name: Native release artifact audit

on:
  push:
    paths:
      - ".gitea/workflows/artifact-audit.yml"
      - "ci/artifact-policy.json"
      - "ci/dependency-policy.json"
      - "ci/provenance-policy.json"
      - "tools/ci-matrix/**"
      - "tools/install_openjpeg_2_5_4.sh"
      - "docs/release-artifacts.md"
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/**"
      - "programs/**"
  pull_request:
    paths:
      - ".gitea/workflows/artifact-audit.yml"
      - "ci/artifact-policy.json"
      - "ci/dependency-policy.json"
      - "ci/provenance-policy.json"
      - "tools/ci-matrix/**"
      - "tools/install_openjpeg_2_5_4.sh"
      - "docs/release-artifacts.md"
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/**"
      - "programs/**"
  workflow_dispatch:

env:
  CARGO_BUILD_JOBS: 1
  CARGO_INCREMENTAL: 0
  CARGO_PROFILE_RELEASE_OPT_LEVEL: 0
  FORCE_SKIA_BINARIES_DOWNLOAD: 1
  OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-artifact-audit
  PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-artifact-audit/lib/pkgconfig
  LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-artifact-audit/lib

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: 1.97.1
      - name: Install documented native prerequisites
        run: |
          sudo apt-get update
          sudo apt-get install --yes build-essential clang cmake curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev
          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
          pkg-config --exact-version 2.5.4 libopenjp2
          pkg-config --modversion opus
      - name: Record source identity without a shipped build helper
        run: echo "METACRATE_RUST_COMMIT=$(git rev-parse --verify HEAD)" >>"$GITHUB_ENV"
      - name: Fetch the locked dependency graph
        run: cargo fetch --locked
      - name: Create every release source package atomically
        run: |
          cargo package --locked --no-verify \
            -p libremetaverse-types \
            -p libremetaverse-structured-data \
            -p libremetaverse-imaging \
            -p libremetaverse-imaging-skia \
            -p libremetaverse-openjpeg \
            -p libremetaverse-opus \
            -p libremetaverse-prim-mesher \
            -p libremetaverse-lsl-tools \
            -p libremetaverse \
            -p libremetaverse-rendering-simple \
            -p libremetaverse-rendering-mesh-foundry \
            -p libremetaverse-rlv \
            -p libremetaverse-utilities \
            -p libremetaverse-voice-vivox \
            -p libremetaverse-voice-webrtc \
            -p libremetaverse-programs
      - name: Build every shipped native executable
        run: cargo build --locked --release -j 1 -p libremetaverse-programs --bins
      - name: Inspect packages, binaries, links, and offline runtime behavior
        run: |
          cargo run --locked -p metacrate-ci-matrix -- artifact-audit \
            --artifact-dir target/release \
            --package-dir target/package \
            --evidence artifacts/release/artifact-audit.json
      - name: Upload immutable audit evidence and source packages
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: native-release-artifact-audit
          path: |
            artifacts/release/artifact-audit.json
            target/package/*.crate
          if-no-files-found: error