# This workflow automatically publishes the rust secure partition binaries for a
#  given release.
#
# Copyright (c) Microsoft Corporation.
# SPDX-License-Identifier: BSD-2-Clause-Patent
#

name: Rust Secure Partition Build

on:
  release:
    types:
      - published
  pull_request:
    branches:
      - main
    paths:
      - ".github/workflows/release-secure-partitions.yml"
      - "FfaFeaturePkg/**"
      - "**/*.toml"

env:
  OUTOUTPUT_DIR: rust-secure-partitions
  BUILD_TARGET: aarch64-unknown-none

jobs:
  build:
    name: Build Rust Secure Partition
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Install Rust Components
        run: |
          cargo install cargo-binutils
          rustup target add ${{ env.BUILD_TARGET }}
          rustup component add llvm-tools

      - name: Build Secure Partitions
        run: |
          mkdir -p ${{ env.OUTOUTPUT_DIR }}

          # arm-virt, TPM-disabled
          cargo build --target=${{ env.BUILD_TARGET }}
          cargo objcopy --target=${{ env.BUILD_TARGET }} -- -O binary ${{ env.OUTOUTPUT_DIR }}/msft-sp-virt.bin
          cp target/${{ env.BUILD_TARGET }}/debug/msft-sp ${{ env.OUTOUTPUT_DIR }}/msft-sp-virt.elf

          # arm-virt, TPM-enabled
          cargo build --target=${{ env.BUILD_TARGET }} --features tpm
          cargo objcopy --target=${{ env.BUILD_TARGET }} --features tpm -- -O binary ${{ env.OUTOUTPUT_DIR }}/msft-sp-virt-tpm.bin
          cp target/${{ env.BUILD_TARGET }}/debug/msft-sp ${{ env.OUTOUTPUT_DIR }}/msft-sp-virt-tpm.elf

          cp Cargo.lock ${{ env.OUTOUTPUT_DIR }}/Cargo.lock

      - name: Package Files
        run: |
          zip -r ${{ runner.temp }}/rust-secure-partitions-${{ github.event.release.tag_name }}.zip rust-secure-partitions/* ;
          tar -czf ${{ runner.temp }}/rust-secure-partitions-${{ github.event.release.tag_name }}.tar.gz rust-secure-partitions/*

      - name: Upload Release Asset
        if: github.event_name == 'release'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ github.event.release.tag_name }} ${{ runner.temp }}/rust-secure-partitions-*.zip
          gh release upload ${{ github.event.release.tag_name }} ${{ runner.temp }}/rust-secure-partitions-*.tar.gz