ci: bump github/codeql-action to 4.37.9 and group its bumps #1384

Workflow file for this run

	name: CI

	on:
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]

	permissions:
	contents: read

	jobs:
	build-linux-gcc:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset debug

	- name: Build and test
	run: cmake --build --preset debug --target junit BddTargetTests

	- name: Run BDD target tests
	run: cd build/debug && ./Tests/Bdd/Targets/BddTargetTests -ojunit -k BddTargetTests

	- name: Test Report
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (GCC)
	path: build/debug/cpputest_*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-build-linux-gcc
	path: build/debug/cpputest_*.xml
	retention-days: 1

	integration-linux-openssl:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset debug

	- name: Build integration tests
	run: cmake --build --preset debug --target OpenSslIntegrationTests

	- name: Run integration tests
	run: cd build/debug && ./Tests/OpenSslIntegration/OpenSslIntegrationTests -v -ojunit -k OpenSslIntegrationTests

	- name: Test Report
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (OpenSSL Integration)
	path: build/debug/cpputest_*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-integration-linux-openssl
	path: build/debug/cpputest_*.xml
	retention-days: 1

	integration-linux-mbedtls:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	# cpputest-freertos image carries /opt/mbedtls (and exports MBEDTLS_DIR);
	# Tests/MbedTlsIntegration/CMakeLists.txt requires that env var.
	container:
	image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset debug

	- name: Build integration tests
	run: cmake --build --preset debug --target MbedTlsIntegrationTests

	- name: Run integration tests
	run: cd build/debug && ./Tests/MbedTlsIntegration/MbedTlsIntegrationTests -v -ojunit -k MbedTlsIntegrationTests

	- name: Test Report
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (mbedTLS Integration)
	path: build/debug/cpputest_*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-integration-linux-mbedtls
	path: build/debug/cpputest_*.xml
	retention-days: 1

	integration-windows-openssl:
	runs-on: windows-latest
	permissions:
	contents: read
	checks: write
	env:
	VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Enable vcpkg binary cache
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL \|\| '');
	core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN \|\| '');

	# Cache vcpkg's classic-mode installed tree across runs and branches.
	# x-gha (above) is per-workflow scope and goes cold on a fresh branch;
	# actions/cache survives across branches with a static key. Bump the
	# `v1` suffix to force a rebuild (e.g. when adding a package).
	# C:\vcpkg is the standard VCPKG_INSTALLATION_ROOT on github-hosted
	# windows runners — hardcoded here so the cache step doesn't depend
	# on a runner-image-set env var (the linter can't see those).
	- name: Cache vcpkg installed tree
	uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	# The cache is a pure speed optimisation — a flaky restore must never
	# skip the build+test. actions/cache can fail mid-restore (even after
	# reporting a hit); without continue-on-error that failure trips the
	# default `if: success()` on every following step, so Install / Configure
	# / Build-and-test all skip and the job goes red without ever compiling.
	# On a miss or partial restore the `vcpkg install` below rebuilds the
	# tree (backed by the x-gha binary cache), so the only cost is a slower
	# run.
	continue-on-error: true
	with:
	path: C:\vcpkg\installed
	key: ${{ runner.os }}-vcpkg-cpputest-openssl-v1

	- name: Install CppUTest and OpenSSL
	run: \|
	vcpkg install cpputest openssl
	echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" >> $env:GITHUB_ENV

	- name: Configure
	run: cmake --preset msvc-debug

	- name: Build integration tests
	run: cmake --build --preset msvc-debug --target OpenSslIntegrationTests

	- name: Run integration tests
	shell: pwsh
	run: \|
	Set-Location build/msvc-debug/Tests/OpenSslIntegration/Debug
	./OpenSslIntegrationTests.exe -v -ojunit -k OpenSslIntegrationTests

	- name: Test Report
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (OpenSSL Integration Windows)
	path: build/msvc-debug/Tests/OpenSslIntegration/Debug/cpputest_*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-integration-windows-openssl
	path: build/msvc-debug/Tests/OpenSslIntegration/Debug/cpputest_*.xml
	retention-days: 1

	build-linux-tunable-override:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure with tunable override
	run: cmake --preset tunable-override-debug

	# The host BDD target is built here rather than against the defaults --
	# see the @requires_message_size_1500 entry in docs/bdd.md.
	- name: Build and test
	run: cmake --build --preset tunable-override-debug --target junit SolidSyslogBddTarget

	- name: Test Report
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (Tunable Override)
	path: build/tunable-override-debug/cpputest_*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-build-linux-tunable-override
	path: build/tunable-override-debug/cpputest_*.xml
	retention-days: 1

	- name: Upload BDD target binaries
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: solid-syslog-bdd-targets
	path: \|
	build/tunable-override-debug/Bdd/Targets/SolidSyslogBddTarget
	retention-days: 1
	compression-level: 0

	# BDD-side mirror of build-time tunables, generated by configure_file.
	# bdd-linux-syslog-ng downloads this into Bdd/features/steps/ so behave
	# can `import solidsyslog_tunables` (the file is gitignored, not in checkout).
	- name: Upload BDD Python tunables (Linux)
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: bdd-tunables-linux
	path: Bdd/features/steps/solidsyslog_tunables.py
	retention-days: 1

	build-linux-clang:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	container:
	image: ghcr.io/cososo-ltd/cpputest-clang@sha256:95e8a1b076aa2faab98af1415c89a36feaa12e0a9e42950194f9775d0ed27c35 # sha-5905aea
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset clang-debug

	- name: Build and test
	run: cmake --build --preset clang-debug --target junit

	- name: Test Report
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (Clang)
	path: build/clang-debug/cpputest_*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-build-linux-clang
	path: build/clang-debug/cpputest_*.xml
	retention-days: 1

	# Proves the public claim that Core compiles as C99, then checks the POSIX and
	# OpenSSL packs have not drifted off it. Library only, no tests.
	# See docs/builds.md.
	build-linux-c99:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure Core at C99
	run: cmake --preset c99

	- name: Build Core at C99
	run: cmake --build --preset c99

	- name: Configure POSIX and OpenSSL packs at C99
	run: cmake --preset c99-platforms

	- name: Build POSIX and OpenSSL packs at C99
	run: cmake --build --preset c99-platforms

	# The library is C99; the code that includes its headers need not be. Compiles
	# every public header standalone at -std=c89 -pedantic-errors, so an
	# integrator on an older toolchain can include them. See docs/build-integration.md.
	build-linux-c89-headers:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Compile every public header as C89
	run: python3 scripts/check_headers_c89.py --cc gcc

	sanitize-linux-gcc:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset sanitize

	- name: Build and test
	run: cmake --build --preset sanitize --target junit

	- name: Test Report
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (Sanitize)
	path: build/sanitize/cpputest_*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-sanitize-linux-gcc
	path: build/sanitize/cpputest_*.xml
	retention-days: 1

	coverage-linux-gcc:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset coverage

	- name: Build and generate coverage report
	run: cmake --build --preset coverage --target coverage

	- name: Post coverage summary
	run: \|
	echo '## Coverage Summary' >> $GITHUB_STEP_SUMMARY
	echo '```' >> $GITHUB_STEP_SUMMARY
	lcov --summary build/coverage/coverage.filtered.info --rc branch_coverage=1 2>&1 >> $GITHUB_STEP_SUMMARY
	echo '```' >> $GITHUB_STEP_SUMMARY

	- name: Enforce coverage thresholds
	env:
	LINE_THRESHOLD: 90
	BRANCH_THRESHOLD: 90
	run: \|
	SUMMARY=$(lcov --summary build/coverage/coverage.filtered.info --rc branch_coverage=1 2>&1)
	LINE_COV=$(echo "$SUMMARY" \| sed -n 's/.lines\.: $[0-9.]$%./\1/p')
	BRANCH_COV=$(echo "$SUMMARY" \| sed -n 's/.branches\.: $[0-9.]$%./\1/p')
	FAIL=0
	if [ -n "$LINE_COV" ]; then
	echo "Line coverage: ${LINE_COV}% (threshold: ${LINE_THRESHOLD}%)"
	if awk "BEGIN{exit !($LINE_COV < $LINE_THRESHOLD)}"; then
	echo "FAIL: line coverage ${LINE_COV}% is below ${LINE_THRESHOLD}%"
	FAIL=1
	fi
	else
	echo "FAIL: could not determine line coverage"
	FAIL=1
	fi
	if [ -n "$BRANCH_COV" ]; then
	echo "Branch coverage: ${BRANCH_COV}% (threshold: ${BRANCH_THRESHOLD}%)"
	if awk "BEGIN{exit !($BRANCH_COV < $BRANCH_THRESHOLD)}"; then
	echo "FAIL: branch coverage ${BRANCH_COV}% is below ${BRANCH_THRESHOLD}%"
	FAIL=1
	fi
	else
	echo "Branch coverage: no branch data found (skipping threshold check)"
	fi
	exit $FAIL

	# GitHub Pages now serves the docs site (see deploy-docs-pages), not the
	# coverage report. The HTML report stays available as a downloadable run
	# artifact for anyone who wants to inspect it; success()\|\|failure() keeps
	# it uploaded even when the threshold gate above fails, which is exactly
	# when you want to read it.
	- name: Upload coverage report artifact
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: coverage-report-linux-gcc
	path: build/coverage/coverage_report/
	retention-days: 7

	analyze-tidy:
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset tidy

	- name: Build with clang-tidy
	shell: bash
	run: set -o pipefail && cmake --build --preset tidy 2>&1 \| tee build/tidy/clang-tidy-output.txt

	- name: Upload clang-tidy output
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: clang-tidy-report
	path: build/tidy/clang-tidy-output.txt
	retention-days: 1

	analyze-iwyu:
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/cososo-ltd/cpputest-clang@sha256:95e8a1b076aa2faab98af1415c89a36feaa12e0a9e42950194f9775d0ed27c35 # sha-5905aea
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset iwyu

	# IWYU is advisory: the two-pass "should add / should remove" output is
	# hard to interpret correctly under time pressure, and the per-PR
	# friction it causes outweighs the steady-state value (S24.13 / E24).
	# Findings still surface via the uploaded artifact below; release prep
	# is responsible for clearing them.
	- name: Run include-what-you-use (advisory)
	shell: bash
	continue-on-error: true
	run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 \| tee build/iwyu/iwyu-output.txt

	- name: Upload iwyu output
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: iwyu-report
	path: build/iwyu/iwyu-output.txt
	retention-days: 1

	# Mirrors analyze-tidy but runs on cpputest-freertos so the Platform/{FreeRtos,
	# PlusTcp,LwipRaw,MbedTls,FatFs} trees and their Tests/* siblings enter the
	# CMake configure (gated by FREERTOS_KERNEL_PATH / MBEDTLS_DIR / LWIP_PATH /
	# FATFS_PATH, all set in the freertos image). The base lane on cpputest skips
	# those trees because the env vars are absent.
	analyze-tidy-freertos-plustcp:
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset tidy

	- name: Build with clang-tidy
	shell: bash
	run: set -o pipefail && cmake --build --preset tidy 2>&1 \| tee build/tidy/clang-tidy-output.txt

	- name: Upload clang-tidy output
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: clang-tidy-report-freertos-plustcp
	path: build/tidy/clang-tidy-output.txt
	retention-days: 1

	# Same freertos coverage rationale as analyze-tidy-freertos-plustcp. Overrides
	# CMAKE_C_COMPILER explicitly to clang-19 because the cpputest-freertos image
	# (chained from the cpputest gcc base) ships clang-19/clang++-19 but no
	# `clang`/`clang++` alternative — only the cpputest-clang image creates that
	# alias. A future image bump could add the alternative to the gcc base and
	# drop these overrides.
	analyze-iwyu-freertos-plustcp:
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset iwyu -DCMAKE_C_COMPILER=clang-19 -DCMAKE_CXX_COMPILER=clang++-19

	# Advisory per S24.13 — see analyze-iwyu above for rationale.
	- name: Run include-what-you-use (advisory)
	shell: bash
	continue-on-error: true
	run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 \| tee build/iwyu/iwyu-output.txt

	- name: Upload iwyu output
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: iwyu-report-freertos-plustcp
	path: build/iwyu/iwyu-output.txt
	retention-days: 1

	# lwIP twin of analyze-tidy-freertos-plustcp. Same cpputest-freertos image and
	# tidy preset, with Plus-TCP deselected so the configure exercises the lwIP
	# wiring path with Platform/PlusTcp absent. Since S30.06 that is said directly
	# — a platform is deselected by its own switch — rather than inferred from a
	# FreeRTOS networking-backend variable. Guards the LwipRaw tree and its Tests
	# under clang-tidy as a named required check.
	analyze-tidy-freertos-lwip:
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset tidy -DSOLIDSYSLOG_PLUSTCP=OFF

	- name: Build with clang-tidy
	shell: bash
	run: set -o pipefail && cmake --build --preset tidy 2>&1 \| tee build/tidy/clang-tidy-output.txt

	- name: Upload clang-tidy output
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: clang-tidy-report-freertos-lwip
	path: build/tidy/clang-tidy-output.txt
	retention-days: 1

	# NET=LWIP twin of analyze-iwyu-freertos-plustcp — see that lane for the
	# clang-19 override rationale and analyze-tidy-freertos-lwip for the NET scope.
	# Advisory per S24.13.
	analyze-iwyu-freertos-lwip:
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset iwyu -DSOLIDSYSLOG_PLUSTCP=OFF -DCMAKE_C_COMPILER=clang-19 -DCMAKE_CXX_COMPILER=clang++-19

	# Advisory per S24.13 — see analyze-iwyu above for rationale.
	- name: Run include-what-you-use (advisory)
	shell: bash
	continue-on-error: true
	run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 \| tee build/iwyu/iwyu-output.txt

	- name: Upload iwyu output
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: iwyu-report-freertos-lwip
	path: build/iwyu/iwyu-output.txt
	retention-days: 1

	analyze-format:
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Check clang-format
	run: \|
	find Core/Interface Core/Source Platform Tests Bdd/Targets -name '.c' -o -name '.cpp' -o -name '*.h' \
	\| xargs clang-format --dry-run --Werror

	# README.md claims Core's implementation has no conditional compilation.
	# Keep that true rather than aspirational.
	- name: Assert Core's implementation has no conditional compilation
	run: \|
	if grep -rnE '^[[:space:]]#[[:space:]](if\|ifdef\|ifndef\|elif\|else)' Core/Source/*.c; then
	echo "::error::Core/Source/*.c must contain no conditional compilation (see README.md, Architecture)"
	exit 1
	fi

	# A bare _Create in a comment or in Markdown stops meaning anything the
	# moment the surrounding text names a second class, and the header tables
	# name several per row. See docs/NAMING.md, "Writing identifiers in prose".
	#
	# The sed neutralises the reserved identifiers that legitimately begin _X
	# before the second grep, so filtering is per match rather than per line —
	# one line can carry both a legitimate _Atomic and a bare _Destroy, and
	# discarding the whole line would hide the second. Tracked files only, so
	# an untracked local `site/` build never trips it. NAMING.md is exempt: it
	# is the one file that has to quote the form it forbids.
	- name: Assert API identifiers are written in full in prose
	run: \|
	violations=$(git ls-files '.md' '.c' '.h' '.cpp' \
	\| grep -v '^docs/NAMING\.md$' \
	\| xargs -r grep -nE '(^\|[^A-Za-z0-9_>])_[A-Z][a-z]' \
	\| sed -E 's/_(Atomic\|Bool\|Static_assert\|Noreturn\|Thread_local\|Generic\|Alignas\|Alignof\|Complex\|Imaginary\|Pragma\|Exit)\b/KEYWORD/g' \
	\| grep -E '(^\|[^A-Za-z0-9_>])_[A-Z][a-z]' \
	\| cut -d: -f1,2)
	if [ -n "$violations" ]; then
	echo "$violations"
	echo "::error::Write API identifiers in full in prose — SolidSyslogFoo_Create, or <Class>_Create for a pattern-level statement (see docs/NAMING.md, 'Writing identifiers in prose')"
	exit 1
	fi

	# Asserts every shipped source file carries the licence header, and that none
	# of them claims anyone else's copyright. Both halves matter: the header is
	# the only statement of terms that travels with a file copied out of the tree
	# by a Path B integrator, and the no-third-party-code invariant in Core/ and
	# Platform/ is what makes it safe to stamp our copyright across all of them.
	# Pure file scan, no toolchain — runs in about a second.
	analyze-spdx:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Check licence headers
	run: python3 scripts/check_spdx_headers.py

	analyze-markdown:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	# Same pinned engine (markdownlint-cli2 v0.22.1) used locally and by
	# CodeRabbit. Config + ignores come from .markdownlint-cli2.jsonc.
	- name: Lint markdown
	run: \|
	docker run --rm -v "$PWD:/workdir" \
	davidanson/markdownlint-cli2@sha256:0ed9a5f4c77ef447da2a2ac6e67caf74b214a7f80288819565e8b7d2ac148fe5

	# Builds the MkDocs + mkdoxy documentation site with the pinned toolchain
	# image (see docs/containers.md) so the site cannot silently rot. Runs on every
	# PR as a required check; on main it also stages the built site as the Pages
	# artifact for the deploy-docs-pages job to publish. PRs build but never deploy.
	docs-build:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	# Platforms are declared in SOLIDSYSLOG_PLATFORM_REGISTRY and roles by
	# their Core/Interface/SolidSyslog<Role>Definition.h header. This asserts
	# the docs enumerate exactly what the code declares — a platform's pages,
	# nav entry, description and matrix row; a role's link from the porting
	# guide, the roles index and the nav — and the reverse in both cases. It
	# also holds the three boundaries hand review kept losing: no platform
	# names another, every class a platform declares carries its registry
	# token, and every class a platform ships is on its page.
	- name: Check the docs match what the code declares
	run: python3 scripts/check_platform_docs.py

	# A path written in code font in a sentence, or in a CMake list, a
	# Compose mount or a path filter, is text nothing reads back out — the
	# link check below sees Markdown links only. This asserts every such path
	# still exists, so a rename cannot leave a green reference to nothing.
	- name: Check the paths documents and build files name exist
	run: python3 scripts/check_references.py

	# Guard the build hooks against regression — the source-link rewrite's
	# Markdown parsing, and the meta-description map's nav validation.
	# Image digest below is mkdocs-mkdoxy sha-34173c0 (see docs/containers.md).
	- name: Test docs build hooks
	run: \|
	docker run --rm -v "$PWD:/docs" \
	ghcr.io/cososo-ltd/mkdocs-mkdoxy@sha256:9ab3d41807a941f3d5a7077fb7288d0ffe2a926729ce13a4fc889cc8b6630d43 \
	python3 -m unittest discover -s /docs/hooks -p 'test_*.py'

	# --strict fails the build on broken nav, config, or links. Out-of-docs
	# source links (../Core/…, ../SECURITY.md) are rewritten to canonical
	# GitHub URLs by hooks/source_links.py, so not_found validation is fatal;
	# the api/ reference is generated from Core/Interface/*.h by mkdoxy.
	# Image digest below is mkdocs-mkdoxy sha-34173c0 (see docs/containers.md).
	- name: Build docs site
	run: \|
	docker run --rm -v "$PWD:/docs" \
	ghcr.io/cososo-ltd/mkdocs-mkdoxy@sha256:9ab3d41807a941f3d5a7077fb7288d0ffe2a926729ce13a4fc889cc8b6630d43 \
	mkdocs build --strict

	- name: Upload site artifact
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: docs-site
	path: site/
	retention-days: 7

	# On main only, restage the built site as the GitHub Pages artifact so
	# deploy-docs-pages can publish it. PRs stop at the build+artifact above.
	- name: Upload Pages artifact
	if: github.ref == 'refs/heads/main'
	uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
	with:
	path: site/

	# Publishes the built docs site to GitHub Pages. Main-only; PRs never deploy.
	# GitHub Pages permits a single deployment to the github-pages environment, so
	# the pages concurrency group serialises overlapping main pushes.
	deploy-docs-pages:
	needs: docs-build
	if: github.ref == 'refs/heads/main'
	runs-on: ubuntu-latest
	permissions:
	pages: write # to deploy the built site to GitHub Pages
	id-token: write # to verify the deployment originates from this workflow
	environment:
	name: github-pages
	url: ${{ steps.deployment.outputs.page_url }}
	concurrency:
	group: pages
	cancel-in-progress: false
	steps:
	- name: Deploy to GitHub Pages
	id: deployment
	uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

	analyze-cppcheck:
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure
	run: cmake --preset cppcheck

	- name: Build with cppcheck
	run: cmake --build --preset cppcheck

	- name: Generate cppcheck XML report
	if: success() \|\| failure()
	run: >
	cppcheck
	--enable=warning,style,performance,portability
	--suppress=missingIncludeSystem
	--suppressions-list=cppcheck_suppressions_tests.txt
	--inline-suppr
	--std=c11
	-DLWIP_DNS=1
	-DLWIP_UDP=1
	-DLWIP_TCP=1
	-DconfigSUPPORT_STATIC_ALLOCATION=1
	-DconfigUSE_MUTEXES=1
	-DipconfigUSE_TCP=1
	-ICore/Interface
	-IPlatform/StdAtomic/Interface
	-IPlatform/Posix/Interface
	-IPlatform/Windows/Interface
	-IPlatform/OpenSsl/Interface
	-IPlatform/MbedTls/Interface
	-IPlatform/FreeRtos/Interface
	-IPlatform/PlusTcp/Interface
	-IPlatform/LwipRaw/Interface
	-IPlatform/FatFs/Interface
	-IPlatform/PlusFat/Interface
	--xml --xml-version=2
	Core/Source/
	Platform/StdAtomic/Source/
	Platform/Posix/Source/
	Platform/Windows/Source/
	Platform/OpenSsl/Source/
	Platform/MbedTls/Source/
	Platform/FreeRtos/Source/
	Platform/PlusTcp/Source/
	Platform/LwipRaw/Source/
	Platform/FatFs/Source/
	Platform/PlusFat/Source/
	2> build/cppcheck/cppcheck-report.xml

	- name: Upload cppcheck report
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: cppcheck-report
	path: build/cppcheck/cppcheck-report.xml
	retention-days: 1

	# ----------------------------------------------------------------
	# cppcheck-misra addon — runs the MISRA C:2012 addon over Strict +
	# Pragmatic tiers (Core/Source/ + Platform/*/Source/). Findings
	# fail CI (--error-exitcode=1); suppressions live in
	# misra_suppressions.txt with rationales in docs/misra-deviations.md.
	# ----------------------------------------------------------------

	- name: Run cppcheck-misra
	if: success() \|\| failure()
	run: >
	cppcheck
	--addon=misra
	--suppressions-list=misra_suppressions.txt
	--error-exitcode=1
	--inline-suppr
	--std=c11
	-DLWIP_DNS=1
	-DLWIP_UDP=1
	-DLWIP_TCP=1
	-DconfigSUPPORT_STATIC_ALLOCATION=1
	-DconfigUSE_MUTEXES=1
	-DipconfigUSE_TCP=1
	-ICore/Interface
	-IPlatform/StdAtomic/Interface
	-IPlatform/Posix/Interface
	-IPlatform/Windows/Interface
	-IPlatform/OpenSsl/Interface
	-IPlatform/MbedTls/Interface
	-IPlatform/FreeRtos/Interface
	-IPlatform/PlusTcp/Interface
	-IPlatform/LwipRaw/Interface
	-IPlatform/FatFs/Interface
	-IPlatform/PlusFat/Interface
	Core/Source/
	Platform/StdAtomic/Source/
	Platform/Posix/Source/
	Platform/Windows/Source/
	Platform/OpenSsl/Source/
	Platform/MbedTls/Source/
	Platform/FreeRtos/Source/
	Platform/PlusTcp/Source/
	Platform/LwipRaw/Source/
	Platform/FatFs/Source/
	Platform/PlusFat/Source/

	- name: Generate cppcheck-misra XML report
	if: success() \|\| failure()
	run: \|
	mkdir -p build/cppcheck-misra
	cppcheck \
	--addon=misra \
	--suppressions-list=misra_suppressions.txt \
	--error-exitcode=1 \
	--inline-suppr \
	--std=c11 \
	-DLWIP_DNS=1 \
	-DLWIP_UDP=1 \
	-DLWIP_TCP=1 \
	-DconfigSUPPORT_STATIC_ALLOCATION=1 \
	-DconfigUSE_MUTEXES=1 \
	-DipconfigUSE_TCP=1 \
	-ICore/Interface \
	-IPlatform/StdAtomic/Interface \
	-IPlatform/Posix/Interface \
	-IPlatform/Windows/Interface \
	-IPlatform/OpenSsl/Interface \
	-IPlatform/MbedTls/Interface \
	-IPlatform/FreeRtos/Interface \
	-IPlatform/PlusTcp/Interface \
	-IPlatform/LwipRaw/Interface \
	-IPlatform/FatFs/Interface \
	-IPlatform/PlusFat/Interface \
	--xml --xml-version=2 \
	Core/Source/ \
	Platform/StdAtomic/Source/ \
	Platform/Posix/Source/ \
	Platform/Windows/Source/ \
	Platform/OpenSsl/Source/ \
	Platform/MbedTls/Source/ \
	Platform/FreeRtos/Source/ \
	Platform/PlusTcp/Source/ \
	Platform/LwipRaw/Source/ \
	Platform/FatFs/Source/ \
	Platform/PlusFat/Source/ \
	2> build/cppcheck-misra/cppcheck-misra-report.xml

	- name: Upload cppcheck-misra report
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: cppcheck-misra-report
	path: build/cppcheck-misra/cppcheck-misra-report.xml
	retention-days: 1

	build-windows-msvc:
	runs-on: windows-latest
	permissions:
	contents: read
	checks: write
	env:
	VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Enable vcpkg binary cache
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL \|\| '');
	core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN \|\| '');

	# Same cache as integration-windows-openssl — both jobs share one
	# entry. See that job's comment for rationale and key-bump policy.
	- name: Cache vcpkg installed tree
	uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	# The cache is a pure speed optimisation — a flaky restore must never
	# skip the build+test. actions/cache can fail mid-restore (even after
	# reporting a hit); without continue-on-error that failure trips the
	# default `if: success()` on every following step, so Install / Configure
	# / Build-and-test all skip and the job goes red without ever compiling.
	# On a miss or partial restore the `vcpkg install` below rebuilds the
	# tree (backed by the x-gha binary cache), so the only cost is a slower
	# run.
	continue-on-error: true
	with:
	path: C:\vcpkg\installed
	key: ${{ runner.os }}-vcpkg-cpputest-openssl-v1

	- name: Install CppUTest and OpenSSL
	run: \|
	vcpkg install cpputest openssl
	echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" >> $env:GITHUB_ENV

	- name: Configure
	run: cmake --preset msvc-debug

	- name: Build and test
	run: cmake --build --preset msvc-debug --target junit

	# The BDD target is built against a raised message size, as on Linux. Its
	# own configure regenerates the Python tunables mirror uploaded below, so
	# it runs after the default-preset build rather than before it.
	- name: Configure the BDD target with the tunable override
	run: cmake --preset msvc-tunable-override

	- name: Build the BDD target
	run: cmake --build --preset msvc-tunable-override --target SolidSyslogBddTarget

	- name: Test Report
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (MSVC)
	path: build/msvc-debug/cpputest_*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-build-windows-msvc
	path: build/msvc-debug/cpputest_*.xml
	retention-days: 1

	- name: Upload Windows BDD target binary
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: solid-syslog-bdd-target-windows
	path: build/msvc-tunable-override/Bdd/Targets/Debug/SolidSyslogBddTarget.exe
	retention-days: 1
	compression-level: 0

	- name: Upload BDD Python tunables (Windows)
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: bdd-tunables-windows
	path: Bdd/features/steps/solidsyslog_tunables.py
	retention-days: 1

	# Windows is the one platform whose sources are entirely probe-gated, so a
	# Linux runner would emit an empty fragment and verify-manifest cannot
	# generate it. It is checked here rather than committed: a hand-written
	# copy of a generated file would rot, and Path B's audience is embedded
	# toolchains. The check still catches a Windows adapter that reaches the
	# directory without reaching CMakeLists.
	- name: Check the Windows platform manifest against the tree
	shell: bash
	run: \|
	cmake -S . -B build/manifest-windows -DSOLIDSYSLOG_BUILD_TESTING=OFF \
	-DSOLIDSYSLOG_MANIFEST_SCOPE=platform \
	-DSOLIDSYSLOG_PLATFORMS=Windows \
	-DSOLIDSYSLOG_MANIFEST_PLATFORMS=Windows
	python3 scripts/check_manifest.py build/manifest-windows/solidsyslog-manifest.txt

	bdd-windows-otel:
	needs: build-windows-msvc
	runs-on: windows-2025
	permissions:
	contents: read
	checks: write
	defaults:
	run:
	shell: bash

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: solid-syslog-bdd-target-windows
	path: build/msvc-tunable-override/Bdd/Targets/Debug/

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: bdd-tunables-windows
	path: Bdd/features/steps/

	- name: Set up Python
	uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: '3.13'

	- name: Install behave
	run: pip install -r Bdd/requirements.txt

	- name: Install otelcol-contrib
	shell: pwsh
	run: ./Bdd/otel/Install-OtelCollector.ps1

	- name: Prepare BDD directories
	run: mkdir -p Bdd/output Bdd/junit

	- name: Start OTel Collector
	# Use bash `&` backgrounding (what works locally) rather than pwsh
	# Start-Process — the latter launched silently on windows-2025 with
	# empty redirect files and no UDP bind, suggesting the child was
	# either killed with the parent console or never actually executed.
	run: \|
	nohup ./Bdd/otel/bin/otelcol-contrib.exe \
	--config=Bdd/otel/config.yaml \
	> Bdd/output/otelcol.out 2> Bdd/output/otelcol.err &
	echo "otelcol backgrounded with PID $!"

	- name: Wait for oracle to bind UDP 5514 + TCP 6514/6515
	shell: pwsh
	run: \|
	$deadline = (Get-Date).AddSeconds(30)
	while ((Get-Date) -lt $deadline) {
	$udp5514 = Get-NetUDPEndpoint -LocalPort 5514 -ErrorAction SilentlyContinue
	$tcp6514 = Get-NetTCPConnection -LocalPort 6514 -State Listen -ErrorAction SilentlyContinue
	$tcp6515 = Get-NetTCPConnection -LocalPort 6515 -State Listen -ErrorAction SilentlyContinue
	if ($udp5514 -and $tcp6514 -and $tcp6515) {
	Write-Host "otelcol is listening on UDP 5514 + TCP 6514 (TLS) + TCP 6515 (mTLS)"
	exit 0
	}
	Start-Sleep -Milliseconds 500
	}
	Write-Host "otelcol did not bind all expected ports within 30 seconds"
	Write-Host "--- tasklist otelcol-contrib ---"
	tasklist /FI "IMAGENAME eq otelcol-contrib.exe"
	Write-Host "--- UDP endpoints (top 20) ---"
	Get-NetUDPEndpoint \| Select-Object -First 20 \| Format-Table -AutoSize
	Write-Host "--- TCP listeners (top 20) ---"
	Get-NetTCPConnection -State Listen \| Select-Object -First 20 \| Format-Table -AutoSize
	Write-Host "--- Bdd/output contents ---"
	Get-ChildItem Bdd/output -ErrorAction SilentlyContinue \| Format-Table
	Write-Host "--- otelcol.out ---"
	Get-Content Bdd/output/otelcol.out -ErrorAction SilentlyContinue
	Write-Host "--- otelcol.err ---"
	Get-Content Bdd/output/otelcol.err -ErrorAction SilentlyContinue
	exit 1

	- name: Run BDD tests
	env:
	BDD_TARGET: windows
	EXAMPLE_BINARY: build/msvc-tunable-override/Bdd/Targets/Debug/SolidSyslogBddTarget.exe
	RECEIVED_LOG: Bdd/output/received.jsonl
	ORACLE_FORMAT: otel-jsonl
	run: >
	behave --junit --junit-directory Bdd/junit
	--tags='not @wip and not @windows_wip and not @no_rtc and not @aesgcm'
	Bdd/features/

	- name: BDD Test Report (Windows)
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (BDD Windows)
	path: Bdd/junit/TESTS-*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-bdd-windows-otel
	path: Bdd/junit/TESTS-*.xml
	retention-days: 1

	- name: OTel collector logs on failure
	if: failure()
	run: \|
	echo "--- otelcol.out ---"
	cat Bdd/output/otelcol.out \|\| true
	echo "--- otelcol.err ---"
	cat Bdd/output/otelcol.err \|\| true

	bdd-linux-syslog-ng:
	needs: build-linux-tunable-override
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: solid-syslog-bdd-targets
	path: build/tunable-override-debug/Bdd/Targets/

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: bdd-tunables-linux
	path: Bdd/features/steps/

	- name: Make example binary executable
	run: chmod +x build/tunable-override-debug/Bdd/Targets/SolidSyslogBddTarget

	- name: Prepare BDD output directory
	run: mkdir -p Bdd/junit && chmod 777 Bdd/junit

	- name: Run BDD tests
	run: >
	docker compose -f ci/docker-compose.bdd.yml
	up --abort-on-container-exit --exit-code-from behave-linux
	behave-linux syslog-ng-linux

	- name: BDD Test Report
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (BDD)
	path: Bdd/junit/TESTS-*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-bdd-linux-syslog-ng
	path: Bdd/junit/TESTS-*.xml
	retention-days: 1

	- name: Compose logs on failure
	if: failure()
	run: docker compose -f ci/docker-compose.bdd.yml logs --no-color

	build-freertos-host-tdd-plustcp:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	container:
	image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	# Smoke check: configure + build the regular host preset under the
	# cpputest-freertos image. FREERTOS_KERNEL_PATH is set, so
	# Platform/FreeRtos and the FreeRtosFakes / Tests/FreeRtos placeholder
	# directories are added — placeholders today, real fakes from S08.04.
	- name: Configure
	run: cmake --preset debug

	- name: Build and test
	run: cmake --build --preset debug --target junit BddTargetTests SolidSyslogBddTarget

	- name: Run BDD target tests
	run: cd build/debug && ./Tests/Bdd/Targets/BddTargetTests -ojunit -k BddTargetTests

	- name: Test Report
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (FreeRTOS host)
	path: build/debug/cpputest_*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-build-freertos-host-tdd-plustcp
	path: build/debug/cpputest_*.xml
	retention-days: 1

	build-freertos-target-plustcp:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	container:
	image: ghcr.io/cososo-ltd/cpputest-freertos-cross@sha256:481267bea7200641fac41d7136e7e08deeba1b311e9873aa6d1c311db5b4cf58 # sha-ad10bf2
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure (ARM cross)
	run: cmake --preset freertos-cross

	- name: Cross-build FreeRTOS BDD target ELF
	run: cmake --build --preset freertos-cross --target SolidSyslogBddTarget

	- name: Upload FreeRTOS BDD target ELF
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: solid-syslog-bdd-target-freertos
	path: build/freertos-cross/Bdd/Targets/FreeRtos/SolidSyslogBddTarget.elf
	retention-days: 1
	compression-level: 0

	- name: Upload BDD Python tunables (FreeRTOS)
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: bdd-tunables-freertos
	path: Bdd/features/steps/solidsyslog_tunables.py
	retention-days: 1

	# Required as of S28.11 (in the `summary` needs list). Proves the
	# Platform/LwipRaw tree cross-builds for FreeRTOS/ARM with Plus-TCP
	# deselected and zero PlusTcp dependency (the symbol
	# assertion below enforces that). No QEMU run. Adding it to the GitHub
	# branch-protection required-checks set is a separate manual step (David).
	build-freertos-target-lwip:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	container:
	image: ghcr.io/cososo-ltd/cpputest-freertos-cross@sha256:481267bea7200641fac41d7136e7e08deeba1b311e9873aa6d1c311db5b4cf58 # sha-ad10bf2
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Configure (ARM cross, NET=LWIP)
	run: cmake --preset freertos-cross-lwip

	- name: Cross-build FreeRTOS+lwIP BDD target ELF
	run: cmake --build --preset freertos-cross-lwip --target SolidSyslogBddTargetLwip

	- name: Assert no PlusTcp / Plus-TCP symbols linked
	run: \|
	elf=build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/SolidSyslogBddTargetLwip.elf
	arm-none-eabi-nm "$elf" > /tmp/lwip-symbols.txt
	if grep -E -i 'PlusTcp\|FreeRTOS_socket\|FreeRTOS_sendto\|FreeRTOS_recv\|FreeRTOS_IPInit' /tmp/lwip-symbols.txt; then
	echo "::error::PlusTcp / FreeRTOS-Plus-TCP symbol linked into the lwIP BDD target ELF"
	exit 1
	fi
	echo "OK: no PlusTcp / FreeRTOS-Plus-TCP symbols in the lwIP BDD target ELF"

	- name: Upload FreeRTOS+lwIP BDD target ELF
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: solid-syslog-bdd-target-freertos-lwip
	path: build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/SolidSyslogBddTargetLwip.elf
	retention-days: 1
	compression-level: 0

	# BDD-side mirror of build-time tunables (configure_file). The lwIP bdd
	# lane consumes this so environment.py's runtime tag gates track the lwIP
	# target's SOLIDSYSLOG_MAX_MESSAGE_SIZE.
	- name: Upload BDD Python tunables (FreeRTOS+lwIP)
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: bdd-tunables-freertos-lwip
	path: Bdd/features/steps/solidsyslog_tunables.py
	retention-days: 1

	bdd-freertos-qemu-plustcp:
	needs: build-freertos-target-plustcp
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: solid-syslog-bdd-target-freertos
	path: build/freertos-cross/Bdd/Targets/FreeRtos/

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: bdd-tunables-freertos
	path: Bdd/features/steps/

	- name: Make ELF readable
	run: chmod +r build/freertos-cross/Bdd/Targets/FreeRtos/SolidSyslogBddTarget.elf

	- name: Prepare BDD output directory
	run: mkdir -p Bdd/junit && chmod 777 Bdd/junit

	- name: Run BDD tests
	run: >
	docker compose -f ci/docker-compose.bdd.yml
	up --abort-on-container-exit --exit-code-from behave-freertos
	behave-freertos syslog-ng-freertos

	- name: BDD Test Report (FreeRTOS)
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (BDD FreeRTOS)
	path: Bdd/junit/TESTS-*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-bdd-freertos-qemu-plustcp
	path: Bdd/junit/TESTS-*.xml
	retention-days: 1

	- name: Compose logs on failure
	if: failure()
	run: docker compose -f ci/docker-compose.bdd.yml logs --no-color

	# Required as of S28.11 (in the `summary` needs list): runs the lwIP BDD
	# target on QEMU against the syslog-ng oracle over UDP / TCP / TLS / mTLS.
	# Adding it to the GitHub branch-protection required-checks set is a
	# separate manual step (David).
	bdd-freertos-qemu-lwip:
	needs: build-freertos-target-lwip
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: solid-syslog-bdd-target-freertos-lwip
	path: build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: bdd-tunables-freertos-lwip
	path: Bdd/features/steps/

	- name: Make ELF readable
	run: chmod +r build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/SolidSyslogBddTargetLwip.elf

	- name: Prepare BDD output directory
	run: mkdir -p Bdd/junit && chmod 777 Bdd/junit

	- name: Run BDD tests
	run: >
	docker compose -f ci/docker-compose.bdd.yml
	up --abort-on-container-exit --exit-code-from behave-freertos-lwip
	behave-freertos-lwip syslog-ng-freertos-lwip

	- name: BDD Test Report (FreeRTOS+lwIP)
	uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
	if: success() \|\| failure()
	with:
	name: Test Results (BDD FreeRTOS+lwIP)
	path: Bdd/junit/TESTS-*.xml
	reporter: java-junit

	- name: Upload JUnit XML
	if: success() \|\| failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: junit-bdd-freertos-qemu-lwip
	path: Bdd/junit/TESTS-*.xml
	retention-days: 1

	- name: Compose logs on failure
	if: failure()
	run: docker compose -f ci/docker-compose.bdd.yml logs --no-color

	# Anti-drift gate (S30.03): regenerate the committed beta-stack integration
	# manifest from CMake and fail if it differs from what is checked in. Keeps
	# docs/generated/beta-stack-manifest.txt honest against the platform source
	# lists (the generator reads each upstream platform target's INTERFACE_SOURCES
	# and the Core target's SOURCES). The stack is stated in SOLIDSYSLOG_PLATFORMS
	# rather than inherited from the image's environment, so the manifest
	# describes the platforms this gate means to describe (S30.05).
	verify-manifest:
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	# The environment is scrubbed so an upstream platform is described because
	# it was named, not because the image happens to carry its tree. Windows is
	# the one token missing here — it is probe-kind, so it cannot be selected on
	# Linux; build-windows-msvc generates that fragment.
	- name: Regenerate the Core and per-platform manifests
	shell: bash
	run: \|
	scrubbed() {
	env -u LWIP_PATH -u FREERTOS_KERNEL_PATH -u MBEDTLS_DIR \
	-u FATFS_PATH -u FREERTOS_PLUS_FAT_PATH -u FREERTOS_PLUS_TCP_PATH "$@"
	}
	scrubbed cmake -S . -B build/manifest-core -DSOLIDSYSLOG_BUILD_TESTING=OFF \
	-DSOLIDSYSLOG_MANIFEST_SCOPE=core \
	-DSOLIDSYSLOG_MANIFEST_OUTPUT="$(pwd)/docs/generated/core-manifest.txt"
	for platform in $(python3 scripts/check_manifest.py --list-platforms); do
	[ "$platform" = "Windows" ] && continue
	scrubbed cmake -S . -B "build/manifest-$platform" -DSOLIDSYSLOG_BUILD_TESTING=OFF \
	-DSOLIDSYSLOG_MANIFEST_SCOPE=platform \
	-DSOLIDSYSLOG_PLATFORMS="$platform" \
	-DSOLIDSYSLOG_MANIFEST_PLATFORMS="$platform" \
	-DSOLIDSYSLOG_MANIFEST_OUTPUT="$(pwd)/docs/generated/$platform-manifest.txt"
	done

	- name: Regenerate the beta-stack manifest
	shell: bash
	run: \|
	cmake -S . -B build/manifest -DSOLIDSYSLOG_BUILD_TESTING=OFF \
	-DSOLIDSYSLOG_PLATFORMS="LwipRaw;FreeRtos;MbedTls;FatFs;StdAtomic" \
	-DSOLIDSYSLOG_MANIFEST_PLATFORMS="LwipRaw;MbedTls;FreeRtos;FatFs;StdAtomic" \
	-DSOLIDSYSLOG_MANIFEST_OUTPUT="$(pwd)/docs/generated/beta-stack-manifest.txt"

	- name: Fail on drift
	shell: bash
	run: \|
	git diff --exit-code docs/generated/ \
	\|\| { echo "::error::docs/generated is stale — regenerate with the manifest target (see docs/build-integration.md)"; exit 1; }

	# Every manifest section's file list must equal that directory's *.c,
	# compared against the filesystem rather than the build targets, so a
	# source no target lists is visible.
	- name: Assert every manifest matches the tree
	shell: bash
	run: \|
	for manifest in docs/generated/*-manifest.txt; do
	python3 scripts/check_manifest.py "$manifest" \
	\|\| { echo "::error::$manifest does not match the source tree — see the diff above"; exit 1; }
	done

	# Consume the library from outside, the way an integrator does (S30.04). The
	# bug this guards against — SolidSyslog assuming it is the top-level project —
	# survived every other lane precisely because they all build it top-level.
	consumer-smoke-linux:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	container:
	image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	# FETCHCONTENT_SOURCE_DIR_SOLIDSYSLOG points FetchContent at this checkout,
	# so the PR is validated against its own tree instead of main.
	- name: Configure the consumer project
	run: \|
	cmake -S ci/consumer-smoke -B build/consumer-smoke \
	-DFETCHCONTENT_SOURCE_DIR_SOLIDSYSLOG="$(pwd)"

	- name: Build the consumer project
	run: cmake --build build/consumer-smoke

	# A nested configure must not write into the dependency's checkout. The BDD
	# tunables mirror is the one that did, and it is gitignored, so check for
	# the file itself as well as for tracked-file drift.
	- name: Assert the nested configure left the library tree alone
	run: \|
	git diff --exit-code \
	\|\| { echo "::error::configuring SolidSyslog as a subproject modified its own source tree"; exit 1; }
	if [ -f Bdd/features/steps/solidsyslog_tunables.py ]; then
	echo "::error::a nested configure wrote Bdd/features/steps/solidsyslog_tunables.py into the dependency's checkout"
	exit 1
	fi

	consumer-smoke-freertos-cross:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	container:
	image: ghcr.io/cososo-ltd/cpputest-freertos-cross@sha256:481267bea7200641fac41d7136e7e08deeba1b311e9873aa6d1c311db5b4cf58 # sha-ad10bf2
	options: --user root
	env:
	GIT_CONFIG_COUNT: 1
	GIT_CONFIG_KEY_0: safe.directory
	GIT_CONFIG_VALUE_0: '*'

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	# The consumer's toolchain sets CMAKE_SYSTEM_PROCESSOR=arm and
	# CMAKE_CROSSCOMPILING — the exact pair that used to drag SolidSyslog's own
	# BDD ELF into their build. Reusing our arm-none-eabi file keeps the lane
	# honest without vendoring a second copy; a real integrator brings theirs.
	- name: Configure the consumer project (ARM cross)
	run: \|
	cmake -S ci/consumer-smoke -B build/consumer-smoke-cross \
	-DCMAKE_TOOLCHAIN_FILE="$(pwd)/Bdd/Targets/FreeRtos/cmake/arm-none-eabi.cmake" \
	-DFETCHCONTENT_SOURCE_DIR_SOLIDSYSLOG="$(pwd)"

	- name: Cross-build the consumer project
	run: cmake --build build/consumer-smoke-cross

	# The integrator shape no other lane has (S30.05). Every container here
	# exports all five upstream paths, so a pack that exists only because the
	# environment says so looks identical to one that works. Scrubbing the
	# environment leaves -DSOLIDSYSLOG_PLATFORMS as the only thing that can
	# select a pack and -D as the only thing that can locate an upstream tree.
	#
	# It LINKS the packs rather than asserting their targets exist: the packs
	# carry their sources into the consumer's target, so "do these compile
	# against someone else's config header" is the question, and only linking
	# asks it.
	- name: Configure the consumer project (scrubbed environment, explicit selection)
	run: \|
	env -u LWIP_PATH -u FREERTOS_KERNEL_PATH -u MBEDTLS_DIR \
	-u FATFS_PATH -u FREERTOS_PLUS_FAT_PATH -u FREERTOS_PLUS_TCP_PATH \
	cmake -S ci/consumer-smoke -B build/consumer-smoke-scrubbed \
	-DCMAKE_TOOLCHAIN_FILE="$(pwd)/Bdd/Targets/FreeRtos/cmake/arm-none-eabi.cmake" \
	-DFETCHCONTENT_SOURCE_DIR_SOLIDSYSLOG="$(pwd)" \
	-DSOLIDSYSLOG_PLATFORMS="LwipRaw;FreeRtos" \
	-DSOLIDSYSLOG_LWIP_PATH=/opt/lwip \
	-DSOLIDSYSLOG_FREERTOS_KERNEL_PATH=/opt/freertos/kernel \
	-DSOLIDSYSLOG_SMOKE_LINK_PACKS=ON

	- name: Cross-build and link the packs
	run: cmake --build build/consumer-smoke-scrubbed

	# Builds the gated-out path for the packs this lane selects. PlusTcp is an
	# alternative network stack and is not built here.
	- name: Configure the consumer project (LwipRaw and FreeRtos gates off)
	run: \|
	env -u LWIP_PATH -u FREERTOS_KERNEL_PATH -u MBEDTLS_DIR \
	-u FATFS_PATH -u FREERTOS_PLUS_FAT_PATH -u FREERTOS_PLUS_TCP_PATH \
	cmake -S ci/consumer-smoke -B build/consumer-smoke-gates-off \
	-DCMAKE_TOOLCHAIN_FILE="$(pwd)/Bdd/Targets/FreeRtos/cmake/arm-none-eabi.cmake" \
	-DFETCHCONTENT_SOURCE_DIR_SOLIDSYSLOG="$(pwd)" \
	-DSOLIDSYSLOG_PLATFORMS="LwipRaw;FreeRtos" \
	-DSOLIDSYSLOG_LWIP_PATH=/opt/lwip \
	-DSOLIDSYSLOG_FREERTOS_KERNEL_PATH=/opt/freertos/kernel \
	-DSOLIDSYSLOG_SMOKE_CONFIG_DIR=config-gates-off \
	-DSOLIDSYSLOG_SMOKE_LINK_PACKS=ON

	- name: Cross-build the packs with the LwipRaw and FreeRtos gates off
	run: cmake --build build/consumer-smoke-gates-off

	# Path B has no CMake to select anything, so the same consumer is built by
	# directory selection. The environment is scrubbed for the same reason as
	# above: the platform list and the -D paths are all that can reach it.
	- name: Build the Make consumer (scrubbed environment)
	run: \|
	env -u LWIP_PATH -u FREERTOS_KERNEL_PATH -u MBEDTLS_DIR \
	-u FATFS_PATH -u FREERTOS_PLUS_FAT_PATH -u FREERTOS_PLUS_TCP_PATH \
	make -f ci/consumer-smoke/Makefile -j"$(nproc)" \
	LWIP_PATH=/opt/lwip \
	FREERTOS_KERNEL_PATH=/opt/freertos/kernel

	- name: Build the Make consumer with the LwipRaw and FreeRtos gates off
	run: \|
	env -u LWIP_PATH -u FREERTOS_KERNEL_PATH -u MBEDTLS_DIR \
	-u FATFS_PATH -u FREERTOS_PLUS_FAT_PATH -u FREERTOS_PLUS_TCP_PATH \
	make -f ci/consumer-smoke/Makefile -j"$(nproc)" \
	LWIP_PATH=/opt/lwip \
	FREERTOS_KERNEL_PATH=/opt/freertos/kernel \
	CONFIG_DIR=config-gates-off \
	BUILD="$(pwd)/build/consumer-smoke-make-gates-off"

	# A nested configure must not write into the dependency's checkout. The BDD
	# tunables mirror is the one that did, and it is gitignored, so check for
	# the file itself as well as for tracked-file drift.
	- name: Assert the nested configure left the library tree alone
	run: \|
	git diff --exit-code \
	\|\| { echo "::error::configuring SolidSyslog as a subproject modified its own source tree"; exit 1; }
	if [ -f Bdd/features/steps/solidsyslog_tunables.py ]; then
	echo "::error::a nested configure wrote Bdd/features/steps/solidsyslog_tunables.py into the dependency's checkout"
	exit 1
	fi

	summary:
	if: always() && github.event_name == 'pull_request'
	needs: [build-linux-gcc, build-linux-tunable-override, build-linux-clang, build-linux-c99, build-linux-c89-headers, sanitize-linux-gcc, coverage-linux-gcc, analyze-tidy, analyze-tidy-freertos-plustcp, analyze-tidy-freertos-lwip, analyze-cppcheck, analyze-format, analyze-markdown, analyze-spdx, analyze-iwyu, analyze-iwyu-freertos-plustcp, analyze-iwyu-freertos-lwip, bdd-linux-syslog-ng, build-windows-msvc, bdd-windows-otel, integration-linux-openssl, integration-linux-mbedtls, integration-windows-openssl, build-freertos-host-tdd-plustcp, build-freertos-target-plustcp, bdd-freertos-qemu-plustcp, build-freertos-target-lwip, bdd-freertos-qemu-lwip, verify-manifest, consumer-smoke-linux, consumer-smoke-freertos-cross]
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	pull-requests: write

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Download JUnit artifacts
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	pattern: junit-*
	path: quality-reports/

	- name: Download clang-tidy report
	continue-on-error: true
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: clang-tidy-report
	path: quality-reports/

	- name: Download cppcheck report
	continue-on-error: true
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: cppcheck-report
	path: quality-reports/

	- name: Download iwyu report
	continue-on-error: true
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: iwyu-report
	path: quality-reports/

	- name: Quality Monitor
	uses: uhafner/quality-monitor@0100da6973a1498aad89af676852a8c788d397f8 # v4.15.0
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	pr-number: ${{ github.event.pull_request.number }}
	checks-name: Quality Summary
	config: >
	{
	"tests": {
	"name": "Tests",
	"tools": [
	{
	"id": "junit",
	"name": "build-linux-gcc",
	"pattern": "*/junit-build-linux-gcc/cpputest_.xml"
	},
	{
	"id": "junit",
	"name": "build-freertos-host-tdd-plustcp",
	"pattern": "*/junit-build-freertos-host-tdd-plustcp/cpputest_.xml"
	},
	{
	"id": "junit",
	"name": "build-linux-clang",
	"pattern": "*/junit-build-linux-clang/cpputest_.xml"
	},
	{
	"id": "junit",
	"name": "sanitize-linux-gcc",
	"pattern": "*/junit-sanitize-linux-gcc/cpputest_.xml"
	},
	{
	"id": "junit",
	"name": "integration-linux-openssl",
	"pattern": "*/junit-integration-linux-openssl/cpputest_.xml"
	},
	{
	"id": "junit",
	"name": "integration-linux-mbedtls",
	"pattern": "*/junit-integration-linux-mbedtls/cpputest_.xml"
	},
	{
	"id": "junit",
	"name": "integration-windows-openssl",
	"pattern": "*/junit-integration-windows-openssl/cpputest_.xml"
	},
	{
	"id": "junit",
	"name": "bdd-linux-syslog-ng",
	"pattern": "*/junit-bdd-linux-syslog-ng/TESTS-.xml"
	},
	{
	"id": "junit",
	"name": "bdd-windows-otel",
	"pattern": "*/junit-bdd-windows-otel/TESTS-.xml"
	},
	{
	"id": "junit",
	"name": "bdd-freertos-qemu-plustcp",
	"pattern": "*/junit-bdd-freertos-qemu-plustcp/TESTS-.xml"
	},
	{
	"id": "junit",
	"name": "bdd-freertos-qemu-lwip",
	"pattern": "*/junit-bdd-freertos-qemu-lwip/TESTS-.xml"
	},
	{
	"id": "junit",
	"name": "build-windows-msvc",
	"pattern": "*/junit-build-windows-msvc/cpputest_.xml"
	},
	{
	"id": "junit",
	"name": "build-linux-tunable-override",
	"pattern": "*/junit-build-linux-tunable-override/cpputest_.xml"
	}
	]
	},
	"analysis": [
	{
	"name": "analyze-tidy",
	"id": "analyze-tidy",
	"tools": [
	{
	"id": "clang-tidy",
	"pattern": "**/clang-tidy-output.txt"
	}
	]
	},
	{
	"name": "analyze-cppcheck",
	"id": "analyze-cppcheck",
	"tools": [
	{
	"id": "cppcheck",
	"pattern": "**/cppcheck-report.xml"
	}
	]
	}
	]
	}

Navigation Menu

Uh oh!

ci: bump github/codeql-action to 4.37.9 and group its bumps #1384

Workflow file

ci: bump github/codeql-action to 4.37.9 and group its bumps #1384

Uh oh!

Workflow file for this run