ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
  workflow_dispatch:

jobs:
  build-and-test:
    name: ${{ matrix.os }} ${{ matrix.config }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-24.04, ubuntu-24.04-arm, macos-15, windows-2025 ]   # linux x64, linux arm64, apple silicon, windows x64
        config: [ Debug, Release ]
    steps:
      - uses: actions/checkout@v4

      - name: Configure
        run: cmake -B build -DCMAKE_BUILD_TYPE=${{ matrix.config }}

      - name: Build
        run: cmake --build build --config ${{ matrix.config }} --parallel

      - name: Test
        run: ctest --test-dir build --build-config ${{ matrix.config }} --output-on-failure --timeout 600

  mingw:
    name: windows-2025 MinGW
    runs-on: windows-2025
    timeout-minutes: 30
    defaults:
      run:
        shell: msys2 {0}
    steps:
      - uses: actions/checkout@v4

      - name: Set up MinGW
        uses: msys2/setup-msys2@v2
        with:
          msystem: MINGW64
          update: true
          install: >-
            mingw-w64-x86_64-gcc
            mingw-w64-x86_64-cmake
            mingw-w64-x86_64-ninja

      - name: Configure
        run: cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=Release

      - name: Build
        run: cmake --build build --parallel

      - name: Test
        run: ctest --test-dir build --output-on-failure --timeout 600

  system-sodium:
    name: ubuntu-24.04 system sodium
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Install libsodium
        run: sudo apt-get update && sudo apt-get install -y libsodium-dev

      - name: Configure
        run: cmake -B build -DCMAKE_BUILD_TYPE=Release -DNETCODE_SYSTEM_SODIUM=ON -DBUILD_SHARED_LIBS=ON

      - name: Build
        run: cmake --build build --parallel

      - name: Test
        run: ctest --test-dir build --output-on-failure --timeout 600

      - name: Install
        run: |
          cmake --install build --prefix stage
          test -f stage/include/netcode.h
          test -f stage/lib/libnetcode.so || test -L stage/lib/libnetcode.so
          echo "install layout ok"

  # the installed library is what a package manager ships, so CI links a program against it
  # from a clean prefix: the default vendored build carries its own crypto into libnetcode,
  # and the system libsodium build exports the libsodium it found.
  consumer:
    name: consumer (${{ matrix.name }})
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: vendored sodium
            options: ""
            system_sodium: false
          - name: system sodium
            options: "-DNETCODE_SYSTEM_SODIUM=ON"
            system_sodium: true
    steps:
      - uses: actions/checkout@v4

      - name: Install libsodium
        if: matrix.system_sodium
        run: sudo apt-get update && sudo apt-get install -y libsodium-dev

      - name: Configure
        run: cmake -B build -DCMAKE_BUILD_TYPE=Release -DNETCODE_BUILD_TESTS=OFF ${{ matrix.options }}

      - name: Build
        run: cmake --build build --parallel

      - name: Install to a clean prefix
        run: cmake --install build --prefix "${{ github.workspace }}/prefix"

      - name: Build and run the consumer
        run: |
          cmake -S tools/consumer -B consumer-build -DCMAKE_PREFIX_PATH="${{ github.workspace }}/prefix"
          cmake --build consumer-build --parallel
          ./consumer-build/consumer

  # the only big endian coverage in the matrix: the address conversions read and write
  # network byte order for real here, where host order is not a synonym for it
  big-endian:
    name: big endian s390x / ${{ matrix.config }}
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        config: [ Debug, Release ]
    steps:
      - uses: actions/checkout@v4

      - name: Install s390x cross toolchain and qemu
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-s390x-linux-gnu g++-s390x-linux-gnu qemu-user-static

      # static linking so the emulated binaries need no s390x sysroot at runtime
      - name: Configure
        run: >
          cmake -B build
          -DCMAKE_BUILD_TYPE=${{ matrix.config }}
          -DCMAKE_SYSTEM_NAME=Linux
          -DCMAKE_SYSTEM_PROCESSOR=s390x
          -DCMAKE_C_COMPILER=s390x-linux-gnu-gcc
          -DCMAKE_CXX_COMPILER=s390x-linux-gnu-g++
          -DCMAKE_C_FLAGS="-static"
          -DCMAKE_CXX_FLAGS="-static"
          -DCMAKE_CROSSCOMPILING_EMULATOR=qemu-s390x-static

      - name: Build
        run: cmake --build build --parallel

      - name: Test
        run: ctest --test-dir build --output-on-failure --timeout 600

  # every packet the suite encrypts is recorded by key and nonce, and a repeat fails the run
  nonce-audit:
    name: nonce audit
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Configure
        run: cmake -B build -DCMAKE_BUILD_TYPE=Release -DNETCODE_NONCE_AUDIT=ON

      - name: Build
        run: cmake --build build --parallel

      - name: Test
        run: ctest --test-dir build --output-on-failure --timeout 600

  sanitizers:
    name: sanitizers (asan+ubsan)
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      CC: clang
      CXX: clang++
    steps:
      - uses: actions/checkout@v4

      - name: Configure
        run: cmake -B build -DCMAKE_BUILD_TYPE=Debug -DNETCODE_SANITIZE=ON

      - name: Build
        run: cmake --build build --parallel

      - name: Test
        run: ctest --test-dir build --output-on-failure --timeout 600
        env:
          ASAN_OPTIONS: halt_on_error=1:abort_on_error=1
          UBSAN_OPTIONS: halt_on_error=1:abort_on_error=1:print_stacktrace=1

  fuzz:
    name: fuzz (smoke)
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      CC: clang
      CXX: clang++
    steps:
      - uses: actions/checkout@v4

      - name: Configure
        run: cmake -B build -DCMAKE_BUILD_TYPE=Debug -DNETCODE_SANITIZE=ON -DNETCODE_FUZZ=ON

      - name: Build fuzz targets
        run: cmake --build build --parallel --target fuzz_read_packet fuzz_connect_token fuzz_parse_address

      - name: Smoke fuzz
        run: |
          mkdir -p fuzz-run
          cd fuzz-run
          for target in fuzz_read_packet fuzz_connect_token fuzz_parse_address; do
            echo "=== $target ==="
            seeds=""
            if [ -d "../fuzz/corpus/$target" ]; then seeds="../fuzz/corpus/$target"; fi
            ../build/bin/$target -max_total_time=60 -rss_limit_mb=4096 -print_final_stats=1 $seeds
          done

      - name: Upload crashes
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-crashes
          path: |
            fuzz-run/crash-*
            fuzz-run/oom-*
            fuzz-run/timeout-*
          if-no-files-found: ignore

  conformance:
    name: STANDARD.md conformance
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4

      # Checks the wire-format specification against the implementation. The
      # checker parses artifacts the real library produces using ONLY what
      # STANDARD.md states, with no reference to the source. A failure means
      # the document and the code disagree — decide which is wrong, and fix
      # that one. A specification nothing verifies drifts, and a drifted spec
      # is worse than none because independent implementations are built on it.
      - name: Verify STANDARD.md
        run: python3 tools/conformance/verify_standard.py


      # Behaviour over time rather than bytes on the wire: drives a real client
      # and server through a full connection lifecycle and checks every state
      # transition against the machine STANDARD.md specifies.
      - name: Verify STANDARD.md client state machine
        run: python3 tools/conformance/verify_state_machine.py