name: CI

on:
  push:
    branches-ignore:
      - 'main'

env:
  BUILDER_VERSION: v0.9.72
  BUILDER_SOURCE: releases
  BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net
  PACKAGE_NAME: aws-c-auth
  LINUX_BASE_IMAGE: ubuntu-18-x64
  RUN: ${{ github.run_id }}-${{ github.run_number }}
  CRT_CI_ROLE: ${{ secrets.CRT_CI_ROLE_ARN }}
  AWS_DEFAULT_REGION: us-east-1

permissions:
  id-token: write # This is required for requesting the JWT

jobs:
  linux-compat:
    runs-on: ubuntu-24.04 # latest
    strategy:
      fail-fast: false
      matrix:
        image:
          - manylinux1-x64
          - manylinux1-x86
          - manylinux2014-x64
          - manylinux2014-x86
          - al2-x64
          - fedora-34-x64
          - opensuse-leap
          - rhel8-x64
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ matrix.image }} build -p ${{ env.PACKAGE_NAME }}

  linux-compiler-compat:
    runs-on: ubuntu-24.04 # latest
    strategy:
      fail-fast: false
      matrix:
        compiler:
          - clang-6
          - clang-8
          - clang-9
          - clang-10
          - clang-11
          - clang-15
          - clang-17
          - gcc-4.8
          - gcc-5
          - gcc-6
          - gcc-7
          - gcc-8
          - gcc-11
          - gcc-13
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --compiler=${{ matrix.compiler }}

  linux-shared-libs:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DBUILD_SHARED_LIBS=ON

  windows:
    runs-on: windows-2025 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }}

  windows-vc17:
    runs-on: windows-2025 # latest
    strategy:
      matrix:
        arch: [x86, x64]
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} --target windows-${{ matrix.arch }} --compiler msvc-17

  windows-shared-libs:
    runs-on: windows-2025 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DBUILD_SHARED_LIBS=ON

  windows-app-verifier:
    runs-on: windows-2025 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
        python builder.pyz build -p ${{ env.PACKAGE_NAME }} run_tests=false --cmake-extra=-DBUILD_TESTING=ON
    - name: Run and check AppVerifier
      run: |
        python .\aws-c-auth\build\deps\aws-c-common\scripts\appverifier_ctest.py --build_directory .\aws-c-auth\build\aws-c-auth

  macos:
    runs-on: macos-14 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')"
        chmod a+x builder
        ./builder build -p ${{ env.PACKAGE_NAME }}

  macos-x64:
    runs-on: macos-14-large # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    - name: Build ${{ env.PACKAGE_NAME }} + consumers
      run: |
        python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')"
        chmod a+x builder
        ./builder build -p ${{ env.PACKAGE_NAME }}

  # Test downstream repos.
  # This should not be required because we can run into a chicken and egg problem if there is a change that needs some fix in a downstream repo.
  downstream:
    runs-on: ubuntu-24.04 # latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CRT_CI_ROLE }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build downstream -p ${{ env.PACKAGE_NAME }}
