.github/workflows/ci.yml

name: Check

on:
  pull_request:
    branches: [ "master", "stable-*" ]

jobs:
  test-distcheck:
    runs-on: ubuntu-24.04
    container:
      image: ubuntu:26.04
    env:
      PREFIX:   "/usr"
      CONFIG:   "--with-openssl --prefix=/usr"
      CHECK:    "distcheck"
      RUN_TEST: "1"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build libtpms and swtpm and test
        uses: ./.github/actions/test-swtpm

  test-coveralls:
    runs-on: ubuntu-24.04
    container:
      image: ubuntu:26.04
    env:
      PREFIX:                    "/usr"
      CONFIG:                    "--with-openssl --prefix=/usr --enable-test-coverage"
      SUDO:                      "sudo"
      CHECK:                     "check"
      SWTPM_TEST_IBMTSS2:        "1"
      SWTPM_TEST_STORE_VOLATILE: "1"
      COVERALLS_REPO_TOKEN:      ${{ secrets.COVERALLS_REPO_TOKEN }}
      PACKAGES:                  libtpm2-pkcs11-tools
    steps:
      - name: Checkout
        if: env.COVERALLS_REPO_TOKEN != ''
        uses: actions/checkout@v4

      - name: Build libtpms and swtpm and test
        if: env.COVERALLS_REPO_TOKEN != ''
        uses: ./.github/actions/test-swtpm

      - name: Prepare for Coveralls Upload
        if: env.COVERALLS_REPO_TOKEN != ''
        shell: bash
        run: |
          uidgid="$(id -nu):$(id -ng)"
          sudo chown -R ${uidgid} ./
          git clone https://github.com/eddyxu/cpp-coveralls
          pushd cpp-coveralls
           sudo pip install -e . --break-system-packages
          popd
          cpp-coveralls -e libtpms --gcov-options '\-lp'

  test-asan-ubsan:
    runs-on: ubuntu-24.04
    container:
      image: ubuntu:26.04
    env:
      CFLAGS:         "-fsanitize=address,undefined -g -fno-omit-frame-pointer -fno-sanitize-recover"
      LIBTPMS_CFLAGS: "-fsanitize=address,undefined -g -fno-omit-frame-pointer -fno-sanitize-recover"
      LIBS:           "-lasan -lubsan"
      ASAN_OPTIONS:   "halt_on_error=1"
      UBSAN_OPTIONS:  "halt_on_error=1"
      PREFIX:         "/usr"
      CONFIG:         "--with-openssl --prefix=/usr --without-seccomp"
      SUDO:           "sudo"
      CHECK:          "check"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build libtpms and swtpm and test
        uses: ./.github/actions/test-swtpm

  test-asan-ubsan-non-openssl:
    runs-on: ubuntu-24.04
    container:
      image: ubuntu:26.04
    env:
      CFLAGS:         "-fsanitize=address,undefined -g -fno-omit-frame-pointer -fno-sanitize-recover"
      LIBTPMS_CFLAGS: "-fsanitize=address,undefined -g -fno-omit-frame-pointer -fno-sanitize-recover"
      LIBTPMS_CONFIG: "--disable-use-openssl-functions"
      LIBS:           "-lasan -lubsan"
      ASAN_OPTIONS:   "halt_on_error=1"
      UBSAN_OPTIONS:  "halt_on_error=1"
      PREFIX:         "/usr"
      CONFIG:         "--with-openssl --prefix=/usr --without-seccomp"
      SUDO:           "sudo"
      CHECK:          "check"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build libtpms and swtpm and test
        uses: ./.github/actions/test-swtpm