ci.yml

# CI (04 §11.2): build + unit tests + import audit for x64-modern, x64-xp, x86-ia32 and x86-sse2, plus the
# x64-analysis (/analyze) build. The x86 flavours also run the ISA audit and the constant-time helper-call
# gate (sd-isacheck) as post-build steps and CTests; their test binaries run under WOW64 on the x64
# runner (Dokany tests skip there). The arm64 and arm32 entries are build-only (M6, 04 §1.1, §5.1): they
# cross-compile on the x64 runner, the build-time tools run from a nested x64 build, and no test runs (ARM
# binaries cannot run there; the ARM64 test job belongs to windows-11-arm, §11.2; arm32 has no test job, D5).
# The per-machine MSIs (04 §8, D31) are built on x86-ia32, x64-modern, arm64 and arm32 with WiX 3.14 of the runner image,
# and their msi.* checks run there; on the ARM entries those are the only tests (x64 sd-test-msi from the nested
# host-tools build, CMakePresets.json). The x64 and ARM64 MSIs carry the x86-sse2 shell extension, built with v141_xp.
# TM-R39: first-party actions only, pinned by commit SHA; read-only token.
name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: build (${{ matrix.preset }})
    runs-on: ${{ vars.SD_BUILD_RUNNER || 'windows-2022' }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        preset: [x64-modern, x64-xp, x86-ia32, x86-sse2, arm64, arm32]
        include:
          - preset: x64-modern
            msi: true
          - preset: x86-ia32
            msi: true
          - preset: arm64
            msi: true
          - preset: arm32
            msi: true
    env:
      SD_BUILD_NUMBER: ${{ github.run_number }}
      SD_MSI: ${{ matrix.msi }}
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # The XP presets need it, and so do x64-modern and arm64 for the x86 shell extension of their MSI.
      - name: Set up v141_xp toolset
        if: matrix.preset != 'arm32'
        uses: ./.github/actions/setup-xp-toolset

      - name: Check WiX 3.14
        if: matrix.msi
        shell: pwsh
        run: |
          $wix = if ($env:WIX) { $env:WIX } else { "${env:ProgramFiles(x86)}\WiX Toolset v3.14" }
          if (-not (Test-Path (Join-Path $wix 'bin\candle.exe'))) { throw "WiX 3.14 not found at $wix (04 section 8.1)" }
          Write-Host "WiX: $wix"

      - name: Configure
        shell: pwsh
        run: |
          $msiArgs = @()
          if ($env:SD_MSI -eq 'true') { $msiArgs += '-DSD_BUILD_MSI=ON' }
          cmake --preset ${{ matrix.preset }} "-DSD_BUILD_NUMBER=${{ github.run_number }}" @msiArgs
          if ($LASTEXITCODE) { exit $LASTEXITCODE }

      # Release and Debug both run the post-build import audit (sd-importcheck) and the sdl10n
      # completeness check; either failure fails the build.
      - name: Build Release
        shell: pwsh
        run: cmake --build --preset ${{ matrix.preset }}

      - name: Build Debug
        shell: pwsh
        run: cmake --build --preset ${{ matrix.preset }}-debug

      # arm64 and arm32 run no unit tests (ARM test binaries cannot run on the x64 runner, 04 §11.4): their Release
      # ctest preset selects only the msi.* checks, and their Debug ctest is skipped.
      - name: Test Release
        if: (matrix.preset != 'arm64' && matrix.preset != 'arm32') || matrix.msi
        shell: pwsh
        run: ctest --preset ${{ matrix.preset }} --output-on-failure --output-junit "${{ github.workspace }}/build/ctest-${{ matrix.preset }}.xml"

      - name: Test Debug
        if: matrix.preset != 'arm64' && matrix.preset != 'arm32'
        shell: pwsh
        run: ctest --preset ${{ matrix.preset }}-debug --output-on-failure

      - name: Upload binaries
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: bin-${{ matrix.preset }}
          path: |
            build/${{ matrix.preset }}/bin/Release/*.exe
            build/${{ matrix.preset }}/bin/Release/*.pdb
            build/${{ matrix.preset }}/msi/Release/*.msi
            build/ctest-${{ matrix.preset }}.xml
          if-no-files-found: error

  analysis:
    name: analysis (x64-analysis)
    runs-on: ${{ vars.SD_BUILD_RUNNER || 'windows-2022' }}
    timeout-minutes: 60
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure
        shell: pwsh
        run: cmake --preset x64-analysis

      - name: Build (/analyze, warnings are errors)
        shell: pwsh
        run: cmake --build --preset x64-analysis

      - name: Test
        shell: pwsh
        run: ctest --preset x64-analysis --output-on-failure

  # TM-R39 / TST-32: the workflow lint (tools/check-workflows.ps1). Read-only; CODEOWNERS is reported as a warning
  # until the maintainer review owner is recorded.
  workflow-lint:
    name: workflow lint
    runs-on: ${{ vars.SD_BUILD_RUNNER || 'windows-2022' }}
    timeout-minutes: 10
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Lint the workflows
        shell: pwsh
        run: ./tools/check-workflows.ps1