name: Build and release

on:
  push:
    tags:
      - '**'

permissions:
  contents: read

jobs:
  test:
    name: Test (${{ matrix.os }})
    strategy:
      matrix:
        os:
          - ubuntu-24.04
          - macos-14
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Run kernel correctness tests
        run: make test

  build:
    name: Build ${{ matrix.target }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: linux-amd64
            os: ubuntu-24.04
          - target: linux-i386
            os: ubuntu-24.04
          - target: linux-arm64
            os: ubuntu-24.04-arm
          - target: linux-ppc32be
            os: ubuntu-24.04
          - target: macos-amd64
            os: macos-14
          - target: macos-arm64
            os: macos-14
          - target: windows-amd64
            os: ubuntu-24.04
          - target: windows-i386
            os: ubuntu-24.04
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Install the Linux i386 multilib compiler
        if: matrix.target == 'linux-i386'
        run: |
          sudo apt-get update
          sudo apt-get install --yes gcc-multilib

      - name: Install the Linux PPC32 big-endian cross-compiler
        if: matrix.target == 'linux-ppc32be'
        run: |
          sudo apt-get update
          sudo apt-get install --yes gcc-powerpc-linux-gnu

      - name: Install the Windows/AMD64 cross-compiler
        if: matrix.target == 'windows-amd64'
        run: |
          sudo apt-get update
          sudo apt-get install --yes gcc-mingw-w64-x86-64

      - name: Install the Windows/i386 cross-compiler
        if: matrix.target == 'windows-i386'
        run: |
          sudo apt-get update
          sudo apt-get install --yes gcc-mingw-w64-i686

      - name: Build Linux executable
        if: startsWith(matrix.target, 'linux-')
        run: |
          make "${{ matrix.target }}"
          file "dist/fossbench-${{ matrix.target }}"
          if ! file "dist/fossbench-${{ matrix.target }}" | grep -q 'dynamically linked'; then
            echo 'Linux release uses static glibc, which is unsafe with NSS-based DNS' >&2
            exit 1
          fi
          if [ "${{ matrix.target }}" != linux-ppc32be ]; then
            "dist/fossbench-${{ matrix.target }}" --help
          fi

      - name: Build macOS executable
        if: startsWith(matrix.target, 'macos-')
        env:
          MACOSX_DEPLOYMENT_TARGET: ${{ matrix.target == 'macos-amd64' && '10.5' || '' }}
        run: |
          build_log="$(mktemp)"
          if ! make "${{ matrix.target }}" >"$build_log" 2>&1; then
            cat "$build_log"
            {
              echo '## macOS build failure'
              echo '```text'
              tail -80 "$build_log"
              echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi
          cat "$build_log"

      - name: Build Windows executable
        if: startsWith(matrix.target, 'windows-')
        run: |
          make "${{ matrix.target }}"
          file "dist/fossbench-${{ matrix.target }}.exe"
          if [ "${{ matrix.target }}" = windows-i386 ]; then
            pe="dist/fossbench-windows-i386.exe"
            i686-w64-mingw32-objdump -p "$pe" > "$RUNNER_TEMP/windows-i386-pe.txt"
            grep -Eq 'MajorSubsystemVersion[[:space:]]+5' "$RUNNER_TEMP/windows-i386-pe.txt"
            grep -Eq 'MinorSubsystemVersion[[:space:]]+1' "$RUNNER_TEMP/windows-i386-pe.txt"
            if grep -Eq 'GetTickCount64|InitializeCriticalSectionEx|CreateThreadpool|WaitOnAddress' "$RUNNER_TEMP/windows-i386-pe.txt"; then
              echo 'Windows i386 release imports an API newer than Windows XP' >&2
              exit 1
            fi
          fi

      - name: Package artifact
        run: |
          bin="fossbench-${{ matrix.target }}"
          if [[ "${{ matrix.target }}" == windows-* ]]; then
            bin="$bin.exe"
          fi
          tar -czf "$GITHUB_WORKSPACE/fossbench-${{ matrix.target }}.tar.gz" \
            -C "$GITHUB_WORKSPACE/dist" "$bin"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: fossbench-${{ matrix.target }}
          path: fossbench-${{ matrix.target }}.tar.gz
          if-no-files-found: error

  release:
    name: Create GitHub release
    needs:
      - test
      - build
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: fossbench-*
          path: release
          merge-multiple: true

      - name: Create checksums
        working-directory: release
        run: sha256sum fossbench-*.tar.gz > SHA256SUMS

      - name: Create release and attach artifacts
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          gh release delete "$RELEASE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --yes 2>/dev/null || true
          gh release create "$RELEASE_TAG" \
            release/fossbench-*.tar.gz \
            release/SHA256SUMS \
            --repo "$GITHUB_REPOSITORY" \
            --title "Release $RELEASE_TAG" \
            --notes "Fixed x86/Linux builds on systems without OpenSSL development headers. Result uploads now use plain HTTP on every platform, removing the OpenSSL build and runtime dependency." \
            --generate-notes