ci.yml

name: CI

on:
  push:
    branches-ignore:
      - 'main'
      - 'docs'

env:
  BUILDER_VERSION: v0.9.73
  BUILDER_SOURCE: releases
  BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net
  PACKAGE_NAME: aws-crt-cpp
  LINUX_BASE_IMAGE: ubuntu-18-x64
  RUN: ${{ github.run_id }}-${{ github.run_number }}
  CRT_CI_ROLE: ${{ secrets.CRT_CI_ROLE_ARN }}
  AWS_DEFAULT_REGION: us-east-1

permissions:
  id-token: write # This is required for requesting the JWT

# cancel in-progress builds after a new commit
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  linux-compat-use-openssl:
    runs-on: ubuntu-24.04 # latest
    strategy:
      matrix:
        image:
          - fedora-34-x64
          - opensuse-leap
          - rhel8-x64
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Install qemu/docker
      run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ matrix.image }} build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DUSE_OPENSSL=ON

  # These linux-compat images need to run without -DUSE_OPENSSL because they do not have OpenSSL packages
  # that are up-to-date (AL2) or don't provide OpenSSL development packages that is found in CMake (alpine)
  # or are not able to connect on the socket even with the correct setup (manylinux2014)
  linux-compat:
    runs-on: ubuntu-24.04 # latest
    strategy:
      fail-fast: false
      matrix:
        image:
          - manylinux2014-x64
          - manylinux2014-x86
          - al2-x64
          - alpine-3.16-x64
          - alpine-3.16-x86
          - alpine-3.16-armv6
          - alpine-3.16-armv7
          - alpine-3.16-arm64
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Install qemu/docker
      run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ matrix.image }} build -p ${{ env.PACKAGE_NAME }}

  linux-compiler-compat:
    runs-on: ubuntu-24.04 # latest
    strategy:
      matrix:
        compiler:
          - clang-3
          - clang-6
          - clang-8
          - clang-9
          - clang-10
          - clang-11
          - clang-12
          - clang-15
          - clang-17
          - gcc-4.8
          - gcc-5
          - gcc-6
          - gcc-7
          - gcc-8
          - gcc-9
          - gcc-10
          - gcc-11
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --compiler=${{ matrix.compiler }} --cmake-extra=-DUSE_OPENSSL=ON

  raspberry:
    runs-on: ubuntu-24.04 # latest
    strategy:
      fail-fast: false
      matrix:
        image:
          - raspbian-bullseye
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # set arm arch
    - name: Install qemu/docker
      run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes

    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ matrix.image }} build -p ${{ env.PACKAGE_NAME }}

  std-compat:
    runs-on: ubuntu-24.04 # latest
    strategy:
      matrix:
        compiler: [gcc-8, clang-9]
        std: [c++11, c++14, c++17, c++2a]
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }} with ${{ matrix.std }}
      run: |
        export CXXFLAGS=-std=${{ matrix.std }}
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --compiler=${{ matrix.compiler }} --cmake-extra=-DUSE_OPENSSL=ON

  byo-crypto:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DBYO_CRYPTO=ON --cmake-extra=-DUSE_OPENSSL=ON

  linux-shared-libs:
    runs-on: ubuntu-24.04 # latest
    strategy:
      matrix:
        compiler: [gcc-4.8, gcc-11] # oldest, latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --compiler=${{ matrix.compiler }} --cmake-extra=-DBUILD_SHARED_LIBS=ON

  linux-glibcxx-ancient-abi:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --compiler=gcc-11 --cmake-extra=-DBUILD_SHARED_LIBS=ON --cmake-extra=-DCMAKE_CXX_FLAGS=-D_GLIBCXX_USE_CXX11_ABI=0

  linux-openssl-static:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --variant=openssl --cmake-extra=-DUSE_OPENSSL=ON

  linux-openssl-shared:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --variant=openssl --cmake-extra=-DUSE_OPENSSL=ON --cmake-extra=-DBUILD_SHARED_LIBS=ON

  linux-no-cpu-extensions:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DUSE_CPU_EXTENSIONS=OFF --cmake-extra=-DUSE_OPENSSL=ON

  windows:
    runs-on: windows-2022 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        md D:\a\work
        cd D:\a\work
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }}

  windows-vs14:
    runs-on: windows-2019 # windows-2019 is last env with Visual Studio 2015 (v14.0)
    strategy:
      matrix:
        arch: [x86, x64]
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        md D:\a\work
        cd D:\a\work
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} --compiler msvc-14 --target windows-${{ matrix.arch }}

  windows-shared-libs:
    runs-on: windows-2022 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        md D:\a\work
        cd D:\a\work
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DBUILD_SHARED_LIBS=ON

  # Ensure users can link with /DELAYLOAD:aws-crt-cpp.dll
  # We test by building everything using those linker flags.
  # This will cause linker errors in the tests if an API is built wrong (assuming the API is tested).
  # Usually the problem is extern global variables, and the fix is offering getter functions instead.
  windows-delayload-dll:
    runs-on: windows-2022 # latest
    env:
      LDFLAGS: /DELAYLOAD:aws-crt-cpp.dll
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        md D:\a\work
        cd D:\a\work
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DBUILD_SHARED_LIBS=ON

  windows-no-cpu-extensions:
    runs-on: windows-2022 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        md D:\a\work
        cd D:\a\work
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DUSE_CPU_EXTENSIONS=OFF

  macos:
    runs-on: macos-14 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')"
        chmod a+x builder
        ./builder build -p ${{ env.PACKAGE_NAME }} --spec=downstream

  macos-x64:
    runs-on: macos-14-large # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')"
        chmod a+x builder
        ./builder build -p ${{ env.PACKAGE_NAME }} --spec=downstream

  # cross-compile for iOS
  # Skip signing the code on iOS.
  # Otherwise it will not compile with error that Bundle identifier is missing.
  ios-cross-compile:
    runs-on: macos-14 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')"
        chmod a+x builder
        ./builder build -p ${{ env.PACKAGE_NAME }} --target=ios-arm64 --cmake-extra=-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGNING_ALLOWED=NO

  cross_compile:
    name: Cross Compile ${{matrix.arch}}
    runs-on: ubuntu-24.04 # latest
    strategy:
      matrix:
        arch: [linux-armv6, linux-armv7, linux-arm64, android-armv7]

    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')"
        chmod a+x builder
        ./builder build -p aws-crt-cpp --spec=downstream --target=${{matrix.arch}} run_tests=false

  # check that docs can still build
  check-docs:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - uses: actions/checkout@v4
      with:
        submodules: true
    - name: Check docs
      run: |
        sudo apt-get install -y doxygen
        ./make-docs.py

  check-submodules:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Checkout Source
      uses: actions/checkout@v4
      with:
        submodules: true
        fetch-depth: 0
    - name: Check Submodules
      # note: using "@main" because "@${{env.BUILDER_VERSION}}" doesn't work
      # https://github.com/actions/runner/issues/480
      uses: awslabs/aws-crt-builder/.github/actions/check-submodules@main

  clang-sanitizers:
    runs-on: ubuntu-24.04 # latest
    strategy:
      matrix:
        sanitizers: ["thread", "address,undefined"]
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --compiler=clang-12 --cmake-extra=-DENABLE_SANITIZERS=ON --cmake-extra=-DSANITIZERS="${{ matrix.sanitizers }}"