.github/workflows/build-and-test.yml

name: LibJWT Build, Unit Tests, and Coverage

on:
  workflow_dispatch:
  push:
    branches: [ "master" ]
    paths-ignore:
      - "doxygen/**"
      - ".github/**"
      - "images/**"
      - ".gitignore"
      - "*.md"
  pull_request:
    branches: [ "master" ]
    paths-ignore:
      - "doxygen/**"
      - ".github/**"
      - "images/**"
      - ".gitignore"
      - "*.md"

permissions:
  contents: read

jobs:
  build-macos:
    runs-on: macos-latest
    steps:
    - uses: actions/checkout@v4
    - uses: ConorMacBride/install-package@v1
      with:
        brew: gnutls openssl@3 jansson pkgconf cmake check curl bats-core jq

    - name: Build and Test
      uses: threeal/cmake-action@v2.1.0
      with:
        options:
          WITH_LIBCURL=YES
        build-args: |
          --
          all
          check

  build-linux:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: ConorMacBride/install-package@v1
      with:
        apt: gnutls-dev libssl-dev libjansson-dev pkg-config check lcov valgrind libcurl4-openssl-dev bats jq

    - name: Build, Test, and Coverage
      uses: threeal/cmake-action@v2.1.0
      with:
        options: |
          ENABLE_COVERAGE=YES
          WITH_LIBCURL=YES
        build-args: |
          --
          all
          check-code-coverage

    - uses: codecov/codecov-action@v5.1.2
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: ${{github.workspace}}/build/check-code-coverage.info
        disable_search: true
        verbose: true

    - name: Memcheck
      working-directory: ${{github.workspace}}/build
      run: ctest -T memcheck

  # OpenSSL is now an optional backend, so the library must build and pass the
  # test suite with any non-empty subset of {OpenSSL, GnuTLS, MbedTLS}. Exercise
  # all seven combinations. forky provides all three (GnuTLS >= 3.8.4 and
  # MbedTLS 3.x); GnuTLS >= 3.8.4 is required for the OpenSSL-less GnuTLS combos
  # (older GnuTLS has no native JWK/JWE path and relies on the OpenSSL fallback).
  build-linux-combos:
    runs-on: ubuntu-latest
    container:
      image: debian:forky
    strategy:
      fail-fast: false
      matrix:
        include:
          - { name: "MbedTLS",                flags: "-DWITH_OPENSSL=OFF -DWITH_GNUTLS=OFF -DWITH_MBEDTLS=ON" }
          - { name: "GnuTLS",                 flags: "-DWITH_OPENSSL=OFF -DWITH_GNUTLS=ON -DWITH_MBEDTLS=OFF" }
          - { name: "OpenSSL",                flags: "-DWITH_OPENSSL=ON -DWITH_GNUTLS=OFF -DWITH_MBEDTLS=OFF" }
          - { name: "MbedTLS+GnuTLS",         flags: "-DWITH_OPENSSL=OFF -DWITH_GNUTLS=ON -DWITH_MBEDTLS=ON" }
          - { name: "MbedTLS+OpenSSL",        flags: "-DWITH_OPENSSL=ON -DWITH_GNUTLS=OFF -DWITH_MBEDTLS=ON" }
          - { name: "GnuTLS+OpenSSL",         flags: "-DWITH_OPENSSL=ON -DWITH_GNUTLS=ON -DWITH_MBEDTLS=OFF" }
          - { name: "MbedTLS+GnuTLS+OpenSSL", flags: "-DWITH_OPENSSL=ON -DWITH_GNUTLS=ON -DWITH_MBEDTLS=ON" }
    steps:
    - uses: actions/checkout@v4
    - name: Install dependencies
      run: |
        apt-get update
        apt-get install -y --no-install-recommends \
          gcc cmake pkg-config make git curl \
          libssl-dev gnutls-dev libmbedtls-dev libjansson-dev \
          libcurl4-openssl-dev check bats jq ca-certificates

    - name: "Build (${{ matrix.name }})"
      run: |
        cmake -B build ${{ matrix.flags }} -DWITH_LIBCURL=YES
        cmake --build build -- all

    - name: "Test (${{ matrix.name }})"
      working-directory: ${{github.workspace}}/build
      run: ctest --output-on-failure

  build-linux-json-c:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: ConorMacBride/install-package@v1
      with:
        apt: gnutls-dev libssl-dev libjson-c-dev pkg-config check libcurl4-openssl-dev bats jq

    - name: Build and Test with json-c
      uses: threeal/cmake-action@v2.1.0
      with:
        options: |
          WITH_JSON_C=YES
          WITH_LIBCURL=YES
        build-args: |
          --
          all
          check

  # MbedTLS requires >= 3.6.0, which Ubuntu does not package (it ships 2.28).
  # Debian forky provides mbedtls 3.6.x, so run the MbedTLS matrix in a forky
  # container. This validates the native MbedTLS JWS/JWK/JWE backend and the
  # cross-backend interop tests (which loop over every compiled provider).
  build-linux-mbedtls:
    runs-on: ubuntu-latest
    container:
      image: debian:forky
    steps:
    - uses: actions/checkout@v4
    - name: Install dependencies
      run: |
        apt-get update
        apt-get install -y --no-install-recommends \
          gcc cmake pkg-config make git curl \
          libssl-dev gnutls-dev libmbedtls-dev libjansson-dev \
          libcurl4-openssl-dev check bats jq ca-certificates lcov

    # The repo is checked out as a different owner than the container user;
    # mark it safe so the Codecov action's git calls work.
    - name: Mark workspace safe for git
      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

    # forky ships GnuTLS >= 3.8.4 and MbedTLS 3.x, so this job exercises the
    # native MbedTLS backend AND the native GnuTLS JWE path (RSA-OAEP-256,
    # ECDH-ES, JWK parsing) that Ubuntu's older GnuTLS cannot. Coverage is
    # collected here too and merged by Codecov with the OpenSSL/GnuTLS-fallback
    # report from build-linux, so the version-gated native lines are counted.
    - name: Build, Test, and Coverage (OpenSSL + GnuTLS + MbedTLS)
      run: |
        cmake -B build -DWITH_MBEDTLS=YES -DWITH_LIBCURL=YES \
              -DENABLE_COVERAGE=YES
        # The genhtml step of check-code-coverage exits non-zero, but the lcov
        # capture (check-code-coverage.info) is produced and is what we upload.
        cmake --build build -- all check-code-coverage || true
        test -f build/check-code-coverage.info

    - uses: codecov/codecov-action@v5.1.2
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: ${{github.workspace}}/build/check-code-coverage.info
        disable_search: true
        verbose: true