name: ci

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Verification: TinyCC builds and tests everything in seconds. tcc warns on
  # `#pragma GCC`, so no -Werror here; the gcc release builds below carry it.
  tcc-check:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        env:
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
            -o /tmp/ci_checkout.sh
          bash /tmp/ci_checkout.sh
      - name: Install dependencies
        run: |
          SUDO=$(command -v sudo || true)
          $SUDO bash scripts/ci_pkg_mirror.sh
          $SUDO apt-get update
          $SUDO apt-get install -y --no-install-recommends \
            build-essential pkg-config python3 curl ca-certificates \
            libcurl4-openssl-dev libncurses-dev
      - name: Build TinyCC
        run: bash scripts/ci_tcc.sh
      - name: Build
        run: make CC=tcc AR=ar CFLAGS="-std=c11 -Wall -O2 -g" -j"$(nproc)" hermit
      - name: Unit tests
        run: make CC=tcc AR=ar CFLAGS="-std=c11 -Wall -O2 -g" check
      - name: Smoke test
        run: |
          ./hermit --help
          ./hermit --workspace "$PWD" --list-sessions
          ./hermit --demo-ctl --workspace .
      - name: WebUI end-to-end (recorded stream, no API key)
        run: sh scripts/e2e_webui.sh

  # Release: static musl binaries, gcc with -Werror.
  # dist/cst-agent-VERSION-linux-ARCH.tar.gz
  linux:
    needs: tcc-check
    runs-on: ubuntu-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
            check: 1
          - arch: x86
            check: 1
          - arch: aarch64
            check: 0
    steps:
      - name: Checkout
        env:
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
            -o /tmp/ci_checkout.sh
          bash /tmp/ci_checkout.sh
      - name: Install host tools
        run: |
          SUDO=$(command -v sudo || true)
          $SUDO bash scripts/ci_pkg_mirror.sh
          $SUDO apt-get update
          # ncurses-bin/-term: tic, infocmp and the fallback terminal entries
          $SUDO apt-get install -y --no-install-recommends \
            build-essential cmake ninja-build pkg-config python3 perl \
            curl ca-certificates xz-utils bzip2 file ncurses-bin ncurses-term
          if [ "${{ matrix.arch }}" = aarch64 ]; then
            $SUDO apt-get install -y --no-install-recommends qemu-user-static
          fi
      - name: Cache musl toolchain + third_party prefix
        uses: actions/cache@v4
        with:
          path: |
            ${{ env.HOME }}/.local/toolchains
            /opt/*musl*
            third_party/prefix-linux-${{ matrix.arch }}
            third_party/src
          key: linux-${{ matrix.arch }}-tp-v1-${{ hashFiles('scripts/build_third_party_linux.sh', 'scripts/ci_linux_toolchain.sh') }}
          restore-keys: |
            linux-${{ matrix.arch }}-tp-v1-
      - name: Build (static, -Werror)
        env:
          CST_LINUX_CHECK: ${{ matrix.check }}
        run: bash scripts/package_linux.sh ${{ matrix.arch }}
      - name: Smoke test
        run: |
          d=$(ls -d dist/hermit-*-linux-${{ matrix.arch }})
          file "$d/hermit"
          run=""
          [ "${{ matrix.arch }}" = aarch64 ] && run=qemu-aarch64-static
          $run "$d/hermit" --version
          $run "$d/hermit" --help >/dev/null
          $run "$d/hermit" --workspace "$PWD" --list-sessions
          cat dist/hermit-*-linux-${{ matrix.arch }}.tar.gz.sha256
      # Release vVERSION (from include/cst_version.h) on Gitea. Prefer repo
      # secret RELEASE_TOKEN (write:repository); fall back to the job token.
      - name: Publish Gitea Release
        if: github.event_name == 'push'
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CST_GITEA: ${{ github.server_url }}
          CST_REPO: ${{ github.repository }}
          GITHUB_REF: ${{ github.ref }}
        run: bash scripts/ci_publish.sh dist/hermit-*-linux-${{ matrix.arch }}.tar.gz dist/cst-agent-*-linux-${{ matrix.arch }}.tar.gz

  # Release: mingw-w64 UCRT gcc (Debian trixie) with -Werror.
  # dist/cst-agent-VERSION-windows-x86_64.zip and -setup.exe (NSIS)
  windows:
    needs: tcc-check
    runs-on: ubuntu-latest
    timeout-minutes: 120
    container: debian:trixie
    steps:
      - name: Install tools
        run: |
          # No CA certificates in the image yet, so the mirror is plain http.
          sed -i 's#https\?://deb.debian.org#http://mirrors.tuna.tsinghua.edu.cn#g' \
            /etc/apt/sources.list.d/debian.sources
          apt-get update
          apt-get install -y --no-install-recommends \
            ca-certificates curl git build-essential cmake ninja-build make \
            pkg-config python3 perl zip unzip xz-utils patch file \
            gcc-mingw-w64-ucrt64 binutils-mingw-w64-ucrt64 nsis
      - name: Checkout
        env:
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
            -o /tmp/ci_checkout.sh
          bash /tmp/ci_checkout.sh
      - name: Cache mingw third_party
        uses: actions/cache@v4
        with:
          path: |
            third_party/prefix-mingw-x86_64
            third_party/src
            third_party/busybox
          key: win-tp-v1-${{ hashFiles('scripts/build_third_party_mingw.sh', 'scripts/bootstrap_windows.sh') }}
          restore-keys: |
            win-tp-v1-
      - name: Cross-build zip and installer
        env:
          CST_WIN_CFLAGS: -Wall -Wextra -Werror
        run: bash scripts/ci_windows_cross.sh
      - name: Verify
        run: |
          ls -lah dist/windows-x86_64/
          file dist/windows-x86_64/cst-agent.exe dist/cst-agent-*-windows-x86_64-setup.exe
          cat dist/cst-agent-*-windows-x86_64.zip.sha256 dist/cst-agent-*-windows-x86_64-setup.exe.sha256
          unzip -l dist/cst-agent-*-windows-x86_64.zip
      - name: Publish Gitea Release
        if: github.event_name == 'push'
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CST_GITEA: ${{ github.server_url }}
          CST_REPO: ${{ github.repository }}
          GITHUB_REF: ${{ github.ref }}
        run: |
          bash scripts/ci_publish.sh dist/cst-agent-*-windows-x86_64.zip \
            dist/cst-agent-*-windows-x86_64-setup.exe