CI.yaml

on:
  push:
    branches-ignore:
      # dependabot branches will fail on push since they run with fork-level permissions despite being in the main repo.
      # said branches are tested anyhow when dependabot makes its PR and the pull_request triggers the run.
      - 'dependabot/**'
  pull_request:

name: CI
jobs:
  prepare:
    name: Prepare
    runs-on: ubuntu-22.04
    outputs:
      github_commit_desc: ${{ steps.get_commit_desc.outputs.github_commit_desc }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4.1.7
        with:
          fetch-depth: 0

      - name: Get head branch latest commit
        run: echo "GITHUB_PR_HEAD_SHA=$(git log --pretty=format:'%h' $GITHUB_SHA^2 -1)" >> $GITHUB_ENV

      - name: Get base branch latest commit
        run: echo "GITHUB_PR_BASE_SHA=$(git log --pretty=format:'%h' $GITHUB_SHA^1 -1)" >> $GITHUB_ENV

      - name: Get latest commit
        run: echo "GITHUB_HEAD_SHA=$(git log --pretty=format:'%h' -1)" >> $GITHUB_ENV
      
      # on a pull_request event in github actions, the tests are not run on the head branch of the PR, rather they are run on the merge commit of head merged into the base branch
      # this means the latest commit in github actions, which is used for build artifact names is a commit that does not exist in the repository
      # so on pull requests we create a user-friendly string to use in place of the merge commit sha, otherwise we just use the normal git HEAD sha.
      - id: get_commit_desc
        run: | 
          if [[ ${{ github.event_name }} == 'pull_request' ]]; then
            echo "github_commit_desc=merge-${{ env.GITHUB_PR_HEAD_SHA }}-into-${{ env.GITHUB_PR_BASE_SHA }}" >> $GITHUB_OUTPUT
          else
            echo "github_commit_desc=${{ env.GITHUB_HEAD_SHA }}" >> $GITHUB_OUTPUT
          fi

  flatpak:
    name: Flatpak
    runs-on: ubuntu-22.04
    env:
      FLATPAK_BUILD_PATH: flatpak_app/files/share
    needs: prepare
    container:
      image: bilelmoussaoui/flatpak-github-actions:gnome-46
      options: --privileged
    steps:
    - name: Checkout
      uses: actions/checkout@v4.1.7

    - name: Enable errors on warnings
      run: |
        dnf install -y jq
        # jq does not have an option to save edits in place so we should make a temporary file to edit this safely
        updated_manifest=$(mktemp)
        jq '.modules[0]."config-opts" += ["-Dwerror=true"]' util/flatpak/com.github.wwmm.easyeffects.Devel.json > "$updated_manifest"
        mv "$updated_manifest" util/flatpak/com.github.wwmm.easyeffects.Devel.json

    - uses: flatpak/flatpak-github-actions/flatpak-builder@v6.3
      with:
        bundle: easyeffects-flatpak-${{ needs.prepare.outputs.github_commit_desc }}.flatpak
        manifest-path: util/flatpak/com.github.wwmm.easyeffects.Devel.json
        cache-key: flatpak-builder-${{ github.sha }}
        run-tests: true
    
    # we also validate appstream in the appstream-news-validate job, 
    # but we still should specifically ensure the flatpak outputs it properly
    #- name: Validate AppStream
    #  shell: bash
    #  working-directory: ${{ env.FLATPAK_BUILD_PATH }}
      #run: |
      #  appstream-util validate-relax appdata/com.github.wwmm.easyeffects.Devel.appdata.xml
    
    # - name: Verify icon and metadata in app-info
    #   shell: bash
    #   working-directory: ${{ env.FLATPAK_BUILD_PATH }}
    #   run: |
    #     test -f app-info/icons/flatpak/128x128/com.github.wwmm.easyeffects.Devel.png || { echo "Missing 128x128 icon in app-info" ; exit 1; }
    #     test -f app-info/xmls/com.github.wwmm.easyeffects.Devel.xml.gz || { echo "Missing com.github.wwmm.easyeffects.Devel.xml.gz in app-info" ; exit 1; }

    # this just validates, actual update PRs are done in flatpak-update.yaml
    - name: Verify flatpak external data checker metadata
      uses: docker://ghcr.io/flathub/flatpak-external-data-checker:latest
      with:
        args: util/flatpak/com.github.wwmm.easyeffects.Devel.json

  arch-linux:
    name: Arch Linux
    runs-on: ubuntu-22.04
    needs: prepare
    steps:
    - name: Checkout
      uses: actions/checkout@v4.1.7
      with:
        # needed for getting git describe info for pkgver() in pkgbuild
        fetch-depth: 0

    - name: Save commit description to file
      # if this file is present, pkgver() in pkgbuild will use it to show a more user-friendly commit sha
      run: echo ${{ needs.prepare.outputs.github_commit_desc }} >> GITHUB_COMMIT_DESC

    - name: Makepkg Build and Check
      id: makepkg
      uses: edlanglois/pkgbuild-action@v1.1.8
      with:
        # namcap doesn't actually exclude this rule, resulting in unnecessary warnings, so just disable namcap since it's not critical
        # namcapExcludeRules: unusedsodepends
        namcapDisable: true

    - name: Upload Package Archive
      uses: actions/upload-artifact@v4.3.3
      with:
        name: easyeffects-archlinux-${{ needs.prepare.outputs.github_commit_desc }}-x86_64
        path: ${{ steps.makepkg.outputs.pkgfile0 }}
        if-no-files-found: error


  alpine-linux:
    name: Alpine Linux (stdc++)
    runs-on: ubuntu-22.04
    container:
      image: alpine

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4.1.7

    - name: Install deps
      run: |
        apk update
        apk upgrade

        # install general build deps
        apk add cmake extra-cmake-modules samurai clang clang-extra-tools build-base bash libc++-dev

        # inspired by https://git.alpinelinux.org/aports/plain/community/easyeffects/APKBUILD
        depends="lv2"
        makedepends="
        qt6-qtbase-dev
        qt6-qtcharts-dev
        kirigami-dev
        ki18n-dev
        kconfigwidgets-dev
        kconfig-dev
        kcoreaddons-dev
        appstream-glib-dev
        desktop-file-utils
        fftw-dev
        gsl-dev
        itstool
        libbs2b-dev
        libebur128-dev
        libsamplerate-dev
        libsigc++3-dev
        libsndfile-dev
        libtbb-dev
        lilv-dev
        lv2-dev
        nlohmann-json
        pipewire-dev
        pkgconf
        rnnoise-dev
        soundtouch-dev
        speexdsp-dev
        zita-convolver-dev
        ladspa-dev
        "

        # install easyeffects deps
        apk add $makedepends $depends

        # install libportal since we technically need it for a full check
        apk add libportal-dev

    - name: Build with Clang (libstdc++)
      run: |
        CC=clang CXX=clang++ CXXFLAGS=-stdlib=libstdc++ cmake -B build -S . -G Ninja -Wno-dev -DENABLE_LIBCPP_WORKAROUNDS=ON -DENABLE_LIBPORTAL=ON
        cmake --build build

  # For some reason a program compiled with libc++ does not link to a Qt built with libstdc++. The linking fails
  # because of undefined functions. So I moved the libc++ CI a a distribution that uses libc++ by default.
  # 
  # For some reason "actions/checkout@v4.1.7" did not work in the Chimera image. Failed with an error about the nodejs
  # binary not being found
  chimera-linux:
    name: Chimera Linux (libc++)
    runs-on: ubuntu-22.04
    container:
      image: chimeralinux/chimera

    steps:
    - name: Install deps
      run: |
        apk add chimera-repo-contrib
        apk update
        apk upgrade

        # install general build deps
        apk add git cmake extra-cmake-modules ninja clang clang-tools-extra base-devel bash libcxx-devel nodejs

        depends="lv2"
        makedepends="
        appstream
        appstream-glib-devel
        desktop-file-utils
        fftw-devel
        gettext
        itstool
        kirigami-devel
        ki18n-devel
        kconfigwidgets-devel
        kconfig-devel
        kcoreaddons-devel
        libbs2b-devel
        libebur128-devel
        libsamplerate-devel
        libsigc++-devel
        libsndfile-devel
        lilv-devel
        lv2
        nlohmann-json
        onetbb-devel
        pipewire-devel
        pkgconf
        qt6-qtbase-devel
        qt6-qtcharts-devel
        rnnoise-devel
        soundtouch-devel
        speexdsp-devel
        zita-convolver-devel
        ladspa-sdk
        "

        # install easyeffects deps
        apk add $makedepends $depends

        # install libportal since we technically need it for a full check
        apk add libportal-devel

    - name: Build with Clang (libc++)
      run: |
        git clone https://github.com/wwmm/easyeffects.git --depth=1 -b eeqt
        cd easyeffects
        CC=clang CXX=clang++ cmake -B build -S . -G Ninja -Wno-dev -DENABLE_LIBCPP_WORKAROUNDS=ON -DENABLE_LIBPORTAL=ON
        cmake --build build

  codeql-analyze:
    name: CodeQL Analyze
    runs-on: ubuntu-22.04
    permissions:
      security-events: write
    container:
      image: archlinux

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4.1.7

    - name: Install deps
      run: |
        # install general build deps
        pacman -Syu --noconfirm ninja gcc pkgconf python3 python-pip which
        # install easyeffects deps
        source ./PKGBUILD && pacman -Syu --noconfirm --needed --asdeps "${makedepends[@]}" "${depends[@]}"

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3.25.11
      with:
        languages: cpp 
        build-mode: manual
    
    - name: Building
      run: |
        cmake -B build -S . -G Ninja -Wno-dev
        cmake --build build

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3.25.11

  clang-tidy:
    name: Clang Tidy
    runs-on: ubuntu-22.04
    container:
      image: archlinux

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4.1.7

    - name: Install deps
      run: |
        # install general build deps
        pacman -Syu --noconfirm ninja gcc pkgconf python3 python-pip which
        # install easyeffects deps
        source ./PKGBUILD && pacman -Syu --noconfirm --needed --asdeps "${makedepends[@]}" "${depends[@]}"
        # install clang
        pacman -S --noconfirm --needed --asdeps clang
        # install libportal since we technically need it for a full check
        pacman -S --noconfirm --needed --asdeps libportal libportal-gtk4

    - name: Build with Clang
      # build with clang not because we strictly need to (we do need to do some kind of build so config.h shows up)
      # but because any clang compiler failures will cause clang-tidy to fail later on, so we might as well fail fast
      run: |
        CC=clang CXX=clang++ cmake -B build -S . -G Ninja -Wno-dev -DENABLE_LIBPORTAL=ON
        cmake --build build

    - name: Install ctcache
      run: |
        git clone https://github.com/matus-chochlik/ctcache
        cd ctcache
        git checkout bd1620a8609ddaf2f64500820abc8b4d150edeaf # v1.1.0
        ./install-user-client

    - name: Restore Clang Tidy cache
      uses: actions/cache/restore@v4.0.2
      with:
        # since the ctcache is just a list of checksums that were checked, we want to write to it every ci run to keep it up to date
        # otherwise github actions just restores some old cache if the key didn't change
        # the ctcache itself is what handles what misses or not
        # https://github.com/actions/cache/blob/ea0503788c59256f4da17725d04df850ca027df5/tips-and-workarounds.md#update-a-cache
        path: /tmp/ci-ctcache
        key: clang-tidy-ctcache-${{ github.run_id }}
        # this restores the most recently saved cache from the following 3 categories 
        # it first checks caches from the current branch/pull request, then the base branch of the pull request (if it exists), and then master (the default branch), as described here:
        # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#matching-a-cache-key
        # this also relies on github's fairly restricted isolation for caches:
        # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#restrictions-for-accessing-a-cache
        # note the most recently saved cache is not necessarily the one with the greatest run id, as a workflow run could have started before another but taken longer to complete
        restore-keys: |
          clang-tidy-ctcache-

    - name: Clang Tidy
      run: |
        cd build
        PATH=~/.local/bin:"$PATH" CTCACHE_DIR=/tmp/ci-ctcache ../util/clang-tidy.sh

    - name: Save Clang Tidy cache
      uses: actions/cache/save@v4.0.2
      # always run, except if the workflow was cancelled
      # this means clang tidy will get cached even if some checks are failing
      if: success() || failure()
      with:
        path: /tmp/ci-ctcache
        key: clang-tidy-ctcache-${{ github.run_id }}

  appstream-news-validate:
    name: AppStream and News validate
    runs-on: ubuntu-22.04
    container:
      image: archlinux
    steps:
      - name: Checkout code
        uses: actions/checkout@v4.1.7
      
      - name: Install deps
        run: pacman -Syu --noconfirm appstream appstream-glib libxslt which
        
      - name: Validate existing files
        run: ./util/update-release-files.sh --no-new-release