linux-ci.yml

name: Linux CI

# Pin map (verify with `gh api repos/<owner>/<repo>/git/ref/tags/<tag>`):
#   actions/checkout         @ v7.0.0 → 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
#   actions/upload-artifact  @ v7.0.1 → 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    name: Build, test, lint, format
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential cmake pkg-config \
            libsodium-dev libssl-dev libcurl4-openssl-dev libopus-dev \
            libayatana-appindicator3-dev libgtk-3-dev libnotify-dev

      # Ubuntu 24.04 ships clang-format 18 by default, which disagrees with
      # brew's current LLVM (used by macos-ci.yml) on braced-init lists and
      # other subtle rules. Pin to a recent clang-format from PyPI so the
      # Linux and macOS workflows agree on style.
      - name: Install clang-format (pinned)
        run: |
          pipx install clang-format==22.1.4
          pipx ensurepath
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Tool versions
        run: |
          cmake --version
          g++ --version | head -1
          clang-format --version
          pkg-config --modversion libsodium
          pkg-config --modversion opus
          pkg-config --modversion ayatana-appindicator3-0.1
          pkg-config --modversion gtk+-3.0

      # The gate itself lives in scripts/check-format.sh so this workflow,
      # macos-ci.yml, windows-ci.yml and scripts/ci-local.sh cannot drift on
      # the file set or the invocation.
      - name: clang-format (check only)
        run: bash scripts/check-format.sh

      # Compiler-independent architecture gate: src/core stays std+intra-core+
      # nlohmann-only, and net/adapters never name a platform/<os>/ path.
      - name: Core purity gate
        run: bash scripts/check_core_purity.sh

      # The configure line (Release + warnings-as-errors) lives in
      # CMakePresets.json (preset linux) so this workflow and scripts/build.sh
      # / scripts/ci-local.sh run the identical build. It stays out of
      # CMakeLists.txt so casual `cmake -S . -B build` invocations remain
      # friendly.
      - name: Configure (Release, tray enabled)
        run: cmake --preset linux

      # Bound -j: bare `-j` oversubscribes and OOM-kills hosted runners (exit 143).
      - name: Build (tray enabled)
        run: cmake --build --preset linux -j "$(nproc)"

      - name: Run tests
        run: ctest --preset linux

      # The unprivileged ctest pass above skips uinput_smoke (it cannot open
      # the event nodes it creates). This lane runs the binary directly as
      # root so a skip — module missing, node never appearing — fails loudly
      # instead of masquerading as coverage.
      - name: uinput smoke test (real kernel, as root)
        run: |
          sudo modprobe uinput
          sudo ./test_uinput_smoke

      - name: Verify binary links against AppIndicator
        run: |
          test -x satellite
          ldd satellite | grep -E 'ayatana-appindicator|gtk-3' \
            || (echo "tray-enabled build missing AppIndicator/GTK link" && exit 1)

      - name: Upload satellite binary artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: satellite-linux-x64
          path: satellite
          retention-days: 14

  headless:
    name: Verify headless fallback build
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install dependencies (no tray)
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential cmake pkg-config libsodium-dev libssl-dev \
            libcurl4-openssl-dev libopus-dev

      - name: Configure (Release, no tray) and confirm tray is disabled
        run: |
          cmake --preset linux 2>&1 | tee cmake-configure.log
          grep -q 'libayatana-appindicator not found' cmake-configure.log \
            || (echo "expected headless fallback message in cmake output" && exit 1)

      - name: Build (headless)
        run: cmake --build --preset linux -j "$(nproc)"

      - name: Run tests
        run: ctest --preset linux

  fuzz:
    name: Fuzz smoke (decrypt->dispatch robustness, bounded)
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install dependencies (clang + libFuzzer runtime)
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential cmake pkg-config clang libclang-rt-18-dev \
            libsodium-dev libssl-dev libcurl4-openssl-dev libopus-dev

      - name: Configure (clang, SATELLITE_FUZZ=ON)
        run: |
          CC=clang CXX=clang++ cmake -S . -B build-fuzz \
            -DCMAKE_BUILD_TYPE=RelWithDebInfo -DSATELLITE_FUZZ=ON
          # The lane exists to run the REAL fuzzer; fail loudly if configure
          # fell back to the standalone driver instead of libFuzzer.
          grep -q "^SATELLITE_HAVE_LIBFUZZER:INTERNAL=1$" build-fuzz/CMakeCache.txt \
            || (echo "libFuzzer runtime not detected on the CI toolchain" && exit 1)

      - name: Build fuzz target
        run: cmake --build build-fuzz --target fuzz_receiver_dispatch -j "$(nproc)"

      - name: Corpus regression (each committed seed exactly once)
        run: ./fuzz_receiver_dispatch -runs=0 tests/fuzz/corpus

      # Short bounded run so the lane gates on "malformed datagrams never
      # crash or read out of bounds" without meaningful CI time. New inputs
      # go to a scratch dir; the committed seeds stay read-only.
      - name: Bounded fuzz (10 s wall clock)
        run: |
          mkdir -p /tmp/fuzz-corpus
          ./fuzz_receiver_dispatch -max_total_time=10 -timeout=5 -rss_limit_mb=2048 \
            /tmp/fuzz-corpus tests/fuzz/corpus

  reproducibility:
    name: Build reproducibility (advisory)
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    # Advisory only: the upstream goal is bit-identical Release builds
    # but the toolchain doesn't guarantee that yet. Surface drift in the
    # job summary; do not block the PR. See SECURITY_HARDENING_PROMPT.md
    # section A.5.
    # push-only: a per-PR double-build isn't worth it, and its
    # continue-on-error red X misreads as a PR-check failure.
    if: github.event_name == 'push'
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential cmake pkg-config libsodium-dev libssl-dev \
            libcurl4-openssl-dev libopus-dev \
            libayatana-appindicator3-dev libgtk-3-dev libnotify-dev diffoscope

      - name: Build twice and diff
        shell: bash
        run: |
          set -euo pipefail
          cmake -S . -B build-A -DCMAKE_BUILD_TYPE=Release
          cmake --build build-A -j "$(nproc)"
          mv satellite satellite-A
          rm -rf build-A
          cmake -S . -B build-B -DCMAKE_BUILD_TYPE=Release
          cmake --build build-B -j "$(nproc)"
          mv satellite satellite-B
          {
            if cmp -s satellite-A satellite-B; then
              echo "::notice::satellite Linux Release build is bit-identical across two runs."
            else
              echo "::warning::satellite Linux Release build is NOT bit-identical across two runs."
              diffoscope --no-progress satellite-A satellite-B | head -200 || true
            fi
          } >> "$GITHUB_STEP_SUMMARY"

  # The SDK is only built when a DSN is present, which no PR build has, so
  # this is the one lane that compiles and links the Sentry path before a
  # release tag does. The DSN resolves nowhere; nothing runs it.
  sentry-sdk:
    name: Build with the Sentry SDK (dummy DSN)
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential cmake pkg-config \
            libsodium-dev libssl-dev libcurl4-openssl-dev libopus-dev \
            libayatana-appindicator3-dev libgtk-3-dev libnotify-dev

      - name: Configure with a DSN that resolves nowhere
        run: |
          cmake -S . -B build-sentry -DCMAKE_BUILD_TYPE=Release \
            -DSATELLITE_SENTRY_DSN="https://public@o0.ingest.sentry.invalid/0"

      - name: Build
        run: cmake --build build-sentry --target satellite -j "$(nproc)"

      - name: Verify the SDK is linked and the binary carries debug info
        run: |
          test -x satellite
          nm satellite | grep -q 'sentry_init' || { echo "::error::sentry_init is not linked"; exit 1; }
          readelf -S satellite | grep -q '\.debug_info' || { echo "::error::no debug info for the symbol upload"; exit 1; }