ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

jobs:
  clang-tidy:
    name: C static analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: |
          clang-tidy priv/c_src/lexbor_bridge.c \
            -checks='-*,clang-analyzer-*,bugprone-*,portability-*,-bugprone-easily-swappable-parameters' \
            -warnings-as-errors='*' \
            -- -std=c99 -DLEXBOR_STATIC \
            -Ipriv/c_src -Ipriv/c_src/lexbor/ports/posix

  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        otp: ['27.0']
        elixir: ['1.18']
    env:
      MIX_ENV: test
      QUICKBEAM_BUILD: "1"
    steps:
      - uses: actions/checkout@v4

      - uses: erlef/setup-beam@v1
        with:
          otp-version: ${{ matrix.otp }}
          elixir-version: ${{ matrix.elixir }}

      - uses: goto-bus-stop/setup-zig@v2
        with:
          version: 0.15.2

      - name: Cache deps
        uses: actions/cache@v4
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-mix-${{ matrix.otp }}-${{ matrix.elixir }}-${{ hashFiles('mix.lock') }}-${{ hashFiles('lib/quickbeam/*.zig') }}
          restore-keys: ${{ runner.os }}-mix-${{ matrix.otp }}-${{ matrix.elixir }}-

      - name: Install zlint
        run: curl -fsSL https://raw.githubusercontent.com/DonIsaac/zlint/refs/heads/main/tasks/install.sh | bash

      - run: mix deps.get
      - run: mix npm.get
      - run: npm install
      - run: mix ci

  ubsan:
    name: UBSan + Zig Debug
    runs-on: ubuntu-latest
    env:
      MIX_ENV: test
      QUICKBEAM_BUILD: "1"
      QUICKBEAM_UBSAN: "1"
      ZIGLER_RELEASE_MODE: debug
    steps:
      - uses: actions/checkout@v4

      - uses: erlef/setup-beam@v1
        with:
          otp-version: '27.0'
          elixir-version: '1.18'

      - uses: goto-bus-stop/setup-zig@v2
        with:
          version: 0.15.2

      - name: Cache deps
        uses: actions/cache@v4
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-ubsan-27.0-1.18-${{ hashFiles('mix.lock') }}-${{ hashFiles('lib/quickbeam/*.zig') }}
          restore-keys: ${{ runner.os }}-ubsan-27.0-1.18-

      - run: mix deps.get
      - run: mix npm.get
      - run: mix compile
      - run: mix test --no-start --exclude napi_addon --exclude napi_sqlite

  asan:
    name: AddressSanitizer
    runs-on: ubuntu-latest
    env:
      MIX_ENV: test
      QUICKBEAM_BUILD: "1"
      OTP_VERSION: "27.0"
      ELIXIR_VERSION: "1.18.3"
    steps:
      - uses: actions/checkout@v4

      - uses: goto-bus-stop/setup-zig@v2
        with:
          version: 0.15.2

      - name: Cache OTP ASAN build
        id: otp-cache
        uses: actions/cache@v4
        with:
          path: /tmp/otp-asan
          key: otp-asan-${{ env.OTP_VERSION }}-v4

      - name: Build OTP with ASAN emulator
        if: steps.otp-cache.outputs.cache-hit != 'true'
        run: |
          sudo apt-get update
          sudo apt-get install -y autoconf libncurses-dev libssl-dev

          cd /tmp
          curl -fSL "https://github.com/erlang/otp/releases/download/OTP-${OTP_VERSION}/otp_src_${OTP_VERSION}.tar.gz" | tar xz
          cd otp_src_${OTP_VERSION}
          export ERL_TOP=$(pwd)

          ./configure --prefix=/tmp/otp-asan --disable-jit \
            --without-javac --without-wx --without-odbc \
            --without-debugger --without-observer --without-et
          make -j$(nproc)
          make install

          # Build ASAN emulator on top of the standard build
          make -j$(nproc) -C erts/emulator asan
          make -j$(nproc) -C erts/lib_src asan

          # Install ASAN beam binary alongside the standard one
          ERTS_DIR=$(ls -d /tmp/otp-asan/lib/erlang/erts-*)
          find . -name 'beam.asan.smp' -exec cp {} ${ERTS_DIR}/bin/ \;
          find . -name 'erl_child_setup.asan' -exec cp {} ${ERTS_DIR}/bin/ \; 2>/dev/null || true
          ls -la ${ERTS_DIR}/bin/beam.asan.smp

      - name: Cache Elixir build
        id: elixir-cache
        uses: actions/cache@v4
        with:
          path: /tmp/elixir
          key: elixir-asan-${{ env.ELIXIR_VERSION }}-${{ env.OTP_VERSION }}-v1

      - name: Build Elixir
        if: steps.elixir-cache.outputs.cache-hit != 'true'
        run: |
          export PATH="/tmp/otp-asan/bin:$PATH"
          curl -fSL "https://github.com/elixir-lang/elixir/archive/refs/tags/v${ELIXIR_VERSION}.tar.gz" | tar xz -C /tmp
          cd /tmp/elixir-${ELIXIR_VERSION}
          make -j$(nproc)
          make install PREFIX=/tmp/elixir

      - name: Set PATH
        run: |
          echo "/tmp/elixir/bin" >> $GITHUB_PATH
          echo "/tmp/otp-asan/bin" >> $GITHUB_PATH

      - name: Verify ASAN emulator
        run: |
          erl -emu_type asan -noshell -eval 'io:format("ASAN emulator OK~n"), halt().'

      - name: Install Hex and Rebar
        run: |
          mix local.hex --force
          mix local.rebar --force

      - name: Cache deps
        uses: actions/cache@v4
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-asan-${{ env.OTP_VERSION }}-${{ env.ELIXIR_VERSION }}-${{ hashFiles('mix.lock') }}-${{ hashFiles('lib/quickbeam/*.zig') }}
          restore-keys: ${{ runner.os }}-asan-${{ env.OTP_VERSION }}-${{ env.ELIXIR_VERSION }}-

      - run: mix deps.get
      - run: mix compile

      - name: Run tests under ASAN
        run: |
          mkdir -p /tmp/asan_logs
          export ASAN_OPTIONS="log_path=/tmp/asan_logs/asan:halt_on_error=0:detect_leaks=0"
          export ERL_AFLAGS="-emu_type asan"
          mix test --no-start || true

      - name: Report ASAN results
        if: always()
        run: |
          if ls /tmp/asan_logs/asan.* 1>/dev/null 2>&1; then
            echo "## ASAN Issues Found" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            for f in /tmp/asan_logs/asan.*; do
              head -20 "$f"
              echo "---"
            done | head -200 >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
          else
            echo "## No ASAN issues detected ✅" >> $GITHUB_STEP_SUMMARY
          fi

      - name: Upload ASAN logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: asan-logs
          path: /tmp/asan_logs/
          if-no-files-found: ignore