build.yml

# Copyright (C) Viktor Szakats. See LICENSE.md
# SPDX-License-Identifier: MIT
---
# https://docs.github.com/actions/learn-github-actions
# https://github.com/actions/upload-artifact
name: build
on:
  push:
    branches:
      - main
      - dev
      - test

concurrency:
  group: '${{ github.workflow }}-${{ github.ref }}'
  cancel-in-progress: true

permissions: {}

env:
  CW_MAP: '1'
  CW_JOBS: '5'
  DO_NOT_TRACK: '1'

jobs:
  reuse-check:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
      - name: 'REUSE compliance check'
        uses: fsfe/reuse-action@bb774aa972c2a89ff34781233d275075cbddf542 # v5

  shellcheck:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
      - name: 'shellcheck'
        run: |
          shellcheck --version
          shellcheck --exclude=1091 \
            --enable=avoid-nullary-conditions,deprecate-which,quote-safe-variables,require-variable-braces \
            ./*.sh

  spellcheck:
    runs-on: 'ubuntu-24.04'
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
      - name: 'install tools'
        run: pip install --break-system-packages -U codespell
      - name: 'spellcheck'
        run: |
          codespell --version
          codespell --skip='*.asc,*.patch,*.pem' \
            --ignore-words '.github/workflows/codespell-ignore.txt' \
            $(git ls-files)

  linux-glibc-debian-testing-llvm:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux-a64-x64"
          export CW_REVISION='${{ github.sha }}'
          . ./_versions.sh
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-glibc-debian-testing-llvm'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  linux-glibc-debian-testing-gcc:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux-a64-r64-x64-gcc"
          export CW_REVISION='${{ github.sha }}'
          . ./_versions.sh
          export CW_GCCSUFFIX='-14'
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-glibc-debian-testing-gcc'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  linux-glibc-debian-bookworm-llvm:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux"
          export CW_REVISION='${{ github.sha }}'
          DOCKER_IMAGE='debian:bookworm-slim'
          export CW_CCSUFFIX='-15'
          export CW_GCCSUFFIX='-12'
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-glibc-debian-bookworm-llvm'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  linux-glibc-debian-bookworm-gcc:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux-gcc"
          export CW_REVISION='${{ github.sha }}'
          DOCKER_IMAGE='debian:bookworm-slim'
          export CW_CCSUFFIX='-15'
          export CW_GCCSUFFIX='-12'
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-glibc-debian-bookworm-gcc'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  linux-musl-debian-testing-llvm:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux-a64-r64-x64-musl"
          export CW_REVISION='${{ github.sha }}'
          . ./_versions.sh
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-musl-debian-testing-llvm'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  linux-musl-debian-testing-gcc:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux-a64-r64-x64-musl-gcc"
          export CW_REVISION='${{ github.sha }}'
          . ./_versions.sh
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-musl-debian-testing-gcc'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  linux-musl-debian-bookworm-llvm:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux-musl"
          export CW_REVISION='${{ github.sha }}'
          DOCKER_IMAGE='debian:bookworm-slim'
          export CW_CCSUFFIX='-15'
          export CW_GCCSUFFIX='-12'
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-musl-debian-bookworm-llvm'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  linux-musl-debian-bookworm-gcc:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux-musl-gcc"
          export CW_REVISION='${{ github.sha }}'
          DOCKER_IMAGE='debian:bookworm-slim'
          export CW_CCSUFFIX='-15'
          export CW_GCCSUFFIX='-12'
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-musl-debian-bookworm-gcc'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  linux-musl-alpine-llvm:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux"
          export CW_REVISION='${{ github.sha }}'
          DOCKER_IMAGE='alpine:latest'
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c 'apk add --no-cache bash && ./_ci-linux-alpine.sh'

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-musl-alpine-llvm-x86_64'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  linux-musl-alpine-gcc:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux-gcc"
          export CW_REVISION='${{ github.sha }}'
          DOCKER_IMAGE='alpine:latest'
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c 'apk add --no-cache bash && ./_ci-linux-alpine.sh'

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-musl-alpine-gcc-x86_64'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  linux-musl-from-mac:
    runs-on: macos-13
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        env:
          GITHUB_TOKEN: '${{ github.token }}'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-linux"
          export CW_REVISION='${{ github.sha }}'
          sh -c ./_ci-mac-homebrew.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-linux-musl-from-mac'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-linux*.*
            urls.txt

  mac-clang:
    runs-on: 'macos-latest'
    timeout-minutes: 30
    env:
      CW_JOBS: '4'
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        env:
          GITHUB_TOKEN: '${{ github.token }}'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-mac-macuni"
          export CW_REVISION='${{ github.sha }}'
          sh -c ./_ci-mac-homebrew.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-macos-universal-clang'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-macos*.*
            urls.txt

  mac-llvm:
    runs-on: 'macos-latest'
    timeout-minutes: 30
    env:
      CW_JOBS: '4'
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        env:
          GITHUB_TOKEN: '${{ github.token }}'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-mac-macuni-llvm"
          export CW_REVISION='${{ github.sha }}'
          sh -c ./_ci-mac-homebrew.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-macos-universal-llvm'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-macos*.*
            urls.txt

  mac-gcc:
    runs-on: 'macos-latest'
    timeout-minutes: 30
    env:
      CW_JOBS: '4'
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        env:
          GITHUB_TOKEN: '${{ github.token }}'
        run: |
          export CW_CCSUFFIX='-14'
          export CW_CONFIG="${GITHUB_REF_NAME}-mac-gcc-a64"
          export CW_REVISION='${{ github.sha }}'
          sh -c ./_ci-mac-homebrew.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-macos-gcc-arm64'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-macos*.*
            urls.txt

  win-llvm-from-mac:
    runs-on: 'macos-latest'
    timeout-minutes: 30
    env:
      CW_JOBS: '4'
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        env:
          CW_LLVM_MINGW_DL: '1'
          CW_LLVM_MINGW_ONLY: '0'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-win"
          export CW_REVISION='${{ github.sha }}'
          . ./_versions.sh
          sh -c ./_ci-mac-homebrew.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-windows-llvm-from-mac'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-mingw*.*
            urls.txt

  win-llvm:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        env:
          CW_LLVM_MINGW_DL: '1'
          CW_LLVM_MINGW_ONLY: '0'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-win"
          export CW_REVISION='${{ github.sha }}'
          . ./_versions.sh
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-windows-llvm'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-mingw*.*
            urls.txt

  win-gcc:
    runs-on: 'ubuntu-latest'
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
          fetch-depth: '300'
      - name: 'build'
        env:
          CW_LLVM_MINGW_DL: '1'
          CW_LLVM_MINGW_ONLY: '0'
        run: |
          export CW_CONFIG="${GITHUB_REF_NAME}-win-gcc"
          export CW_REVISION='${{ github.sha }}'
          . ./_versions.sh
          sudo podman image trust set --type reject default
          sudo podman image trust set --type accept docker.io/library
          time podman pull "${DOCKER_IMAGE}"
          podman images --digests
          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
            --env-file <(env | grep -a -E \
              '^(CW_|GITHUB_|DO_NOT_TRACK)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh

      - name: 'list dependencies'
        run: cat urls.txt *-version-*.txt || true
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: 'curl-windows-gcc-noarm64'
          retention-days: ${{ github.ref_name == 'main' && 90 || 5 }}
          path: |
            *-*-mingw*.*
            urls.txt