ci-linux.yml

name: CI Linux

on:
  push:
    branches:
      - master
    paths:
      - 'CMakeLists.txt'
      - 'include/sys/*'
      - 'src/common/*'
      - 'src/linux/*'
      - 'test/*'
      - 'tools/test-stack-dump.sh'
      - '.github/workflows/ci-linux.yml'
  pull_request:
    branches:
      - master
    paths:
      - 'CMakeLists.txt'
      - 'include/sys/*'
      - 'src/common/*'
      - 'src/linux/*'
      - 'test/*'
      - 'tools/test-stack-dump.sh'
      - '.github/workflows/ci-linux.yml'
  schedule:
    # Daily soak run: 50 iterations to surface flakes that a single
    # iteration won't catch.
    - cron: '0 6 * * *'
  workflow_dispatch:
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true


env:
  ASAN_OPTIONS: symbolize=1 detect_leaks=1 detect_stack_use_after_return=1
  LSAN_OPTIONS: fast_unwind_on_malloc=0:malloc_context_size=50
  M_PERTURB: "0x42"

jobs:
  linux-build-and-test:
    timeout-minutes: ${{ github.event_name == 'schedule' && 60 || 10 }}
    strategy:
      fail-fast: false
      matrix:
          env:
            - { CC: gcc,      OS: ubuntu-24.04, NAME: release-gcc,               BUILD_TYPE: Release    }
            - { CC: clang,    OS: ubuntu-24.04, NAME: release-clang,             BUILD_TYPE: Release    }
            - { CC: musl-gcc, OS: ubuntu-24.04, NAME: release-musl-gcc,          BUILD_TYPE: Release    }
            - { CC: clang,    OS: ubuntu-24.04, NAME: debug-asan,                BUILD_TYPE: Debug,    ENABLE_ASAN: YES,   ENABLE_LSAN: YES,   ENABLE_UBSAN: YES }
            - { CC: clang,    OS: ubuntu-24.04, NAME: debug-tsan,                BUILD_TYPE: Debug,    ENABLE_TSAN: YES }

    runs-on: ${{ matrix.env.OS }}

    env: ${{ matrix.env }}

    name: "${{ matrix.env.NAME }}"

    steps:
    - uses: actions/checkout@v5

    - name: Set environment
      run: |
        echo 'Acquire::http::Timeout "5"; Acquire::Retries "2";' | \
            sudo tee /etc/apt/apt.conf.d/99-ci-timeouts >/dev/null
        . /etc/lsb-release
        sudo tee /etc/apt/sources.list.d/ubuntu-canonical.sources >/dev/null <<EOF
        Types: deb
        URIs: http://archive.ubuntu.com/ubuntu http://us.archive.ubuntu.com/ubuntu http://mirrors.edge.kernel.org/ubuntu
        Suites: ${DISTRIB_CODENAME} ${DISTRIB_CODENAME}-updates ${DISTRIB_CODENAME}-security
        Components: main restricted universe multiverse
        Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
        EOF
        sudo apt-get update -qq
        sudo apt-get install -y --no-install-recommends curl gpg lsb-release
        MYREL="`lsb_release -c | grep ^Codename | awk '{print $2}'`"
        echo "CLANG_VER=20" >> ${GITHUB_ENV}
        echo "GCC_VER=14" >> ${GITHUB_ENV}
        echo "MYREL=${MYREL}" >> ${GITHUB_ENV}

    # Cache the apt signing keyrings.  Cache key is the
    # fingerprint list, so a key rotation drops the cache
    # naturally.  apt-key files are immutable in practice.
    - name: Cache LLVM signing key
      if: ${{ matrix.env.CC == 'clang' }}
      uses: actions/cache@v4
      id: cache-llvm-key
      with:
        path: llvm-snapshot.gpg
        key: apt-key-llvm-snapshot-v1

    - name: Fetch LLVM signing key
      if: ${{ matrix.env.CC == 'clang' && steps.cache-llvm-key.outputs.cache-hit != 'true' }}
      run: |
        curl --retry 5 --retry-all-errors -fsSL \
          https://apt.llvm.org/llvm-snapshot.gpg.key \
          | gpg --dearmor -o llvm-snapshot.gpg

    - name: Add llvm source
      if: ${{ matrix.env.CC == 'clang' }}
      run: |
        sudo install -dm 0755 /etc/apt/keyrings
        sudo cp llvm-snapshot.gpg /etc/apt/keyrings/llvm-snapshot.gpg
        echo "deb [signed-by=/etc/apt/keyrings/llvm-snapshot.gpg] http://apt.llvm.org/${{ env.MYREL }}/ llvm-toolchain-${{ env.MYREL }}-${{ env.CLANG_VER }} main" \
          | sudo tee /etc/apt/sources.list.d/llvm-toolchain.list
        sudo apt-get update

    - name: Install LLVM ${{ env.CLANG_VER }}
      if: ${{ matrix.env.CC == 'clang' }}
      run: |
        sudo apt-get install -y --no-install-recommends clang-${{ env.CLANG_VER }} llvm-${{ env.CLANG_VER }} gdb libclang-rt-${{ env.CLANG_VER }}-dev
        sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${{ env.CLANG_VER }} 60 && sudo update-alternatives --set clang /usr/bin/clang-${{ env.CLANG_VER }}
        sudo update-alternatives --install /usr/bin/llvm-symbolizer llvm-symbolizer /usr/bin/llvm-symbolizer-${{ env.CLANG_VER }} 60 && sudo update-alternatives --set llvm-symbolizer /usr/bin/llvm-symbolizer-${{ env.CLANG_VER }}

    - name: Cache GCC PPA signing keys
      if: ${{ matrix.env.CC == 'gcc' }}
      uses: actions/cache@v4
      id: cache-gcc-keys
      with:
        path: ubuntu-toolchain-r-test.gpg
        # Bump the v<n> suffix when the PPA's key list changes.
        key: apt-key-ubuntu-toolchain-r-test-1E9377A2BA9EF27F-2C277A0A352154E5-v1

    - name: Fetch GCC PPA signing keys
      if: ${{ matrix.env.CC == 'gcc' && steps.cache-gcc-keys.outputs.cache-hit != 'true' }}
      run: |
        TMP=$(mktemp -d)
        for k in 1E9377A2BA9EF27F 2C277A0A352154E5; do
          curl --retry 5 --retry-all-errors -fsSL \
            "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${k}" \
            | gpg --dearmor -o "${TMP}/${k}.gpg"
        done
        cat "${TMP}"/*.gpg > ubuntu-toolchain-r-test.gpg
        rm -rf "${TMP}"

    - name: Add GCC source
      if: ${{ matrix.env.CC == 'gcc' }}
      run: |
        sudo install -dm 0755 /etc/apt/keyrings
        sudo cp ubuntu-toolchain-r-test.gpg /etc/apt/keyrings/
        echo "deb [signed-by=/etc/apt/keyrings/ubuntu-toolchain-r-test.gpg] https://ppa.launchpadcontent.net/ubuntu-toolchain-r/test/ubuntu ${{ env.MYREL }} main" \
          | sudo tee /etc/apt/sources.list.d/ubuntu-toolchain-r-test.list
        sudo apt-get update

    - name: Install GCC ${{ env.GCC_VER }}
      if: ${{ matrix.env.CC == 'gcc' }}
      run: |
        sudo apt-get install -y --no-install-recommends gcc-${{ env.GCC_VER }} gccgo-${{ env.GCC_VER }} gdb
        sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-${{ env.GCC_VER }} 9999 && sudo update-alternatives --config gcc

    - name: Install MUSL
      if: ${{ matrix.env.CC == 'musl-gcc' }}
      run: |
        sudo apt-get install -y --no-install-recommends musl musl-dev musl-tools

    - name: Install other build deps
      run: |
        sudo apt-get install -y \
          build-essential \
          debhelper \
          devscripts \
          dh-make \
          fakeroot

    - name: Configure build system
      run: |
        cmake . -G "Unix Makefiles" \
          -DCMAKE_INSTALL_PREFIX="/usr" \
          -DCMAKE_INSTALL_LIBDIR="lib"  \
          -DCMAKE_VERBOSE_MAKEFILE:BOOL="ON" \
          -DENABLE_TESTING="YES" \
          -DENABLE_ASAN="${ENABLE_ASAN:-NO}" \
          -DENABLE_LSAN="${ENABLE_LSAN:-NO}" \
          -DENABLE_UBSAN="${ENABLE_UBSAN:-NO}" \
          -DENABLE_TSAN="${ENABLE_TSAN:-NO}" \
          -DCMAKE_BUILD_TYPE="${BUILD_TYPE}"
        cat config.h

    - name: Build libkqueue
      run: make -j2

    - name: Gated tests
      if: always()
      run: |
        GATED=$(test/libkqueue-test --list-gated=linux 2>/dev/null) || true
        {
          printf '## Gated on linux\n'
          printf '| Suite | Test | Reason |\n| --- | --- | --- |\n'
          if [ -n "$GATED" ]; then
            printf '%s\n' "$GATED" | awk -F'\t' '{gsub(/\|/,"&#124;",$3); print "| "$1" | "$2" | "$3" |"}'
          else
            printf '_none_\n'
          fi
        } >> "$GITHUB_STEP_SUMMARY"

    - name: Install watchdog debug tools
      continue-on-error: true
      run: |
        sudo apt-get install -y elfutils gdb >/dev/null

    - name: Run tests
      # KQUEUE_DEBUG is compiled out of Release builds (NDEBUG path),
      # so setting the env var on Release is dead weight - the
      # library doesn't read it.  Set it only on Debug variants
      # where the debug printf paths are actually live.
      env:
        KQUEUE_DEBUG: ${{ matrix.env.BUILD_TYPE == 'Release' && '' || '1' }}
        TSAN_OPTIONS: suppressions=${{ github.workspace }}/tools/tsan.supp
      run: |
        test/libkqueue-test \
          --watchdog-timeout=120 \
          --watchdog-cmd="${{ github.workspace }}/tools/test-stack-dump.sh" \
          -n ${{ github.event_name == 'schedule' && 50 || 1 }}

    - name: Build debian packages
      run: cpack -G DEB

    - name: Install debian packages
      run: sudo apt-get install -y ./*.deb