name: ci

on:
  push:
  pull_request:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  linux:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        cc: [gcc, clang]
    steps:
      - name: Checkout
        env:
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
            -o /tmp/ci_checkout.sh
          bash /tmp/ci_checkout.sh
      - name: Install dependencies
        run: |
          SUDO=$(command -v sudo || true)
          $SUDO bash scripts/ci_pkg_mirror.sh
          $SUDO apt-get update
          $SUDO apt-get install -y --no-install-recommends \
            build-essential clang cmake pkg-config python3 \
            libcurl4-openssl-dev libncurses-dev
      - name: Build (warnings are errors)
        run: make CC=${{ matrix.cc }} CFLAGS="-std=c11 -Wall -Wextra -O2 -g -Werror" -j"$(nproc)"
      - name: Unit tests
        run: make CC=${{ matrix.cc }} check
      - name: CMake build + ctest
        run: |
          cmake -B build -DCMAKE_C_COMPILER=${{ matrix.cc }} -DCST_BUILD_TUI=ON
          cmake --build build -j"$(nproc)"
          ctest --test-dir build --output-on-failure
      - name: Smoke test
        run: |
          ./cst-agent --help
          ./cst-agent --workspace "$PWD" --list-sessions
          ./cst-agent --demo-ctl --workspace .

  # Disabled: Docker runner lacks SYS_PTRACE; ASan spins on DEADLYSIGNAL and
  # wedged the only runner. Re-enable after the runner gets --cap-add SYS_PTRACE
  # (or seccomp=unconfined).
  sanitizers:
    if: false
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        env:
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
            -o /tmp/ci_checkout.sh
          bash /tmp/ci_checkout.sh
      - name: Install dependencies
        run: |
          SUDO=$(command -v sudo || true)
          $SUDO bash scripts/ci_pkg_mirror.sh
          $SUDO apt-get update
          $SUDO apt-get install -y --no-install-recommends \
            build-essential pkg-config libcurl4-openssl-dev libncurses-dev
      - name: ASan + UBSan
        timeout-minutes: 10
        env:
          ASAN_OPTIONS: abort_on_error=1:halt_on_error=1:detect_leaks=0:use_sigaltstack=0
          UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
        run: timeout -s KILL 480 make asan

  musl:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    container: alpine:3.20
    steps:
      - name: Install tools + mirror
        run: |
          sed -i 's#https\?://dl-cdn.alpinelinux.org/alpine#https://mirrors.tuna.tsinghua.edu.cn/alpine#g' \
            /etc/apk/repositories
          apk add --no-cache curl git bash
      - name: Checkout
        env:
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
            -o /tmp/ci_checkout.sh
          bash /tmp/ci_checkout.sh
      - name: Install build dependencies
        run: apk add --no-cache build-base pkgconf curl-dev ncurses-dev git nodejs bash python3
      - name: Build + unit tests
        run: |
          make CFLAGS="-std=c11 -Wall -Wextra -O2 -Werror" -j"$(nproc)"
          make check

  # MinGW-w64 UCRT cross build → dist/cst-agent-*-windows-x86_64.zip
  windows-cross:
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - name: Checkout
        env:
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
            -o /tmp/ci_checkout.sh
          bash /tmp/ci_checkout.sh
      - name: Install host tools
        run: |
          SUDO=$(command -v sudo || true)
          $SUDO bash scripts/ci_pkg_mirror.sh
          $SUDO apt-get update
          $SUDO apt-get install -y --no-install-recommends \
            ca-certificates curl git cmake ninja-build make pkg-config \
            python3 zip perl xz-utils
      - name: Install Nix (TUNA)
        run: |
          if ! command -v nix-shell >/dev/null; then
            curl -L https://mirrors.tuna.tsinghua.edu.cn/nix/latest/install | sh -s -- --no-daemon
          fi
          mkdir -p "$HOME/.config/nix"
          printf '%s\n' \
            'substituters = https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store https://cache.nixos.org/' \
            'trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' \
            > "$HOME/.config/nix/nix.conf"
          # shellcheck source=/dev/null
          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
          nix --version
      - name: Proxy GitHub for third_party clones
        run: |
          # curl/busybox-w32/ncurses sources; skip if the proxy is down
          git config --global url."https://gitclone.com/github.com/".insteadOf "https://github.com/"
      - name: Cross-build Windows zip
        run: |
          # shellcheck source=/dev/null
          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
          nix-shell shell-win.nix --run 'scripts/bootstrap_windows.sh .'
      - name: Verify zip
        run: |
          ls -lah dist/windows-x86_64/
          ls -lah dist/cst-agent-*-windows-x86_64.zip
          cat dist/cst-agent-*-windows-x86_64.zip.sha256
          unzip -l dist/cst-agent-*-windows-x86_64.zip | head -20