v7
        with:
          name: sqlite-src
          path: sqlite-src/
          if-no-files-found: error
          retention-days: 1

  build_openssl:
    # Build a static OpenSSL build, used to build SQLCipher later.
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    name: Compile OpenSSL
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/cache@v6
        id: cache_build
        with:
          path: openssl-compiled
          key: openssl-prebuilt-${{ runner.os }}-3.6.4-${{ hashFiles('tool/build_openssl.dart') }}
      - uses: dart-lang/setup-dart@v1
        if: steps.cache_build.outputs.cache-hit != 'true'

      - name: Download OpenSSL
        if: steps.cache_build.outputs.cache-hit != 'true'
        # When updating this, also update the version in tool/generate_sbom.dart
        run: |
          curl -L https://github.com/openssl/openssl/releases/download/openssl-3.6.4/openssl-3.6.4.tar.gz | tar --extract --gzip
          mv openssl-3.6.4 openssl-src

      - name: Install cross-compiling GCC
        shell: bash
        if: runner.os == 'Linux' && steps.cache_build.outputs.cache-hit != 'true'
        run: |
          sudo apt update
          sudo apt install -y gcc-aarch64-linux-gnu gcc-riscv64-linux-gnu gcc-arm-linux-gnueabihf gcc-i686-linux-gnu

      - name: Compile OpenSSL for Linux and Android
        if: steps.cache_build.outputs.cache-hit != 'true' && matrix.os == 'ubuntu-latest'
        run: |
          dart pub get
          dart run tool/build_openssl.dart linux android

      - name: Compile OpenSSL for Windows
        if: steps.cache_build.outputs.cache-hit != 'true' && matrix.os == 'windows-latest'
        run: |
          dart pub get
          dart run tool/build_openssl.dart windows

      - name: Upload openssl binaries
        uses: actions/upload-artifact@v7
        with:
          name: openssl-libs-${{ runner.os }}
          path: openssl-compiled
          if-no-files-found: error
          retention-days: 1

  build_sqlite:
    needs: [download_sqlite, build_openssl]
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    runs-on: ${{ matrix.os }}
    name: Compile sqlite3
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/cache@v6
        id: cache_build
        with:
          path: sqlite-compiled
          key: sqlite-prebuilt-${{ runner.os }}-${{ hashFiles('tool/**', 'sqlite3/lib/src/hook/compile/**') }}

      - name: Download sqlite3 sources
        if: steps.cache_build.outputs.cache-hit != 'true'
        uses: actions/download-artifact@v8
        with:
          name: sqlite-src
          path: sqlite-src

      - name: Download compiled OpenSSL
        if: (runner.os == 'Linux' || runner.os == 'Windows') && steps.cache_build.outputs.cache-hit != 'true'
        uses: actions/download-artifact@v8
        with:
          name: openssl-libs-${{ runner.os }}
          path: openssl-compiled

      - uses: dart-lang/setup-dart@v1
        if: steps.cache_build.outputs.cache-hit != 'true'

      - name: Install cross-compiling GCC
        shell: bash
        if: runner.os == 'Linux' && steps.cache_build.outputs.cache-hit != 'true'
        run: |
          sudo apt update
          sudo apt install -y gcc-aarch64-linux-gnu gcc-riscv64-linux-gnu gcc-arm-linux-gnueabihf gcc-i686-linux-gnu

      - name: Compile sqlite3
        if: steps.cache_build.outputs.cache-hit != 'true'
        run: |
          dart pub get
          dart run tool/build_sqlite.dart

      - name: Upload sqlite3 binaries
        uses: actions/upload-artifact@v7
        with:
          name: sqlite3-libs-${{ runner.os }}
          path: sqlite-compiled
          if-no-files-found: error
          retention-days: 1

  build_with_sanitizers:
    needs: [download_sqlite]
    runs-on: ubuntu-latest
    outputs:
      libs: ${{ steps.upload.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/cache@v6
        id: cache_build
        with:
          path: sqlite-sanitized
          key: sqlite-sanitizers-${{ runner.os }}-${{ hashFiles('tool/**', 'sqlite3/lib/src/hook/description.dart', 'sqlite3_connection_pool/src/**') }}
      - name: Download sqlite3 sources
        if: steps.cache_build.outputs.cache-hit != 'true'
        uses: actions/download-artifact@v8
        with:
          name: sqlite-src
          path: sqlite-src

      - uses: dart-lang/setup-dart@v1
        if: steps.cache_build.outputs.cache-hit != 'true'

      - name: Install rust
        if: steps.cache_build.outputs.cache-hit != 'true'
        run: rustup toolchain install nightly --component rust-src

      - name: Install LLVM toolchain
        shell: bash
        if: steps.cache_build.outputs.cache-hit != 'true'
        run: |
          sudo apt update
          sudo apt install -y llvm clang lld

      - name: Compile sqlite3
        if: steps.cache_build.outputs.cache-hit != 'true'
        run: |
          dart pub get
          dart run tool/build_with_sanitizers.dart

      - name: Compile pool libraries
        if: steps.cache_build.outputs.cache-hit != 'true'
        working-directory: sqlite3_connection_pool
        run: ./tool/build_linux_sanitizer.sh

      - name: Upload binaries
        uses: actions/upload-artifact@v7
        id: upload
        with:
          name: sqlite3-sanitized
          path: sqlite-sanitized
          if-no-files-found: error
          retention-days: 1

  compile_wasm:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/cache@v6
        id: cache_build
        with:
          path: sqlite3_wasm_build/out/
          key: sqlite-prebuilt-wasm-${{ hashFiles('sqlite3_wasm_build/src/**') }}

      # clang 18 that ships on ubuntu crashes when compiling the wasm sources
      - name: Install LLVM and Clang
        if: steps.cache_build.outputs.cache-hit != 'true'
        uses: KyleMayes/install-llvm-action@ebc0426251bc40c7cd31162802432c68818ab8f0 #v2.0.9
        with:
          version: "21"

      - name: Download WASI SDK
        if: steps.cache_build.outputs.cache-hit != 'true'
        run: |
          ls -al ${LLVM_PATH}

          curl -L https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-27/wasi-sdk-27.0-x86_64-linux.deb -o wasi-sdk.deb
          sudo dpkg -i wasi-sdk.deb
          sudo mkdir /usr/lib/llvm-18/lib/clang/18/lib/wasi
          sudo cp -r /opt/wasi-sdk/lib/clang/20/lib/* ${LLVM_PATH}/lib/clang/21/lib/

          curl -L https://github.com/WebAssembly/binaryen/releases/download/version_124/binaryen-version_124-x86_64-linux.tar.gz -o binaryen.tar.gz
          tar --extract --gzip --file binaryen.tar.gz
          sudo mv binaryen-version_124/bin/* /usr/local/bin

      - uses: dart-lang/setup-dart@v1
        if: steps.cache_build.outputs.cache-hit != 'true'

      - name: Compile WASM binaries
        if: steps.cache_build.outputs.cache-hit != 'true'
        working-directory: sqlite3_wasm_build/
        run: |
          cmake -Dwasi_sysroot=/opt/wasi-sdk/share/wasi-sysroot/ -S src -B .dart_tool/sqlite_build
          cmake --build .dart_tool/sqlite_build/ -t output -j

      - name: Upload sqlite3 binaries
        uses: actions/upload-artifact@v7
        with:
          name: sqlite3-libs-wasm
          path: sqlite3_wasm_build/out/
          if-no-files-found: error
          retention-days: 1

  compile_pool_linux_android:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/cache@v6
        id: cache_build
        with:
          path: sqlite3_connection_pool/out
          key: pool-helper-v2-${{ runner.os }}-${{ hashFiles('sqlite3_connection_pool/src/**', 'sqlite3_connection_pool/Cargo.toml', 'sqlite3_connection_pool/.cargo/**') }}
      - name: Install rust
        if: steps.cache_build.outputs.cache-hit != 'true'
        run: |
          rustup toolchain install nightly --component rust-src
          rustup target add --toolchain nightly armv7-unknown-linux-gnueabihf
          rustup target add --toolchain nightly aarch64-unknown-linux-gnu
          rustup target add --toolchain nightly x86_64-unknown-linux-gnu
          rustup target add --toolchain nightly riscv64gc-unknown-linux-gnu

          rustup target add --toolchain nightly armv7-unknown-linux-gnueabihf
          rustup target add --toolchain nightly aarch64-linux-android
          rustup target add --toolchain nightly armv7-linux-androideabi
          rustup target add --toolchain nightly x86_64-linux-android
      - run: cargo install cargo-ndk
        if: steps.cache_build.outputs.cache-hit != 'true'
      - name: Install cross-compiling GCC
        if: steps.cache_build.outputs.cache-hit != 'true'
        run: |
          sudo apt update
          sudo apt install -y gcc-aarch64-linux-gnu gcc-riscv64-linux-gnu gcc-arm-linux-gnueabihf

      - name: Build for Linux
        if: steps.cache_build.outputs.cache-hit != 'true'
        working-directory: sqlite3_connection_pool
        run: ./tool/build_linux.sh
      - name: Build Android libs
        if: steps.cache_build.outputs.cache-hit != 'true'
        working-directory: sqlite3_connection_pool
        env:
          RUSTFLAGS: "-Zlocation-detail=none -Zfmt-debug=none -Zunstable-options -Cpanic=immediate-abort"
        run: cargo +nightly ndk -t armeabi-v7a -t arm64-v8a -t x86_64 -o target/android build --release -Zbuild-std=std,panic_abort -Zbuild-std-features=

      - name: Copy libraries
        if: steps.cache_build.outputs.cache-hit != 'true'
        working-directory: sqlite3_connection_pool
        run: |
          mkdir out
          cp target/x86_64-unknown-linux-gnu/release/libsqlite3_connection_pool.so out/libsqlite3_connection_pool.linux_x64.so
          cp target/aarch64-unknown-linux-gnu/release/libsqlite3_connection_pool.so out/libsqlite3_connection_pool.linux_aarch64.so
          cp target/armv7-unknown-linux-gnueabihf/release/libsqlite3_connection_pool.so out/libsqlite3_connection_pool.linux_arm7.so
          cp target/riscv64gc-unknown-linux-gnu/release/libsqlite3_connection_pool.so out/libsqlite3_connection_pool.linux_riscv.so

          cp target/android/x86_64/libsqlite3_connection_pool.so out/libsqlite3_connection_pool.android_x86_64.so
          cp target/android/armeabi-v7a/libsqlite3_connection_pool.so out/libsqlite3_connection_pool.android_v7a.so
          cp target/android/arm64-v8a/libsqlite3_connection_pool.so out/libsqlite3_connection_pool.android_v8a.so
      - uses: actions/upload-artifact@v7
        with:
          name: connection-pool-linux
          retention-days: 1
          path: sqlite3_connection_pool/out

  compile_pool_apple:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/cache@v6
        id: cache_build
        with:
          path: sqlite3_connection_pool/out
          key: pool-helper-v2-${{ runner.os }}-${{ hashFiles('sqlite3_connection_pool/src/**', 'sqlite3_connection_pool/Cargo.toml', 'sqlite3_connection_pool/.cargo/**') }}
      - name: Install rust
        if: steps.cache_build.outputs.cache-hit != 'true'
        run: |
          rustup toolchain install nightly --component rust-src
          rustup target add --toolchain nightly x86_64-apple-darwin
          rustup target add --toolchain nightly aarch64-apple-darwin
      - name: Build for macOS and iOS
        if: steps.cache_build.outputs.cache-hit != 'true'
        working-directory: sqlite3_connection_pool
        run: |
          rustup component add rust-src --toolchain nightly-aarch64-apple-darwin
          ./tool/build_apple.sh
      - name: Copy libraries
        if: steps.cache_build.outputs.cache-hit != 'true'
        working-directory: sqlite3_connection_pool
        run: |
          mkdir out
          cp target/x86_64-apple-darwin/release/libsqlite3_connection_pool.dylib out/libsqlite3_connection_pool.macos_x64.dylib
          cp target/aarch64-apple-darwin/release/libsqlite3_connection_pool.dylib out/libsqlite3_connection_pool.macos_aarch64.dylib

          cp target/aarch64-apple-ios/release/libsqlite3_connection_pool.dylib out/libsqlite3_connection_pool.ios_aarch64.dylib
          cp target/aarch64-apple-ios-sim/release/libsqlite3_connection_pool.dylib out/libsqlite3_connection_pool.ios_sim_aarch64.dylib
          cp target/x86_64-apple-ios/release/libsqlite3_connection_pool.dylib out/libsqlite3_connection_pool.ios_sim_x64.dylib
      - uses: actions/upload-artifact@v7
        with:
          name: connection-pool-apple
          retention-days: 1
          path: sqlite3_connection_pool/out

  compile_pool_windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/cache@v6
        id: cache_build
        with:
          path: sqlite3_connection_pool/out
          key: pool-helper-v2-${{ runner.os }}-${{ hashFiles('sqlite3_connection_pool/src/**', 'sqlite3_connection_pool/Cargo.toml', 'sqlite3_connection_pool/.cargo/**') }}
      - name: Install rust
        if: steps.cache_build.outputs.cache-hit != 'true'
        run: |
          rustup toolchain install nightly --component rust-src
          rustup target add --toolchain nightly x86_64-pc-windows-msvc
          rustup target add --toolchain nightly aarch64-pc-windows-msvc
      - name: Build for Windows
        if: steps.cache_build.outputs.cache-hit != 'true'
        working-directory: sqlite3_connection_pool
        env:
          toolchain: nightly
          components: rust-src
          RUSTFLAGS: "-Zlocation-detail=none -Zfmt-debug=none -Zunstable-options -Cpanic=immediate-abort"
        run: |
          rustup component add rust-src --toolchain nightly-x86_64-pc-windows-msvc
          cargo +nightly build --release -Z build-std=std,panic_abort -Z build-std-features= --target x86_64-pc-windows-msvc
          cargo +nightly build --release -Z build-std=std,panic_abort -Z build-std-features= --target aarch64-pc-windows-msvc
      - name: Copy libraries
        if: steps.cache_build.outputs.cache-hit != 'true'
        working-directory: sqlite3_connection_pool
        run: |
          mkdir out
          cp target/x86_64-pc-windows-msvc/release/sqlite3_connection_pool.dll out/sqlite3_connection_pool.win_x64.dll
          cp target/aarch64-pc-windows-msvc/release/sqlite3_connection_pool.dll out/sqlite3_connection_pool.win_aarch64.dll
      - uses: actions/upload-artifact@v7
        with:
          name: connection-pool-windows
          retention-days: 1
          path: sqlite3_connection_pool/out

  merge_assets:
    runs-on: ubuntu-slim
    needs:
      - build_sqlite
      - compile_wasm
      - compile_pool_linux_android
      - compile_pool_apple
      - compile_pool_windows
    name: Merge prebuilt libraries into single directory
    outputs:
      sqlite_merged: ${{ steps.upload.outputs.artifact-id }}
      pool_libs: ${{ steps.upload_pool.outputs.artifact-id }}

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/download-artifact@v8
        with:
          path: out/
          merge-multiple: true
          pattern: sqlite3-libs-*

      - uses: actions/download-artifact@v8
        with:
          path: sqlite3_connection_pool/lib/src/precompiled
          merge-multiple: true
          pattern: connection-pool-*

      - run: ls -al out/
      - run: ls -al sqlite3_connection_pool/lib/src/precompiled/

      - name: Upload sqlite3 binaries
        uses: actions/upload-artifact@v7
        id: upload
        with:
          name: sqlite3-precompiled
          path: out/
          if-no-files-found: error
          retention-days: 1

      - name: Upload pool helper binaries
        uses: actions/upload-artifact@v7
        id: upload_pool
        with:
          name: connection-pool-libs
          path: sqlite3_connection_pool/lib/src/precompiled/
          if-no-files-found: error
          retention-days: 1

  attest_binaries:
    runs-on: ubuntu-latest
    needs:
      - build_sqlite
      - compile_wasm
      - compile_pool_linux_android
      - compile_pool_apple
      - compile_pool_windows
    permissions:
      attestations: write
      id-token: write
      artifact-metadata: write
    name: Attest binaries

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/download-artifact@v8
        with:
          path: out/
          merge-multiple: true
          pattern: sqlite3-libs-*

      - uses: actions/download-artifact@v8
        with:
          path: sqlite3_connection_pool/lib/src/precompiled
          merge-multiple: true
          pattern: connection-pool-*

      - run: ls -al out/
      - run: ls -al sqlite3_connection_pool/lib/src/precompiled/

      - uses: dart-lang/setup-dart@v1
      - name: Generate SBOMs
        run: |
          dart pub get
          dart tool/generate_sbom.dart out/ sqlite3_connection_pool/lib/src/precompiled/

      - name: Upload sboms
        uses: actions/upload-artifact@v7
        with:
          name: sboms
          path: sbom

      - name: Attest provenance
        uses: actions/attest@v4
        if: inputs.attest
        with:
          subject-path: |
            out/*
            sqlite3_connection_pool/lib/src/precompiled/*

      - name: Attest plain SQLite build SBOM
        uses: actions/attest@v4
        if: inputs.attest
        with:
          sbom-path: sbom/sqlite3.bom.json
          subject-path: |
            out/libsqlite3.*
            out/sqlite3.*

      - name: Attest SQLite3 Multiple Ciphers build SBOM
        uses: actions/attest@v4
        if: inputs.attest
        with:
          sbom-path: sbom/sqlite3mc.bom.json
          subject-path: |
            out/libsqlite3mc.*
            out/sqlite3mc.*

      - name: Attest SQLCipher build SBOM
        uses: actions/attest@v4
        if: inputs.attest
        with:
          sbom-path: sbom/sqlcipher.bom.json
          subject-path: |
            out/libsqlcipher.*
            out/sqlcipher.*

      - name: Attest connection pools SBOM
        uses: actions/attest@v4
        if: inputs.attest
        with:
          sbom-path: sbom/connection_pool.bom.json
          subject-path: |
            sqlite3_connection_pool/lib/src/precompiled/*