Declare it.
Forge builds it.

[project]
name = "demo"
description = "A complete build manifest"

[vars]
VERSION = "1.0"
POSTGRESQL_VERSION = "17"

[[components]]
name = "base"
ops = [
  { packages = { build = ["build-essential", "pkg-config"],
                 runtime = ["curl", "ca-certificates"],
                 conditional = [{ category = "build",
                                  when = { var = "POSTGRESQL_VERSION", gte = "17" },
                                  packages = ["bison", "flex"] }] } },
  { user = { name = "app", create_home = true, system = true,
             shell = "/bin/bash" } },
  { mkdir = [{ path = "/opt/app", mode = "0755", owner = "app" }] },
]

[[components]]
name = "app"
ops = [
  { source_install = { type = "archive",
                       url = "https://example.com/app-${VERSION}.tar.gz",
                       strategy = "configure",
                       prefix = "/usr/local/app",
                       flags = ["--with-ssl"],
                       jobs = 4 } },
  { verify = [{ file = "/usr/local/app/bin/app" }] },
]

[[components]]
name = "metrics"
ops = [
  { binary_install = { url = "https://example.com/metrics.tar.gz",
                       copy = [{ from = "metrics", to = "/usr/local/bin/metrics",
                                 mode = "0755" }] } },
  { raw = "systemctl daemon-reload" },
]

# Build packages are removed after all components finish.
# Runtime packages are kept. Remove packages are explicitly stripped.
# Conditional packages gate behind version checks.

[[components]]
name = "deps"
ops = [
  { packages = { build    = ["build-essential", "pkg-config"],
                 runtime  = ["curl", "ca-certificates"],
                 remove   = ["vim-tiny", "nano"],
                 conditional = [{ category = "build",
                                  when = { var = "POSTGRESQL_VERSION", gte = "17" },
                                  packages = ["bison", "flex"] }] } },
]

# Fetch source (archive or git), build with the chosen strategy,
# run before/after hooks, and verify outputs.

[[components]]
name = "app"
ops = [
  { source_install = { type = "archive",
                       url = "https://example.com/app-${VERSION}.tar.gz",
                       ref = "",
                       strategy = "configure",
                       prefix = "/usr/local/app",
                       flags = ["--with-ssl"],
                       jobs = 4,
                       before = [{ raw = "echo preparing" }],
                       after  = [{ verify = [{ file = "/usr/local/app/bin/app" }] }] } },
]

# Download an archive and copy prebuilt binaries into place.

[[components]]
name = "tools"
ops = [
  { binary_install = { url = "https://example.com/tools.tar.gz",
                       copy = [{ from = "tool-a", to = "/usr/local/bin/tool-a",
                                 mode = "0755" },
                               { from = "tool-b", to = "/usr/local/bin/tool-b",
                                 mode = "0755" }] } },
]

# Users, directories, permissions, ownership, file copy, code generation.

[[components]]
name = "setup"
ops = [
  { user  = { name = "app", create_home = true, system = true, shell = "/bin/bash" } },
  { mkdir = [{ path = "/opt/app", mode = "0755", owner = "app" }] },
  { copy  = [{ from = "conf/app.toml", to = "/etc/app/app.toml", mode = "0644" }] },
  { chown = [{ path = "/var/log/app.log", owner = "app", group = "app", recursive = true }] },
  { chmod = [{ path = "/opt/app/run.sh", mode = "0700" }] },
  { touch = ["/var/log/app.log"] },
  { generate = { tool = "protoc-c", input = "proto/msg.proto",
                 out = "gen", flags = ["--proto_path=proto"] } },
  { verify = [{ file = "/usr/local/app/bin/app" }] },
]