build.yml

name: CI
on: [push, pull_request]
permissions:
  contents: read
env:
  BUILD_NUMBER: ${{ github.run_number }}
  CMAKE_BUILD_PARALLEL_LEVEL: 4
  UBUNTU_DEPS: cmake libxml2-dev libxmlsec1-dev zlib1g-dev
jobs:
  macos:
    name: Build on macOS for ${{ matrix.target }}
    runs-on: macos-latest
    strategy:
      matrix:
        target: [macos, iphoneos, iphonesimulator, androidarm, androidarm64, androidx86_64]
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Install dependencies
      run: |
        brew update
        brew install --formula ninja swig doxygen boost
        brew unlink python@3.11 || true
        brew unlink python@3.12 || true
        brew unlink xz
    - name: Cache
      uses: actions/cache@v4
      id: cache
      with:
        path: cache
        key: ${{ matrix.target }}-${{ hashFiles('prepare_osx_build_environment.sh') }}
    - name: Build openssl
      if: steps.cache.outputs.cache-hit != 'true'
      run: ./prepare_osx_build_environment.sh openssl ${{ matrix.target }}
    - name: Build libxml2
      if: steps.cache.outputs.cache-hit != 'true'
      run: ./prepare_osx_build_environment.sh libxml2 ${{ matrix.target }}
    - name: Build xmlsec
      if: steps.cache.outputs.cache-hit != 'true'
      run: ./prepare_osx_build_environment.sh xmlsec ${{ matrix.target }}
    - name: Move to cache
      if: steps.cache.outputs.cache-hit != 'true'
      run: |
        mkdir cache
        sudo mv /Library/libdigidocpp* cache
    - name: Setup cache
      run: sudo ln -s $PWD/cache/* /Library/
    - name: Build macOS
      if: matrix.target == 'macos'
      run: |
        cmake --preset ${{ matrix.target }} -DCMAKE_BUILD_TYPE=RelWithDebInfo
        cmake --build --preset ${{ matrix.target }}
        cmake --build --preset ${{ matrix.target }} --target test pkcs11sign zipdebug embedlibs pkgbuild
    - name: Build ${{ matrix.target }}
      if: matrix.target != 'macos'
      run: |
        cmake --preset ${{ matrix.target }} -DCMAKE_BUILD_TYPE=RelWithDebInfo
        cmake --build --preset ${{ matrix.target }}
        sudo cmake --build --preset ${{ matrix.target }} --target install/strip
        cd /Library
        zip -q -r ${OLDPWD}/libdigidocpp.${{ matrix.target }}.zip libdigidocpp.*
    - name: Archive artifacts
      if: matrix.target == 'macos'
      uses: actions/upload-artifact@v4
      with:
        name: macOS
        path: build/macos/libdigidocpp*.*
    - name: Archive artifacts
      if: matrix.target != 'macos'
      uses: actions/upload-artifact@v4
      with:
        name: ${{ matrix.target }}
        path: libdigidocpp*.zip
  fedora:
    name: Build on Fedora ${{ matrix.container }}
    runs-on: ubuntu-latest
    container: fedora:${{ matrix.container }}
    strategy:
      matrix:
        container: [39, 40]
    steps:
    - name: Install Deps
      run: |
        dnf install -y --setopt=install_weak_deps=False \
          git gcc-c++ cmake rpm-build libxml2-devel xmlsec1-openssl-devel libtool-ltdl-devel zlib-devel doxygen boost-test swig python3-devel java-17-openjdk-devel minizip-devel
    - name: Install CMake
      if: matrix.container == 39
      run: |
        dnf install -y --setopt=install_weak_deps=False wget
        wget -q https://github.com/Kitware/CMake/releases/download/v3.28.1/cmake-3.28.1-linux-x86_64.sh
        sh cmake-3.28.1-linux-x86_64.sh --skip-license --prefix=/usr/local
    - name: Checkout
      uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Build
      run: |
        cmake -DCMAKE_INSTALL_SYSCONFDIR=/etc -B build -S .
        cmake --build build
        cmake --build build --target package
    - name: Archive artifacts
      uses: actions/upload-artifact@v4
      with:
        name: fedora_${{ matrix.container }}
        path: build/libdigidocpp*.rpm
  ubuntu:
    name: Build on Ubuntu ${{ matrix.container }}
    runs-on: ubuntu-latest
    container: ubuntu:${{ matrix.container }}
    strategy:
      matrix:
        container: ['20.04', '22.04', '24.04']
    env:
      DEBIAN_FRONTEND: noninteractive
      DEBFULLNAME: github-actions
      DEBEMAIL: github-actions@github.com
    steps:
    - name: Install dependencies
      run: apt update -qq && apt install --no-install-recommends -y git lsb-release build-essential devscripts debhelper lintian pkg-config ${UBUNTU_DEPS} doxygen swig openjdk-11-jdk-headless libpython3-dev python3-setuptools libboost-test-dev
    - name: Checkout
      uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Setup changelog
      run: |
        export VERSION=$(grep project CMakeLists.txt | egrep -o "([0-9]{1,}\.)+[0-9]{1,}")
        export VERSIONEX=${VERSION}.${BUILD_NUMBER}.$(lsb_release -rs)
        dch --distribution $(lsb_release -cs) -v ${VERSIONEX} "Release ${VERSIONEX}."
    - name: Build packages
      run: |
        dpkg-buildpackage -us -uc
        mv ../libdigidocpp*.* .
    - name: Lintian
      run: lintian *.deb;
    - name: Archive artifacts
      uses: actions/upload-artifact@v4
      with:
        name: ubuntu_${{ matrix.container }}
        path: libdigidocpp*.*
  windows:
    name: Build on Windows
    runs-on: ${{ matrix.image }}
    strategy:
      matrix:
        toolset: [143, 142]
        platform: [x86, x64]
        include:
        - toolset: 143
          image: windows-2022
          vcvars: "C:\\Program Files\\Microsoft Visual Studio\\2022\\Enterprise\\VC\\Auxiliary\\Build\\vcvarsall.bat"
        - toolset: 142
          image: windows-2019
          vcvars: "C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Enterprise\\VC\\Auxiliary\\Build\\vcvarsall.bat"
    env:
      VER_SUFFIX: .VS${{ matrix.toolset }}
      CXXFLAGS: '/D_DISABLE_CONSTEXPR_MUTEX_CONSTRUCTOR' # https://github.com/actions/runner-images/issues/10004
      VCPKG_INSTALLED_DIR: ${{ github.workspace }}/vcpkg_installed
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Prepare vcpkg
      uses: lukka/run-vcpkg@v11
      with:
        vcpkgGitCommitId: 0f8b6ddf49fa8ae66a7826234e9ba3fda5f46d3c
        vcpkgJsonGlob: ./vcpkg.json
        runVcpkgInstall: true
        runVcpkgFormatString: "[`install`, `--recurse`, `--clean-after-build`, `--x-install-root`, `$[env.VCPKG_INSTALLED_DIR]`, `--triplet`, `$[env.VCPKG_DEFAULT_TRIPLET]`, `--x-feature`, `tests`]"
      env:
        VCPKG_DEFAULT_TRIPLET: ${{ matrix.platform }}-windows
    - name: Install dependencies
      run: choco install doxygen.install -y > $null
    - uses: actions/setup-python@v5
      if: matrix.platform == 'x86'
      with:
        python-version: 3.12
        architecture: x86
    - name: Install WiX
      run: |
        dotnet tool install -g wix --version 5.0.1
        wix extension -g add WixToolset.UI.wixext/5.0.1
    - name: Build
      run: |
        & .\build.ps1 `
          -vcpkg_installed ${{ env.VCPKG_INSTALLED_DIR }} `
          -vcvars "${{ matrix.vcvars }}" `
          -platform ${{ matrix.platform }} `
          -swig C:/ProgramData/chocolatey/bin/swig.exe `
          -doxygen "C:/Program files/doxygen/bin/doxygen.exe" `
          -boost
    - name: Archive artifacts
      uses: actions/upload-artifact@v4
      with:
        name: msi_${{ matrix.toolset }}_${{ matrix.platform }}
        path: ./*.msi
  pages:
    name: Deploy pages
    if: github.repository == 'open-eid/libdigidocpp' && contains(github.ref, 'master')
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Install dependencies
      run: sudo apt update -qq && sudo apt install --no-install-recommends -y doxygen ${UBUNTU_DEPS}
    - name: Build docs
      run: |
        cmake -B build -S .
        cmake --build build --target docs
    - name: Deploy
      uses: peaceiris/actions-gh-pages@v4
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        publish_dir: ./build/doc
        force_orphan: true
  coverity:
    name: Run Coverity tests
    if: github.repository == 'open-eid/libdigidocpp' && contains(github.ref, 'coverity_scan')
    runs-on: ubuntu-22.04
    env:
      TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
      PROJECTNAME: ${{ github.repository }}
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Install dependencies
      run: sudo apt update -qq && sudo apt install --no-install-recommends -y curl ca-certificates ${UBUNTU_DEPS}
    - name: Download Coverity Build Tool
      run: |
        curl --silent --data "token=$TOKEN&project=$PROJECTNAME" -o cov-analysis-linux64.tar.gz https://scan.coverity.com/download/cxx/linux64
        mkdir cov-analysis-linux64
        tar xzf cov-analysis-linux64.tar.gz --strip 1 -C cov-analysis-linux64
    - name: Build
      run: |
        cmake .
        export PATH=$PWD/cov-analysis-linux64/bin:$PATH
        cov-build --dir cov-int cmake --build .
    - name: Submit the result to Coverity Scan
      run: |
        tar czvf upload.tgz cov-int
        curl --silent \
          --form project=$PROJECTNAME \
          --form token=$TOKEN \
          --form email=eid-teenusehaldus@ria.ee \
          --form file=@upload.tgz \
          --form version=master \
          --form description="Github Actions CI build" \
          https://scan.coverity.com/builds?project=$PROJECTNAME
  codeql:
    name: Run CodeQL tests
    if: github.repository == 'open-eid/libdigidocpp'
    runs-on: ubuntu-22.04
    permissions:
      security-events: write
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Install dependencies
      run: sudo apt update -qq && sudo apt install --no-install-recommends -y ${UBUNTU_DEPS}
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: cpp
        queries: +security-and-quality
    - name: Build
      run: |
        cmake -B build -S . \
          -DCMAKE_DISABLE_FIND_PACKAGE_SWIG=YES \
          -DCMAKE_DISABLE_FIND_PACKAGE_Boost=YES \
          -DCMAKE_DISABLE_FIND_PACKAGE_Doxygen=YES \
          -DBUILD_TOOLS=NO
        cmake --build build
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        upload: False
        output: sarif-results
    - name: Filter results
      uses: advanced-security/filter-sarif@develop
      with:
        patterns: |
          -src/json.hpp
          -src/minizip/*
          -**:cpp/poorly-documented-function
          -**:cpp/loop-variable-changed
        input: sarif-results/cpp.sarif
        output: sarif-results/cpp.sarif
    - name: Upload results
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: sarif-results/cpp.sarif