electron/.github/workflows/pipeline-segment-electron-gn-check.yml

name: Pipeline Segment - Electron GN Check

on:
  workflow_call:
    inputs:
      target-platform:
        type: string
        description: 'Platform to run on, can be macos, win or linux'
        required: true
      target-archs:
        type: string
        description: 'Archs to check for, can be x64 or arm64 space separated'
        required: true
      check-runs-on:
        type: string
        description: 'What host to run the tests on'
        required: true
      check-container:
        type: string
        description: 'JSON container information for aks runs-on'
        required: false
        default: '{"image":null}'
    secrets:
      ELECTRON_RBE_JWT:
        required: false

permissions: {}

concurrency:
  group: electron-gn-check-${{ inputs.target-platform }}-${{ github.ref_protected == true && github.run_id || github.ref }}
  cancel-in-progress: ${{ github.ref_protected != true }}

env:
  ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
  GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' && '--custom-var=checkout_mac=True --custom-var=host_os=mac' || (inputs.target-platform == 'linux' && '--custom-var=checkout_arm64=True' || '--custom-var=checkout_win=True') }}
  ELECTRON_OUT_DIR: Default

jobs:
  gn-check:
    defaults:
      run:
        shell: bash
    runs-on: ${{ inputs.check-runs-on }}
    permissions:
      contents: read
    container: ${{ fromJSON(inputs.check-container) }} # zizmor: ignore[unpinned-images] the caller passes ghcr.io/electron/build tagged by the content hash computed in build.yml; there is no static digest to pin
    steps:
    - name: Checkout Electron
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      with:
        path: src/electron
        fetch-depth: 0
        ref: ${{ github.event.pull_request.head.sha }}
        persist-credentials: false
    - name: Cleanup disk space on macOS
      if: ${{ inputs.target-platform == 'macos' }}
      shell: bash
      run: |   
        sudo mkdir -p $TMPDIR/del-target

        tmpify() {
          if [ -d "$1" ]; then
            sudo mv "$1" $TMPDIR/del-target/$(echo $1|shasum -a 256|head -n1|cut -d " " -f1)
          fi
        }   
        tmpify /Library/Developer/CoreSimulator
        tmpify ~/Library/Developer/CoreSimulator
        sudo rm -rf $TMPDIR/del-target
    - name: Check disk space after freeing up space
      if: ${{ inputs.target-platform == 'macos' }}
      run: df -h
    - name: Set Chromium Git Cookie
      uses: ./src/electron/.github/actions/set-chromium-cookie
    - name: Install Build Tools
      uses: ./src/electron/.github/actions/install-build-tools
    - name: Enable windows toolchain
      if: ${{ inputs.target-platform == 'win' }}
      run: |
        echo "ELECTRON_DEPOT_TOOLS_WIN_TOOLCHAIN=1" >> $GITHUB_ENV
    - name: Generate DEPS Hash
      run: |
        node src/electron/script/generate-deps-hash.js
        DEPSHASH=v2-src-cache-$(cat src/electron/.depshash)
        echo "DEPSHASH=$DEPSHASH" >> $GITHUB_ENV
        echo "CACHE_PATH=$DEPSHASH.tar" >> $GITHUB_ENV
    - name: Restore src cache via AZCopy
      if: ${{ inputs.target-platform == 'macos' }}
      uses: ./src/electron/.github/actions/restore-cache-azcopy
      with:
        target-platform: ${{ inputs.target-platform }}      
    - name: Restore src cache via AKS
      if: ${{ inputs.target-platform == 'linux' || inputs.target-platform == 'win' }}
      uses: ./src/electron/.github/actions/restore-cache-aks
      with:
        target-platform: ${{ inputs.target-platform }}
    - name: Checkout Electron
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      with:
        path: src/electron
        fetch-depth: 0
        ref: ${{ github.event.pull_request.head.sha }}
        persist-credentials: false
    - name: Fix hermetic Python (macOS)
      if: ${{ inputs.target-platform == 'macos' }}
      uses: ./src/electron/.github/actions/cipd-install
      with:
        dependency: cpython3-host
        deps-file: src/DEPS
        installation-dir: src/third_party/cpython3/host
        target-platform: ${{ inputs.target-platform }}
        package: infra/3pp/tools/cpython3/${platform}
    - name: Run Electron Only Hooks
      env:
        TARGET_PLATFORM: ${{ inputs.target-platform }}
      run: |
        echo "solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False},'managed':False}]" > tmpgclient
        if [ "$TARGET_PLATFORM" = "win" ]; then
          echo "solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False,'install_sysroot':False,'checkout_win':True},'managed':False}]" > tmpgclient
          echo "target_os=['win']" >> tmpgclient
        fi
        e d gclient runhooks --gclientfile=tmpgclient

        # Fix VS Toolchain
        if [ "$TARGET_PLATFORM" = "win" ]; then
          rm -rf src/third_party/depot_tools/win_toolchain/vs_files
          e d python3 src/build/vs_toolchain.py update --force
        fi
    - name: Regenerate DEPS Hash
      run: |
        (cd src/electron && git checkout .) && node src/electron/script/generate-deps-hash.js
        echo "DEPSHASH=$(cat src/electron/.depshash)" >> $GITHUB_ENV
    - name: Install Dependencies
      uses: ./src/electron/.github/actions/install-dependencies
    - name: Default GN gen
      run: |
        cd src/electron
        git pack-refs
    # The testing config sets is_official_build = false, so a check against
    # only the testing args never evaluates targets that are only reachable
    # with official-build flags and release-only graph breakage surfaces for
    # the first time in publish builds. Run gn gen + check (no compile) with
    # the release args as well to catch that here. No PGO profile download is
    # needed: gn gen only read_file()s the checked-in state files in
    # build/pgo_profiles, the profiles themselves are compile-time inputs.
    - name: Run GN Check for ${{ inputs.target-archs }}
      env:
        TARGET_PLATFORM: ${{ inputs.target-platform }}
        TARGET_ARCHS: ${{ inputs.target-archs }}
      run: |
        for build_type in testing release
        do
          for target_cpu in $TARGET_ARCHS
          do
            e init -f --root=$(pwd) --out=Default $build_type --import $build_type --target-cpu $target_cpu --remote-build none
            cd src/electron
            export GN_EXTRA_ARGS="target_cpu=\"$target_cpu\""
            if [ "$TARGET_PLATFORM" = "linux" ]; then
              if [ "$target_cpu" = "arm64" ]; then
                export GN_EXTRA_ARGS="$GN_EXTRA_ARGS fatal_linker_warnings=false enable_linux_installer=false"
              fi
            fi
            if [ "$TARGET_PLATFORM" = "win" ]; then
              export GN_EXTRA_ARGS="$GN_EXTRA_ARGS use_v8_context_snapshot=true target_os=\"win\""
            fi

            e build --gen=only

            npm run gn-check -- --outDir Default

            # The publish matrix also builds a Mac App Store variant of every
            # macOS release, so check that graph too.
            if [ "$TARGET_PLATFORM" = "macos" ] && [ "$build_type" = "release" ]; then
              export GN_EXTRA_ARGS="$GN_EXTRA_ARGS is_mas_build=true"

              e build --gen=only

              npm run gn-check -- --outDir Default
            fi
            cd ../..
          done
        done

        # These checks do not depend on the gn config, so run them once.
        cd src/electron

        # Check the hunspell filenames
        node script/gen-hunspell-filenames.js --check

        node script/gen-libc++-filenames.js --check
        node script/gen-siso-revision.js --check
        node script/gen-filenames.mts --check
    - name: Wait for active SSH sessions
      if: always() && !cancelled()
      shell: bash
      run: |
        while [ -f /var/.ssh-lock ]
        do
          sleep 60
        done