name: Build and release

on:
  push:
    tags:
      - '**'

permissions:
  contents: read

jobs:
  test:
    name: Test (${{ matrix.os }})
    strategy:
      matrix:
        os:
          - ubuntu-24.04
          - macos-14
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Run kernel correctness tests
        run: make test

  build:
    name: Build ${{ matrix.target }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: linux-amd64
            os: ubuntu-24.04
            openssl_target: linux-x86_64
            cross_prefix: ''
          - target: linux-arm64
            os: ubuntu-24.04
            openssl_target: linux-aarch64
            cross_prefix: aarch64-linux-gnu-
          - target: linux-ppc32be
            os: ubuntu-24.04
            openssl_target: linux-ppc
            cross_prefix: powerpc-linux-gnu-
          - target: macos-amd64
            os: macos-14
            openssl_target: darwin64-x86_64-cc
            cross_prefix: ''
          - target: macos-arm64
            os: macos-14
            openssl_target: darwin64-arm64-cc
            cross_prefix: ''
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Install the Linux ARM64 cross-compiler
        if: matrix.target == 'linux-arm64'
        run: |
          sudo apt-get update
          sudo apt-get install --yes gcc-aarch64-linux-gnu

      - name: Install the Linux PPC32 big-endian cross-compiler
        if: matrix.target == 'linux-ppc32be'
        run: |
          sudo apt-get update
          sudo apt-get install --yes gcc-powerpc-linux-gnu

      - name: Build static OpenSSL
        env:
          OPENSSL_VERSION: 3.5.7
          OPENSSL_TARGET: ${{ matrix.openssl_target }}
          CROSS_PREFIX: ${{ matrix.cross_prefix }}
        run: |
          curl --fail --location --retry 3 \
            "https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz" \
            --output openssl.tar.gz
          tar -xzf openssl.tar.gz
          cd "openssl-${OPENSSL_VERSION}"
          CROSS_COMPILE="$CROSS_PREFIX" ./Configure "$OPENSSL_TARGET" \
            no-shared no-tests no-module no-dso \
            --prefix="$GITHUB_WORKSPACE/openssl-static" \
            --openssldir=/etc/ssl
          make -j3 build_sw
          make install_sw

      - name: Build static Linux executable
        if: startsWith(matrix.target, 'linux-')
        run: |
          OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)"
          EXTRA_STATIC_LIBS='-ldl'
          if [ "${{ matrix.target }}" = linux-ppc32be ]; then
            EXTRA_STATIC_LIBS="$EXTRA_STATIC_LIBS -latomic"
          fi
          make "${{ matrix.target }}" \
            TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \
            TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a $EXTRA_STATIC_LIBS" \
            LDFLAGS=-static
          file "dist/fossmark-${{ matrix.target }}"
          if ldd "dist/fossmark-${{ matrix.target }}" 2>&1 | grep -q '=>'; then
            echo 'Linux release binary is dynamically linked' >&2
            exit 1
          fi

      - name: Build macOS executable with static OpenSSL
        if: startsWith(matrix.target, 'macos-')
        run: |
          OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)"
          make "${{ matrix.target }}" \
            TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \
            TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a"
          if otool -L "dist/fossmark-${{ matrix.target }}" | grep -E 'lib(ssl|crypto)'; then
            echo 'macOS release uses dynamic OpenSSL' >&2
            exit 1
          fi

      - name: Package artifact
        run: tar -czf fossmark-${{ matrix.target }}.tar.gz -C dist fossmark-${{ matrix.target }}

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: fossmark-${{ matrix.target }}
          path: fossmark-${{ matrix.target }}.tar.gz
          if-no-files-found: error

  release:
    name: Create GitHub release
    needs:
      - test
      - build
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: fossmark-*
          path: release
          merge-multiple: true

      - name: Create checksums
        working-directory: release
        run: sha256sum fossmark-*.tar.gz > SHA256SUMS

      - name: Create release and attach artifacts
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          gh release delete "$RELEASE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --yes 2>/dev/null || true
          gh release create "$RELEASE_TAG" \
            release/fossmark-*.tar.gz \
            release/SHA256SUMS \
            --repo "$GITHUB_REPOSITORY" \
            --title "Release $RELEASE_TAG" \
            --generate-notes