Hermit/.gitea/workflows/ci.yml

name: ci

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  linux:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        cc: [gcc, clang]
    steps:
      - name: Checkout
        env:
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
            -o /tmp/ci_checkout.sh
          bash /tmp/ci_checkout.sh
      - name: Install dependencies
        run: |
          SUDO=$(command -v sudo || true)
          $SUDO bash scripts/ci_pkg_mirror.sh
          $SUDO apt-get update
          $SUDO apt-get install -y --no-install-recommends \
            build-essential clang cmake pkg-config python3 \
            libcurl4-openssl-dev libncurses-dev
      - name: Build (warnings are errors)
        run: make CC=${{ matrix.cc }} CFLAGS="-std=c11 -Wall -Wextra -O2 -g -Werror" -j"$(nproc)"
      - name: Unit tests
        run: |
          # Same -Werror as the build step so undeclared libc helpers cannot
          # silently return int and truncate pointers (see test_subagent).
          make CC=${{ matrix.cc }} \
            CFLAGS="-std=c11 -Wall -Wextra -O2 -g -Werror" check
      - name: CMake build + ctest
        run: |
          cmake -B build -DCMAKE_C_COMPILER=${{ matrix.cc }} -DCST_BUILD_TUI=ON
          cmake --build build -j"$(nproc)"
          ctest --test-dir build --output-on-failure
      - name: Smoke test
        run: |
          ./cst-agent --help
          ./cst-agent --workspace "$PWD" --list-sessions
          ./cst-agent --demo-ctl --workspace .
      - name: WebUI end-to-end (recorded stream, no API key)
        run: sh scripts/e2e_webui.sh

  musl:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    container: alpine:3.20
    steps:
      - name: Install tools + mirror
        run: |
          sed -i 's#https\?://dl-cdn.alpinelinux.org/alpine#https://mirrors.tuna.tsinghua.edu.cn/alpine#g' \
            /etc/apk/repositories
          apk add --no-cache curl git bash
      - name: Checkout
        env:
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
            -o /tmp/ci_checkout.sh
          bash /tmp/ci_checkout.sh
      - name: Install build dependencies
        run: |
          # linux-headers provides linux/audit.h for the seccomp probe path
          apk add --no-cache build-base pkgconf curl-dev ncurses-dev \
            linux-headers git nodejs bash python3
      - name: Build + unit tests
        run: |
          make CFLAGS="-std=c11 -Wall -Wextra -O2 -Werror" -j"$(nproc)"
          make check

  # MinGW-w64 UCRT cross build → dist/cst-agent-*-windows-x86_64.zip
  windows-cross:
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - name: Checkout
        env:
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
            -o /tmp/ci_checkout.sh
          bash /tmp/ci_checkout.sh
      - name: Install host tools
        run: |
          SUDO=$(command -v sudo || true)
          $SUDO bash scripts/ci_pkg_mirror.sh
          $SUDO apt-get update
          $SUDO apt-get install -y --no-install-recommends \
            ca-certificates curl git cmake ninja-build make pkg-config \
            python3 zip unzip perl xz-utils
      - name: Cross-build Windows zip
        run: bash scripts/ci_windows_cross.sh
      - name: Verify zip
        run: |
          ls -lah dist/windows-x86_64/
          ls -lah dist/cst-agent-*-windows-x86_64.zip
          cat dist/cst-agent-*-windows-x86_64.zip.sha256
          unzip -l dist/cst-agent-*-windows-x86_64.zip | head -20
      # Auto-publish to Gitea Releases (v$CST_VERSION from include/cst_version.h).
      # Prefer repo secret RELEASE_TOKEN (write:repository); fall back to the
      # job token. Skipped on pull_request and when no token is available.
      - name: Publish Gitea Release
        if: github.event_name == 'push'
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CST_GITEA: ${{ github.server_url }}
          CST_REPO: ${{ github.repository }}
          GITHUB_REF: ${{ github.ref }}
          CI: "true"
        run: |
          export GITEA_TOKEN="${RELEASE_TOKEN:-${GITHUB_TOKEN:-}}"
          if [[ -z "${GITEA_TOKEN}" ]]; then
            echo "::warning::no RELEASE_TOKEN / GITHUB_TOKEN; skip auto-release"
            exit 0
          fi
          bash scripts/release_windows.sh