ci.yml

name: CI

on:
  push:
    branches-ignore:
      - 'main'

env:
  BUILDER_VERSION: v0.9.72
  BUILDER_SOURCE: releases
  BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net
  PACKAGE_NAME: aws-c-cal
  LINUX_BASE_IMAGE: ubuntu-18-x64
  CRT_CI_ROLE: ${{ secrets.CRT_CI_ROLE_ARN }}
  AWS_DEFAULT_REGION: us-east-1

permissions:
  id-token: write # This is required for requesting the JWT

jobs:
  linux-compat:
    runs-on: ubuntu-24.04 # latest
    strategy:
      fail-fast: false
      matrix:
        image:
          - manylinux1-x64
          - manylinux1-x86
          - manylinux2014-x64
          - manylinux2014-x86
          - fedora-34-x64
          - opensuse-leap
          - rhel8-x64
          - al2-x64
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ matrix.image }} build -p ${{ env.PACKAGE_NAME }}

  linux-compiler-compat:
    runs-on: ubuntu-24.04 # latest
    strategy:
      matrix:
        compiler:
          - clang-3
          - clang-6
          - clang-8
          - clang-9
          - clang-10
          - clang-11
          - clang-15
          - clang-17
          - gcc-4.8
          - gcc-5
          - gcc-6
          - gcc-7
          - gcc-8
          - gcc-11
          - gcc-13
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --compiler=${{ matrix.compiler }}

  clang-sanitizers:
    runs-on: ubuntu-24.04 # latest
    strategy:
      matrix:
        sanitizers: [",thread", ",address,undefined"]
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --compiler=clang-11 --cmake-extra=-DENABLE_SANITIZERS=ON --cmake-extra=-DSANITIZERS="${{ matrix.sanitizers }}"

  linux-shared-libs:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DBUILD_SHARED_LIBS=ON

  #Warning: this ci relies on ubuntu pulling correct version of openssl
  #Current version (18.04) pulls 1.1.1, but 22.04+ will pull in 3.0
  linux-openssl-static:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --variant=openssl --cmake-extra=-DUSE_OPENSSL=ON

  #ubuntu 22.04 defaults to openssl3 version by default when installing
  #libssl-dev package. Hence we can rely on OS version to pull in openssl3.
  linux-openssl3-static:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-ubuntu-22-x64 build -p ${{ env.PACKAGE_NAME }} --variant=openssl --cmake-extra=-DUSE_OPENSSL=ON

  linux-openssl-shared:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --variant=openssl --cmake-extra=-DUSE_OPENSSL=ON --cmake-extra=-DBUILD_SHARED_LIBS=ON

  linux-boringssl:
    runs-on: ubuntu-24.04 # latest
    steps:
        # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} --variant=boringssl --cmake-extra=-DUSE_OPENSSL=ON

  linux-aws-lc-fips:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        AWS_TEST_FIPS=1 python builder.pyz build -p ${{ env.PACKAGE_NAME }} --variant=aws-lc-fips --cmake-extra=-DFIPS=ON --cmake-extra=-DPERL_EXECUTABLE=perl --cmake-extra=-DGO_EXECUTABLE=go

  windows:
    runs-on: windows-2022 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }}

  windows-debug:
    runs-on: windows-2022 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} --config Debug --variant=just-tests

  windows-vc14:
    runs-on: windows-2019 # windows-2019 is last env with Visual Studio 2015 (v14.0)
    strategy:
      matrix:
        arch: [x86, x64]
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} --target windows-${{ matrix.arch }} --compiler msvc-14

  windows-shared-libs:
    runs-on: windows-2022 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DBUILD_SHARED_LIBS=ON

  windows-app-verifier:
    runs-on: windows-2022 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} run_tests=false --cmake-extra=-DBUILD_TESTING=ON
    - name: Run and check AppVerifier
      run: |
        python .\aws-c-cal\build\deps\aws-c-common\scripts\appverifier_ctest.py --build_directory .\aws-c-cal\build\aws-c-cal

  macos:
    runs-on: macos-14 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz', 'builder')"
        chmod a+x builder
        ./builder build -p ${{ env.PACKAGE_NAME }}

  macos-x64:
    runs-on: macos-14-large # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz', 'builder')"
        chmod a+x builder
        ./builder build -p ${{ env.PACKAGE_NAME }}

  macos-min-deployment-target:
    runs-on: macos-14 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz', 'builder')"
        chmod a+x builder
        ./builder build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DCMAKE_OSX_DEPLOYMENT_TARGET=10.9

  freebsd:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - uses: actions/checkout@v4
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      uses: cross-platform-actions/action@v0.25.0
      with:
        operating_system: freebsd
        architecture: x86-64
        version: '14.1'
        shell: bash
        run: |
          sudo pkg install -y python3 net/py-urllib3
          python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz', 'builder')"
          chmod a+x builder
          ./builder build -p ${{ env.PACKAGE_NAME }}

  openbsd:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - uses: actions/checkout@v4
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      uses: cross-platform-actions/action@v0.25.0
      with:
        operating_system: openbsd
        architecture: x86-64
        version: '7.4'
        shell: bash
        run: |
          sudo pkg_add py3-urllib3
          python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz', 'builder')"
          chmod a+x builder
          ./builder build -p ${{ env.PACKAGE_NAME }}

  # Test downstream repos.
  # This should not be required because we can run into a chicken and egg problem if there is a change that needs some fix in a downstream repo.
  downstream:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build downstream -p ${{ env.PACKAGE_NAME }}

  byo-crypto:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4  
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --variant=no-tests --cmake-extra=-DBYO_CRYPTO=ON