ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

permissions:
  contents: read

jobs:
  build-linux-gcc:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset debug

      - name: Build and test
        run: cmake --build --preset debug --target junit BddTargetTests

      - name: Run BDD target tests
        run: cd build/debug && ./Tests/Bdd/Targets/BddTargetTests -ojunit -k BddTargetTests

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (GCC)
          path: build/debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-build-linux-gcc
          path: build/debug/cpputest_*.xml
          retention-days: 1

  integration-linux-openssl:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset debug

      - name: Build integration tests
        run: cmake --build --preset debug --target OpenSslIntegrationTests

      - name: Run integration tests
        run: cd build/debug && ./Tests/OpenSslIntegration/OpenSslIntegrationTests -v -ojunit -k OpenSslIntegrationTests

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (OpenSSL Integration)
          path: build/debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-integration-linux-openssl
          path: build/debug/cpputest_*.xml
          retention-days: 1

  integration-linux-mbedtls:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    # cpputest-freertos image carries /opt/mbedtls (and exports MBEDTLS_DIR);
    # Tests/MbedTlsIntegration/CMakeLists.txt requires that env var.
    container:
      image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset debug

      - name: Build integration tests
        run: cmake --build --preset debug --target MbedTlsIntegrationTests

      - name: Run integration tests
        run: cd build/debug && ./Tests/MbedTlsIntegration/MbedTlsIntegrationTests -v -ojunit -k MbedTlsIntegrationTests

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (mbedTLS Integration)
          path: build/debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-integration-linux-mbedtls
          path: build/debug/cpputest_*.xml
          retention-days: 1

  integration-windows-openssl:
    runs-on: windows-latest
    permissions:
      contents: read
      checks: write
    env:
      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Enable vcpkg binary cache
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      # Cache vcpkg's classic-mode installed tree across runs and branches.
      # x-gha (above) is per-workflow scope and goes cold on a fresh branch;
      # actions/cache survives across branches with a static key. Bump the
      # `v1` suffix to force a rebuild (e.g. when adding a package).
      # C:\vcpkg is the standard VCPKG_INSTALLATION_ROOT on github-hosted
      # windows runners — hardcoded here so the cache step doesn't depend
      # on a runner-image-set env var (the linter can't see those).
      - name: Cache vcpkg installed tree
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        # The cache is a pure speed optimisation — a flaky restore must never
        # skip the build+test. actions/cache can fail mid-restore (even after
        # reporting a hit); without continue-on-error that failure trips the
        # default `if: success()` on every following step, so Install / Configure
        # / Build-and-test all skip and the job goes red without ever compiling.
        # On a miss or partial restore the `vcpkg install` below rebuilds the
        # tree (backed by the x-gha binary cache), so the only cost is a slower
        # run.
        continue-on-error: true
        with:
          path: C:\vcpkg\installed
          key: ${{ runner.os }}-vcpkg-cpputest-openssl-v1

      - name: Install CppUTest and OpenSSL
        run: |
          vcpkg install cpputest openssl
          echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" >> $env:GITHUB_ENV

      - name: Configure
        run: cmake --preset msvc-debug

      - name: Build integration tests
        run: cmake --build --preset msvc-debug --target OpenSslIntegrationTests

      - name: Run integration tests
        shell: pwsh
        run: |
          Set-Location build/msvc-debug/Tests/OpenSslIntegration/Debug
          ./OpenSslIntegrationTests.exe -v -ojunit -k OpenSslIntegrationTests

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (OpenSSL Integration Windows)
          path: build/msvc-debug/Tests/OpenSslIntegration/Debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-integration-windows-openssl
          path: build/msvc-debug/Tests/OpenSslIntegration/Debug/cpputest_*.xml
          retention-days: 1

  build-linux-tunable-override:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure with tunable override
        run: cmake --preset tunable-override-debug

      # The host BDD target is built here rather than against the defaults --
      # see the @requires_message_size_1500 entry in docs/bdd.md.
      - name: Build and test
        run: cmake --build --preset tunable-override-debug --target junit SolidSyslogBddTarget

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (Tunable Override)
          path: build/tunable-override-debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-build-linux-tunable-override
          path: build/tunable-override-debug/cpputest_*.xml
          retention-days: 1

      - name: Upload BDD target binaries
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: solid-syslog-bdd-targets
          path: |
            build/tunable-override-debug/Bdd/Targets/SolidSyslogBddTarget
          retention-days: 1
          compression-level: 0

      # BDD-side mirror of build-time tunables, generated by configure_file.
      # bdd-linux-syslog-ng downloads this into Bdd/features/steps/ so behave
      # can `import solidsyslog_tunables` (the file is gitignored, not in checkout).
      - name: Upload BDD Python tunables (Linux)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bdd-tunables-linux
          path: Bdd/features/steps/solidsyslog_tunables.py
          retention-days: 1

  build-linux-clang:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/cososo-ltd/cpputest-clang@sha256:95e8a1b076aa2faab98af1415c89a36feaa12e0a9e42950194f9775d0ed27c35 # sha-5905aea
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset clang-debug

      - name: Build and test
        run: cmake --build --preset clang-debug --target junit

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (Clang)
          path: build/clang-debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-build-linux-clang
          path: build/clang-debug/cpputest_*.xml
          retention-days: 1

  # Proves the public claim that Core compiles as C99, then checks the POSIX and
  # OpenSSL packs have not drifted off it. Library only, no tests.
  # See docs/builds.md.
  build-linux-c99:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure Core at C99
        run: cmake --preset c99

      - name: Build Core at C99
        run: cmake --build --preset c99

      - name: Configure POSIX and OpenSSL packs at C99
        run: cmake --preset c99-platforms

      - name: Build POSIX and OpenSSL packs at C99
        run: cmake --build --preset c99-platforms

  # The library is C99; the code that includes its headers need not be. Compiles
  # every public header standalone at -std=c89 -pedantic-errors, so an
  # integrator on an older toolchain can include them. See docs/build-integration.md.
  build-linux-c89-headers:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Compile every public header as C89
        run: python3 scripts/check_headers_c89.py --cc gcc

  sanitize-linux-gcc:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset sanitize

      - name: Build and test
        run: cmake --build --preset sanitize --target junit

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (Sanitize)
          path: build/sanitize/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-sanitize-linux-gcc
          path: build/sanitize/cpputest_*.xml
          retention-days: 1

  coverage-linux-gcc:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset coverage

      - name: Build and generate coverage report
        run: cmake --build --preset coverage --target coverage

      - name: Post coverage summary
        run: |
          echo '## Coverage Summary' >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          lcov --summary build/coverage/coverage.filtered.info --rc branch_coverage=1 2>&1 >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

      - name: Enforce coverage thresholds
        env:
          LINE_THRESHOLD: 90
          BRANCH_THRESHOLD: 90
        run: |
          SUMMARY=$(lcov --summary build/coverage/coverage.filtered.info --rc branch_coverage=1 2>&1)
          LINE_COV=$(echo "$SUMMARY" | sed -n 's/.*lines\.*: \([0-9.]*\)%.*/\1/p')
          BRANCH_COV=$(echo "$SUMMARY" | sed -n 's/.*branches\.*: \([0-9.]*\)%.*/\1/p')
          FAIL=0
          if [ -n "$LINE_COV" ]; then
            echo "Line coverage:   ${LINE_COV}% (threshold: ${LINE_THRESHOLD}%)"
            if awk "BEGIN{exit !($LINE_COV < $LINE_THRESHOLD)}"; then
              echo "FAIL: line coverage ${LINE_COV}% is below ${LINE_THRESHOLD}%"
              FAIL=1
            fi
          else
            echo "FAIL: could not determine line coverage"
            FAIL=1
          fi
          if [ -n "$BRANCH_COV" ]; then
            echo "Branch coverage: ${BRANCH_COV}% (threshold: ${BRANCH_THRESHOLD}%)"
            if awk "BEGIN{exit !($BRANCH_COV < $BRANCH_THRESHOLD)}"; then
              echo "FAIL: branch coverage ${BRANCH_COV}% is below ${BRANCH_THRESHOLD}%"
              FAIL=1
            fi
          else
            echo "Branch coverage: no branch data found (skipping threshold check)"
          fi
          exit $FAIL

      # GitHub Pages now serves the docs site (see deploy-docs-pages), not the
      # coverage report. The HTML report stays available as a downloadable run
      # artifact for anyone who wants to inspect it; success()||failure() keeps
      # it uploaded even when the threshold gate above fails, which is exactly
      # when you want to read it.
      - name: Upload coverage report artifact
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-report-linux-gcc
          path: build/coverage/coverage_report/
          retention-days: 7

  analyze-tidy:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset tidy

      - name: Build with clang-tidy
        shell: bash
        run: set -o pipefail && cmake --build --preset tidy 2>&1 | tee build/tidy/clang-tidy-output.txt

      - name: Upload clang-tidy output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: clang-tidy-report
          path: build/tidy/clang-tidy-output.txt
          retention-days: 1

  analyze-iwyu:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/cososo-ltd/cpputest-clang@sha256:95e8a1b076aa2faab98af1415c89a36feaa12e0a9e42950194f9775d0ed27c35 # sha-5905aea
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset iwyu

      # IWYU is advisory: the two-pass "should add / should remove" output is
      # hard to interpret correctly under time pressure, and the per-PR
      # friction it causes outweighs the steady-state value (S24.13 / E24).
      # Findings still surface via the uploaded artifact below; release prep
      # is responsible for clearing them.
      - name: Run include-what-you-use (advisory)
        shell: bash
        continue-on-error: true
        run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 | tee build/iwyu/iwyu-output.txt

      - name: Upload iwyu output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: iwyu-report
          path: build/iwyu/iwyu-output.txt
          retention-days: 1

  # Mirrors analyze-tidy but runs on cpputest-freertos so the Platform/{FreeRtos,
  # PlusTcp,LwipRaw,MbedTls,FatFs} trees and their Tests/* siblings enter the
  # CMake configure (gated by FREERTOS_KERNEL_PATH / MBEDTLS_DIR / LWIP_PATH /
  # FATFS_PATH, all set in the freertos image). The base lane on cpputest skips
  # those trees because the env vars are absent.
  analyze-tidy-freertos-plustcp:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset tidy

      - name: Build with clang-tidy
        shell: bash
        run: set -o pipefail && cmake --build --preset tidy 2>&1 | tee build/tidy/clang-tidy-output.txt

      - name: Upload clang-tidy output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: clang-tidy-report-freertos-plustcp
          path: build/tidy/clang-tidy-output.txt
          retention-days: 1

  # Same freertos coverage rationale as analyze-tidy-freertos-plustcp. Overrides
  # CMAKE_C_COMPILER explicitly to clang-19 because the cpputest-freertos image
  # (chained from the cpputest gcc base) ships clang-19/clang++-19 but no
  # `clang`/`clang++` alternative — only the cpputest-clang image creates that
  # alias. A future image bump could add the alternative to the gcc base and
  # drop these overrides.
  analyze-iwyu-freertos-plustcp:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset iwyu -DCMAKE_C_COMPILER=clang-19 -DCMAKE_CXX_COMPILER=clang++-19

      # Advisory per S24.13 — see analyze-iwyu above for rationale.
      - name: Run include-what-you-use (advisory)
        shell: bash
        continue-on-error: true
        run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 | tee build/iwyu/iwyu-output.txt

      - name: Upload iwyu output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: iwyu-report-freertos-plustcp
          path: build/iwyu/iwyu-output.txt
          retention-days: 1

  # lwIP twin of analyze-tidy-freertos-plustcp. Same cpputest-freertos image and
  # tidy preset, with Plus-TCP deselected so the configure exercises the lwIP
  # wiring path with Platform/PlusTcp absent. Since S30.06 that is said directly
  # — a platform is deselected by its own switch — rather than inferred from a
  # FreeRTOS networking-backend variable. Guards the LwipRaw tree and its Tests
  # under clang-tidy as a named required check.
  analyze-tidy-freertos-lwip:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset tidy -DSOLIDSYSLOG_PLUSTCP=OFF

      - name: Build with clang-tidy
        shell: bash
        run: set -o pipefail && cmake --build --preset tidy 2>&1 | tee build/tidy/clang-tidy-output.txt

      - name: Upload clang-tidy output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: clang-tidy-report-freertos-lwip
          path: build/tidy/clang-tidy-output.txt
          retention-days: 1

  # NET=LWIP twin of analyze-iwyu-freertos-plustcp — see that lane for the
  # clang-19 override rationale and analyze-tidy-freertos-lwip for the NET scope.
  # Advisory per S24.13.
  analyze-iwyu-freertos-lwip:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset iwyu -DSOLIDSYSLOG_PLUSTCP=OFF -DCMAKE_C_COMPILER=clang-19 -DCMAKE_CXX_COMPILER=clang++-19

      # Advisory per S24.13 — see analyze-iwyu above for rationale.
      - name: Run include-what-you-use (advisory)
        shell: bash
        continue-on-error: true
        run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 | tee build/iwyu/iwyu-output.txt

      - name: Upload iwyu output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: iwyu-report-freertos-lwip
          path: build/iwyu/iwyu-output.txt
          retention-days: 1

  analyze-format:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check clang-format
        run: |
          find Core/Interface Core/Source Platform Tests Bdd/Targets -name '*.c' -o -name '*.cpp' -o -name '*.h' \
            | xargs clang-format --dry-run --Werror

      # README.md claims Core's implementation has no conditional compilation.
      # Keep that true rather than aspirational.
      - name: Assert Core's implementation has no conditional compilation
        run: |
          if grep -rnE '^[[:space:]]*#[[:space:]]*(if|ifdef|ifndef|elif|else)' Core/Source/*.c; then
            echo "::error::Core/Source/*.c must contain no conditional compilation (see README.md, Architecture)"
            exit 1
          fi

      # A bare _Create in a comment or in Markdown stops meaning anything the
      # moment the surrounding text names a second class, and the header tables
      # name several per row. See docs/NAMING.md, "Writing identifiers in prose".
      #
      # The sed neutralises the reserved identifiers that legitimately begin _X
      # before the second grep, so filtering is per match rather than per line —
      # one line can carry both a legitimate _Atomic and a bare _Destroy, and
      # discarding the whole line would hide the second. Tracked files only, so
      # an untracked local `site/` build never trips it. NAMING.md is exempt: it
      # is the one file that has to quote the form it forbids.
      - name: Assert API identifiers are written in full in prose
        run: |
          violations=$(git ls-files '*.md' '*.c' '*.h' '*.cpp' \
            | grep -v '^docs/NAMING\.md$' \
            | xargs -r grep -nE '(^|[^A-Za-z0-9_>])_[A-Z][a-z]' \
            | sed -E 's/_(Atomic|Bool|Static_assert|Noreturn|Thread_local|Generic|Alignas|Alignof|Complex|Imaginary|Pragma|Exit)\b/KEYWORD/g' \
            | grep -E '(^|[^A-Za-z0-9_>])_[A-Z][a-z]' \
            | cut -d: -f1,2)
          if [ -n "$violations" ]; then
            echo "$violations"
            echo "::error::Write API identifiers in full in prose — SolidSyslogFoo_Create, or <Class>_Create for a pattern-level statement (see docs/NAMING.md, 'Writing identifiers in prose')"
            exit 1
          fi

  # Asserts every shipped source file carries the licence header, and that none
  # of them claims anyone else's copyright. Both halves matter: the header is
  # the only statement of terms that travels with a file copied out of the tree
  # by a Path B integrator, and the no-third-party-code invariant in Core/ and
  # Platform/ is what makes it safe to stamp our copyright across all of them.
  # Pure file scan, no toolchain — runs in about a second.
  analyze-spdx:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check licence headers
        run: python3 scripts/check_spdx_headers.py

  analyze-markdown:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Same pinned engine (markdownlint-cli2 v0.22.1) used locally and by
      # CodeRabbit. Config + ignores come from .markdownlint-cli2.jsonc.
      - name: Lint markdown
        run: |
          docker run --rm -v "$PWD:/workdir" \
            davidanson/markdownlint-cli2@sha256:0ed9a5f4c77ef447da2a2ac6e67caf74b214a7f80288819565e8b7d2ac148fe5

  # Builds the MkDocs + mkdoxy documentation site with the pinned toolchain
  # image (see docs/containers.md) so the site cannot silently rot. Runs on every
  # PR as a required check; on main it also stages the built site as the Pages
  # artifact for the deploy-docs-pages job to publish. PRs build but never deploy.
  docs-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Platforms are declared in SOLIDSYSLOG_PLATFORM_REGISTRY and roles by
      # their Core/Interface/SolidSyslog<Role>Definition.h header. This asserts
      # the docs enumerate exactly what the code declares — a platform's pages,
      # nav entry, description and matrix row; a role's link from the porting
      # guide, the roles index and the nav — and the reverse in both cases. It
      # also holds the three boundaries hand review kept losing: no platform
      # names another, every class a platform declares carries its registry
      # token, and every class a platform ships is on its page.
      - name: Check the docs match what the code declares
        run: python3 scripts/check_platform_docs.py

      # A path written in code font in a sentence, or in a CMake list, a
      # Compose mount or a path filter, is text nothing reads back out — the
      # link check below sees Markdown links only. Nor does anything read back
      # the library symbols a page names, in prose or in a fenced example. This
      # asserts both still exist, so a rename cannot leave a green reference to
      # nothing, and a page cannot offer an integrator a symbol that never
      # compiled.
      - name: Check the paths and symbols documents and build files name exist
        run: python3 scripts/check_references.py

      # Guard the build hooks against regression — the source-link rewrite's
      # Markdown parsing, and the meta-description map's nav validation.
      # Image digest below is mkdocs-mkdoxy sha-34173c0 (see docs/containers.md).
      - name: Test docs build hooks
        run: |
          docker run --rm -v "$PWD:/docs" \
            ghcr.io/cososo-ltd/mkdocs-mkdoxy@sha256:9ab3d41807a941f3d5a7077fb7288d0ffe2a926729ce13a4fc889cc8b6630d43 \
            python3 -m unittest discover -s /docs/hooks -p 'test_*.py'

      # --strict fails the build on broken nav, config, or links. Out-of-docs
      # source links (../Core/…, ../SECURITY.md) are rewritten to canonical
      # GitHub URLs by hooks/source_links.py, so not_found validation is fatal;
      # the api/ reference is generated from Core/Interface/*.h by mkdoxy.
      # Image digest below is mkdocs-mkdoxy sha-34173c0 (see docs/containers.md).
      - name: Build docs site
        run: |
          docker run --rm -v "$PWD:/docs" \
            ghcr.io/cososo-ltd/mkdocs-mkdoxy@sha256:9ab3d41807a941f3d5a7077fb7288d0ffe2a926729ce13a4fc889cc8b6630d43 \
            mkdocs build --strict

      - name: Upload site artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: docs-site
          path: site/
          retention-days: 7

      # On main only, restage the built site as the GitHub Pages artifact so
      # deploy-docs-pages can publish it. PRs stop at the build+artifact above.
      - name: Upload Pages artifact
        if: github.ref == 'refs/heads/main'
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: site/

  # Publishes the built docs site to GitHub Pages. Main-only; PRs never deploy.
  # GitHub Pages permits a single deployment to the github-pages environment, so
  # the pages concurrency group serialises overlapping main pushes.
  deploy-docs-pages:
    needs: docs-build
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      pages: write # to deploy the built site to GitHub Pages
      id-token: write # to verify the deployment originates from this workflow
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    concurrency:
      group: pages
      cancel-in-progress: false
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

  analyze-cppcheck:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset cppcheck

      - name: Build with cppcheck
        run: cmake --build --preset cppcheck

      - name: Generate cppcheck XML report
        if: success() || failure()
        run: >
          cppcheck
          --enable=warning,style,performance,portability
          --suppress=missingIncludeSystem
          --suppressions-list=cppcheck_suppressions_tests.txt
          --inline-suppr
          --std=c11
          -DLWIP_DNS=1
          -DLWIP_UDP=1
          -DLWIP_TCP=1
          -DconfigSUPPORT_STATIC_ALLOCATION=1
          -DconfigUSE_MUTEXES=1
          -DipconfigUSE_TCP=1
          -ICore/Interface
          -IPlatform/StdAtomic/Interface
          -IPlatform/Posix/Interface
          -IPlatform/Windows/Interface
          -IPlatform/OpenSsl/Interface
          -IPlatform/MbedTls/Interface
          -IPlatform/FreeRtos/Interface
          -IPlatform/PlusTcp/Interface
          -IPlatform/LwipRaw/Interface
          -IPlatform/FatFs/Interface
          -IPlatform/PlusFat/Interface
          --xml --xml-version=2
          Core/Source/
          Platform/StdAtomic/Source/
          Platform/Posix/Source/
          Platform/Windows/Source/
          Platform/OpenSsl/Source/
          Platform/MbedTls/Source/
          Platform/FreeRtos/Source/
          Platform/PlusTcp/Source/
          Platform/LwipRaw/Source/
          Platform/FatFs/Source/
          Platform/PlusFat/Source/
          2> build/cppcheck/cppcheck-report.xml

      - name: Upload cppcheck report
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cppcheck-report
          path: build/cppcheck/cppcheck-report.xml
          retention-days: 1

      # ----------------------------------------------------------------
      # cppcheck-misra addon — runs the MISRA C:2012 addon over Strict +
      # Pragmatic tiers (Core/Source/ + Platform/*/Source/). Findings
      # fail CI (--error-exitcode=1); suppressions live in
      # misra_suppressions.txt with rationales in docs/misra-deviations.md.
      # ----------------------------------------------------------------

      - name: Run cppcheck-misra
        if: success() || failure()
        run: >
          cppcheck
          --addon=misra
          --suppressions-list=misra_suppressions.txt
          --error-exitcode=1
          --inline-suppr
          --std=c11
          -DLWIP_DNS=1
          -DLWIP_UDP=1
          -DLWIP_TCP=1
          -DconfigSUPPORT_STATIC_ALLOCATION=1
          -DconfigUSE_MUTEXES=1
          -DipconfigUSE_TCP=1
          -ICore/Interface
          -IPlatform/StdAtomic/Interface
          -IPlatform/Posix/Interface
          -IPlatform/Windows/Interface
          -IPlatform/OpenSsl/Interface
          -IPlatform/MbedTls/Interface
          -IPlatform/FreeRtos/Interface
          -IPlatform/PlusTcp/Interface
          -IPlatform/LwipRaw/Interface
          -IPlatform/FatFs/Interface
          -IPlatform/PlusFat/Interface
          Core/Source/
          Platform/StdAtomic/Source/
          Platform/Posix/Source/
          Platform/Windows/Source/
          Platform/OpenSsl/Source/
          Platform/MbedTls/Source/
          Platform/FreeRtos/Source/
          Platform/PlusTcp/Source/
          Platform/LwipRaw/Source/
          Platform/FatFs/Source/
          Platform/PlusFat/Source/

      - name: Generate cppcheck-misra XML report
        if: success() || failure()
        run: |
          mkdir -p build/cppcheck-misra
          cppcheck \
            --addon=misra \
            --suppressions-list=misra_suppressions.txt \
            --error-exitcode=1 \
            --inline-suppr \
            --std=c11 \
            -DLWIP_DNS=1 \
            -DLWIP_UDP=1 \
            -DLWIP_TCP=1 \
            -DconfigSUPPORT_STATIC_ALLOCATION=1 \
            -DconfigUSE_MUTEXES=1 \
            -DipconfigUSE_TCP=1 \
            -ICore/Interface \
            -IPlatform/StdAtomic/Interface \
            -IPlatform/Posix/Interface \
            -IPlatform/Windows/Interface \
            -IPlatform/OpenSsl/Interface \
            -IPlatform/MbedTls/Interface \
            -IPlatform/FreeRtos/Interface \
            -IPlatform/PlusTcp/Interface \
            -IPlatform/LwipRaw/Interface \
            -IPlatform/FatFs/Interface \
            -IPlatform/PlusFat/Interface \
            --xml --xml-version=2 \
            Core/Source/ \
            Platform/StdAtomic/Source/ \
            Platform/Posix/Source/ \
            Platform/Windows/Source/ \
            Platform/OpenSsl/Source/ \
            Platform/MbedTls/Source/ \
            Platform/FreeRtos/Source/ \
            Platform/PlusTcp/Source/ \
            Platform/LwipRaw/Source/ \
            Platform/FatFs/Source/ \
            Platform/PlusFat/Source/ \
            2> build/cppcheck-misra/cppcheck-misra-report.xml

      - name: Upload cppcheck-misra report
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cppcheck-misra-report
          path: build/cppcheck-misra/cppcheck-misra-report.xml
          retention-days: 1

  build-windows-msvc:
    runs-on: windows-latest
    permissions:
      contents: read
      checks: write
    env:
      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Enable vcpkg binary cache
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      # Same cache as integration-windows-openssl — both jobs share one
      # entry. See that job's comment for rationale and key-bump policy.
      - name: Cache vcpkg installed tree
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        # The cache is a pure speed optimisation — a flaky restore must never
        # skip the build+test. actions/cache can fail mid-restore (even after
        # reporting a hit); without continue-on-error that failure trips the
        # default `if: success()` on every following step, so Install / Configure
        # / Build-and-test all skip and the job goes red without ever compiling.
        # On a miss or partial restore the `vcpkg install` below rebuilds the
        # tree (backed by the x-gha binary cache), so the only cost is a slower
        # run.
        continue-on-error: true
        with:
          path: C:\vcpkg\installed
          key: ${{ runner.os }}-vcpkg-cpputest-openssl-v1

      - name: Install CppUTest and OpenSSL
        run: |
          vcpkg install cpputest openssl
          echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" >> $env:GITHUB_ENV

      - name: Configure
        run: cmake --preset msvc-debug

      - name: Build and test
        run: cmake --build --preset msvc-debug --target junit

      # The BDD target is built against a raised message size, as on Linux. Its
      # own configure regenerates the Python tunables mirror uploaded below, so
      # it runs after the default-preset build rather than before it.
      - name: Configure the BDD target with the tunable override
        run: cmake --preset msvc-tunable-override

      - name: Build the BDD target
        run: cmake --build --preset msvc-tunable-override --target SolidSyslogBddTarget

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (MSVC)
          path: build/msvc-debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-build-windows-msvc
          path: build/msvc-debug/cpputest_*.xml
          retention-days: 1

      - name: Upload Windows BDD target binary
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: solid-syslog-bdd-target-windows
          path: build/msvc-tunable-override/Bdd/Targets/Debug/SolidSyslogBddTarget.exe
          retention-days: 1
          compression-level: 0

      - name: Upload BDD Python tunables (Windows)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bdd-tunables-windows
          path: Bdd/features/steps/solidsyslog_tunables.py
          retention-days: 1

      # Windows is the one platform whose sources are entirely probe-gated, so a
      # Linux runner would emit an empty fragment and verify-manifest cannot
      # generate it. It is checked here rather than committed: a hand-written
      # copy of a generated file would rot, and Path B's audience is embedded
      # toolchains. The check still catches a Windows adapter that reaches the
      # directory without reaching CMakeLists.
      - name: Check the Windows platform manifest against the tree
        shell: bash
        run: |
          cmake -S . -B build/manifest-windows -DSOLIDSYSLOG_BUILD_TESTING=OFF \
            -DSOLIDSYSLOG_MANIFEST_SCOPE=platform \
            -DSOLIDSYSLOG_PLATFORMS=Windows \
            -DSOLIDSYSLOG_MANIFEST_PLATFORMS=Windows
          python3 scripts/check_manifest.py build/manifest-windows/solidsyslog-manifest.txt

  bdd-windows-otel:
    needs: build-windows-msvc
    runs-on: windows-2025
    permissions:
      contents: read
      checks: write
    defaults:
      run:
        shell: bash

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: solid-syslog-bdd-target-windows
          path: build/msvc-tunable-override/Bdd/Targets/Debug/

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: bdd-tunables-windows
          path: Bdd/features/steps/

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.13'

      - name: Install behave
        run: pip install -r Bdd/requirements.txt

      - name: Install otelcol-contrib
        shell: pwsh
        run: ./Bdd/otel/Install-OtelCollector.ps1

      - name: Prepare BDD directories
        run: mkdir -p Bdd/output Bdd/junit

      - name: Start OTel Collector
        # Use bash `&` backgrounding (what works locally) rather than pwsh
        # Start-Process — the latter launched silently on windows-2025 with
        # empty redirect files and no UDP bind, suggesting the child was
        # either killed with the parent console or never actually executed.
        run: |
          nohup ./Bdd/otel/bin/otelcol-contrib.exe \
            --config=Bdd/otel/config.yaml \
            > Bdd/output/otelcol.out 2> Bdd/output/otelcol.err &
          echo "otelcol backgrounded with PID $!"

      - name: Wait for oracle to bind UDP 5514 + TCP 6514/6515
        shell: pwsh
        run: |
          $deadline = (Get-Date).AddSeconds(30)
          while ((Get-Date) -lt $deadline) {
              $udp5514  = Get-NetUDPEndpoint -LocalPort 5514 -ErrorAction SilentlyContinue
              $tcp6514  = Get-NetTCPConnection -LocalPort 6514 -State Listen -ErrorAction SilentlyContinue
              $tcp6515  = Get-NetTCPConnection -LocalPort 6515 -State Listen -ErrorAction SilentlyContinue
              if ($udp5514 -and $tcp6514 -and $tcp6515) {
                  Write-Host "otelcol is listening on UDP 5514 + TCP 6514 (TLS) + TCP 6515 (mTLS)"
                  exit 0
              }
              Start-Sleep -Milliseconds 500
          }
          Write-Host "otelcol did not bind all expected ports within 30 seconds"
          Write-Host "--- tasklist otelcol-contrib ---"
          tasklist /FI "IMAGENAME eq otelcol-contrib.exe"
          Write-Host "--- UDP endpoints (top 20) ---"
          Get-NetUDPEndpoint | Select-Object -First 20 | Format-Table -AutoSize
          Write-Host "--- TCP listeners (top 20) ---"
          Get-NetTCPConnection -State Listen | Select-Object -First 20 | Format-Table -AutoSize
          Write-Host "--- Bdd/output contents ---"
          Get-ChildItem Bdd/output -ErrorAction SilentlyContinue | Format-Table
          Write-Host "--- otelcol.out ---"
          Get-Content Bdd/output/otelcol.out -ErrorAction SilentlyContinue
          Write-Host "--- otelcol.err ---"
          Get-Content Bdd/output/otelcol.err -ErrorAction SilentlyContinue
          exit 1

      - name: Run BDD tests
        env:
          BDD_TARGET: windows
          EXAMPLE_BINARY: build/msvc-tunable-override/Bdd/Targets/Debug/SolidSyslogBddTarget.exe
          RECEIVED_LOG: Bdd/output/received.jsonl
          ORACLE_FORMAT: otel-jsonl
        run: >
          behave --junit --junit-directory Bdd/junit
          --tags='not @wip and not @windows_wip and not @no_rtc and not @aesgcm'
          Bdd/features/

      - name: BDD Test Report (Windows)
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (BDD Windows)
          path: Bdd/junit/TESTS-*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-bdd-windows-otel
          path: Bdd/junit/TESTS-*.xml
          retention-days: 1

      - name: OTel collector logs on failure
        if: failure()
        run: |
          echo "--- otelcol.out ---"
          cat Bdd/output/otelcol.out || true
          echo "--- otelcol.err ---"
          cat Bdd/output/otelcol.err || true

  bdd-linux-syslog-ng:
    needs: build-linux-tunable-override
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: solid-syslog-bdd-targets
          path: build/tunable-override-debug/Bdd/Targets/

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: bdd-tunables-linux
          path: Bdd/features/steps/

      - name: Make example binary executable
        run: chmod +x build/tunable-override-debug/Bdd/Targets/SolidSyslogBddTarget

      - name: Prepare BDD output directory
        run: mkdir -p Bdd/junit && chmod 777 Bdd/junit

      - name: Run BDD tests
        run: >
          docker compose -f ci/docker-compose.bdd.yml
          up --abort-on-container-exit --exit-code-from behave-linux
          behave-linux syslog-ng-linux

      - name: BDD Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (BDD)
          path: Bdd/junit/TESTS-*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-bdd-linux-syslog-ng
          path: Bdd/junit/TESTS-*.xml
          retention-days: 1

      - name: Compose logs on failure
        if: failure()
        run: docker compose -f ci/docker-compose.bdd.yml logs --no-color

  build-freertos-host-tdd-plustcp:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Smoke check: configure + build the regular host preset under the
      # cpputest-freertos image. FREERTOS_KERNEL_PATH is set, so
      # Platform/FreeRtos and the FreeRtosFakes / Tests/FreeRtos placeholder
      # directories are added — placeholders today, real fakes from S08.04.
      - name: Configure
        run: cmake --preset debug

      - name: Build and test
        run: cmake --build --preset debug --target junit BddTargetTests SolidSyslogBddTarget

      - name: Run BDD target tests
        run: cd build/debug && ./Tests/Bdd/Targets/BddTargetTests -ojunit -k BddTargetTests

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (FreeRTOS host)
          path: build/debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-build-freertos-host-tdd-plustcp
          path: build/debug/cpputest_*.xml
          retention-days: 1

  build-freertos-target-plustcp:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: ghcr.io/cososo-ltd/cpputest-freertos-cross@sha256:481267bea7200641fac41d7136e7e08deeba1b311e9873aa6d1c311db5b4cf58 # sha-ad10bf2
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure (ARM cross)
        run: cmake --preset freertos-cross

      - name: Cross-build FreeRTOS BDD target ELF
        run: cmake --build --preset freertos-cross --target SolidSyslogBddTarget

      - name: Upload FreeRTOS BDD target ELF
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: solid-syslog-bdd-target-freertos
          path: build/freertos-cross/Bdd/Targets/FreeRtos/SolidSyslogBddTarget.elf
          retention-days: 1
          compression-level: 0

      - name: Upload BDD Python tunables (FreeRTOS)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bdd-tunables-freertos
          path: Bdd/features/steps/solidsyslog_tunables.py
          retention-days: 1

  # Required as of S28.11 (in the `summary` needs list). Proves the
  # Platform/LwipRaw tree cross-builds for FreeRTOS/ARM with Plus-TCP
  # deselected and zero PlusTcp dependency (the symbol
  # assertion below enforces that). No QEMU run. Adding it to the GitHub
  # branch-protection required-checks set is a separate manual step (David).
  build-freertos-target-lwip:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: ghcr.io/cososo-ltd/cpputest-freertos-cross@sha256:481267bea7200641fac41d7136e7e08deeba1b311e9873aa6d1c311db5b4cf58 # sha-ad10bf2
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure (ARM cross, NET=LWIP)
        run: cmake --preset freertos-cross-lwip

      - name: Cross-build FreeRTOS+lwIP BDD target ELF
        run: cmake --build --preset freertos-cross-lwip --target SolidSyslogBddTargetLwip

      - name: Assert no PlusTcp / Plus-TCP symbols linked
        run: |
          elf=build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/SolidSyslogBddTargetLwip.elf
          arm-none-eabi-nm "$elf" > /tmp/lwip-symbols.txt
          if grep -E -i 'PlusTcp|FreeRTOS_socket|FreeRTOS_sendto|FreeRTOS_recv|FreeRTOS_IPInit' /tmp/lwip-symbols.txt; then
            echo "::error::PlusTcp / FreeRTOS-Plus-TCP symbol linked into the lwIP BDD target ELF"
            exit 1
          fi
          echo "OK: no PlusTcp / FreeRTOS-Plus-TCP symbols in the lwIP BDD target ELF"

      - name: Upload FreeRTOS+lwIP BDD target ELF
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: solid-syslog-bdd-target-freertos-lwip
          path: build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/SolidSyslogBddTargetLwip.elf
          retention-days: 1
          compression-level: 0

      # BDD-side mirror of build-time tunables (configure_file). The lwIP bdd
      # lane consumes this so environment.py's runtime tag gates track the lwIP
      # target's SOLIDSYSLOG_MAX_MESSAGE_SIZE.
      - name: Upload BDD Python tunables (FreeRTOS+lwIP)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bdd-tunables-freertos-lwip
          path: Bdd/features/steps/solidsyslog_tunables.py
          retention-days: 1

  bdd-freertos-qemu-plustcp:
    needs: build-freertos-target-plustcp
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: solid-syslog-bdd-target-freertos
          path: build/freertos-cross/Bdd/Targets/FreeRtos/

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: bdd-tunables-freertos
          path: Bdd/features/steps/

      - name: Make ELF readable
        run: chmod +r build/freertos-cross/Bdd/Targets/FreeRtos/SolidSyslogBddTarget.elf

      - name: Prepare BDD output directory
        run: mkdir -p Bdd/junit && chmod 777 Bdd/junit

      - name: Run BDD tests
        run: >
          docker compose -f ci/docker-compose.bdd.yml
          up --abort-on-container-exit --exit-code-from behave-freertos
          behave-freertos syslog-ng-freertos

      - name: BDD Test Report (FreeRTOS)
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (BDD FreeRTOS)
          path: Bdd/junit/TESTS-*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-bdd-freertos-qemu-plustcp
          path: Bdd/junit/TESTS-*.xml
          retention-days: 1

      - name: Compose logs on failure
        if: failure()
        run: docker compose -f ci/docker-compose.bdd.yml logs --no-color

  # Required as of S28.11 (in the `summary` needs list): runs the lwIP BDD
  # target on QEMU against the syslog-ng oracle over UDP / TCP / TLS / mTLS.
  # Adding it to the GitHub branch-protection required-checks set is a
  # separate manual step (David).
  bdd-freertos-qemu-lwip:
    needs: build-freertos-target-lwip
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: solid-syslog-bdd-target-freertos-lwip
          path: build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: bdd-tunables-freertos-lwip
          path: Bdd/features/steps/

      - name: Make ELF readable
        run: chmod +r build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/SolidSyslogBddTargetLwip.elf

      - name: Prepare BDD output directory
        run: mkdir -p Bdd/junit && chmod 777 Bdd/junit

      - name: Run BDD tests
        run: >
          docker compose -f ci/docker-compose.bdd.yml
          up --abort-on-container-exit --exit-code-from behave-freertos-lwip
          behave-freertos-lwip syslog-ng-freertos-lwip

      - name: BDD Test Report (FreeRTOS+lwIP)
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (BDD FreeRTOS+lwIP)
          path: Bdd/junit/TESTS-*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-bdd-freertos-qemu-lwip
          path: Bdd/junit/TESTS-*.xml
          retention-days: 1

      - name: Compose logs on failure
        if: failure()
        run: docker compose -f ci/docker-compose.bdd.yml logs --no-color

  # Anti-drift gate (S30.03): regenerate the committed beta-stack integration
  # manifest from CMake and fail if it differs from what is checked in. Keeps
  # docs/generated/beta-stack-manifest.txt honest against the platform source
  # lists (the generator reads each upstream platform target's INTERFACE_SOURCES
  # and the Core target's SOURCES). The stack is stated in SOLIDSYSLOG_PLATFORMS
  # rather than inherited from the image's environment, so the manifest
  # describes the platforms this gate means to describe (S30.05).
  verify-manifest:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/cososo-ltd/cpputest-freertos@sha256:476cfeab90e8179ab909dba8c77c8e9ef3b594e67ba98dca39108747583f5c41 # sha-ad10bf2
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # The environment is scrubbed so an upstream platform is described because
      # it was named, not because the image happens to carry its tree. Windows is
      # the one token missing here — it is probe-kind, so it cannot be selected on
      # Linux; build-windows-msvc generates that fragment.
      - name: Regenerate the Core and per-platform manifests
        shell: bash
        run: |
          scrubbed() {
            env -u LWIP_PATH -u FREERTOS_KERNEL_PATH -u MBEDTLS_DIR \
                -u FATFS_PATH -u FREERTOS_PLUS_FAT_PATH -u FREERTOS_PLUS_TCP_PATH "$@"
          }
          scrubbed cmake -S . -B build/manifest-core -DSOLIDSYSLOG_BUILD_TESTING=OFF \
            -DSOLIDSYSLOG_MANIFEST_SCOPE=core \
            -DSOLIDSYSLOG_MANIFEST_OUTPUT="$(pwd)/docs/generated/core-manifest.txt"
          for platform in $(python3 scripts/check_manifest.py --list-platforms); do
            [ "$platform" = "Windows" ] && continue
            scrubbed cmake -S . -B "build/manifest-$platform" -DSOLIDSYSLOG_BUILD_TESTING=OFF \
              -DSOLIDSYSLOG_MANIFEST_SCOPE=platform \
              -DSOLIDSYSLOG_PLATFORMS="$platform" \
              -DSOLIDSYSLOG_MANIFEST_PLATFORMS="$platform" \
              -DSOLIDSYSLOG_MANIFEST_OUTPUT="$(pwd)/docs/generated/$platform-manifest.txt"
          done

      - name: Regenerate the beta-stack manifest
        shell: bash
        run: |
          cmake -S . -B build/manifest -DSOLIDSYSLOG_BUILD_TESTING=OFF \
            -DSOLIDSYSLOG_PLATFORMS="LwipRaw;FreeRtos;MbedTls;FatFs;StdAtomic" \
            -DSOLIDSYSLOG_MANIFEST_PLATFORMS="LwipRaw;MbedTls;FreeRtos;FatFs;StdAtomic" \
            -DSOLIDSYSLOG_MANIFEST_OUTPUT="$(pwd)/docs/generated/beta-stack-manifest.txt"

      - name: Fail on drift
        shell: bash
        run: |
          git diff --exit-code docs/generated/ \
            || { echo "::error::docs/generated is stale — regenerate with the manifest target (see docs/build-integration.md)"; exit 1; }

      # Every manifest section's file list must equal that directory's *.c,
      # compared against the filesystem rather than the build targets, so a
      # source no target lists is visible.
      - name: Assert every manifest matches the tree
        shell: bash
        run: |
          for manifest in docs/generated/*-manifest.txt; do
            python3 scripts/check_manifest.py "$manifest" \
              || { echo "::error::$manifest does not match the source tree — see the diff above"; exit 1; }
          done

  # Consume the library from outside, the way an integrator does (S30.04). The
  # bug this guards against — SolidSyslog assuming it is the top-level project —
  # survived every other lane precisely because they all build it top-level.
  consumer-smoke-linux:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: ghcr.io/cososo-ltd/cpputest@sha256:68e7fbb6f02996717ce9211fd8089a0c52763da4990dfe69653c00ad697551b9 # sha-6715942
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # FETCHCONTENT_SOURCE_DIR_SOLIDSYSLOG points FetchContent at this checkout,
      # so the PR is validated against its own tree instead of main.
      - name: Configure the consumer project
        run: |
          cmake -S ci/consumer-smoke -B build/consumer-smoke \
            -DFETCHCONTENT_SOURCE_DIR_SOLIDSYSLOG="$(pwd)"

      - name: Build the consumer project
        run: cmake --build build/consumer-smoke

      # A nested configure must not write into the dependency's checkout. The BDD
      # tunables mirror is the one that did, and it is gitignored, so check for
      # the file itself as well as for tracked-file drift.
      - name: Assert the nested configure left the library tree alone
        run: |
          git diff --exit-code \
            || { echo "::error::configuring SolidSyslog as a subproject modified its own source tree"; exit 1; }
          if [ -f Bdd/features/steps/solidsyslog_tunables.py ]; then
            echo "::error::a nested configure wrote Bdd/features/steps/solidsyslog_tunables.py into the dependency's checkout"
            exit 1
          fi

  consumer-smoke-freertos-cross:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: ghcr.io/cososo-ltd/cpputest-freertos-cross@sha256:481267bea7200641fac41d7136e7e08deeba1b311e9873aa6d1c311db5b4cf58 # sha-ad10bf2
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # The consumer's toolchain sets CMAKE_SYSTEM_PROCESSOR=arm and
      # CMAKE_CROSSCOMPILING — the exact pair that used to drag SolidSyslog's own
      # BDD ELF into their build. Reusing our arm-none-eabi file keeps the lane
      # honest without vendoring a second copy; a real integrator brings theirs.
      - name: Configure the consumer project (ARM cross)
        run: |
          cmake -S ci/consumer-smoke -B build/consumer-smoke-cross \
            -DCMAKE_TOOLCHAIN_FILE="$(pwd)/Bdd/Targets/FreeRtos/cmake/arm-none-eabi.cmake" \
            -DFETCHCONTENT_SOURCE_DIR_SOLIDSYSLOG="$(pwd)"

      - name: Cross-build the consumer project
        run: cmake --build build/consumer-smoke-cross

      # The integrator shape no other lane has (S30.05). Every container here
      # exports all five upstream paths, so a pack that exists only because the
      # environment says so looks identical to one that works. Scrubbing the
      # environment leaves -DSOLIDSYSLOG_PLATFORMS as the only thing that can
      # select a pack and -D as the only thing that can locate an upstream tree.
      #
      # It LINKS the packs rather than asserting their targets exist: the packs
      # carry their sources into the consumer's target, so "do these compile
      # against someone else's config header" is the question, and only linking
      # asks it.
      - name: Configure the consumer project (scrubbed environment, explicit selection)
        run: |
          env -u LWIP_PATH -u FREERTOS_KERNEL_PATH -u MBEDTLS_DIR \
              -u FATFS_PATH -u FREERTOS_PLUS_FAT_PATH -u FREERTOS_PLUS_TCP_PATH \
          cmake -S ci/consumer-smoke -B build/consumer-smoke-scrubbed \
            -DCMAKE_TOOLCHAIN_FILE="$(pwd)/Bdd/Targets/FreeRtos/cmake/arm-none-eabi.cmake" \
            -DFETCHCONTENT_SOURCE_DIR_SOLIDSYSLOG="$(pwd)" \
            -DSOLIDSYSLOG_PLATFORMS="LwipRaw;FreeRtos" \
            -DSOLIDSYSLOG_LWIP_PATH=/opt/lwip \
            -DSOLIDSYSLOG_FREERTOS_KERNEL_PATH=/opt/freertos/kernel \
            -DSOLIDSYSLOG_SMOKE_LINK_PACKS=ON

      - name: Cross-build and link the packs
        run: cmake --build build/consumer-smoke-scrubbed

      # Builds the gated-out path for the packs this lane selects. PlusTcp is an
      # alternative network stack and is not built here.
      - name: Configure the consumer project (LwipRaw and FreeRtos gates off)
        run: |
          env -u LWIP_PATH -u FREERTOS_KERNEL_PATH -u MBEDTLS_DIR \
              -u FATFS_PATH -u FREERTOS_PLUS_FAT_PATH -u FREERTOS_PLUS_TCP_PATH \
          cmake -S ci/consumer-smoke -B build/consumer-smoke-gates-off \
            -DCMAKE_TOOLCHAIN_FILE="$(pwd)/Bdd/Targets/FreeRtos/cmake/arm-none-eabi.cmake" \
            -DFETCHCONTENT_SOURCE_DIR_SOLIDSYSLOG="$(pwd)" \
            -DSOLIDSYSLOG_PLATFORMS="LwipRaw;FreeRtos" \
            -DSOLIDSYSLOG_LWIP_PATH=/opt/lwip \
            -DSOLIDSYSLOG_FREERTOS_KERNEL_PATH=/opt/freertos/kernel \
            -DSOLIDSYSLOG_SMOKE_CONFIG_DIR=config-gates-off \
            -DSOLIDSYSLOG_SMOKE_LINK_PACKS=ON

      - name: Cross-build the packs with the LwipRaw and FreeRtos gates off
        run: cmake --build build/consumer-smoke-gates-off

      # Path B has no CMake to select anything, so the same consumer is built by
      # directory selection. The environment is scrubbed for the same reason as
      # above: the platform list and the -D paths are all that can reach it.
      - name: Build the Make consumer (scrubbed environment)
        run: |
          env -u LWIP_PATH -u FREERTOS_KERNEL_PATH -u MBEDTLS_DIR \
              -u FATFS_PATH -u FREERTOS_PLUS_FAT_PATH -u FREERTOS_PLUS_TCP_PATH \
          make -f ci/consumer-smoke/Makefile -j"$(nproc)" \
            LWIP_PATH=/opt/lwip \
            FREERTOS_KERNEL_PATH=/opt/freertos/kernel

      - name: Build the Make consumer with the LwipRaw and FreeRtos gates off
        run: |
          env -u LWIP_PATH -u FREERTOS_KERNEL_PATH -u MBEDTLS_DIR \
              -u FATFS_PATH -u FREERTOS_PLUS_FAT_PATH -u FREERTOS_PLUS_TCP_PATH \
          make -f ci/consumer-smoke/Makefile -j"$(nproc)" \
            LWIP_PATH=/opt/lwip \
            FREERTOS_KERNEL_PATH=/opt/freertos/kernel \
            CONFIG_DIR=config-gates-off \
            BUILD="$(pwd)/build/consumer-smoke-make-gates-off"

      # A nested configure must not write into the dependency's checkout. The BDD
      # tunables mirror is the one that did, and it is gitignored, so check for
      # the file itself as well as for tracked-file drift.
      - name: Assert the nested configure left the library tree alone
        run: |
          git diff --exit-code \
            || { echo "::error::configuring SolidSyslog as a subproject modified its own source tree"; exit 1; }
          if [ -f Bdd/features/steps/solidsyslog_tunables.py ]; then
            echo "::error::a nested configure wrote Bdd/features/steps/solidsyslog_tunables.py into the dependency's checkout"
            exit 1
          fi

  summary:
    if: always() && github.event_name == 'pull_request'
    needs: [build-linux-gcc, build-linux-tunable-override, build-linux-clang, build-linux-c99, build-linux-c89-headers, sanitize-linux-gcc, coverage-linux-gcc, analyze-tidy, analyze-tidy-freertos-plustcp, analyze-tidy-freertos-lwip, analyze-cppcheck, analyze-format, analyze-markdown, analyze-spdx, analyze-iwyu, analyze-iwyu-freertos-plustcp, analyze-iwyu-freertos-lwip, bdd-linux-syslog-ng, build-windows-msvc, bdd-windows-otel, integration-linux-openssl, integration-linux-mbedtls, integration-windows-openssl, build-freertos-host-tdd-plustcp, build-freertos-target-plustcp, bdd-freertos-qemu-plustcp, build-freertos-target-lwip, bdd-freertos-qemu-lwip, verify-manifest, consumer-smoke-linux, consumer-smoke-freertos-cross]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
      pull-requests: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Download JUnit artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: junit-*
          path: quality-reports/

      - name: Download clang-tidy report
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: clang-tidy-report
          path: quality-reports/

      - name: Download cppcheck report
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: cppcheck-report
          path: quality-reports/

      - name: Download iwyu report
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: iwyu-report
          path: quality-reports/

      - name: Quality Monitor
        uses: uhafner/quality-monitor@0100da6973a1498aad89af676852a8c788d397f8 # v4.15.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          pr-number: ${{ github.event.pull_request.number }}
          checks-name: Quality Summary
          config: >
            {
              "tests": {
                "name": "Tests",
                "tools": [
                  {
                    "id": "junit",
                    "name": "build-linux-gcc",
                    "pattern": "**/junit-build-linux-gcc/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "build-freertos-host-tdd-plustcp",
                    "pattern": "**/junit-build-freertos-host-tdd-plustcp/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "build-linux-clang",
                    "pattern": "**/junit-build-linux-clang/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "sanitize-linux-gcc",
                    "pattern": "**/junit-sanitize-linux-gcc/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "integration-linux-openssl",
                    "pattern": "**/junit-integration-linux-openssl/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "integration-linux-mbedtls",
                    "pattern": "**/junit-integration-linux-mbedtls/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "integration-windows-openssl",
                    "pattern": "**/junit-integration-windows-openssl/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "bdd-linux-syslog-ng",
                    "pattern": "**/junit-bdd-linux-syslog-ng/TESTS-*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "bdd-windows-otel",
                    "pattern": "**/junit-bdd-windows-otel/TESTS-*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "bdd-freertos-qemu-plustcp",
                    "pattern": "**/junit-bdd-freertos-qemu-plustcp/TESTS-*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "bdd-freertos-qemu-lwip",
                    "pattern": "**/junit-bdd-freertos-qemu-lwip/TESTS-*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "build-windows-msvc",
                    "pattern": "**/junit-build-windows-msvc/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "build-linux-tunable-override",
                    "pattern": "**/junit-build-linux-tunable-override/cpputest_*.xml"
                  }
                ]
              },
              "analysis": [
                {
                  "name": "analyze-tidy",
                  "id": "analyze-tidy",
                  "tools": [
                    {
                      "id": "clang-tidy",
                      "pattern": "**/clang-tidy-output.txt"
                    }
                  ]
                },
                {
                  "name": "analyze-cppcheck",
                  "id": "analyze-cppcheck",
                  "tools": [
                    {
                      "id": "cppcheck",
                      "pattern": "**/cppcheck-report.xml"
                    }
                  ]
                }
              ]
            }