---
name: Daemon+CLI - Build and test
on:
  pull_request:
    paths:
      - '**'
      - '!**/**.md'
      - '!.github/workflows/**'
      - '.github/workflows/daemon.yml'
      - '!.github/CODEOWNERS'
      - '!android/**'
      - '!audits/**'
      - '!build.sh'
      - '!ci/**'
      - 'ci/check-rust.sh'
      - '!clippy.toml'
      - '!deny.toml'
      - '!docs/**'
      - '!graphics/**'
      - '!desktop/**'
      - '!ios/**'
      - '!scripts/**'
      - '!.*ignore'
      - '!prepare-release.sh'
      - '!rustfmt.toml'
      - '!.yamllint'
      - '!**/osv-scanner.toml'

  workflow_dispatch:
    inputs:
      override_container_image:
        description: Override container image
        type: string
        required: false

permissions: {}

jobs:
  prepare-linux:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Use custom container image if specified
        if: ${{ github.event.inputs.override_container_image != '' }}
        run: echo "inner_container_image=${{ github.event.inputs.override_container_image }}"
          >> $GITHUB_ENV

      - name: Use default container image and resolve digest
        if: ${{ github.event.inputs.override_container_image == '' }}
        run: echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV

    outputs:
      container_image: ${{ env.inner_container_image }}

  build-linux:
    needs: prepare-linux
    runs-on: ubuntu-latest
    container:
      image: ${{ needs.prepare-linux.outputs.container_image }}

    strategy:
      matrix:
        rust: [stable, beta, nightly]
    continue-on-error: true
    steps:
      # Fix for HOME path overridden by GH runners when building in containers, see:
      # https://github.com/actions/runner/issues/863
      - name: Fix HOME path
        run: echo "HOME=/root" >> $GITHUB_ENV

      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Checkout submodules
        run: |
          git config --global --add safe.directory '*'
          git submodule update --init --depth=1 dist-assets/binaries
          git submodule update --init wireguard-go-rs/libwg/wireguard-go

      # The container image already has rustup and the pinned version of Rust
      - name: Install Rust toolchain
        # When running this job for "stable" test against our pinned rust version
        # instead of the stable channel.
        # TODO: Improve this so both "stable" and the pinned version are tested if
        # they differ.
        if: ${{ matrix.rust != 'stable' }}
        run: rustup override set ${{ matrix.rust }}

      - name: Build and test crates
        run: ./ci/check-rust.sh

  build-macos:
    runs-on: macos-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Checkout wireguard-go submodule
        run: |
          git config --global --add safe.directory '*'
          git submodule update --init wireguard-go-rs/libwg/wireguard-go

      - name: Install Protoc
        uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Go
        uses: actions/setup-go@v3
        with:
          go-version: 1.21.3

      - name: Build and test crates
        run: ./ci/check-rust.sh

  build-windows:
    strategy:
      matrix:
        config:
          - os: windows-latest
            arch: x64
          - os: windows-11-arm
            arch: arm64
    runs-on: ${{ matrix.config.os }}
    steps:
      # By default, the longest path a filename can have in git on Windows is 260 character.
      - name: Set git config for long paths
        run: |
          git config --system core.longpaths true

      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Checkout submodules
        run: |
          git submodule update --init --depth=1
          git submodule update --init wireguard-go-rs/libwg/wireguard-go

      - name: Install Protoc
        uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Calculate Windows libraries cache hash
        id: windows-modules-hash
        shell: bash
        run: |
          hash="$(git grep --recurse-submodules --cached -l '' -- './windows/' \
            | grep -v '\.exe$\|\.md$' \
            | xargs sha1sum \
            | sha1sum \
            | cut -d" " -f1)"
          echo "hash=$hash" >> "$GITHUB_OUTPUT"

      - name: Cache Windows libraries
        uses: actions/cache@v4
        id: cache-windows-modules
        with:
          path: |
            ./windows/*/bin/${{ matrix.config.arch }}-*/*.dll
            ./windows/*/bin/${{ matrix.config.arch }}-*/*.lib
            !./windows/*/bin/${{ matrix.config.arch }}-*/libcommon.lib
            !./windows/*/bin/${{ matrix.config.arch }}-*/libshared.lib
            !./windows/*/bin/${{ matrix.config.arch }}-*/libwfp.lib
          key: windows-modules-${{ steps.windows-modules-hash.outputs.hash }}

      # The x64 toolchain is needed to build talpid-openvpn-plugin
      # TODO: Remove once fixed
      - name: Install Rust x64 target
        uses: actions-rust-lang/setup-rust-toolchain@v1
        if: ${{ matrix.config.arch == 'arm64' }}
        with:
          target: x86_64-pc-windows-msvc

      - name: Install Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          target: i686-pc-windows-msvc

      - name: Install msbuild
        uses: microsoft/setup-msbuild@v1.0.2
        with:
          vs-version: 16

      - name: Install latest zig
        uses: mlugg/setup-zig@v2

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: 1.21.3

      - name: Build Windows modules (x86_64)
        if: ${{ (steps.cache-windows-modules.outputs.cache-hit != 'true') && (matrix.config.arch == 'x64') }}
        shell: bash
        run: ./build-windows-modules.sh

      - name: Build Windows modules (ARM64)
        if: ${{ (steps.cache-windows-modules.outputs.cache-hit != 'true') && (matrix.config.arch == 'arm64') }}
        shell: bash
        # By default, ./build-windows-modules.sh will use 4 concurrent processes during compilation
        # because the Windows 11 ARM runner has 4 cores:
        # https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job#standard-github-hosted-runners-for-public-repositories
        #
        # Cap the number of concurrent processes to something less than 4 to avoid OOM issues.
        run: ./build-windows-modules.sh --max-concurrent-processes 3

      - name: Build and test crates
        shell: bash
        env:
          # On Windows, the checkout is on the D drive, which is very small.
          # Moving the target directory to the C drive ensures that the runner
          # doesn't run out of space on the D drive.
          CARGO_TARGET_DIR: "C:/cargo-target"
        run: ./ci/check-rust.sh