sbt-compatibility.yml

name: sbt / Mill / scala-cli compatibility

# Real sbt releases through every mode, plus Mill and scala-cli, all driven
# by scripts/sbt-compat-matrix.sh (docs/testing/sbt-compatibility.md):
#
# - docker: the six probed sbt lines x {agent, hosted, vendored} in the
#   tests/docker/Dockerfile.sbt image. sbt <= 1.3.13 runs on JDK 8 (sbt
#   1.3.x is the last line whose launcher still boots there and the first
#   on Coursier), later lines on JDK 17, plus JDK 21 legs for 1.13.0 and
#   2.0.9. 0.13.18 = the 0.13 syntax line; 1.2.8 = last Ivy-default 1.x
#   (the offline-ordering boundary); 1.3.13 = first Coursier line; 1.9.9 =
#   mid 1.x; 1.13.0 = current 1.x; 2.0.9 = sbt 2.
# - scala-tools: the Mill agent cells (0.11.13 and 0.12.17 over `build.sc`,
#   1.1.10 over `build.mill`; the image installs all three) and the
#   scala-cli agent + vendored cells.
# - native: sbt 1.13.0 hosted + vendored on macOS and Windows runners with
#   a host JDK and the sbt launcher (no Docker there).
#
# ci.yml runs the small blocking slice on every PR (agent 1.2.8 + 1.13.0 in
# coverage-docker, hosted + vendored 1.13.0 on ubuntu in e2e).

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    # Everything the agent, hosted and vendored cells run through, shared
    # engine code included (as composer-compatibility.yml does).
    paths:
      - '.github/workflows/sbt-compatibility.yml'
      - 'scripts/sbt-compat-matrix.sh'
      - 'scripts/sbt-warm-seed.sh'
      - 'docs/testing/sbt-compatibility.md'
      - 'tests/docker/Dockerfile.sbt'
      - 'tests/docker/Dockerfile.base'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'crates/*/Cargo.toml'
      - 'crates/socket-patch-core/src/formats/**'
      - 'crates/socket-patch-core/src/crawlers/**'
      - 'crates/socket-patch-core/src/hosted/**'
      - 'crates/socket-patch-core/src/patch/**'
      - 'crates/socket-patch-core/src/manifest/**'
      - 'crates/socket-patch-core/src/api/**'
      - 'crates/socket-patch-core/src/utils/**'
      - 'crates/socket-patch-core/src/vendor/**'
      - 'crates/socket-patch-core/src/vex/**'
      - 'crates/socket-patch-cli/src/**'
      - 'crates/socket-patch-cli/tests/docker_e2e_sbt.rs'
      - 'crates/socket-patch-cli/tests/e2e_sbt_build.rs'
      - 'crates/socket-patch-cli/tests/e2e_sbt_vendor_build.rs'
      - 'crates/socket-patch-cli/tests/e2e_scala_cli_vendor.rs'
      - 'crates/socket-patch-cli/tests/sbt_build_common/**'
      - 'crates/socket-patch-cli/tests/sbt_vendor_build_common/**'
      - 'crates/socket-patch-cli/tests/sbt_e2e_shared/**'
      - 'crates/socket-patch-cli/tests/sbt_common/**'
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: sbt-compat-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  SOCKET_NO_CONFIG: '1'
  SOCKET_NO_UPDATE_CHECK: '1'
  SOCKET_TELEMETRY_DISABLED: '1'

jobs:
  image:
    if: github.event.pull_request.draft != true
    # Builds the sbt image once (base image first: Dockerfile.sbt is
    # `FROM socket-patch-test-base:latest`) and hands it to every leg.
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        # `driver: docker` so `FROM socket-patch-test-base:latest` resolves
        # against the host daemon (as in ci.yml's coverage-docker job).
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
        with:
          driver: docker

      # No `actions/cache`: this job builds Docker images (zizmor
      # cache-poisoning audit), as in ci.yml's docker jobs.

      - name: Build base image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: tests/docker/Dockerfile.base
          tags: socket-patch-test-base:latest
          load: true

      - name: Build sbt image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: tests/docker
          file: tests/docker/Dockerfile.sbt
          tags: socket-patch-test-sbt:latest
          load: true

      - name: Save sbt image
        run: |
          mkdir -p sbt-image
          docker save --output sbt-image/socket-patch-test-sbt.tar socket-patch-test-sbt:latest

      - uses: ./.github/actions/upload-artifact
        with:
          name: sbt-image
          path: sbt-image/socket-patch-test-sbt.tar
          if-no-files-found: error
          retention-days: 3

  linux-bins:
    if: github.event.pull_request.draft != true
    # The Linux socket-patch and the real-tool test binaries (docker_e2e_sbt's
    # host side too, so no leg compiles), built once in the script's pinned
    # rust container. Absolute paths are kept (`tar -P`):
    # the test binaries carry their compile-time paths, and every leg checks
    # out to the same workspace path.
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Build
        run: |
          set -euo pipefail
          scripts/sbt-compat-matrix.sh --build-only > sbt-bins.txt
          cat sbt-bins.txt
          mkdir -p sbt-bins
          tar -cPf sbt-bins/sbt-linux-bins.tar -T sbt-bins.txt

      - uses: ./.github/actions/upload-artifact
        with:
          name: sbt-linux-bins
          path: sbt-bins/sbt-linux-bins.tar
          if-no-files-found: error
          retention-days: 3

  docker:
    name: sbt ${{ matrix.sbt }} / jdk ${{ matrix.jdk }} / ${{ matrix.group }}
    needs: [image, linux-bins]
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        group: [agent, hosted, vendored]
        sbt: ['0.13.18', '1.2.8', '1.3.13', '1.9.9', '1.13.0', '2.0.9']
        jdk: ['8', '17']
        exclude:
          - {sbt: '0.13.18', jdk: '17'}
          - {sbt: '1.2.8', jdk: '17'}
          - {sbt: '1.3.13', jdk: '17'}
          - {sbt: '1.9.9', jdk: '8'}
          - {sbt: '1.13.0', jdk: '8'}
          - {sbt: '2.0.9', jdk: '8'}
        include:
          - {group: agent, sbt: '1.13.0', jdk: '21'}
          - {group: hosted, sbt: '1.13.0', jdk: '21'}
          - {group: vendored, sbt: '1.13.0', jdk: '21'}
          - {group: agent, sbt: '2.0.9', jdk: '21'}
          - {group: hosted, sbt: '2.0.9', jdk: '21'}
          - {group: vendored, sbt: '2.0.9', jdk: '21'}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Download the sbt image and Linux binaries
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: sbt-*
          merge-multiple: true
          path: sbt-artifacts

      - name: Load the sbt image and Linux binaries
        run: |
          set -euo pipefail
          docker load --input sbt-artifacts/socket-patch-test-sbt.tar
          tar -xPf sbt-artifacts/sbt-linux-bins.tar
          rm -rf sbt-artifacts

      - name: Run the ${{ matrix.group }} group
        env:
          SBT_GROUP: ${{ matrix.group }}
          SBT_VERSION: ${{ matrix.sbt }}
          SBT_JDK: ${{ matrix.jdk }}
        run: scripts/sbt-compat-matrix.sh --group "$SBT_GROUP" --version "$SBT_VERSION" --jdk "$SBT_JDK" --skip-build

      - name: Upload the raw logs
        if: failure()
        uses: ./.github/actions/upload-artifact
        with:
          name: sbt-logs-${{ matrix.group }}-${{ matrix.sbt }}-jdk${{ matrix.jdk }}
          path: target/linux/sbt-matrix-logs/
          if-no-files-found: ignore
          retention-days: 7

  scala-tools:
    # Mill 0.11.13 / 0.12.17 / 1.1.10 agent; scala-cli 1.17.1 agent +
    # vendored (the versions the image installs).
    name: ${{ matrix.group }} ${{ matrix.version }}
    needs: [image, linux-bins]
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - {group: mill, version: '0.11.13'}
          - {group: mill, version: '0.12.17'}
          - {group: mill, version: '1.1.10'}
          - {group: scala-cli, version: '1.17.1'}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Download the sbt image and Linux binaries
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: sbt-*
          merge-multiple: true
          path: sbt-artifacts

      - name: Load the sbt image and Linux binaries
        run: |
          set -euo pipefail
          docker load --input sbt-artifacts/socket-patch-test-sbt.tar
          tar -xPf sbt-artifacts/sbt-linux-bins.tar
          rm -rf sbt-artifacts

      - name: Run the ${{ matrix.group }} group
        env:
          SBT_GROUP: ${{ matrix.group }}
          TOOL_VERSION: ${{ matrix.version }}
        run: scripts/sbt-compat-matrix.sh --group "$SBT_GROUP" --version "$TOOL_VERSION" --skip-build

      - name: Upload the raw logs
        if: failure()
        uses: ./.github/actions/upload-artifact
        with:
          name: sbt-logs-${{ matrix.group }}-${{ matrix.version }}
          path: target/linux/sbt-matrix-logs/
          if-no-files-found: ignore
          retention-days: 7

  native:
    # Hosted + vendored on sbt 1.13.0 with sbt on the host: the launcher
    # from sbt/setup-sbt, a Temurin JDK 17, the tests' own native runner.
    # The warm-seed step boots sbt once so the tests share its caches.
    name: sbt 1.13.0 ${{ matrix.suite }} / ${{ matrix.os }}
    if: github.event.pull_request.draft != true
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
        suite: [e2e_sbt_build, e2e_sbt_vendor_build]
        exclude:
          # macOS legs run on push to main (and nightly where scheduled), not per PR push.
          - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - run: rustup show
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          shared-key: dev-${{ matrix.os }}
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: temurin
          java-version: '17'
      - uses: sbt/setup-sbt@6158cb0903b8ceeae04f830055f3155e1b6a5ad7 # v1.5.11
        with:
          sbt-runner-version: 1.13.0
          disk-cache: false
      - name: Keep temp dirs on the seed's volume
        # The tests hard-link the warm seed into each temp dir; on Windows
        # %TEMP% (C:) and $RUNNER_TEMP (D:) are different volumes, where
        # every link would fall back to a full copy.
        shell: bash
        run: |
          {
            echo "TMPDIR=$RUNNER_TEMP"
            echo "TEMP=$RUNNER_TEMP"
            echo "TMP=$RUNNER_TEMP"
          } >> "$GITHUB_ENV"
      - name: Warm the sbt seed
        shell: bash
        run: scripts/sbt-warm-seed.sh 1.13.0 "$RUNNER_TEMP/sbt-seed" >> "$GITHUB_ENV"
      - name: Real-sbt ${{ matrix.suite }}
        shell: bash
        env:
          SOCKET_PATCH_SBT_E2E_VERSION: 1.13.0
          SOCKET_PATCH_SBT_E2E_REQUIRED: '1'
          SBT_SUITE: ${{ matrix.suite }}
        run: cargo test -p socket-patch-cli --test "$SBT_SUITE" -- --ignored --test-threads=1