ci.yml

name: CI

on:
  push:
    branches: [jb/close-ssl, master]
  pull_request:
    branches: [jb/close-ssl, master]

# Cancel an in-progress run when a newer commit is pushed to the same ref.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  # urcrypt requires nettle >= 4.0 (2-argument *_digest() interface) and a
  # libsecp256k1 built with the recovery + Schnorr modules. Neither is available
  # from the runners' package managers, so both are built from source (cached).
  NETTLE_VERSION: "4.0"
  NETTLE_SHA256: "3addbc00da01846b232fb3bc453538ea5468da43033f21bb345cb1e9073f5094"
  SECP256K1_REF: "v0.7.1"

jobs:
  build-test:
    name: build & test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v4

      - name: Install build tools (Ubuntu)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            autoconf automake libtool pkg-config autoconf-archive m4 build-essential

      - name: Install build tools (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install autoconf automake libtool pkg-config autoconf-archive

      - name: Set up crypto dependencies
        uses: ./.github/actions/setup-crypto-deps
        with:
          prefix: ${{ github.workspace }}/.deps
          nettle-version: ${{ env.NETTLE_VERSION }}
          nettle-sha256: ${{ env.NETTLE_SHA256 }}
          secp256k1-ref: ${{ env.SECP256K1_REF }}

      - name: Build
        run: |
          ./autogen.sh
          # Build statically on Linux (the deps are static there, matching how
          # urbit/vere links urcrypt); macOS can't fully static-link, so shared.
          if [ "$RUNNER_OS" = "Linux" ]; then
            ./configure --enable-static --disable-shared
          else
            ./configure
          fi
          make -j"$(getconf _NPROCESSORS_ONLN)"

      - name: Test
        run: make check

      - name: Upload logs on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: logs-${{ matrix.os }}
          path: |
            config.log
            test-suite.log
            test_runner.log
          if-no-files-found: ignore

  sanitizers:
    name: ASan + UBSan (Ubuntu)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install build tools
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            autoconf automake libtool pkg-config autoconf-archive m4 build-essential clang

      - name: Set up crypto dependencies
        uses: ./.github/actions/setup-crypto-deps
        with:
          prefix: ${{ github.workspace }}/.deps
          nettle-version: ${{ env.NETTLE_VERSION }}
          nettle-sha256: ${{ env.NETTLE_SHA256 }}
          secp256k1-ref: ${{ env.SECP256K1_REF }}

      # Built with clang so UBSan can be scoped to urcrypt's own code via an
      # ignore list (an -fsanitize-ignorelist= feature gcc lacks). ASan still
      # covers everything, including the vendored libraries.
      - name: Build & test with sanitizers
        env:
          # Leak detection is off: the one-shot test runner intentionally does
          # not free every allocation, which is not a defect under test.
          ASAN_OPTIONS: detect_leaks=0:abort_on_error=1
          UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
        run: |
          ./autogen.sh
          ./configure --enable-static --disable-shared CC=clang \
            CFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=all -fsanitize-ignorelist=${{ github.workspace }}/ci/sanitizer-ignorelist.txt -g -O1" \
            LDFLAGS="-fsanitize=address,undefined"
          make -j"$(getconf _NPROCESSORS_ONLN)"
          make check

      - name: Upload logs on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: logs-sanitizers
          path: |
            config.log
            test-suite.log
            test_runner.log
          if-no-files-found: ignore

  static-analysis:
    name: cppcheck (non-blocking)
    runs-on: ubuntu-latest
    # Advisory only: findings are surfaced but do not fail the workflow.
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4

      - name: Install cppcheck
        run: |
          sudo apt-get update
          sudo apt-get install -y cppcheck

      - name: Run cppcheck on urcrypt sources
        # Analyse only urcrypt's own code, not the bulk-vendored libraries.
        run: |
          cppcheck --enable=warning,portability --inline-suppr --error-exitcode=1 \
            --std=c11 --suppress=missingInclude --suppress=missingIncludeSystem \
            -I urcrypt -I aes_siv urcrypt aes_siv