actions.yml

name: Build Native Libraries
on:
  pull_request:
  push:
    branches: [ master ]
    tags:
      - '*'
defaults:
  run:
    shell: bash
env:
  buildType: RelWithDebInfo
  tempdir: ${{ github.workspace }}/build
  libddwafVersion: 2.0.1
jobs:
  Spotless:
    name: spotless
    runs-on: ubuntu-24.04
    if: "!(contains(github.ref, 'refs/tags/v'))"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        name: Checkout
        with:
          submodules: recursive
          clean: true
      - name: Spotless
        run: |
          ./gradlew spotlessCheck
  ClangFormat:
    name: clang-format
    runs-on: ubuntu-24.04
    if: "!(contains(github.ref, 'refs/tags/v'))"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        name: Checkout
        with:
          submodules: recursive
          clean: true
      - name: clang-format
        run: |
          clang-format-18 -n -Werror $(find src/main/c -type f)
  Coverage:
    runs-on: ubuntu-22.04
    if: "!(contains(github.ref, 'refs/tags/v'))"
    permissions:
      contents: read
      id-token: write # needed for dd-sts OIDC token exchange
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        name: Checkout
        with:
          submodules: recursive
          clean: true
      - name: Cache Gradle artifacts
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-
      - name: Build and test
        run: |
          ./gradlew check jacocoTestReport
      - name: Generate native coverage report
        run: |
          sudo apt-get install -y gcovr
          gcovr -f '.*src/main/c/.*' -x -d -o build/coverage.xml
      - name: Get Datadog credentials
        id: dd-sts
        if: always()
        continue-on-error: true
        uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
        with:
          policy: libddwaf-java
      - name: Upload coverage to Datadog
        if: steps.dd-sts.outputs.api_key != ''
        continue-on-error: true
        uses: DataDog/coverage-upload-github-action@d2cf302a39c05e0ad22063360a2bf6ce0cc4906c # v1
        with:
          api_key: ${{ steps.dd-sts.outputs.api_key }}
          files: build/coverage.xml
          flags: helper
          extra-args: build/reports/jacoco/test/jacocoTestReport.xml
  Native_binaries_Stage_macos_x86_64:
    name: MacOS x86_64
    runs-on: macos-14-large
    env:
      generator: Unix Makefiles
      shlib_prefix: lib
      shlib_ext: dylib
      debug_ext: dylib.dwarf
      artifactsuff: macos-x86_64
      libdir: macos/x86_64
    steps:
    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      name: Checkout
    - name: Prepare libddwaf
      run: |
        # Get sha256sum
        brew install coreutils
        wget https://github.com/DataDog/libddwaf/releases/download/${{ env.libddwafVersion }}/libddwaf-${{ env.libddwafVersion }}-darwin-x86_64.tar.gz
        wget https://github.com/DataDog/libddwaf/releases/download/${{ env.libddwafVersion }}/libddwaf-${{ env.libddwafVersion }}-darwin-x86_64.tar.gz.sha256
        sha256sum --check libddwaf-${{ env.libddwafVersion }}-darwin-x86_64.tar.gz.sha256
        mkdir -p libddwaf/out
        tar xvzf libddwaf-${{ env.libddwafVersion }}-darwin-x86_64.tar.gz -C libddwaf/out --strip-components=1
        mv libddwaf/out/lib/.build-id/*/*.debug libddwaf/out/lib/libddwaf.dylib.dwarf
    - name: Create Build Directory for JNI binding
      run: cmake -E make_directory "${{ env.tempdir }}/buildAG"
    - name: Generate Build Scripts for JNI binding
      run: |
        cmake -DCMAKE_OSX_ARCHITECTURES=x86_64 \
          -DCMAKE_BUILD_TYPE=${{ env.buildType }} \
          -DCMAKE_PREFIX_PATH='${{ github.workspace }}/libddwaf/out/share/cmake/libddwaf/' \
          -DCMAKE_C_FLAGS="-fno-omit-frame-pointer" \
          -G "${{ env.generator }}" ${{ github.workspace }}
      working-directory: ${{ env.tempdir }}/buildAG
    - name: Build Binaries for JNI Binding
      run: cmake --build . --verbose
      working-directory: ${{ env.tempdir }}/buildAG
    - name: Copy libddwaf binaries to native_libs
      run: |
        cmake -E copy ${{ env.shlib_prefix }}ddwaf.${{ env.shlib_ext }} \
          ${{ env.shlib_prefix }}ddwaf.${{ env.debug_ext }} \
          ${{ github.workspace }}/native_libs/${{ env.libdir }}
      working-directory: ${{ github.workspace }}/libddwaf/out/lib
    - name: Copy JNI binding binaries to native_libs
      run: |
        cmake -E copy ${{ env.shlib_prefix }}sqreen_jni.${{ env.shlib_ext }} \
          ${{ env.shlib_prefix }}sqreen_jni.${{ env.debug_ext }} \
          ${{ github.workspace }}/native_libs/${{ env.libdir }}
      working-directory: ${{ env.tempdir }}/buildAG
    - name: Save Artifacts
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
      with:
        path: native_libs
        name: libsqreen_jni_${{ env.artifactsuff }}

  Native_binaries_Stage_macos_aarch64:
    name: MacOS aarch64
    runs-on: macos-14
    env:
      generator: Unix Makefiles
      shlib_prefix: lib
      shlib_ext: dylib
      debug_ext: dylib.dwarf
      artifactsuff: macos-aarch64
      libdir: macos/aarch64
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        name: Checkout
      - name: Prepare libddwaf
        run: |
          # Get sha256sum
          brew install coreutils
          wget https://github.com/DataDog/libddwaf/releases/download/${{ env.libddwafVersion }}/libddwaf-${{ env.libddwafVersion }}-darwin-arm64.tar.gz
          wget https://github.com/DataDog/libddwaf/releases/download/${{ env.libddwafVersion }}/libddwaf-${{ env.libddwafVersion }}-darwin-arm64.tar.gz.sha256
          sha256sum --check libddwaf-${{ env.libddwafVersion }}-darwin-arm64.tar.gz.sha256
          mkdir -p libddwaf/out
          tar xvzf libddwaf-${{ env.libddwafVersion }}-darwin-arm64.tar.gz -C libddwaf/out --strip-components=1
          mv libddwaf/out/lib/.build-id/*/*.debug libddwaf/out/lib/libddwaf.dylib.dwarf
      - name: Create Build Directory for JNI binding
        run: cmake -E make_directory "${{ env.tempdir }}/buildAG"
      - name: Generate Build Scripts for JNI binding
        run: |
          cmake -DCMAKE_OSX_ARCHITECTURES=arm64 \
            -DCMAKE_BUILD_TYPE=${{ env.buildType }} \
            -DCMAKE_PREFIX_PATH='${{ github.workspace }}/libddwaf/out/share/cmake/libddwaf/' \
            -DCMAKE_C_FLAGS="-fno-omit-frame-pointer" \
            -G "${{ env.generator }}" ${{ github.workspace }}
        working-directory: ${{ env.tempdir }}/buildAG
      - name: Build Binaries for JNI Binding
        run: cmake --build .
        working-directory: ${{ env.tempdir }}/buildAG
      - name: Copy libddwaf binaries to native_libs
        run: |
          cmake -E copy ${{ env.shlib_prefix }}ddwaf.${{ env.shlib_ext }} \
            ${{ env.shlib_prefix }}ddwaf.${{ env.debug_ext }} \
            ${{ github.workspace }}/native_libs/${{ env.libdir }}
        working-directory: ${{ github.workspace }}/libddwaf/out/lib
      - name: Copy JNI binding binaries to native_libs
        run: |
          cmake -E copy ${{ env.shlib_prefix }}sqreen_jni.${{ env.shlib_ext }} \
            ${{ env.shlib_prefix }}sqreen_jni.${{ env.debug_ext }} \
            ${{ github.workspace }}/native_libs/${{ env.libdir }}
        working-directory: ${{ env.tempdir }}/buildAG
      - name: Save Artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          path: native_libs
          name: libsqreen_jni_${{ env.artifactsuff }}

  Native_binaries_Stage_windows_x86_64:
    name: Windows x86_64
    runs-on: windows-2022
    defaults:
      run:
        shell: cmd
    env:
      generator: NMake Makefiles
      shlib_prefix:
      shlib_ext: dll
      debug_ext: pdb
      artifactsuff: win-x86_64
      libdir: windows/x86_64
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        name: Checkout
      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
        name: Setup x86_64 build
        with:
          vsversion: 2022
          toolset: 14.44
          arch: amd64
      - name: Prepare libddwaf
        run: |
          choco install wget --no-progress
          wget https://github.com/DataDog/libddwaf/releases/download/${{ env.libddwafVersion }}/libddwaf-${{ env.libddwafVersion }}-windows-x64.tar.gz
          wget https://github.com/DataDog/libddwaf/releases/download/${{ env.libddwafVersion }}/libddwaf-${{ env.libddwafVersion }}-windows-x64.tar.gz.sha256
          sha256sum --check libddwaf-${{ env.libddwafVersion }}-windows-x64.tar.gz.sha256
          mkdir -p libddwaf/out
          tar xvzf libddwaf-${{ env.libddwafVersion }}-windows-x64.tar.gz -C libddwaf/out --strip-components=1
        shell: bash
      - name: Create Build Directory for JNI binding
        run: cmake -E make_directory "${{ env.tempdir }}/buildAG"
      - name: Generate Build Scripts for JNI binding
        run: |
          cmake -DCMAKE_BUILD_TYPE=${{ env.buildType }} -DCMAKE_PREFIX_PATH="${{ github.workspace }}/libddwaf/out/share/cmake/libddwaf/" -G "${{ env.generator }}" "${{ github.workspace }}"
        working-directory: ${{ env.tempdir }}/buildAG
      - name: Build Binaries for JNI Binding
        run: cmake --build .
        working-directory: ${{ env.tempdir }}/buildAG
      - name: Copy JNI binding binaries to native_libs
        run: cmake -E copy ${{ env.shlib_prefix }}sqreen_jni.${{ env.shlib_ext }} ${{ env.shlib_prefix }}sqreen_jni.${{ env.debug_ext }} ${{ github.workspace }}\native_libs\${{ env.libdir }}
        shell: cmd
        working-directory: ${{ env.tempdir }}/buildAG
      - name: Save Artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          path: native_libs
          name: libsqreen_jni_${{ env.artifactsuff }}

  Native_binaries_Stage_linux:
    strategy:
      fail-fast: false
      matrix:
        include:
          - libc: glibc
            arch: x86_64
            dockerfile: ci/manylinux/x86_64
            runs-on: ubuntu-24.04
          - libc: musl
            arch: x86_64
            dockerfile: ci/alpine
            runs-on: ubuntu-24.04
          - libc: glibc
            arch: aarch64
            dockerfile: ci/manylinux/aarch64
            runs-on: arm-4core-linux-ubuntu24.04
          - libc: musl
            arch: aarch64
            dockerfile: ci/alpine
            runs-on: arm-4core-linux-ubuntu24.04
    name: Linux ${{ matrix.libc }} ${{ matrix.arch }}
    runs-on: ${{ matrix.runs-on }}
    env:
      artifactsuff: linux_${{ matrix.libc }}-${{ matrix.arch }}
      libdir: linux/${{ matrix.arch }}/${{ matrix.libc }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      - name: Prepare libddwaf
        run: |
          wget https://github.com/DataDog/libddwaf/releases/download/${{ env.libddwafVersion }}/libddwaf-${{ env.libddwafVersion }}-${{ matrix.arch }}-linux-musl.tar.gz
          wget https://github.com/DataDog/libddwaf/releases/download/${{ env.libddwafVersion }}/libddwaf-${{ env.libddwafVersion }}-${{ matrix.arch }}-linux-musl.tar.gz.sha256
          sha256sum --check libddwaf-${{ env.libddwafVersion }}-${{ matrix.arch }}-linux-musl.tar.gz.sha256
          mkdir -p libddwaf/out
          tar xvzf libddwaf-${{ env.libddwafVersion }}-${{ matrix.arch }}-linux-musl.tar.gz -C libddwaf/out --strip-components=1
          mv libddwaf/out/lib/.build-id/*/*.debug libddwaf/out/lib/libddwaf.so.debug
      - name: Build docker linux image
        run: docker build ${{ matrix.dockerfile  }} -t linux_cmake
      - name: Build bindings
        run: |
          docker run --name pwaf_java_build -u $(id -u):$(id -g) -w ${{ github.workspace }} -v ${{ github.workspace }}:${{ github.workspace }} linux_cmake bash -e -c 'export VERBOSE=1;
            export LIBDDWAF_INSTALL_PREFIX=${{ github.workspace }}/libddwaf/out;
            set -x;
            mkdir buildAG &&
            cd buildAG &&
            cmake ${{ github.workspace }} -DCMAKE_PREFIX_PATH=$LIBDDWAF_INSTALL_PREFIX/share/cmake/libddwaf -DCMAKE_BUILD_TYPE=${{ env.buildType }} -DCMAKE_C_FLAGS="-fno-omit-frame-pointer" &&
            make -j &&
            cp -v $LIBDDWAF_INSTALL_PREFIX/lib/libddwaf.so{,.debug} ${{ github.workspace }}/native_libs/linux/${{ matrix.arch }}/ &&
            cp -v *.so *.so.debug ${{ github.workspace }}/native_libs/${{ env.libdir }}'
        shell: bash
      - name: Save Artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          path: native_libs
          name: jni_${{ env.artifactsuff }}

  Native_binaries_Stage_asan:
    name: ASAN on Linux
    runs-on: ubuntu-22.04
    steps:
    - name: Checkout project
      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      with:
        submodules: recursive
    - name: Install GCC and clang
      run: |
        sudo apt-get update
        sudo apt-get install -y libc++-dev libc++abi-dev libc++abi1 libstdc++-12-dev gcc g++
      shell: bash
    - name: Build and test (with ASAN)
      run: ./gradlew check -PwithASAN

  Native_binaries_Stage_static_analyzer:
    name: Static analyzer on Linux
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout project
      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      with:
        submodules: recursive
    - name: Install GCC and clang
      run: |
        sudo apt-get update
        sudo apt-get install -y libc++-dev libc++abi-dev libc++abi1 libstdc++-12-dev gcc g++ clang-19 clang-tools-19
      shell: bash
    - name: Build
      run: ./gradlew buildLibddwafDebug
    - name: Run static analyzer
      run: |
        SCAN_BUILD=scan-build-19 ./ci/static_analysis
      shell: bash

  Dev_Tests:
    # Used to test our development workflow for debug builds.
    # This should be in sync with whatever we document in the README.
    strategy:
      fail-fast: false
      matrix:
        include:
          - runs-on: ubuntu-22.04
          - runs-on: macos-15
    name: Development tests
    runs-on: ${{ matrix.runs-on }}
    steps:
    - name: Checkout repository
      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      with:
        submodules: recursive
        clean: true
    - name: Setup JDK 11
      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
      with:
        java-version: 11
        distribution: temurin
    - name: Setup recent Xcode
      if: ${{ matrix.runs-on == 'macos-15' }}
      run: xcodes select 16.2
    - name: Build and run tests
      run: ./gradlew check

  Jmh_Build:
    name: JMH Build
    runs-on: ubuntu-22.04
    steps:
    - name: Checkout repository
      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      with:
        submodules: recursive
        clean: true
    - name: Setup JDK 8
      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
      with:
        java-version: 8
        distribution: temurin
    - name: Build JMH jar
      run: ./gradlew jmhJar

  Jar_File_Stage_build_jar:
    name: Build
    runs-on: ubuntu-24.04
    needs:
      - Native_binaries_Stage_macos_x86_64
      - Native_binaries_Stage_macos_aarch64
      - Native_binaries_Stage_windows_x86_64
      - Native_binaries_Stage_linux
      - Native_binaries_Stage_asan
      - Native_binaries_Stage_static_analyzer
    steps:
    - name: Setup JDK 1.8
      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
      with:
        java-version: 8
        distribution: temurin
    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      name: Checkout
      with:
        submodules: recursive
        clean: true
    - name: Download libsqreen_jni_win-x86_64
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: libsqreen_jni_win-x86_64
        path: native_libs
    - name: Download jni_linux_glibc-x86_64
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: jni_linux_glibc-x86_64
        path: native_libs
    - name: Download jni_linux_glibc-aarch64
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: jni_linux_glibc-aarch64
        path: native_libs
    - name: Download jni_linux_musl-x86_64
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: jni_linux_musl-x86_64
        path: native_libs
    - name: Download jni_linux_musl-aarch64
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: jni_linux_musl-aarch64
        path: native_libs
    - name: Download libsqreen_jni_macos-x86_64
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: libsqreen_jni_macos-x86_64
        path: native_libs
    - name: Download libsqreen_jni_macos_aarch64
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: libsqreen_jni_macos-aarch64
        path: native_libs
    - run: find .
      working-directory: native_libs
    - name: Cache Gradle artifacts
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        path: |
          ~/.gradle/caches
          ~/.gradle/wrapper
        key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
        restore-keys: |
          ${{ runner.os }}-gradle-
    - name: Build final JAR and debug symbols package
      run: ./gradlew assemble -Prelease -PuseReleaseBinaries
    - name: Copy artifacts to the packages directory
      run: |
        set -ex
        mkdir -p "${{ env.tempdir }}/packages"
        cp ${{ github.workspace }}/build/libs/libsqreen-*.jar "${{ env.tempdir }}/packages"
        cp ${{ github.workspace }}/build/distributions/libsqreen-*-dbgsym.zip "${{ env.tempdir }}/packages"
      shell: bash
    - name: Publish artifacts (native libs)
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
      with:
        path: native_libs
        name: native_libs
    - name: Publish artifacts (jars)
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
      with:
        path: ${{ env.tempdir }}/packages
        name: libsqreen_jni_jar

  Test:
    name: Test
    needs:
      - Jar_File_Stage_build_jar
    strategy:
      fail-fast: false
      matrix:
        include:
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: ubuntu2204-temurin8
            test_java_home_var: JAVA_8_HOME
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: ubuntu2204-temurin11
            test_java_home_var: JAVA_11_HOME
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: ubuntu2204-temurin17
            test_java_home_var: JAVA_17_HOME
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: ubuntu2204-temurin21
            test_java_home_var: JAVA_21_HOME
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: ubuntu2204-semeru8
            test_java_home_var: JAVA_SEMERU8_HOME
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: ubuntu2204-semeru11
            test_java_home_var: JAVA_SEMERU11_HOME
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: ubuntu2204-semeru17
            test_java_home_var: JAVA_SEMERU17_HOME
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: ubuntu2204-semeru21
            test_java_home_var: JAVA_SEMERU21_HOME
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: centos7-stock8
            test_java_home_var: JAVA_8_HOME
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: alpine-stock8
            test_java_home_var: JAVA_8_HOME
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: centos6-stock8
            test_java_home_var: JAVA_8_HOME
          # Alpine (musl libc) + JDK 21/25 with ZGC: the exact environment where
          # APPSEC-62784 SIGSEGV crashes were observed in production.
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: alpine-temurin21
            test_java_home_var: JAVA_21_HOME
            use_zgc: true
          - runs-on: ubuntu-24.04
            os: linux
            arch: x86_64
            docker_image: alpine-temurin25
            test_java_home_var: JAVA_25_HOME
            use_zgc: true
          - runs-on: arm-4core-linux-ubuntu24.04
            os: linux
            arch: aarch64
            docker_image: ubuntu2204-temurin8
            test_java_home_var: JAVA_8_HOME
          - runs-on: arm-4core-linux-ubuntu24.04
            os: linux
            arch: aarch64
            docker_image: alpine-stock8
            test_java_home_var: JAVA_8_HOME
          - runs-on: macos-14-large
            os: macos
            arch: x86_64
            jdk: temurin8
            java_home_var: JAVA_HOME_8_X64
          - runs-on: macos-14
            os: macos
            arch: aarch64
            jdk: temurin11
            java_home_var: JAVA_HOME_11_arm64
          - runs-on: macos-14-large
            os: macos
            arch: x86_64
            jdk: temurin11
            java_home_var: JAVA_HOME_11_X64
          - runs-on: macos-15
            os: macos
            arch: aarch64
            jdk: temurin11
            java_home_var: JAVA_HOME_11_arm64
          - runs-on: macos-14-large
            os: macos
            arch: x86_64
            jdk: temurin17
            java_home_var: JAVA_HOME_17_X64
          - runs-on: macos-15
            os: macos
            arch: aarch64
            jdk: temurin17
            java_home_var: JAVA_HOME_17_arm64
          - runs-on: windows-2022
            os: windows
            arch: x86_64
            jdk: temurin8
            java_home_var: JAVA_HOME_8_X64
          - runs-on: windows-2022
            os: windows
            arch: x86_64
            jdk: temurin8
            java_home_var: JAVA_HOME_8_X64
    runs-on: ${{ matrix.runs-on }}
    steps:
    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      name: Checkout
    - name: Download artifacts
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: native_libs
        path: native_libs
    - name: Build Docker image
      run: docker build -t ${{ matrix.docker_image }} ci/${{ matrix.docker_image }}
      if: ${{ matrix.docker_image != '' }}
    - name: Run tests (docker)
      run: |
        docker run --rm -w $(pwd) -v $(pwd):$(pwd) ${{ matrix.docker_image }} \
          sh -c './gradlew check --no-daemon --info -Prelease -PuseReleaseBinaries -Dorg.gradle.native=false -PtestJavaHome="$${{ matrix.test_java_home_var }}"${{ matrix.use_zgc && ' -PuseZGC' || '' }}'
      if: ${{ matrix.os == 'linux' }}
    - name: Run tests (no docker)
      run: |
        set -eux
        export JAVA_HOME="$${{ matrix.java_home_var }}"
        ./gradlew check --info -Prelease -PuseReleaseBinaries
      if: ${{ matrix.os != 'linux' }}

  TestsPass:
    # This test is a fan-in for GitHub branch rules
    name: Tests pass
    needs:
      - Test
      - Dev_Tests
      - Jmh_Build
      - Jar_File_Stage_build_jar
      - Spotless
    runs-on: ubuntu-24.04
    steps:
    - name: Done
      run: echo Done

  Publish:
    name: Publish
    runs-on: ubuntu-24.04
    needs:
      - Test
      - Dev_Tests
      - Jar_File_Stage_build_jar
    if: contains(github.ref, 'refs/tags/v')
    steps:
    - name: Checkout repository
      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      with:
        submodules: recursive
        clean: true
    - name: Setup JDK 1.8
      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
      with:
        java-version: 8
        distribution: temurin
    - name: Download artifacts
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: native_libs
        path: native_libs
    - name: Publish artifacts to sonatype
      run: ./gradlew publishToSonatype -Prelease -PuseReleaseBinaries
      env:
        SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
        SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
        GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
      if: (success() && contains(github.ref, 'refs/tags/v'))