ci.yml

# vim: sw=2

name: Build CI

on:
  push:
  pull_request:
  release:
    types: [published]
  check_suite:
    types: [rerequested]

permissions:
  contents: read #  to fetch code (actions/checkout)

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  DEBIAN_FRONTEND: noninteractive
  RUNTEST_JOBS: 8

jobs:

  rip-and-test:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: |
        echo Number of CPUs: $(nproc)
        echo "$GITHUB_CONTEXT"
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        submodules: false
        fetch-depth: 1
    - name: Install dependencies
      run: |
        set -x
        .github/scripts/install-deps.sh
    - name: Build RIP GCC
      run: |
        set -x
        .github/scripts/build-rip.sh --with-realtime=uspace
    - name: Verify no untracked or modified files after build
      run: |
        .github/scripts/verify-clean-repo.sh
    - name: Arm core dumps
      run: |
        set -x
        mkdir -p /tmp/linuxcnc-ui-smoke-cores
        sudo sysctl -w kernel.core_pattern=/tmp/linuxcnc-ui-smoke-cores/core.%e.%p
    - name: Test
      run: |
        set -x
        scripts/rip-environment runtests -j $RUNTEST_JOBS -p -d
    - name: Upload UI smoke screenshots
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: ui-smoke-screenshots-gcc
        path: |
          tests/ui-smoke/**/screenshot.png
          tests/ui-smoke/**/confirm.png
          tests/ui-smoke/**/diff.png
          tests/ui-smoke/**/diff-abs.png
        if-no-files-found: ignore
        retention-days: 14
    - name: Verify no untracked or modified files after test
      run: |
        .github/scripts/verify-clean-repo.sh

  rip-headless:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: |
        echo Number of CPUs: $(nproc)
        echo "$GITHUB_CONTEXT"
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        submodules: false
        fetch-depth: 1
    - name: Install minimal headless dependencies
      run: |
        set -x
        .github/scripts/install-deps-headless.sh
    - name: Build RIP headless
      run: |
        set -x
        .github/scripts/build-rip.sh --with-realtime=uspace --disable-gui --disable-manpages --disable-build-documentation
    - name: Verify GUI artifacts are absent and headless artifacts exist
      run: |
        set -x
        for f in bin/axis bin/axis-remote bin/touchy bin/gscreen bin/gmoccapy \
                 bin/halshow bin/pyvcp bin/gladevcp bin/stepconf bin/pncconf \
                 bin/image-to-gcode tcl/linuxcnc.so tcl/hal.so; do
            if test -e "$f"; then
                echo "error: GUI artifact built despite --disable-gui: $f"
                exit 1
            fi
        done
        for f in scripts/linuxcnc scripts/halrun bin/linuxcncrsh bin/linuxcncsvr \
                 bin/halcmd bin/halui bin/mdi bin/linuxcnctop; do
            if test ! -x "$f"; then
                echo "error: missing headless artifact: $f"
                exit 1
            fi
        done
    - name: Verify no untracked or modified files after build
      run: |
        .github/scripts/verify-clean-repo.sh
    - name: Test
      run: |
        set -x
        scripts/rip-environment runtests -j $RUNTEST_JOBS -p ./tests
    - name: Verify no untracked or modified files after test
      run: |
        .github/scripts/verify-clean-repo.sh

  rip-rtai:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: |
        echo Number of CPUs: $(nproc)
        echo "$GITHUB_CONTEXT"
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        submodules: false
        fetch-depth: 1
    - name: Install dependencies
      run: |
        set -x
        .github/scripts/install-rtai.sh trixie
        .github/scripts/install-deps.sh
    - name: Build RIP RTAI
      run: |
        set -x
        #It is save to assume there is only one /usr/realtime-* folder
        .github/scripts/build-rip.sh --with-realtime=/usr/realtime-*
    - name: Verify no untracked or modified files after build
      run: |
        .github/scripts/verify-clean-repo.sh

  rip-and-test-clang:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: |
        echo Number of CPUs: $(nproc)
        echo "$GITHUB_CONTEXT"
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        submodules: false
        fetch-depth: 1
    - name: Install dependencies
      run: |
        set -x
        .github/scripts/install-deps.sh
    - name: Build RIP Clang
      run: |
        set -x
        CC=clang CXX=clang++ .github/scripts/build-rip.sh --with-realtime=uspace
    - name: Verify no untracked or modified files after build
      run: |
        .github/scripts/verify-clean-repo.sh
    - name: Arm core dumps
      run: |
        set -x
        mkdir -p /tmp/linuxcnc-ui-smoke-cores
        sudo sysctl -w kernel.core_pattern=/tmp/linuxcnc-ui-smoke-cores/core.%e.%p
    - name: Test
      run: |
        set -x
        scripts/rip-environment runtests -j $RUNTEST_JOBS -p -d
    - name: Upload UI smoke screenshots
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: ui-smoke-screenshots-clang
        path: |
          tests/ui-smoke/**/screenshot.png
          tests/ui-smoke/**/confirm.png
          tests/ui-smoke/**/diff.png
          tests/ui-smoke/**/diff-abs.png
        if-no-files-found: ignore
        retention-days: 14
    - name: Verify no untracked or modified files after test
      run: |
        .github/scripts/verify-clean-repo.sh

  cppcheck:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        submodules: false
        fetch-depth: 1
    - name: Install dependencies
      run: |
        set -x
        .github/scripts/install-deps.sh
        sudo apt-get --yes install cppcheck
    - name: Cppcheck
      run: |
        set -x
        scripts/cppcheck.sh

  shellcheck:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        submodules: false
        fetch-depth: 1
    - name: Install dependencies
      run: |
        set -x
        .github/scripts/install-deps.sh
        sudo apt-get --yes install shellcheck
    - name: Configure
      run: |
        set -x
        .github/scripts/configure.sh
    - name: Shellcheck
      run: |
        set -x
        scripts/shellcheck.sh

  htmldocs:
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: |
        echo Number of CPUs: $(nproc)
        echo "$GITHUB_CONTEXT"
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        submodules: false
        fetch-depth: 1
    - name: Install dependencies
      run: |
        set -x
        .github/scripts/install-deps.sh
    - name: Build HTML docmentation
      run: |
        set -x
        .github/scripts/build-doc.sh
    - name: Check manpage names match filenames
      run: scripts/manpage-name-check.py --enforce docs/build/man
    - name: Check for derived-id section references
      run: scripts/docs-anchor-check.py --enforce
    - name: Verify no untracked or modified files after build
      run: |
        #*.po and documentation.pot are modifyed by build. Ignore them for now.
        .github/scripts/verify-clean-repo.sh ':(exclude)docs/po/*.po' ':(exclude)docs/po/documentation.pot'
    - name: HTML checks
      run: |
        set -x
        #-w sets warn only, remove to generate a CI failure on error
        scripts/htmlcheck.sh -w
    - name: Tar linuxcnc-doc
      run: |
        set -x
        tar -czf linuxcnc-doc.tar.gz -C docs/build html
    - name: Upload linuxcnc-doc artifact
      uses: actions/upload-artifact@v7
      with:
        name: linuxcnc-doc
        archive: false
        path: linuxcnc-doc.tar.gz
        if-no-files-found: error

  package-arch:
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 75
    strategy:
      matrix:
        runner: ["ubuntu-26.04", "ubuntu-26.04-arm"]
        image: ["debian:bookworm", "debian:trixie", "debian:sid"]
        include:
          - allow_fail: False
            image: debian:bookworm
          - allow_fail: False
            image: debian:trixie
          - allow_fail: True
            image: debian:sid
    container:
      image: ${{ matrix.image }}
      # IPC_OWNER is needed for shmget IPC_CREAT
      # SYS_ADMIN is needed for shmctl IPC_SET
      # needed for bwrap parallel tests:
      #   --security-opt apparmor=unconfined
      #   --security-opt seccomp=unconfined
      #   --security-opt systempaths=unconfined
      # needed for parallel tests due to an overlay is mounted in /tmp and overlay over overlay fails:
      #   --tmpfs /tmp:rw
      options: >-
        --cap-add=IPC_OWNER
        --cap-add=SYS_ADMIN
        --security-opt apparmor=unconfined
        --security-opt seccomp=unconfined
        --security-opt systempaths=unconfined
        --tmpfs /tmp:rw
    continue-on-error: ${{ matrix.allow_fail }}
    steps:
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: |
        echo Allow failure: ${{ matrix.allow_fail }}
        echo Number of CPUs: $(nproc)
        echo "$GITHUB_CONTEXT"
    - name: Install pre-dependencies
      run: |
        set -x
        apt-get -q update
        apt --yes upgrade
        # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package and run tests.
        apt-get --yes --no-install-recommends install curl git lsb-release python3 devscripts adduser xauth
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        submodules: false
        # "fetch-depth: 0" fetches all of history, this is needed by
        # our build system to determine the version from tags
        fetch-depth: 0
    - name: Git config
      run: |
        set -x
        git config --global --add safe.directory ${PWD}
    - name: Build architecture-specific Debian packages
      env:
        DEBEMAIL: emc-developers@lists.sourceforge.net
        DEBFULLNAME: LinuxCNC Github CI Robot
      run: |
        set -x
        .github/scripts/build-package-arch.sh
    - name: Verify no untracked or modified files after build
      run: |
        .github/scripts/verify-clean-repo.sh ':(exclude)VERSION' ':(exclude)debian/changelog'
    - name: Install debian packages
      run: |
        set -x
        apt-get --yes --no-install-recommends install ../*.deb
    - name: Test debian packages
      run: |
        set -x
        adduser --disabled-password --gecos "" testrunner
        chown -R testrunner:testrunner tests # make test dirs owned by testrunner for parallel execution
        su -c "./scripts/runtests -j $RUNTEST_JOBS -p -d ./tests" testrunner
    - name: Verify no untracked or modified files after test
      run: |
        .github/scripts/verify-clean-repo.sh ':(exclude)VERSION' ':(exclude)debian/changelog'
    - name: Gather build artifacts
      run: |
        set -x
        ARCH=$(dpkg --print-architecture)
        DIST=$(echo ${{ matrix.image }} | cut -d : -f 2)
        OUTDIR="artifacts/${DIST}/${ARCH}"
        mkdir -p "$OUTDIR"
        cp -v $(find .. -maxdepth 1 -type f | LC_ALL=C sort) "$OUTDIR" || true
        (cd "$OUTDIR" && sha256sum * > SHA256SUMS.txt)
        echo "DIST=$DIST" >> "$GITHUB_ENV"
        echo "ARCH=$ARCH" >> "$GITHUB_ENV"
    - name: Compute artifact metadata
      id: meta
      run: |
        echo "dist=$(echo ${{ matrix.image }} | cut -d : -f 2)" >> $GITHUB_OUTPUT
        echo "arch=$(dpkg --print-architecture)" >> $GITHUB_OUTPUT
    - name: Upload build artifacts
      uses: actions/upload-artifact@v7
      with:
        name: linuxcnc-${{ steps.meta.outputs.dist }}-${{ steps.meta.outputs.arch }}
        path: artifacts/${{ steps.meta.outputs.dist }}/${{ steps.meta.outputs.arch }}
        if-no-files-found: error

  package-arch-32bit:
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: i386
            platform: linux/386
            runner: ubuntu-24.04
          - arch: armhf
            platform: linux/arm/v7
            runner: ubuntu-24.04-arm
    steps:
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: |
        echo Number of CPUs: $(nproc)
        echo "$GITHUB_CONTEXT"
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        submodules: false
        # "fetch-depth: 0" fetches all of history, this is needed by
        # our build system to determine the version from tags
        fetch-depth: 0
    - name: Check for native 32-bit execution
      id: native
      run: |
        set -x
        if docker run --rm --platform ${{ matrix.platform }} debian:trixie true; then
          echo "native=true" >> $GITHUB_OUTPUT
        else
          echo "native=false" >> $GITHUB_OUTPUT
        fi
    - name: Set up QEMU
      if: steps.native.outputs.native != 'true'
      uses: docker/setup-qemu-action@v3
      with:
        platforms: ${{ matrix.platform }}
    - name: Build and test ${{ matrix.arch }} Debian packages
      run: |
        set -x
        # IPC_OWNER is needed for shmget IPC_CREAT
        # SYS_ADMIN is needed for shmctl IPC_SET
        docker run --rm --platform ${{ matrix.platform }} \
          --cap-add=IPC_OWNER --cap-add=SYS_ADMIN \
          -e DEBIAN_FRONTEND \
          -v "$PWD:/build/linuxcnc" -w /build/linuxcnc \
          debian:trixie .github/scripts/package-arch-in-container.sh

  package-indep:
    runs-on: ubuntu-26.04
    timeout-minutes: 75
    strategy:
      matrix:
        image: ["debian:bookworm", "debian:trixie", "debian:sid"]
        include:
        - allow_fail: False
          image: debian:bookworm
        - allow_fail: False
          image: debian:trixie
        - allow_fail: True
          image: debian:sid
    container:
      image: ${{ matrix.image }}
      # IPC_OWNER is needed for shmget IPC_CREAT
      # SYS_ADMIN is needed for shmctl IPC_SET
      options: --cap-add=IPC_OWNER --cap-add=SYS_ADMIN
    continue-on-error: ${{ matrix.allow_fail }}
    steps:
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: |
        echo Allow failure: ${{ matrix.allow_fail }}
        echo Number of CPUs: $(nproc)
        echo "$GITHUB_CONTEXT"
    - name: Install pre-dependencies
      run: |
        set -x
        apt-get -q update
        apt --yes upgrade
        # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
        apt-get --yes --no-install-recommends install curl git lsb-release python3 devscripts
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        submodules: false
        # "fetch-depth: 0" fetches all of history, this is needed by
        # our build system to determine the version from tags
        fetch-depth: 0
    - name: Git config
      run: |
        set -x
        git config --global --add safe.directory ${PWD}
    - name: Build architecture-independent Debian packages
      env:
        DEBEMAIL: emc-developers@lists.sourceforge.net
        DEBFULLNAME: LinuxCNC Github CI Robot
      run: |
        set -x
        .github/scripts/build-package-indep.sh
    - name: Verify no untracked or modified files after build
      run: |
        #*.po and documentation.pot are modifyed by build. Ignore them for now.
        .github/scripts/verify-clean-repo.sh ':(exclude)VERSION' ':(exclude)debian/changelog' ':(exclude)docs/po/*.po' ':(exclude)docs/po/documentation.pot'
    - name: Install debian packages
      run: |
        set -x
        apt-get --yes --no-install-recommends install ../*.deb
    - name: Gather build artifacts
      run: |
        set -x
        ARCH=all
        DIST=$(echo ${{ matrix.image }} | cut -d : -f 2)
        OUTDIR="artifacts/${DIST}/${ARCH}"
        mkdir -p "$OUTDIR"
        cp -v $(find .. -maxdepth 1 -type f | LC_ALL=C sort) "$OUTDIR" || true
        (cd "$OUTDIR" && sha256sum * > SHA256SUMS.txt)
        echo "DIST=$DIST" >> "$GITHUB_ENV"
        echo "ARCH=$ARCH" >> "$GITHUB_ENV"
    - name: Compute artifact metadata
      id: meta
      run: |
        echo "dist=$(echo ${{ matrix.image }} | cut -d : -f 2)" >> $GITHUB_OUTPUT
        echo "arch=all" >> $GITHUB_OUTPUT
    - name: Upload build artifacts
      uses: actions/upload-artifact@v7
      with:
        name: linuxcnc-${{ steps.meta.outputs.dist }}-${{ steps.meta.outputs.arch }}
        path: artifacts/${{ steps.meta.outputs.dist }}/${{ steps.meta.outputs.arch }}
        if-no-files-found: error

  release:
    name: Release packages
    needs:
      - package-arch
      - package-indep
    if: (github.event_name == 'release' && github.event.action == 'published') || startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
    runs-on: ubuntu-24.04
    steps:
    - name: Download artifacts
      uses: actions/download-artifact@v8
      with:
        path: release_artifacts
    - name: Prepare upload assets
      run: |
        set -x
        mkdir -p upload
        echo "Downloaded artifacts layout:" && find release_artifacts -maxdepth 3 -print | sed 's/^/  /'
        for d in release_artifacts/*; do
          [ -d "$d" ] || continue
          name=$(basename "$d")
          # Expect name like linuxcnc-bookworm-amd64 or linuxcnc-trixie-all
          dist=${name#linuxcnc-}
          dist=${dist%-*}
          arch=${name##*-}
          echo "Processing artifact: $name (dist=$dist arch=$arch)"
          # Copy built files into distro and arch specific directory
          mkdir "upload/${dist}-${arch}/"
          # sort file list for stable output
          for f in $(find "$d" -maxdepth 1 -type f | LC_ALL=C sort); do
            [ -f "$f" ] || continue
            cp "$f" "upload/${dist}-${arch}"
          done
          echo "Preview of SHA256SUMS.txt:" && sed -n '1,200p' "upload/${dist}-${arch}/SHA256SUMS.txt" | sed 's/^/  /'
          echo "Upload dir contents:" && ls -l "upload/${dist}-${arch}" | sed 's/^/  /'
        done
    - name: Create GitHub Release and upload assets
      uses: softprops/action-gh-release@v3
      with:
        files: |
          upload/*
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}