name: wasm-build (reusable)

# THE single KiCad WASM build+test recipe, called by ci-ubicloud.yml (main/PR) and
# release.yml (tag). Both build the SAME way — the asyncify `wasm-opt` tail is -O1
# everywhere — so the build can never diverge from what ships (the bug that shipped
# a -O1 / 3D-off demo while CI built -O1 / 3D-on). The opt_level input remains as an
# escape hatch for a one-off -O2 build, but is -O1 for both real callers, so a tag
# release FINAL-cache-hits main's build and skips the asyncify tail entirely.
#
# Two-tier output cache around docker/build.sh's --compile-only / --postprocess-only
# split. The expensive container compile (→ base wasm) is opt- and binaryen-
# independent; only the host `asyncify + wasm-opt -O` tail depends on the binaryen
# fork + opt level. So:
#   - BASE cache  (compile-input key): the --compile-only output (base wasm +
#     sysroot headers). Reused whenever only the binaryen fork / asyncify config
#     changed — the compile is skipped and just the tail reruns.
#   - FINAL cache (base + binaryen SHA + opt level): the post-processed output;
#     fast-path for re-running the same SHA (a tag release reusing main, a re-deploy).
# Both keys include the 3D-viewer flag, so a 3D-on and 3D-off build can never
# poison each other's cache.

on:
  workflow_call:
    inputs:
      opt_level:
        description: "Binaryen wasm-opt shrink level for the asyncify tail (-O1 everywhere; escape hatch for a one-off -O2)"
        type: string
        default: "-O1"
      build_3d_viewer:
        description: "Build the WASM 3D viewer into pcbnew (ON/OFF)"
        type: string
        default: "ON"
      run_tests:
        description: "Run the wxWidgets + KiCad e2e suites after building"
        type: boolean
        default: true
      no_cache:
        description: "Bypass the WASM output caches (force a full rebuild this run)"
        type: boolean
        default: false
      upload_output:
        description: "Upload the publishable output/ subset as the 'wasm-output' artifact"
        type: boolean
        default: false
    secrets:
      # Declared so this reusable workflow may reference ${{ secrets.DISCORD_WEBHOOK_URL }}
      # (an undeclared secret reference is a workflow startup failure). ci-ubicloud.yml
      # passes it via `secrets: inherit`; release.yml doesn't (required: false) → the
      # screenshot/perf report step just no-ops there.
      DISCORD_WEBHOOK_URL:
        required: false

jobs:
  build-and-test:
    name: Build all tools + KiCad e2e (Ubicloud)
    # Don't run untrusted fork PRs on the paid runner (push/dispatch always run;
    # same-repo PRs run). github.event_name here is the CALLER's event.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubicloud-standard-30
    timeout-minutes: 300
    env:
      KICAD_LOG_NESTED: "1"
      # Opt level for the asyncify shrink pass (the only opt-dependent step).
      BINARYEN_OPT_LEVEL: ${{ inputs.opt_level }}
      BUILD_3D_VIEWER: ${{ inputs.build_3d_viewer }}
      # Stable docker-compose project → deterministic build-cache volume name.
      COMPOSE_PROJECT_NAME: kicad-wasm-ci
    steps:
      - name: Install build toolchain (Binaryen from-source)
        run: |
          export DEBIAN_FRONTEND=noninteractive
          sudo apt-get update
          # xvfb: kicad e2e runs headed Firefox under a virtual display.
          # autoconf/automake/make: host wxWidgets + wx test-app builds.
          sudo apt-get install -y cmake ninja-build g++ libjemalloc2 xvfb autoconf automake make

      - uses: actions/checkout@v4
        with: { submodules: recursive }

      - uses: actions/setup-node@v4
        with: { node-version: 20 }

      # --- cache keys --------------------------------------------------------
      # base  = opt-INDEPENDENT (no binaryen / opt level): docker compile out.
      # final = opt-SPECIFIC: post-processed (asyncify + wasm-opt -O) out, keyed
      #   on the binaryen submodule SHA — the host post-process uses that fork's
      #   wasm-opt (--hoist-cpp-catches + --asyncify + -O), so bumping the fork
      #   must bust this cache — plus the opt level.
      # Both include the 3D flag so 3D-on/off never share an entry.
      - name: Compute build inputs
        id: keys
        run: |
          KICAD=$(git -C kicad rev-parse HEAD)
          WX=$(git -C wxwidgets rev-parse HEAD)
          BIN=$(git -C binaryen rev-parse --short HEAD)
          SC=$(node scripts/deploy/wasm-cache-hash.mjs)
          EPOCH=$(cat .ci-cache-epoch 2>/dev/null || echo 0)
          THREED='${{ inputs.build_3d_viewer }}'
          BASE="kbase-${{ runner.os }}-k${KICAD}-wx${WX}-sc${SC}-3d${THREED}-e${EPOCH}"
          FINAL="kwasm-${{ runner.os }}-bin${BIN}${{ inputs.opt_level }}-k${KICAD}-wx${WX}-sc${SC}-3d${THREED}-e${EPOCH}"
          {
            echo "kicad=$KICAD"; echo "wx=$WX"; echo "sc=$SC"; echo "epoch=$EPOCH"
            echo "base_key=$BASE"; echo "final_key=$FINAL"
          } >> "$GITHUB_OUTPUT"

      - name: Cache control (commit message / dispatch)
        id: cachectl
        env:
          HEAD_MSG: ${{ github.event.head_commit.message }}
          PR_TITLE: ${{ github.event.pull_request.title }}
          DISPATCH_NOCACHE: ${{ inputs.no_cache }}
        run: |
          SKIP=false
          if printf '%s\n%s' "$HEAD_MSG" "$PR_TITLE" | grep -qiE '\[(no-cache|rebuild-wasm)\]'; then SKIP=true; fi
          [ "$DISPATCH_NOCACHE" = "true" ] && SKIP=true
          echo "skip=$SKIP" >> "$GITHUB_OUTPUT"
          echo "WASM output-cache restore skip=$SKIP"

      # The cached paths the e2e tests need: final wasms (or base, mid-build) +
      # the sysroot headers the host GAL build compiles against. Same glob set for
      # both tiers — only the bytes (base vs final) and the key differ.
      - name: Restore FINAL WASM output cache
        id: final-cache
        if: steps.cachectl.outputs.skip != 'true'
        uses: actions/cache/restore@v4
        with:
          path: |
            output/*.js
            output/*.wasm
            output/*.wasm.map
            output/*.worker.js
            output/images.tar.gz
            build-wasm/sysroot/include
            !output/*.wasm.debug.wasm
          key: ${{ steps.keys.outputs.final_key }}

      # Only consulted when the final (opt-specific) cache missed: the
      # opt-independent compile output, warm across -O1/-O2.
      - name: Restore BASE compile cache
        id: base-cache
        if: steps.cachectl.outputs.skip != 'true' && steps.final-cache.outputs.cache-hit != 'true'
        uses: actions/cache/restore@v4
        with:
          path: |
            output/*.js
            output/*.wasm
            output/*.wasm.map
            output/*.worker.js
            output/images.tar.gz
            build-wasm/sysroot/include
            !output/*.wasm.debug.wasm
          key: ${{ steps.keys.outputs.base_key }}

      # deps (sysroot + stamps) are only needed when we must COMPILE (base miss).
      - name: Restore deps cache
        id: deps-cache
        if: steps.final-cache.outputs.cache-hit != 'true' && steps.base-cache.outputs.cache-hit != 'true'
        uses: actions/cache@v4
        with:
          path: deps-cache
          key: deps-${{ runner.os }}-${{ hashFiles('scripts/deps/**','scripts/common/versions.sh','scripts/common/functions.sh','scripts/common/env.sh','docker/Dockerfile','docker/docker-compose.yml') }}

      - name: Seed deps volume from cache
        if: steps.final-cache.outputs.cache-hit != 'true' && steps.base-cache.outputs.cache-hit != 'true' && steps.deps-cache.outputs.cache-hit == 'true'
        run: |
          docker volume create kicad-wasm-ci_kicad-build-cache
          docker run --rm -v kicad-wasm-ci_kicad-build-cache:/bw -v "$PWD/deps-cache":/cache \
            alpine sh -c 'tar xzf /cache/deps.tar.gz -C /bw'

      # PHASE 1 (base miss only): container compile of all 6 tools → output/ base
      # wasm (opt-independent). 3D viewer per input. --compile-only skips the host
      # asyncify/-O tail. KICAD_PIPELINE has no effect here (no post-process to
      # overlap), but the deps short-circuit on a warm volume.
      - name: Compile all KiCad tools (container, base wasm)
        if: steps.final-cache.outputs.cache-hit != 'true' && steps.base-cache.outputs.cache-hit != 'true'
        run: |
          export KICAD_DOCKER_CPUS="$(( $(nproc) - 1 ))" KICAD_DOCKER_MEM=110G
          echo "Compiling ALL tools (base wasm), 3D viewer=${BUILD_3D_VIEWER}, -j $(nproc)"
          ./docker/build.sh all --compile-only --build-deps -j "$(nproc)"
          ls -lh output/*.wasm

      - name: Package deps for cache
        if: steps.final-cache.outputs.cache-hit != 'true' && steps.base-cache.outputs.cache-hit != 'true' && steps.deps-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p deps-cache
          docker run --rm -v kicad-wasm-ci_kicad-build-cache:/bw -v "$PWD/deps-cache":/cache \
            alpine sh -c 'cd /bw && tar czf /cache/deps.tar.gz sysroot stamps'

      # GAL test compiles against kicad headers from the docker sysroot volume —
      # export them to the host so they ride in the base cache (and thus any hit).
      - name: Expose docker sysroot headers to host builds
        if: steps.final-cache.outputs.cache-hit != 'true' && steps.base-cache.outputs.cache-hit != 'true'
        run: |
          VOL=kicad-wasm-ci_kicad-build-cache
          mkdir -p build-wasm/sysroot
          docker run --rm -v "$VOL":/bw -v "$PWD/build-wasm/sysroot":/host alpine \
            sh -c 'cp -r /bw/sysroot/include /host/'
          sudo chown -R "$(id -u):$(id -g)" build-wasm/sysroot

      # Save the opt-independent base (compile output + headers) for cross-opt reuse.
      - name: Save BASE compile cache
        if: steps.final-cache.outputs.cache-hit != 'true' && steps.base-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: |
            output/*.js
            output/*.wasm
            output/*.wasm.map
            output/*.worker.js
            output/images.tar.gz
            build-wasm/sysroot/include
            !output/*.wasm.debug.wasm
          key: ${{ steps.keys.outputs.base_key }}

      # PHASE 2 (any final miss): pure-host post-process on the base wasm —
      # dyncall + finalize + asyncify + `wasm-opt ${opt_level}`. The ONLY
      # opt-dependent work. No container; the binaryen submodule fork's wasm-opt
      # is built on demand via scripts/binaryen-hoist-pass/build-wasm-opt.sh.
      - name: Host post-process (asyncify + wasm-opt ${{ inputs.opt_level }})
        if: steps.final-cache.outputs.cache-hit != 'true'
        run: |
          export KICAD_PIPELINE=1 BINARYEN_CORES=16
          echo "Post-processing ALL tools with ${BINARYEN_OPT_LEVEL}"
          ./docker/build.sh all --postprocess-only
          echo "wasm-opt used:"; "$(./scripts/binaryen-hoist-pass/build-wasm-opt.sh 2>/dev/null)" --version || true
          ls -lh output/*.wasm

      - name: Save FINAL WASM output cache
        if: steps.final-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: |
            output/*.js
            output/*.wasm
            output/*.wasm.map
            output/*.worker.js
            output/images.tar.gz
            build-wasm/sysroot/include
            !output/*.wasm.debug.wasm
          key: ${{ steps.keys.outputs.final_key }}

      # --- publishable artifact (release path) -------------------------------
      - name: Upload WASM output artifact
        if: inputs.upload_output
        uses: actions/upload-artifact@v4
        with:
          name: wasm-output
          if-no-files-found: error
          path: |
            output/*.js
            output/*.wasm
            output/*.wasm.map
            output/*.worker.js
            output/images.tar.gz
            !output/*.wasm.debug.wasm

      # --- e2e tests (gated on run_tests) ------------------------------------
      - name: Restore wx build cache
        id: wx-cache
        if: inputs.run_tests
        uses: actions/cache@v4
        with:
          path: build-wasm/wxwidgets
          key: wx-${{ runner.os }}-${{ steps.keys.outputs.wx }}-${{ hashFiles('scripts/build-wx-wasm.sh','scripts/common/versions.sh') }}

      # One shared timestamp, not per-file "now": plain `touch {} +` stamps each file
      # a few ns apart in readdir order, and GNU make 4.x compares ns mtimes — so any
      # object touched before a generated header it depends on (wx/setup.h, pcre2.h
      # via .deps/*.d) looks stale and a random subset recompiles every cache-hit run.
      # Equal mtimes read as up to date.
      - name: Mark restored wx objects current
        if: inputs.run_tests && steps.wx-cache.outputs.cache-hit == 'true'
        run: find build-wasm/wxwidgets -exec touch -d "@$(date +%s)" {} +

      - name: Build wxWidgets (wxUniversal WASM)
        if: inputs.run_tests
        run: ./scripts/build-wx-wasm.sh

      - name: Build wxWidgets test apps
        if: inputs.run_tests
        run: ./scripts/build-wasm-test.sh

      - name: Build GAL WebGL test app
        if: inputs.run_tests
        run: ./scripts/build-gal-webgl-test.sh

      - name: Install test deps
        if: inputs.run_tests
        working-directory: tests
        run: npm ci

      - name: Install web workspace deps (collab bundle)
        if: inputs.run_tests
        working-directory: web
        run: |
          corepack enable
          pnpm install --frozen-lockfile

      - name: Install Playwright browsers
        if: inputs.run_tests
        working-directory: tests
        run: npx playwright install --with-deps firefox chromium

      - name: Stage KiCad WASM for tests
        if: inputs.run_tests
        working-directory: tests
        run: npm run setup:kicad

      - name: wxWidgets e2e (npm run test)
        id: wx_e2e
        if: inputs.run_tests
        working-directory: tests
        run: npm run test

      - name: KiCad e2e (npm run test:kicad:ci)
        id: kicad_e2e
        if: inputs.run_tests
        working-directory: tests
        run: xvfb-run -a npm run test:kicad:ci

      # Runtime-perf E2E (eeschema + pcbnew): measures the current build's
      # load / open+render / FPS and writes tests/test-results/perf-*.json.
      # Track-only — never gates the build (continue-on-error). CI is
      # headless/SwiftShader so FPS is CPU-bound + noisy; openMs is the stable number.
      - name: KiCad runtime perf (track-only, non-gating)
        if: inputs.run_tests
        continue-on-error: true
        working-directory: tests
        run: xvfb-run -a npm run test:perf

      # ON SUCCESS ONLY: screenshot drift gate + Discord report (perf + triptychs).
      # Runs only when the build + e2e passed (so renders and test deps exist).
      # Report-only during rollout: compare.ts exits 0 without --fail-on-change and
      # the step is continue-on-error, so it never blocks the build — flip to gating
      # once the per-engine floors are calibrated (tests/tools/screenshots/config.ts,
      # seeded by `npm run screenshots:noise`). Posts ONLY on push to main and no-ops
      # without DISCORD_WEBHOOK_URL (inert on PRs/forks). No extra build — reads the
      # already-produced test-results (screenshots + perf-*.json).
      - name: Screenshot gate + perf report (on success)
        id: screenshot_report
        if: success() && inputs.run_tests
        working-directory: tests
        env:
          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
          GH_TOKEN: ${{ github.token }}
        # ENFORCING gate: `screenshots:check --fail-on-change` writes report.json and exits
        # nonzero on any changed/added/removed vs the committed baselines. We still post the
        # report (drift triptychs + perf) so the failure is actionable, then exit with the
        # gate's status so a drift fails the build. (A re-render change → re-promote baselines.)
        run: |
          set +e
          npm run screenshots:check -- --fail-on-change; GATE=$?
          npm run screenshots:report -- --e2e pass
          exit $GATE

      # ON FAILURE (build or e2e): a minimal text-only "CI failed" notice, nothing
      # else (no images / no comparison). Uses curl, NOT the TS reporter, because on a
      # build failure the test deps (npm ci) never installed. Main-push only.
      - name: Discord CI-failure notice
        # Build/e2e failure only — NOT a screenshot-gate failure (that already posted the
        # drift report), so we don't double-post "CI failed" on drift.
        if: failure() && steps.screenshot_report.outcome != 'failure' && github.ref == 'refs/heads/main' && github.event_name == 'push'
        continue-on-error: true
        env:
          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
        run: |
          [ -z "$DISCORD_WEBHOOK_URL" ] && { echo "no webhook — skipping"; exit 0; }
          SHORT="$(echo "${{ github.sha }}" | cut -c1-7)"
          URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          SUBJ="$(git log -1 --pretty=%s 2>/dev/null || true)"
          CONTENT="❌ **CI failed** \`$SHORT\` — $SUBJ"$'\n'"$URL"
          jq -n --arg c "$CONTENT" '{content:$c, allowed_mentions:{parse:[]}}' \
            | curl -sS -X POST "$DISCORD_WEBHOOK_URL" -H "Content-Type: application/json" -d @- >/dev/null \
            && echo "posted CI-failure notice"

      - name: Upload test logs & screenshots
        if: always() && inputs.run_tests
        uses: actions/upload-artifact@v4
        with:
          name: ubicloud-e2e-${{ github.run_id }}
          path: |
            tests/logs/**
            tests/test-results/**
            tests/pw-artifacts/**
            tests/playwright-report/**
          if-no-files-found: ignore