name: CI
on:
  # SECURITY: This must be a push event only, otherwise our M1 mac runner would be compromised by
  # third-party pull requests which could run arbitrary code. This way, we can restrict it to
  # collaborators of the repository only.
  #
  # Whenever GitHub Actions gets official M1 support, we can use that for PRs and get rid of this
  # self-hosted runner: https://github.com/actions/virtual-environments/issues/2187
  - push
jobs:
  aarch64-macos:
    if: ${{ github.repository == 'hexops/mach' }}
    runs-on: [self-hosted, macOS, ARM64]
    defaults:
      run:
        shell: '/usr/bin/arch -arch arm64e /bin/bash --noprofile --norc -eo pipefail {0}'
    steps:
      - name: Clean repository submodules
        # See https://github.com/actions/checkout/issues/385
        run: |
          rm -rf $GITHUB_WORKSPACE && mkdir $GITHUB_WORKSPACE
      - name: Checkout
        uses: actions/checkout@v2
      - name: Setup Zig
        run: |
          sudo rm -rf /usr/local/bin/zig /usr/local/bin/lib/
          sudo sh -c 'wget -c https://ziglang.org/builds/zig-macos-aarch64-0.10.0-dev.4333+f5f28e0d2.tar.xz -O - | tar -xJ --strip-components=1 -C /usr/local/bin'
      - name: mach::test
        run: zig build test
        env:
          AGREE: true
      - name: compile all examples
        run: zig build compile-all
        env:
          AGREE: true
      - name: compile all examples (WASM)
        run: zig build compile-all -Dtarget=wasm32-freestanding-none