ci.yml

name: CI

on:
  push:
    branches:
      - main
      - master
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CCACHE_DIR: ${{ github.workspace }}/.ccache
  DEFAULT_CFLAGS: >-
    -Wall -Wextra -Werror -O2 -g
    -fstack-protector-strong -D_FORTIFY_SOURCE=2
  DEFAULT_VERIFY_CFLAGS: >-
    -Wall -Wextra -Werror -O2
    -fstack-protector-strong -D_FORTIFY_SOURCE=2
  SANITIZER_CFLAGS: >-
    -Wall -Wextra -Werror -O1 -g
    -fsanitize=address,undefined -fno-omit-frame-pointer

jobs:
  lint:
    name: Lint and static analysis
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install linting tools
        run: |
          sudo apt-get update
          sudo apt-get install -y clang-format cppcheck

      - name: Verify formatting with clang-format
        shell: bash
        run: |
          mapfile -t files < <(find src tests -type f \( -name '*.c' -o -name '*.h' \) | sort)

          if [ "${#files[@]}" -eq 0 ]; then
            echo "No C source files found to format-check."
            exit 0
          fi

          clang-format --version
          clang-format \
            --style=file \
            --fallback-style=LLVM \
            --dry-run \
            --Werror \
            "${files[@]}"

      - name: Run cppcheck
        shell: bash
        run: |
          cppcheck \
            --std=c11 \
            --language=c \
            --enable=warning,style,performance,portability \
            --error-exitcode=1 \
            --inline-suppr \
            --suppress=missingIncludeSystem \
            src tests

  build-test:
    name: Build and test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    needs: lint
    timeout-minutes: 20

    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            install_cmd: |
              sudo apt-get update
              sudo apt-get install -y gcc make ccache
          - os: macos-latest
            install_cmd: |
              brew update
              brew install gcc make ccache

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install build dependencies
        run: ${{ matrix.install_cmd }}

      - name: Resolve toolchain
        shell: bash
        run: |
          if [ "${{ runner.os }}" = "macOS" ]; then
            CC_BIN="$(command -v gcc-14 || command -v gcc-13 || command -v gcc-12)"
            MAKE_BIN="$(command -v gmake)"
            BUILD_CFLAGS="-Wall -Wextra -Werror -O2 -g -fstack-protector-strong"
            BUILD_VERIFY_CFLAGS="-Wall -Wextra -Werror -O2 -fstack-protector-strong"
          else
            CC_BIN="$(command -v gcc)"
            MAKE_BIN="$(command -v make)"
            BUILD_CFLAGS="${DEFAULT_CFLAGS}"
            BUILD_VERIFY_CFLAGS="${DEFAULT_VERIFY_CFLAGS}"
          fi

          if [ -z "${CC_BIN}" ] || [ -z "${MAKE_BIN}" ]; then
            echo "Failed to resolve compiler or make binary."
            exit 1
          fi

          echo "CC_BIN=${CC_BIN}" >> "${GITHUB_ENV}"
          echo "MAKE_BIN=${MAKE_BIN}" >> "${GITHUB_ENV}"
          echo "BUILD_CFLAGS=${BUILD_CFLAGS}" >> "${GITHUB_ENV}"
          echo "BUILD_VERIFY_CFLAGS=${BUILD_VERIFY_CFLAGS}" >> "${GITHUB_ENV}"

      - name: Restore ccache
        uses: actions/cache@v4
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ${{ runner.os }}-ccache-${{ hashFiles('Makefile', 'src/**/*.c', 'src/**/*.h', 'tests/**/*.c', 'tests/**/*.h') }}
          restore-keys: |
            ${{ runner.os }}-ccache-

      - name: Configure ccache
        shell: bash
        run: |
          ccache --max-size 250M
          ccache --zero-stats

      - name: Run verify, test, and check
        shell: bash
        run: |
          "${MAKE_BIN}" clean
          "${MAKE_BIN}" verify \
            CC="ccache ${CC_BIN}" \
            CFLAGS="${BUILD_CFLAGS}" \
            VERIFY_CFLAGS="${BUILD_VERIFY_CFLAGS}"
          "${MAKE_BIN}" test \
            CC="ccache ${CC_BIN}" \
            CFLAGS="${BUILD_CFLAGS}" \
            VERIFY_CFLAGS="${BUILD_VERIFY_CFLAGS}"
          "${MAKE_BIN}" check \
            CC="ccache ${CC_BIN}" \
            CFLAGS="${BUILD_CFLAGS}" \
            VERIFY_CFLAGS="${BUILD_VERIFY_CFLAGS}"

      - name: Show ccache statistics
        if: always()
        run: ccache --show-stats

      - name: Upload compiled binaries
        uses: actions/upload-artifact@v4
        with:
          name: binaries-${{ runner.os }}
          if-no-files-found: error
          retention-days: 14
          path: |
            vuln_buffer_overflow
            safe_input_demo
            stack_layout_demo
            overflow_behavior_demo
            control_flow_simulation
            demo_runtime_checks

  security:
    name: Hardened and sanitizer checks
    runs-on: ubuntu-latest
    needs: lint
    timeout-minutes: 20

    env:
      ASAN_OPTIONS: detect_leaks=1:halt_on_error=1:strict_string_checks=1
      UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install security build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc make ccache

      - name: Restore ccache
        uses: actions/cache@v4
        with:
          path: ${{ env.CCACHE_DIR }}
          key: security-ccache-${{ hashFiles('Makefile', 'src/**/*.c', 'src/**/*.h', 'tests/**/*.c', 'tests/**/*.h') }}
          restore-keys: |
            security-ccache-

      - name: Configure ccache
        shell: bash
        run: |
          ccache --max-size 250M
          ccache --zero-stats

      - name: Run hardened build and test
        shell: bash
        run: |
          make clean
          make check \
            CC="ccache gcc" \
            CFLAGS="${DEFAULT_CFLAGS}" \
            VERIFY_CFLAGS="${DEFAULT_VERIFY_CFLAGS}"

      - name: Run AddressSanitizer and UBSan checks
        shell: bash
        run: |
          make clean
          make check \
            CC="ccache gcc" \
            CFLAGS="${SANITIZER_CFLAGS}" \
            VERIFY_CFLAGS="${SANITIZER_CFLAGS}"

      - name: Show ccache statistics
        if: always()
        run: ccache --show-stats