stable.yml

on: [push, pull_request]

name: Stable

permissions:
  contents: read
  pull-requests: write

env:
  DEFAULT_OPTIONS: "--features=async,ffi,qlog,rpk --workspace"
  # Used by `quiche_multiarch`, which can't link `boring` for foreign targets.
  NO_BORING_OPTIONS: "--features=ffi,qlog --workspace --exclude h3i --exclude tokio-quiche"
  RUSTFLAGS: "-D warnings"
  RUSTTOOLCHAIN: "stable"

concurrency:
  group: ${{ github.ref }}-stable
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

jobs:
  quiche:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        boring_version: ["latest", "4"]
    # Only run on "pull_request" event for external PRs. This is to avoid
    # duplicate builds for PRs created from internal branches.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUSTTOOLCHAIN }}
          components: clippy

      - name: Install qlog-dancer dependencies
        run: |
          sudo apt-get update
          sudo apt-get install libexpat1-dev libfreetype6-dev libfontconfig1-dev

      - name: Maybe pin boring to MSRV (4.19.0)
        if: matrix.boring_version == '4'
        run: |
          # Pin boring to the minimum supported 4.x. cargo's resolver
          # normally picks the highest match (5.x); generate the
          # lockfile first, then downgrade to the floor of the
          # workspace dep range (`>= 4.19, < 6`) via `--precise`.
          # Pinning to the floor (rather than the latest 4.x) catches
          # accidental use of APIs added in later 4.x point releases.
          # `quiche/src/build.rs` and `tokio-quiche/build.rs` then read
          # the lockfile and leave `cfg(boring_v5)` off (the default).
          cargo generate-lockfile
          cargo update -p boring --precise 4.19.0

      - name: Unused dependency check
        uses: bnjbvr/cargo-machete@main

      - name: Run cargo test
        run: cargo test --verbose --all-targets ${{ env.DEFAULT_OPTIONS }}

      # Need to run doc tests separately.
      # (https://github.com/rust-lang/cargo/issues/6669)
      - name: Run cargo doc test
        run: cargo test --verbose --doc ${{ env.DEFAULT_OPTIONS }}

      # NOTE: this is disabled as it fails when building changes that bump
      # version of local crates (e.g. when doing a `qlog` release) that have not
      # been published yet, and we couldn't find a workaround.
      #
      # - name: Run cargo package
      #   run: cargo package --verbose --workspace --exclude=quiche_apps --allow-dirty

      - name: Run cargo clippy
        run: cargo clippy ${{ env.DEFAULT_OPTIONS }} -- -D warnings

      - name: Run cargo clippy on examples
        run: cargo clippy --examples ${{ env.DEFAULT_OPTIONS }} -- -D warnings

      - name: Run cargo doc
        run: cargo doc --no-deps --all-features --document-private-items

      - name: Build C examples
        run: |
          sudo apt-get install libev-dev uthash-dev
          make -C quiche/examples

  quiche_macos:
    strategy:
      matrix:
        target:
          - "macos-15-intel"     # Intel (x86_64)
          - "macos-latest" # Apple Silicon (M1)
    runs-on: ${{ matrix.target }}
    # Only run on "pull_request" event for external PRs. This is to avoid
    # duplicate builds for PRs created from internal branches.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUSTTOOLCHAIN }}

      - name: Run cargo test
        run: cargo test --verbose --all-targets ${{ env.DEFAULT_OPTIONS }}

      - name: Build C examples
        run: |
          brew install libev uthash
          make -C quiche/examples

  quiche_ios:
    runs-on: macos-latest
    strategy:
      matrix:
        target: ["x86_64-apple-ios", "aarch64-apple-ios"]
    # Only run on "pull_request" event for external PRs. This is to avoid
    # duplicate builds for PRs created from internal branches.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    env:
      IPHONEOS_DEPLOYMENT_TARGET: "10.0"
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUSTTOOLCHAIN }}
          targets: ${{ matrix.target }}

      - name: Remove cdylib from iOS build
        run: |
          sed -i -e 's/, "cdylib"//g' quiche/Cargo.toml

      - name: Run cargo build
        run: cargo build --target=${{ matrix.target }} --verbose

  quiche_windows:
    runs-on: windows-2022
    strategy:
      matrix:
        target: ["x86_64-pc-windows-msvc", "i686-pc-windows-msvc", "x86_64-pc-windows-gnu", "i686-pc-windows-gnu"]
        include:
          # i686 (32-bit) BoringSSL builds require SSE2 explicitly. The
          # toolchain file in BoringSSL sets `-msse2`, but cmake-rs
          # passes `-DCMAKE_C_FLAGS=...` on the command line which
          # overrides that, so we re-add it here.
          - target: "i686-pc-windows-msvc"
            cxxflags: "-msse2"
          - target: "i686-pc-windows-gnu"
            # `-mlong-double-64`: bindgen detects that Rust doesn't
            # support 80-bit long double.
            # `-msse2`: same reason as i686-pc-windows-msvc above.
            cflags: "-mlong-double-64 -msse2"
            cxxflags: "-mlong-double-64 -msse2"
    env:
      CFLAGS: ${{ matrix.cflags }}
      CXXFLAGS: ${{ matrix.cxxflags }}
      BINDGEN_EXTRA_CLANG_ARGS: ${{ matrix.cflags }}
    # Only run on "pull_request" event for external PRs. This is to avoid
    # duplicate builds for PRs created from internal branches.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUSTTOOLCHAIN }}
          targets: ${{ matrix.target }}

      # The windows-2022 image preinstalls MSYS2 (gcc 14.2.0) at
      # `C:\msys64` but doesn't put it on PATH. For x86_64-pc-windows-gnu
      # we rely on these preinstalled tools and just point the C/C++
      # toolchain at them, matching `boring`'s own CI workflow.
      - name: Set up MinGW for 64 bit
        if: matrix.target == 'x86_64-pc-windows-gnu'
        shell: bash
        run: |
          echo >> "$GITHUB_ENV" CC=gcc
          echo >> "$GITHUB_ENV" CXX=g++
          echo >> "$GITHUB_ENV" 'C_INCLUDE_PATH=C:\msys64\usr\include'
          echo >> "$GITHUB_ENV" 'CPLUS_INCLUDE_PATH=C:\msys64\usr\include'
          echo >> "$GITHUB_ENV" 'LIBRARY_PATH=C:\msys64\usr\lib'

      # For i686 we install a fresh 32-bit MSYS2 toolchain (and a
      # 32-bit cmake from MSYS2, since the system cmake is 64-bit and
      # picks up the wrong `gcc`). Mirrors `boring`'s CI workflow.
      - name: Set up MinGW for 32 bit
        if: matrix.target == 'i686-pc-windows-gnu'
        uses: msys2/setup-msys2@v2
        id: msys2
        with:
          msystem: MINGW32
          path-type: inherit
          install: >-
            mingw-w64-i686-gcc
            mingw-w64-i686-cmake

      - name: Set up 32-bit MSYS2 env vars
        if: matrix.target == 'i686-pc-windows-gnu'
        shell: bash
        run: |
          MSYS_ROOT='${{ steps.msys2.outputs.msys2-location }}'
          test -d "$MSYS_ROOT\\mingw32\\bin"
          echo >> $GITHUB_PATH "$MSYS_ROOT\\mingw32\\bin"
          echo >> $GITHUB_PATH "$MSYS_ROOT\\usr\\bin"
          echo >> $GITHUB_ENV CC="$MSYS_ROOT\\mingw32\\bin\\gcc"
          echo >> $GITHUB_ENV CXX="$MSYS_ROOT\\mingw32\\bin\\g++"
          echo >> $GITHUB_ENV AR="$MSYS_ROOT\\mingw32\\bin\\ar"
          echo >> $GITHUB_ENV CFLAGS="$CFLAGS -I$MSYS_ROOT\\mingw32\\include"
          echo >> $GITHUB_ENV CXXFLAGS="$CXXFLAGS -I$MSYS_ROOT\\mingw32\\include"
          echo >> $GITHUB_ENV BINDGEN_EXTRA_CLANG_ARGS="$BINDGEN_EXTRA_CLANG_ARGS -I$MSYS_ROOT\\mingw32\\include"
          echo >> $GITHUB_ENV LIBRARY_PATH="$MSYS_ROOT\\mingw32\\lib"
          echo >> $GITHUB_ENV LDFLAGS="-L$MSYS_ROOT\\mingw32\\lib"
          # Force cmake-rs to use the MinGW Makefiles generator instead
          # of MSYS Makefiles; cmake-rs's default for windows-gnu picks
          # the latter, which then can't find `cl.exe` (cmake's default
          # Windows compiler) and fails configuration.
          echo >> $GITHUB_ENV "CMAKE_GENERATOR=MinGW Makefiles"

      - name: Install dependencies
        uses: crazy-max/ghaction-chocolatey@v3
        with:
          args: install nasm

      - name: Run cargo build
        if: endsWith(matrix.target, '-gnu')
        run: cargo build --target=${{ matrix.target }} --verbose --all-targets ${{ env.DEFAULT_OPTIONS }} --exclude qlog-dancer

      - name: Run cargo test
        if: endsWith(matrix.target, '-msvc')
        run: cargo test --target=${{ matrix.target }} --verbose --all-targets ${{ env.DEFAULT_OPTIONS }} --exclude qlog-dancer

  quiche_multiarch:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        target: ["aarch64-unknown-linux-gnu","armv7-unknown-linux-gnueabihf","i686-unknown-linux-gnu"]
    # Only run on "pull_request" event for external PRs. This is to avoid
    # duplicate builds for PRs created from internal branches.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUSTTOOLCHAIN }}

      - name: Install cargo-binstall
        uses: cargo-bins/cargo-binstall@main

      - name: Install cross
        run: cargo-binstall -y cross

      - name: Run cargo test using cross
        run: cross test --target=${{ matrix.target }} --verbose --all-targets ${{ env.NO_BORING_OPTIONS }} --exclude qlog-dancer

  http3_test:
    runs-on: ubuntu-latest
    # Only run on "pull_request" event for external PRs. This is to avoid
    # duplicate builds for PRs created from internal branches.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUSTTOOLCHAIN }}
          components: clippy

      - name: Run cargo test
        run: cargo test --no-run --verbose --manifest-path=tools/http3_test/Cargo.toml

      - name: Run cargo clippy
        run: cargo clippy --manifest-path=tools/http3_test/Cargo.toml -- -D warnings

  docker:
    runs-on: ubuntu-latest
    # Only run on "pull_request" event for external PRs. This is to avoid
    # duplicate builds for PRs created from internal branches.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Build Docker images
        run: make docker-build

  android_ndk_lts:
    runs-on: ubuntu-latest
    env:
      API_LEVEL: "21"
    strategy:
      matrix:
        target: ["aarch64-linux-android","armv7-linux-androideabi","x86_64-linux-android","i686-linux-android"]
        include:
          - target: "aarch64-linux-android"
            arch: "arm64-v8a"
          - target: "armv7-linux-androideabi"
            arch: "armeabi-v7a"
          - target: "x86_64-linux-android"
            arch: "x86_64"
          - target: "i686-linux-android"
            arch: "x86"
    # Only run on "pull_request" event for external PRs. This is to avoid
    # duplicate builds for PRs created from internal branches.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain for the target
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUSTTOOLCHAIN }}
          targets: ${{ matrix.target }}

      - name: Install cargo-ndk
        run: cargo install cargo-ndk

      - name: Run cargo ndk
        run: cargo ndk --manifest-path quiche/Cargo.toml --target ${{ matrix.arch }} --platform ${{ env.API_LEVEL }} -- build --verbose --features ffi