ci.yml

name: CI

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  build:
    # The library builds on every push/PR across all three platforms for
    # early compile-failure signal. Release publishing (provenance, SBOM,
    # cosign signatures) is handled by the separate release.yml workflow
    # so the tests here stay a pure gate.
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            artifact-suffix: linux-x64
            shared-lib: libarkilian.so
            static-lib: libarkilian.a
          - os: macos-latest
            artifact-suffix: darwin-x64
            shared-lib: libarkilian.dylib
            static-lib: libarkilian.a
          - os: windows-latest
            artifact-suffix: windows-x64
            shared-lib: arkilian.dll
            static-lib: arkilian.lib

    runs-on: ${{ matrix.os }}

    steps:
    - uses: actions/checkout@v4

    - name: Install Dependencies (Ubuntu)
      if: matrix.os == 'ubuntu-latest'
      run: |
        sudo apt-get update
        sudo apt-get install -y libcurl4-openssl-dev clang-tidy

    - name: Install Dependencies (Windows)
      if: matrix.os == 'windows-latest'
      run: |
        $vcpkgPath = "${{ runner.temp }}/vcpkg"
        git clone https://github.com/microsoft/vcpkg.git $vcpkgPath
        & "$vcpkgPath/bootstrap-vcpkg.bat"
        & "$vcpkgPath/vcpkg" install curl:x64-windows
        echo "VCPKG_ROOT=$vcpkgPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
      shell: pwsh

    - name: Configure CMake (Windows)
      if: matrix.os == 'windows-latest'
      run: cmake -B build -S . -DCMAKE_BUILD_TYPE=Release -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" -DARKILIAN_BUILD_EXAMPLES=OFF
      shell: pwsh

    - name: Configure CMake (Unix)
      if: matrix.os != 'windows-latest'
      run: cmake -B build -S . -DCMAKE_BUILD_TYPE=Release -DARKILIAN_BUILD_EXAMPLES=OFF

    - name: Build
      run: cmake --build build --config Release

  test:
    # The C suite, Go control plane, and Node binding run on every
    # push/PR. Windows is exercised via MSYS2 UCRT64 MinGW so the tests
    # build with the same POSIX-thread/socket API the library targets
    # (the MSVC `build` job above covers native compile-fitness).
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        include:
          - os: ubuntu-latest
            install-deps: |
              sudo apt-get update
              sudo apt-get install -y libcurl4-openssl-dev clang-tidy
          - os: macos-latest
            install-deps: |
              brew install curl
              echo "CMAKE_PREFIX_PATH=$(brew --prefix curl)" >> "$GITHUB_ENV"
    runs-on: ${{ matrix.os }}
    steps:
    - uses: actions/checkout@v4

    - name: Install Dependencies (Unix)
      if: matrix.os != 'windows-latest'
      run: ${{ matrix.install-deps }}

    - name: Setup MSYS2 UCRT64 (Windows)
      if: matrix.os == 'windows-latest'
      uses: msys2/setup-msys2@v2
      with:
        msystem: UCRT64
        update: true
        install: >-
          mingw-w64-ucrt-x86_64-toolchain
          mingw-w64-ucrt-x86_64-cmake
          mingw-w64-ucrt-x86_64-curl
          mingw-w64-ucrt-x86_64-make

    - name: Setup Go (Unix)
      if: matrix.os != 'windows-latest'
      uses: actions/setup-go@v5
      with:
        go-version: '1.25'

    - name: Configure CMake (with tests, Unix)
      if: matrix.os != 'windows-latest'
      run: |
        cmake -B build -S . -DCMAKE_BUILD_TYPE=Debug \
          -DARKILIAN_BUILD_TESTS=ON -DARKILIAN_BUILD_EXAMPLES=OFF

    - name: Configure CMake (with tests, Windows/MSYS2)
      if: matrix.os == 'windows-latest'
      shell: msys2 {0}
      run: |
        cmake -B build -S . -G "MinGW Makefiles" \
          -DCMAKE_PREFIX_PATH=/ucrt64 \
          -DCMAKE_BUILD_TYPE=Debug \
          -DARKILIAN_BUILD_TESTS=ON -DARKILIAN_BUILD_EXAMPLES=OFF

    - name: Build (with tests, Unix)
      if: matrix.os != 'windows-latest'
      run: cmake --build build --config Debug

    - name: Build (with tests, Windows/MSYS2)
      if: matrix.os == 'windows-latest'
      shell: msys2 {0}
      run: cmake --build build --config Debug

    - name: C test suites (ctest — all 10, Unix)
      if: matrix.os != 'windows-latest'
      working-directory: build
      run: ctest --output-on-failure

    - name: C test suites (ctest — Windows/MSYS2)
      if: matrix.os == 'windows-latest'
      shell: msys2 {0}
      working-directory: build
      run: ctest --output-on-failure

    - name: Go control-plane tests
      if: matrix.os != 'windows-latest'
      run: |
        cd server
        go test ./...

    - name: Node binding build + tests
      # Node binding is platform-portable; only exercise it on Linux to
      # avoid redundant node-gyp toolchain setup on macOS (the build job
      # already builds the lib on both).
      if: matrix.os == 'ubuntu-latest'
      run: |
        npm ci
        npm test

  example:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Install Dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y libcurl4-openssl-dev clang-tidy

    - name: Configure CMake
      run: cmake -B build -S . -DCMAKE_BUILD_TYPE=Debug -DARKILIAN_BUILD_EXAMPLES=ON

    - name: Build
      run: cmake --build build --config Debug

    - name: Run Example
      run: ./build/arkilian_example

  # Sanitizers: the backup subsystem is a multi-threaded C library that
  # ships durability guarantees. ASAN+UBSAN catch the memory and UB
  # regressions that -Wall cannot (use-after-free, OOB read, signed
  # overflow, NULL-deref through freed memory). CONTRIBUTING.md mandates
  # "rigorous memory safety verification"; this job makes it real.
  sanitizer:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Install Dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y libcurl4-openssl-dev clang-tidy

    - name: Configure (ASAN + UBSAN, tests ON)
      run: |
        cmake -B build -S . -DCMAKE_BUILD_TYPE=Debug \
          -DARKILIAN_BUILD_TESTS=ON -DARKILIAN_BUILD_EXAMPLES=OFF \
          -DCMAKE_C_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \
          -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,undefined"

    - name: Build
      run: cmake --build build --config Debug

    - name: Run tests under sanitizer
      working-directory: build
      env:
        ASAN_OPTIONS: detect_leaks=1:halt_on_error=1:abort_on_error=1
        UBSAN_OPTIONS: halt_on_error=1:abort_on_error=1
      run: ctest --output-on-failure

  # ThreadSanitizer: the client runs dedicated game, flush, and snapshot
  # threads plus a hydration single-flight path. ASAN+UBSAN cannot see
  # data races between those threads; TSAN gates synchronization
  # regressions (e.g. a missed mutex on a shared heartbeat counter).
  tsan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Install Dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y libcurl4-openssl-dev clang-tidy

    - name: Configure (TSAN, tests ON)
      run: |
        cmake -B build-tsan -S . -DCMAKE_BUILD_TYPE=Debug \
          -DARKILIAN_BUILD_TESTS=ON -DARKILIAN_BUILD_EXAMPLES=OFF \
          -DCMAKE_C_FLAGS="-fsanitize=thread -fno-omit-frame-pointer -g" \
          -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=thread"

    - name: Build (TSAN)
      run: cmake --build build-tsan --config Debug

    - name: Run tests under ThreadSanitizer
      working-directory: build-tsan
      env:
        TSAN_OPTIONS: halt_on_error=1:abort_on_error=1
      run: ctest --output-on-failure