# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2025 ai-ad4 and the FreePDFEditor contributors
#
# Build matrix (§13.3, §14 step 1): Linux/macOS/Windows × Debug/Release/ASan.
# Runs the gate matrix that exists at the current milestone on every push and
# pull request. The release / packaging pipeline is in release.yml, triggered
# by tags, and runs on ephemeral runners isolated from PR builds.

name: build

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: ${{ matrix.os }} / ${{ matrix.preset }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: linux,   runner: ubuntu-latest,  preset: debug }
          - { os: linux,   runner: ubuntu-latest,  preset: default }
          - { os: linux,   runner: ubuntu-latest,  preset: asan }
          - { os: linux,   runner: ubuntu-latest,  preset: tsan }
          - { os: linux,   runner: ubuntu-latest,  preset: ci-release }
          - { os: macos,   runner: macos-latest,   preset: debug }
          - { os: macos,   runner: macos-latest,   preset: default }
          - { os: windows, runner: windows-latest, preset: debug }
          - { os: windows, runner: windows-latest, preset: default }

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Set up vcpkg
        uses: lukka/run-vcpkg@v11
        with:
          vcpkgGitCommitId: c4467224f8a384b7d52cb7d5e8abfb3f3f463f17

      - name: Configure
        run: cmake --preset ${{ matrix.preset }}

      - name: Build
        run: cmake --build --preset ${{ matrix.preset }}

      - name: Test
        run: ctest --preset default
        working-directory: build/${{ matrix.preset }}

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-${{ matrix.os }}-${{ matrix.preset }}
          path: build/${{ matrix.preset }}/Testing/Temporary/LastTest.log
          if-no-files-found: ignore

  # The gate matrix is a single job that aggregates the gates that exist at the
  # current milestone. M0 gates: round-trip contract test, REUSE lint, license
  # scan. New gates attach here as their layers land (§8.2).
  gates:
    name: gate matrix
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: REUSE lint
        run: |
          pip install reuse
          reuse lint

      - name: License scan (scancode)
        run: |
          pip install scancode-toolkit
          # Fail on any GPL-3-incompatible *linked* dependency. The vcpkg
          # manifest is the source of truth; test-only tools (Ghostscript,
          # veraPDF) are allowlisted in ci/allowlist-licenses.txt.
          scancode --license --only-findings --json scancode.json \
            --license-diagnoses ci/scancode-license-rules.yml . || true
          python3 ci/check-licenses.py scancode.json ci/allowlist-licenses.txt

      - name: gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEACTIONS_ENABLE_COMMENTS: 'false'