# Nightly build for the main branch across multiple targets.
name: Nightly Build

on:
  workflow_dispatch:
  schedule:
  - cron: '15 1 * * *'

env:
  docker-registry: docker.pkg.github.com
  docker-config-path: source/ci/docker

jobs:
  # Run our nightly builds.  We build a matrix with the various build
  # targets and their details.  Then we build either in a docker container
  # (Linux) or on the actual hosts (macOS, Windows).
  build:
    name: Build
    strategy:
      matrix:
        platform:
        - # Xenial, GCC, OpenSSL
          container:
            name: xenial
          env:
            CC: gcc
            CMAKE_GENERATOR: Ninja
            CMAKE_OPTIONS: -DUSE_HTTPS=OpenSSL -DREGEX_BACKEND=builtin -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
          os: ubuntu-latest
        - # Xenial, GCC, mbedTLS
          container:
            name: xenial
          env:
            CC: gcc
            CMAKE_GENERATOR: Ninja
            CMAKE_OPTIONS: -DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
          os: ubuntu-latest
        - # Xenial, Clang, OpenSSL
          container:
            name: xenial
          env:
            CC: clang
            CMAKE_GENERATOR: Ninja
            CMAKE_OPTIONS: -DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
          os: ubuntu-latest
        - # Xenial, Clang, mbedTLS
          container:
            name: xenial
          env:
            CC: clang
            CMAKE_OPTIONS: -DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DREGEX_BACKEND=pcre -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
            CMAKE_GENERATOR: Ninja
          os: ubuntu-latest
        - # Xenial, GCC, thread-free
          container:
            name: xenial
          env:
            CC: gcc
            CMAKE_OPTIONS: -DTHREADSAFE=OFF -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
            CMAKE_GENERATOR: Ninja
          os: ubuntu-latest
        - # Xenial, Clang, OpenSSL (dynamically loaded)
          container:
            name: xenial
          env:
            CC: clang
            CMAKE_OPTIONS: -DUSE_HTTPS=OpenSSL-Dynamic -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
            CMAKE_GENERATOR: Ninja
          os: ubuntu-latest
        - # Focal, Clang 10, mbedTLS, MemorySanitizer
          container:
            name: focal
          env:
            CC: clang-10
            CFLAGS: -fsanitize=memory -fsanitize-memory-track-origins=2 -fsanitize-blacklist=/home/libgit2/source/script/sanitizers.supp -fno-optimize-sibling-calls -fno-omit-frame-pointer
            CMAKE_OPTIONS: -DCMAKE_PREFIX_PATH=/usr/local/msan -DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DREGEX_BACKEND=pcre -DDEPRECATE_HARD=ON -DUSE_BUNDLED_ZLIB=ON -DUSE_SSH=ON
            CMAKE_GENERATOR: Ninja
            SKIP_SSH_TESTS: true
            SKIP_NEGOTIATE_TESTS: true
            ASAN_SYMBOLIZER_PATH: /usr/bin/llvm-symbolizer-10
            UBSAN_OPTIONS: print_stacktrace=1
          os: ubuntu-latest
        - # Focal, Clang 10, OpenSSL, UndefinedBehaviorSanitizer
          container:
            name: focal
          env:
            CC: clang-10
            CFLAGS: -fsanitize=undefined,nullability -fno-sanitize-recover=undefined,nullability -fsanitize-blacklist=/home/libgit2/source/script/sanitizers.supp -fno-optimize-sibling-calls -fno-omit-frame-pointer
            CMAKE_OPTIONS: -DCMAKE_PREFIX_PATH=/usr/local -DUSE_HTTPS=OpenSSL -DUSE_SHA1=HTTPS -DREGEX_BACKEND=pcre -DDEPRECATE_HARD=ON -DUSE_BUNDLED_ZLIB=ON
            CMAKE_GENERATOR: Ninja
            SKIP_SSH_TESTS: true
            SKIP_NEGOTIATE_TESTS: true
            ASAN_SYMBOLIZER_PATH: /usr/bin/llvm-symbolizer-10
          os: ubuntu-latest
        - # Focal, Clang 10, OpenSSL, ThreadSanitizer
          container:
            name: focal
          env:
            CC: clang-10
            CFLAGS: -fsanitize=thread -fno-optimize-sibling-calls -fno-omit-frame-pointer
            CMAKE_OPTIONS: -DCMAKE_PREFIX_PATH=/usr/local -DUSE_HTTPS=OpenSSL -DUSE_SHA1=HTTPS -DREGEX_BACKEND=pcre -DDEPRECATE_HARD=ON -DUSE_BUNDLED_ZLIB=ON
            CMAKE_GENERATOR: Ninja
            SKIP_SSH_TESTS: true
            SKIP_NEGOTIATE_TESTS: true
            ASAN_SYMBOLIZER_PATH: /usr/bin/llvm-symbolizer-10
            TSAN_OPTIONS: suppressions=/home/libgit2/source/script/thread-sanitizer.supp second_deadlock_stack=1
          os: ubuntu-latest
        - # Focal, Clang 10, mmap emulation (NO_MMAP)
          container:
            name: focal
          env:
            CC: clang-10
            CFLAGS: -DNO_MMAP
            CMAKE_OPTIONS: -DCMAKE_PREFIX_PATH=/usr/local
            CMAKE_GENERATOR: Ninja
            SKIP_SSH_TESTS: true
            SKIP_NEGOTIATE_TESTS: true
          os: ubuntu-latest
        - # CentOS 7
          container:
            name: centos7
          env:
            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
            PKG_CONFIG_PATH: /usr/local/lib/pkgconfig
            SKIP_NEGOTIATE_TESTS: true
          os: ubuntu-latest
        - # CentOS 7, OpenSSL (dynamically loaded)
          container:
            name: centos7
          env:
            CMAKE_OPTIONS: -DUSE_HTTPS=OpenSSL-Dynamic -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
            PKG_CONFIG_PATH: /usr/local/lib/pkgconfig
            SKIP_NEGOTIATE_TESTS: true
          os: ubuntu-latest
        - # CentOS 8
          container:
            name: centos8
          env:
            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON
            PKG_CONFIG_PATH: /usr/local/lib/pkgconfig
            SKIP_NEGOTIATE_TESTS: true
            SKIP_SSH_TESTS: true
          os: ubuntu-latest
        - # CentOS 8, OpenSSL (dynamically loaded)
          container:
            name: centos8
          env:
            CMAKE_OPTIONS: -DUSE_HTTPS=OpenSSL-Dynamic -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON
            PKG_CONFIG_PATH: /usr/local/lib/pkgconfig
            SKIP_NEGOTIATE_TESTS: true
            SKIP_SSH_TESTS: true
          os: ubuntu-latest
        - # macOS
          os: macos-10.15
          env:
            CC: clang
            CMAKE_OPTIONS: -DREGEX_BACKEND=regcomp_l -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=leaks -DUSE_GSSAPI=ON
            PKG_CONFIG_PATH: /usr/local/opt/openssl/lib/pkgconfig
            SKIP_SSH_TESTS: true
            SKIP_NEGOTIATE_TESTS: true
          setup-script: osx
        - # Windows amd64 Visual Studio
          os: windows-2019
          env:
            ARCH: amd64
            CMAKE_GENERATOR: Visual Studio 16 2019
            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON
            SKIP_SSH_TESTS: true
            SKIP_NEGOTIATE_TESTS: true
        - # Windows amd64 Visual Studio (NO_MMAP)
          os: windows-2019
          env:
            ARCH: amd64
            CMAKE_GENERATOR: Visual Studio 16 2019
            CFLAGS: -DNO_MMAP
            CMAKE_OPTIONS: -A x64 -DDEPRECATE_HARD=ON
            SKIP_SSH_TESTS: true
            SKIP_NEGOTIATE_TESTS: true
        - # Windows x86 Visual Studio
          os: windows-2019
          env:
            ARCH: x86
            CMAKE_GENERATOR: Visual Studio 16 2019
            CMAKE_OPTIONS: -A Win32 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_SHA1=HTTPS -DUSE_BUNDLED_ZLIB=ON
            SKIP_SSH_TESTS: true
            SKIP_NEGOTIATE_TESTS: true
        - # Windows amd64 mingw
          os: windows-2019
          setup-script: mingw
          env:
            ARCH: amd64
            CMAKE_GENERATOR: MinGW Makefiles
            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON
            BUILD_TEMP: D:\Temp
            BUILD_PATH: D:\Temp\mingw64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin
            SKIP_SSH_TESTS: true
            SKIP_NEGOTIATE_TESTS: true
        - # Windows x86 mingw
          os: windows-2019
          setup-script: mingw
          env:
            ARCH: x86
            CMAKE_GENERATOR: MinGW Makefiles
            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON
            BUILD_TEMP: D:\Temp
            BUILD_PATH: D:\Temp\mingw32\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin
            SKIP_SSH_TESTS: true
            SKIP_NEGOTIATE_TESTS: true
        - # Bionic, GCC, OpenSSL (dynamically loaded)
          container:
            name: bionic
            dockerfile: bionic
          env:
            CC: gcc
            CMAKE_GENERATOR: Ninja
            CMAKE_OPTIONS: -DUSE_HTTPS=OpenSSL-Dynamic -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
            RUN_INVASIVE_TESTS: true
          os: ubuntu-latest
        - # Bionic, x86, Clang, OpenSSL
          container:
            name: bionic-x86
            dockerfile: bionic
            qemu: true
          env:
            CC: clang
            CMAKE_GENERATOR: Ninja
            CMAKE_OPTIONS: -DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
            RUN_INVASIVE_TESTS: true
          os: ubuntu-latest
        - # Bionic, x86, GCC, OpenSSL
          container:
            name: bionic-x86
            dockerfile: bionic
          env:
            CC: gcc
            CMAKE_GENERATOR: Ninja
            CMAKE_OPTIONS: -DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind -DUSE_GSSAPI=ON -DUSE_SSH=ON
            RUN_INVASIVE_TESTS: true
          os: ubuntu-latest
        - # Bionic, arm32, GCC, OpenSSL
          container:
            name: bionic-arm32
            dockerfile: bionic
            qemu: true
          env:
            CC: gcc
            CMAKE_GENERATOR: Ninja
            CMAKE_OPTIONS: -DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON -DUSE_GSSAPI=ON -DUSE_SSH=ON
            RUN_INVASIVE_TESTS: true
            SKIP_PROXY_TESTS: true
          os: ubuntu-latest
        - # Bionic, arm64, GCC, OpenSSL
          container:
            name: bionic-arm64
            dockerfile: bionic
            qemu: true
          env:
            CC: gcc
            CMAKE_GENERATOR: Ninja
            CMAKE_OPTIONS: -DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON -DUSE_GSSAPI=ON -DUSE_SSH=ON
            RUN_INVASIVE_TESTS: true
            SKIP_PROXY_TESTS: true
          os: ubuntu-latest
      fail-fast: false
    env: ${{ matrix.platform.env }}
    runs-on: ${{ matrix.platform.os }}
    steps:
    - name: Check out repository
      uses: actions/checkout@v2
      with:
        path: source
        fetch-depth: 0
    - name: Set up build environment
      run: source/ci/setup-${{ matrix.platform.setup-script }}.sh
      shell: bash
      if: matrix.platform.setup-script != ''
    - name: Setup QEMU
      run: docker run --rm --privileged multiarch/qemu-user-static:register --reset
      if: matrix.platform.container.qemu == true
    - name: Download container
      run: |
        "${{ github.workspace }}/source/ci/getcontainer.sh" "${{ matrix.platform.container.name }}" "${{ matrix.platform.container.dockerfile }}"
      env:
        DOCKER_REGISTRY: ${{ env.docker-registry }}
        GITHUB_TOKEN: ${{ secrets.github_token }}
      working-directory: ${{ env.docker-config-path }}
      if: matrix.platform.container.name != ''
    - name: Create container
      run: docker build -t ${{ env.docker-registry-container-sha }} -f ${{ env.dockerfile }} .
      working-directory: ${{ env.docker-config-path }}
      if: matrix.platform.container.name != '' && env.docker-container-exists != 'true'
    - name: Build and test
      run: |
        export GITTEST_NEGOTIATE_PASSWORD="${{ secrets.GITTEST_NEGOTIATE_PASSWORD }}"

        if [ -n "${{ matrix.platform.container.name }}" ]; then
          docker run \
              --rm \
              --user libgit2:libgit2 \
              -v "$(pwd)/source:/home/libgit2/source" \
              -w /home/libgit2 \
              -e ASAN_SYMBOLIZER_PATH \
              -e CC \
              -e CFLAGS \
              -e CMAKE_GENERATOR \
              -e CMAKE_OPTIONS \
              -e GITTEST_NEGOTIATE_PASSWORD \
              -e PKG_CONFIG_PATH \
              -e SKIP_NEGOTIATE_TESTS \
              -e SKIP_SSH_TESTS \
              -e TSAN_OPTIONS \
              ${{ env.docker-registry-container-sha }} \
              /bin/bash -c "mkdir build && cd build && ../source/ci/build.sh && ../source/ci/test.sh"
        else
          mkdir build && cd build
          ../source/ci/build.sh
          ../source/ci/test.sh
        fi
      shell: bash

  coverity:
    name: Coverity
    runs-on: ubuntu-latest
    steps:
    - name: Check out repository
      uses: actions/checkout@v2
      with:
        path: source
        fetch-depth: 0
    - name: Download container
      run: |
        "${{ github.workspace }}/source/ci/getcontainer.sh" xenial
      env:
        DOCKER_REGISTRY: ${{ env.docker-registry }}
        GITHUB_TOKEN: ${{ secrets.github_token }}
      working-directory: ${{ env.docker-config-path }}
    - name: Run Coverity
      run: source/ci/coverity.sh
      env:
        COVERITY_TOKEN: ${{ secrets.coverity_token }}