name: CI

on: [push, pull_request]

jobs:
  linux:
    name: "${{ matrix.name }}"
    runs-on: [ubuntu-24.04]

    # We want to run on external PRs, but not on our own internal PRs as they'll be run
    # by the push to the branch.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    strategy:
      fail-fast: false
      matrix:
        include:
          - name: "Ubuntu / OpenSSL 1.1.0"
            command: make -f misc/docker-ci.mk CMAKE_ARGS='-DOPENSSL_ROOT_DIR=-DOPENSSL_ROOT_DIR=/opt/openssl-1.1.0 -DWITH_FUSION=OFF' CONTAINER_NAME='h2oserver/h2o-ci:ubuntu1604'
          - name: "Ubuntu / OpenSSL 1.1.1"
            command: make -f misc/docker-ci.mk CMAKE_ARGS='-DWITH_AEGIS=1 -DAEGIS_INCLUDE_DIR=/usr/local/include'
          - name: "Ubuntu / OpenSSL 3.0 + mbedtls"
            command: make -f misc/docker-ci.mk CONTAINER_NAME=h2oserver/h2o-ci:ubuntu2204 CMAKE_ARGS='-DWITH_MBEDTLS=1'
          - name: "Ubuntu / OpenSSL 3.5"
            command: make -f misc/docker-ci.mk CONTAINER_NAME=h2oserver/h2o-ci:ubuntu2404 CMAKE_ARGS='-DOPENSSL_ROOT_DIR=/usr/local/openssl-3.5'
          - name: "Ubuntu / OpenSSL 1.1.1 + ASan & UBSan"
            command: make -f misc/docker-ci.mk CMAKE_ARGS='-DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_C_FLAGS=-fsanitize=address,undefined -DCMAKE_CXX_FLAGS=-fsanitize=address,undefined' CHECK_ENVS='ASAN_OPTIONS=detect_leaks=0 UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1'
          - name: "Ubuntu / boringssl"
            command: make -f misc/docker-ci.mk CONTAINER_NAME=h2oserver/h2o-ci:ubuntu2204 CMAKE_ARGS='-DOPENSSL_ROOT_DIR=/opt/boringssl'
          - name: "CentOS Stream / OpenSSL wo. ENGINE API"
            command: |
              sudo aa-status || true
              sudo aa-teardown || true
              sudo aa-status || true
              make -f misc/docker-ci.mk CONTAINER_NAME=h2oserver/h2o-ci:centosstream10

    timeout-minutes: 20
    steps:
    - uses: actions/checkout@v2
      with:
        submodules: recursive
    - name: Run with Docker
      shell: 'script -q -e -c "bash -xe {0}"'
      run: |
        chmod -R ugo+w .
        ${{ matrix.command }}
  macos:
    name: "${{ matrix.name }}"
    runs-on: [macos-latest]
    # We want to run on external PRs, but not on our own internal PRs as they'll be run
    # by the push to the branch.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    strategy:
      fail-fast: false
      matrix:
        include:
          - name: "macOS / OpenSSL 3.x"
            openssl: openssl@3
          - name: "macOS / OpenSSL 1.1.x"
            openssl: openssl@1.1
          - name: "macOS / LibreSSL"
            openssl: libressl

    timeout-minutes: 20
    steps:
    - uses: actions/checkout@v2
      with:
        submodules: recursive

    - name: Install Dependencies
      env:
        OPENSSL: ${{ matrix.openssl }}
      run: |
        brew install perl libfaketime pkg-config ${OPENSSL}
        perl -v
        curl -sSfL https://cpanmin.us | perl - -v --notest Scope::Guard Test::TCP

    - name: Build
      env:
        OPENSSL: ${{ matrix.openssl }}
      run: |
        set -xe
        mkdir -p build
        cd build
        cmake .. -DOPENSSL_ROOT_DIR="$(brew --prefix ${OPENSSL})"
        make all VERBOSE=1
        make check