csharp.yml

name: Build and Test CSharp
on:
  workflow_call:
  pull_request:
    paths:
      - payjoin-ffi/**
      # The unix jobs run inside the flake's csharp dev shell, so changes to
      # the flake change this workflow's environment.
      - flake.nix
      - flake.lock

permissions:
  contents: read

jobs:
  # Pull requests run only the Linux build and test job. The other jobs
  # cover macOS, Windows and packaging, and run on bindings releases and
  # the daily run.
  build-csharp-and-test-linux:
    name: "Build and test csharp"
    runs-on: ubuntu-26.04
    env:
      RUSTUP_TOOLCHAIN: 1.85.0
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # unneeded: no git auth beyond checkout
      - name: "Install Rust 1.85.0"
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
        with:
          toolchain: 1.85.0
      - name: "Use cache"
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          lookup-only: ${{ startsWith(github.ref, 'refs/tags/') }}
          shared-key: msrv-workspace
      - name: Set up nix
        uses: $/.github/actions/setup-nix
      - name: "Build and test"
        run: nix develop .#csharp -c ./payjoin-ffi/csharp/contrib/test.sh

  build-csharp-and-test-macos:
    name: "Build and test csharp (macos)"
    if: github.event_name != 'pull_request'
    runs-on: macos-latest
    env:
      RUSTUP_TOOLCHAIN: 1.85.0
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # unneeded: no git auth beyond checkout
      - name: "Install Rust 1.85.0"
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
        with:
          toolchain: 1.85.0
      - name: "Use cache"
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          lookup-only: ${{ startsWith(github.ref, 'refs/tags/') }}
          shared-key: msrv-workspace
      - name: Set up nix
        uses: $/.github/actions/setup-nix
      - name: "Build and test"
        run: nix develop .#csharp -c ./payjoin-ffi/csharp/contrib/test.sh

  build-csharp-and-test-windows:
    name: "Build and test csharp (windows)"
    if: github.event_name != 'pull_request'
    runs-on: windows-latest
    env:
      RUSTUP_TOOLCHAIN: 1.85
    defaults:
      run:
        working-directory: payjoin-ffi/csharp
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # unneeded: no git auth beyond checkout
      - name: Install Rust 1.85.0
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
        with:
          toolchain: 1.85.0

      - name: Use cache
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          lookup-only: ${{ startsWith(github.ref, 'refs/tags/') }}

      - name: Install .NET 10 SDK
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: "10.0.x"

      - name: Verify .NET SDK
        run: |
          dotnet --version
          dotnet --list-sdks

      - name: Generate bindings and binaries
        shell: pwsh
        run: ./scripts/generate_bindings.ps1

      - name: Run tests
        run: dotnet test Payjoin.Tests.csproj --logger "console;verbosity=minimal"

  build-nuget-native:
    # Every RID cross-compiles from Linux: cargo-zigbuild links the Linux targets
    # against a pinned glibc floor and the macOS targets against zig's bundled
    # libSystem stubs; cargo-xwin links MSVC-ABI Windows targets against the
    # Microsoft CRT/SDK. The per-RID smoke jobs verify each produced asset on
    # real hardware.
    name: "Build NuGet native asset"
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-26.04
    env:
      # Must match the dtolnay/rust-toolchain version exactly: the cross-target
      # std components are installed for that toolchain, and a partial version
      # here selects a different rustup toolchain entry without them (E0463).
      RUSTUP_TOOLCHAIN: 1.85.0
    defaults:
      run:
        working-directory: payjoin-ffi/csharp
    strategy:
      # Let every RID report its own result; a failure in one target should not
      # cancel the signal from the others.
      fail-fast: false
      matrix:
        include:
          - rid: linux-arm64
            target: aarch64-unknown-linux-gnu
          - rid: linux-x64
            target: x86_64-unknown-linux-gnu
          - rid: osx-arm64
            target: aarch64-apple-darwin
          - rid: osx-x64
            target: x86_64-apple-darwin
          - rid: win-arm64
            target: aarch64-pc-windows-msvc
          - rid: win-x64
            target: x86_64-pc-windows-msvc
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # unneeded: no git auth beyond checkout

      - name: Install Rust 1.85.0
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
        with:
          toolchain: 1.85.0
          targets: ${{ matrix.target }}

      - name: Use cache
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          lookup-only: ${{ startsWith(github.ref, 'refs/tags/') }}

      - name: Install cross toolchain
        # Version- and hash-pinned: these tools produce the shipped binaries.
        run: pip install --require-hashes -r scripts/cross-requirements.txt

      - name: Install MSVC toolchain frontends (clang-cl, llvm-lib)
        if: startsWith(matrix.rid, 'win-')
        # cargo-xwin compiles C dependencies with clang-cl and archives them with
        # llvm-lib. The runner image ships LLVM with versioned binary names only,
        # so expose the unversioned names cc-rs looks for.
        run: |
          for tool in clang-cl llvm-lib; do
            if command -v "$tool" >/dev/null; then
              continue
            fi
            latest=$(ls -1 /usr/bin/"$tool"-* 2>/dev/null | sort -V | tail -n 1)
            if [ -z "$latest" ]; then
              sudo apt-get update -q
              sudo apt-get install -y -q llvm clang
              latest=$(ls -1 /usr/bin/"$tool"-* 2>/dev/null | sort -V | tail -n 1)
            fi
            if [ -z "$latest" ]; then
              echo "$tool not found on the runner" >&2
              exit 1
            fi
            sudo ln -s "$latest" /usr/local/bin/"$tool"
          done
          command -v clang-cl llvm-lib

      - name: Build release native asset
        run: |
          PAYJOIN_FFI_CROSS=1 PAYJOIN_FFI_RID=${{ matrix.rid }} bash ./scripts/build_nuget_native.sh

      - name: Upload NuGet native asset
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ matrix.rid }}
          path: payjoin-ffi/csharp/artifacts/runtimes/${{ matrix.rid }}/native/*
          if-no-files-found: error

  pack-nuget:
    name: "Pack C# NuGet package"
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-26.04
    needs: build-nuget-native
    env:
      # Exact version so the packaged bindings build with the toolchain the
      # action installs, not an implicitly-installed latest 1.85.x.
      RUSTUP_TOOLCHAIN: 1.85.0
    defaults:
      run:
        working-directory: payjoin-ffi/csharp
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # unneeded: no git auth beyond checkout

      - name: Install Rust 1.85.0
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
        with:
          toolchain: 1.85.0

      - name: Use cache
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          lookup-only: ${{ startsWith(github.ref, 'refs/tags/') }}

      - name: Install .NET 10 SDK
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: "10.0.x"

      - name: Download native assets
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: payjoin-ffi/csharp/artifacts/downloaded

      - name: Assemble RID assets
        run: |
          for rid in linux-arm64 linux-x64 osx-arm64 osx-x64 win-arm64 win-x64; do
            mkdir -p "artifacts/runtimes/$rid/native"
            cp "artifacts/downloaded/$rid"/* "artifacts/runtimes/$rid/native/"
          done

      - name: Generate production bindings
        run: |
          PAYJOIN_FFI_FEATURES= PAYJOIN_FFI_PROFILE=release bash ./scripts/generate_bindings.sh

      - name: Pack NuGet package
        run: dotnet pack Payjoin.csproj --configuration Release --output artifacts/packages

      - name: Upload NuGet package
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: payjoin-csharp-nuget-package
          path: payjoin-ffi/csharp/artifacts/packages/*.nupkg
          if-no-files-found: error

  smoke-nuget:
    name: "Smoke test C# NuGet package"
    if: github.event_name != 'pull_request'
    runs-on: ${{ matrix.os }}
    needs: pack-nuget
    defaults:
      run:
        working-directory: payjoin-ffi/csharp
    strategy:
      matrix:
        include:
          - os: ubuntu-26.04-arm
            rid: linux-arm64
          - os: ubuntu-26.04
            rid: linux-x64
          - os: macos-latest
            rid: osx-arm64
          - os: macos-15-intel
            rid: osx-x64
          - os: windows-11-arm
            rid: win-arm64
          - os: windows-latest
            rid: win-x64
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # unneeded: no git auth beyond checkout

      - name: Install .NET 10 SDK
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: "10.0.x"

      - name: Download NuGet package
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: payjoin-csharp-nuget-package
          path: payjoin-ffi/csharp/artifacts/packages

      - name: Run package smoke test
        shell: bash
        # 'auto' derives the version from the packed artifact, so Payjoin.csproj
        # stays the only place the package version is maintained.
        run: bash ./scripts/smoke_nuget_package.sh artifacts/packages auto ${{ matrix.rid }}