ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  pages: write
  id-token: write

jobs:
  lint:
    name: Format check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install clang-format-22
        run: |
          wget -q https://apt.llvm.org/llvm.sh
          chmod +x llvm.sh
          sudo ./llvm.sh 22
          sudo apt-get install -y clang-format-22
          clang-format-22 --version
      - name: Run clang-format
        run: make format-check CLANG_FORMAT=clang-format-22

  build-test:
    name: Build + tests (${{ matrix.os }} / ${{ matrix.cc }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-latest, cc: clang }
          - { os: ubuntu-latest, cc: gcc }
          - { os: macos-latest,  cc: clang }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6

      - name: Install toolchain (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y clang gcc make

      # macOS runners already ship clang + make; nothing to install.

      - name: Build library
        run: make CC=${{ matrix.cc }}

      - name: Build tests
        run: make CC=${{ matrix.cc }} tests

      - name: Run tests
        run: scripts/run-tests.sh

      - name: Upload test log
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: test-log-${{ matrix.os }}-${{ matrix.cc }}
          path: build/test.log
          if-no-files-found: ignore

  sanitize:
    name: ASan + UBSan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install clang
        run: |
          sudo apt-get update
          sudo apt-get install -y clang
      - name: Build + run tests under ASan/UBSan
        run: make CC=clang test-asan
      - name: Upload sanitizer log
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: test-log-asan
          path: build/test.log
          if-no-files-found: ignore

  test-32bit:
    name: Build + tests (32-bit x86, -m32)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install multilib toolchain
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-multilib make
      - name: Build tests with 32-bit size_t
        run: |
          make CC=gcc tests \
            CFLAGS="-Wall -Wextra -std=c99 -Os -m32 -DCFGPACK_LZ4 -DCFGPACK_HEATSHRINK -DCFGPACK_LITTLEFS" \
            LDFLAGS="-m32"
      - name: Run tests
        run: scripts/run-tests.sh
      - name: Upload test log
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: test-log-32bit
          path: build/test.log
          if-no-files-found: ignore

  test-bigendian:
    name: Build + tests (big-endian s390x, qemu)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install s390x cross toolchain + qemu
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-s390x-linux-gnu qemu-user-static make
      - name: Build tests for s390x (static, run via qemu binfmt)
        run: |
          make CC=s390x-linux-gnu-gcc AR=s390x-linux-gnu-ar tests \
            LDFLAGS="-static"
      - name: Run tests
        run: scripts/run-tests.sh
      - name: Upload test log
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: test-log-bigendian
          path: build/test.log
          if-no-files-found: ignore

  cross-compile-arm:
    name: Cross-compile (arm-none-eabi, build only)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install ARM embedded toolchain
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-arm-none-eabi make
      - name: Build library for Cortex-M (freestanding)
        run: |
          make CC=arm-none-eabi-gcc AR=arm-none-eabi-ar \
            CFLAGS="-Wall -Wextra -std=c99 -Os -mcpu=cortex-m4 -mthumb -DCFGPACK_LZ4 -DCFGPACK_HEATSHRINK -DCFGPACK_LITTLEFS"
      - name: Report library size
        run: arm-none-eabi-size -t build/obj/src/*.o

  fuzz-smoke:
    name: Fuzz smoke (30s per target)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install clang
        run: |
          sudo apt-get update
          sudo apt-get install -y clang
      - name: Build fuzz harnesses (also runs gen-seeds)
        run: make CC=clang fuzz
      - name: Run each fuzz target for 30s
        run: scripts/run-fuzz.sh 30
      - name: Upload corpora + any crash artifacts
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: fuzz-artifacts
          path: |
            tests/fuzz/corpus_*
            crash-*
            leak-*
            timeout-*
          if-no-files-found: ignore

  docs:
    name: Docs + coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y doxygen python3-venv clang llvm
      - name: Build coverage report
        run: make coverage
      - name: Build Sphinx + Doxygen
        run: make docs
      - name: Generate coverage badge JSON
        run: |
          pct=$(grep '^TOTAL' build/coverage/report.txt | awk '{print $4}' | tr -d '%')
          echo "Line coverage: $pct%"
          # Color: green ≥90, yellowgreen ≥80, yellow ≥70, orange ≥60, red <60
          if [ "$(echo "$pct >= 90" | bc)" -eq 1 ]; then color="brightgreen"
          elif [ "$(echo "$pct >= 80" | bc)" -eq 1 ]; then color="green"
          elif [ "$(echo "$pct >= 70" | bc)" -eq 1 ]; then color="yellowgreen"
          elif [ "$(echo "$pct >= 60" | bc)" -eq 1 ]; then color="orange"
          else color="red"; fi
          printf '{"schemaVersion":1,"label":"coverage","message":"%s%%","color":"%s"}\n' "$pct" "$color" \
            > build/docs/html/coverage.json
      - name: Upload HTML docs
        uses: actions/upload-artifact@v6
        with:
          name: docs-html
          path: build/docs/html
          if-no-files-found: ignore
      - name: Upload Pages artifact
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        uses: actions/upload-pages-artifact@v4
        with:
          path: build/docs/html

  docs-deploy:
    name: Deploy docs to Pages
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: docs
    runs-on: ubuntu-latest
    concurrency:
      group: pages
      cancel-in-progress: true
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - id: deployment
        uses: actions/deploy-pages@v5