cross-language-validate.yml

name: Cross-Language Validate

on:
  workflow_call:
    inputs:
      ref:
        description: Git ref to validate
        required: false
        type: string

# No workflow-level concurrency: this workflow only runs when called, and
# `github.workflow` resolves to the caller's name, so a group built from it
# collides with the concurrency group the calling run already holds -- the
# called job then never starts and the whole run fails with no logs. Callers
# serialize their own releases.

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.ref }}

      # release-cross-language-check.sh runs smoke-wrapper-monorepo.sh, which
      # exits 1 without this fixture. Without the checkout the whole gate fails
      # before it validates anything.
      - name: Checkout ballast-examples repo
        uses: actions/checkout@v7
        with:
          repository: everydaydevopsio/ballast-examples
          path: .ci/ballast-examples

      - name: Setup pnpm
        uses: pnpm/action-setup@v6.1.0
        with:
          version: 10.27.0

      - name: Setup uv
        uses: astral-sh/setup-uv@v7

      - name: Setup Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.12'

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: packages/ballast-go/go.mod

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build TypeScript CLI
        run: pnpm run build

      - name: Build Go CLIs
        run: |
          set -euo pipefail
          mkdir -p "$GITHUB_WORKSPACE/.ci/bin"
          BALLAST_VERSION="$(node -p "require('./packages/ballast-typescript/package.json').version")"
          # The wrapper prefers a ballast-go sitting next to it over the
          # installer path, so this build must carry the stamp itself.
          go build -C packages/ballast-go -ldflags "-X main.ballastVersion=${BALLAST_VERSION}" -o "$GITHUB_WORKSPACE/.ci/bin/ballast-go" ./cmd/ballast-go
          go build -C cli/ballast -o "$GITHUB_WORKSPACE/.ci/bin/ballast" .
          echo "$GITHUB_WORKSPACE/.ci/bin" >> "$GITHUB_PATH"

      - name: Create local backend shims
        run: |
          set -euo pipefail
          cat > "$GITHUB_WORKSPACE/.ci/bin/ballast-typescript" <<'EOF'
          #!/usr/bin/env bash
          set -euo pipefail
          node "$GITHUB_WORKSPACE/packages/ballast-typescript/dist/cli.js" "$@"
          EOF
          chmod +x "$GITHUB_WORKSPACE/.ci/bin/ballast-typescript"

          cat > "$GITHUB_WORKSPACE/.ci/bin/ballast-python" <<'EOF'
          #!/usr/bin/env bash
          set -euo pipefail
          PYTHONPATH="$GITHUB_WORKSPACE/packages/ballast-python${PYTHONPATH:+:$PYTHONPATH}" python3 -m ballast "$@"
          EOF
          chmod +x "$GITHUB_WORKSPACE/.ci/bin/ballast-python"

      - name: Run cross-language validation
        run: ./scripts/release-cross-language-check.sh