linux.yaml

# SPDX-FileCopyrightText: 2021 Andrea Pappacoda
#
# SPDX-License-Identifier: AGPL-3.0-or-later

name: linux

on: push

defaults:
  run:
    shell: sh

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  linux:
    strategy:
      fail-fast: false
      # memsan is disabled because of https://github.com/openssl/openssl/issues/11013
      matrix:
        os: [ 'debian:stable', 'debian:testing', 'registry.access.redhat.com/ubi8/ubi-minimal', 'registry.access.redhat.com/ubi9/ubi-minimal' ]
        compiler: [ 'gcc', 'clang' ]
        sanitizer: [ 'address', 'thread', 'undefined', 'none' ]
        exclude:
          - os: 'registry.access.redhat.com/ubi8/ubi-minimal'
            sanitizer: 'address'
          - os: 'registry.access.redhat.com/ubi8/ubi-minimal'
            sanitizer: 'thread'
          - os: 'registry.access.redhat.com/ubi8/ubi-minimal'
            sanitizer: 'undefined'
          - os: 'registry.access.redhat.com/ubi9/ubi-minimal'
            sanitizer: 'address'
          - os: 'registry.access.redhat.com/ubi9/ubi-minimal'
            sanitizer: 'undefined'

    runs-on: ubuntu-latest
    container:
      image: ${{ matrix.os }}

    steps:
    # llvm-dev is required because it contains LLVMgold.so in Debian 11
    # libclang-rt-dev is required since Debian 12
    - name: Install dependencies (Debian)
      if: contains(matrix.os, 'debian')
      run: |
        if [ ${{ matrix.compiler }} = gcc ]; then compiler=g++; else compiler="clang lld ?exact-name(libclang-rt-dev)"; fi
        apt -y update
        apt -y install $compiler meson pkg-config libcurl4-openssl-dev libinih-dev git ca-certificates curl gpg gpgv gpg-agent lcov llvm-dev --no-install-recommends

    # For some reason libasan and libubsan are unavaiable on RHEL 9
    - name: Install dependencies (Red Hat)
      if: contains(matrix.os, 'redhat')
      run: |
        if [ ${{ matrix.compiler }} = gcc ]; then compiler=gcc-c++; else compiler=llvm-toolset; fi
        microdnf -y --refresh --disableplugin=subscription-manager install $compiler pkgconf libcurl-devel libtsan git python3-pip gnupg unzip
        curl -LO https://github.com/ninja-build/ninja/releases/latest/download/ninja-linux.zip
        unzip ninja-linux.zip
        mv ninja /usr/local/bin
        rm ninja-linux.zip
        pip3 install meson

    - uses: actions/checkout@v3

    # LTO disabled because of https://github.com/mesonbuild/meson/issues/8371
    - name: Configure Meson
      run: |
        if expr ${{ matrix.os }} : ".*ubi8" >/dev/null; then enable_tests=false; else enable_tests=true; fi
        record_name=$(printf '${{ matrix.sanitizer }}.${{ matrix.compiler }}.${{ matrix.os }}.${{ github.workflow }}.ci.${{ secrets.DOMAIN_NAME }}' | tr -dc '[:alnum:].')
        if [ ${{ matrix.compiler }} = gcc ]; then CXX=g++; else CXX=clang++ CXX_LD=lld; fi
        export CXX CXX_LD
        meson setup build -Dtests=$enable_tests -Dtest_api_token='${{ secrets.API_TOKEN }}' -Dtest_zone_id='${{ secrets.ZONE_ID }}' -Dtest_record_name="$record_name" --buildtype=debug -Db_coverage=true -Db_sanitize=${{ matrix.sanitizer }} -Db_lundef=false -Db_lto=false
      env:
        CC: ${{ matrix.compiler }}

    - name: Build
      run: ninja -C build

    - name: Test
      if: ${{ !contains(matrix.os, 'ubi8') }}
      run: meson test -C build --verbose

    - name: Coverage
      if: ${{ !contains(matrix.os, 'redhat') }}
      run: |
        mkdir -p $HOME/.local/bin
        if [ "${{ matrix.compiler }}" = 'clang' ]; then printf 'llvm-cov gcov "$@"' > $HOME/.local/bin/cov.sh; else printf 'gcov "$@"' > $HOME/.local/bin/cov.sh; fi && chmod +x $HOME/.local/bin/cov.sh
        lcov --capture --output-file coverage.info --directory . --gcov-tool $HOME/.local/bin/cov.sh --exclude '/usr/*' --exclude "${HOME}"'/.cache/*' --exclude '*/tests/*' --exclude '*/subprojects/*'
        lcov --list coverage.info
        curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --keyring trustedkeys.gpg --import
        curl --silent --remote-name https://uploader.codecov.io/latest/linux/codecov
        curl --silent --remote-name https://uploader.codecov.io/latest/linux/codecov.SHA256SUM
        curl --silent --remote-name https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig
        gpgv codecov.SHA256SUM.sig codecov.SHA256SUM
        sha256sum --check codecov.SHA256SUM
        chmod +x codecov
        ./codecov

    - name: Artifact name
      if: matrix.sanitizer == 'none'
      run: printf 'artifact_name=cloudflare-ddns.${{ matrix.os }}.${{ matrix.compiler }}' | tr -dc '[:alnum:]._=-' >> $GITHUB_ENV

    - name: Store compiled program
      if: matrix.sanitizer == 'none'
      uses: actions/upload-artifact@v3
      with:
        name: ${{ env.artifact_name }}
        path: |
          build/libcloudflare-ddns.so.*
          !build/libcloudflare-ddns.so.*.p
          build/exe/cloudflare-ddns