build.yml

name: Build

on:
  push:
    branches: [main]
    tags: ['*']
  pull_request:
  workflow_dispatch:

# Read only by default. The publish job asks for the OIDC token it needs itself.
permissions:
  contents: read

# Cancel in-progress runs if a new push lands on the same branch.
concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true

env:
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_NOLOGO: true

jobs:
  windows:
    name: windows
    runs-on: windows-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up .NET
        uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      # The tag is the version: tag 1.2.3 (or v1.2.3) builds 1.2.3. Other builds use the
      # Version in Directory.Build.props.
      - name: Resolve the version from the tag
        if: startsWith(github.ref, 'refs/tags/')
        shell: bash
        run: echo "VERSION_ARGUMENT=-p:Version=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"

      # A plain build is also the pack step: ProjectDefaults sets GeneratePackageOnBuild for every
      # Release package project, so this produces ./nugets as a side effect. Windows is the job
      # that packs, because DiffEngineTray is WinForms and is excluded from Release-NotWindows.
      - name: Build
        run: dotnet build src --configuration Release ${{ env.VERSION_ARGUMENT }}

      - name: Test
        run: dotnet test --solution src/DiffEngine.slnx --configuration Release --no-build --no-restore

      - name: AOT publish
        run: dotnet publish src/DiffEngine.AotTests/DiffEngine.AotTests.csproj --configuration Release

      - name: Upload received on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: received-windows
          path: '**/*.received.*'
          if-no-files-found: ignore
          retention-days: 14

      # DE0001 warns when a RID has no native renderer. Shipping a package that cannot run on a
      # platform it claims to support is worse than failing the release.
      - name: Verify every RID has a native renderer
        if: startsWith(github.ref, 'refs/tags/')
        shell: bash
        run: |
          missing=0
          check() {
            directory="src/$1/runtimes/$2/native"
            if [ -z "$(ls -A "$directory" 2>/dev/null)" ]; then
              echo "::error::No native renderer for $2. Run the build-native workflow."
              missing=1
            fi
          }
          # No Windows RIDs: that head renders with WinForms and loads no native library.
          check DiffEngineViewer.Linux linux-x64
          check DiffEngineViewer.Linux linux-arm64
          check DiffEngineViewer.Mac osx-x64
          check DiffEngineViewer.Mac osx-arm64
          exit $missing

      - name: Upload packages
        if: success()
        uses: actions/upload-artifact@v7
        with:
          name: nupkgs
          path: nugets/*.nupkg
          if-no-files-found: warn
          retention-days: 30

  unix:
    name: ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        # macOS is pinned rather than latest, because it carries committed pixel baselines and
        # Core Text rasterisation moves between OS versions. Same image build-native uses.
        os: [ubuntu-latest, macos-14]
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up .NET
        uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      # raylib links against X11, GL and friends. xvfb plus the Mesa software rasteriser are what
      # the pixel snapshots run against.
      - name: Install native dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            cmake ninja-build \
            libx11-dev libxrandr-dev libxi-dev libxcursor-dev libxinerama-dev \
            libgl1-mesa-dev libglu1-mesa-dev libwayland-dev libxkbcommon-dev \
            xvfb libgl1-mesa-dri

      # CMake fetches raylib and imgui, so without this every PR re-clones and recompiles them.
      # Keyed on the shim's own sources, which is what actually changes.
      - name: Cache native build
        if: runner.os == 'Linux'
        uses: actions/cache@v6
        with:
          path: native/build
          key: native-linux-x64-${{ hashFiles('native/CMakeLists.txt', 'native/src/**', 'native/include/**') }}

      # Built here rather than taken from the committed binaries, so the Linux job tests the
      # current native source and the pixel baselines track it.
      - name: Build native renderer
        if: runner.os == 'Linux'
        run: |
          cmake -S native -B native/build/linux-x64 -G Ninja -DCMAKE_BUILD_TYPE=Release
          cmake --build native/build/linux-x64
          mkdir -p src/DiffEngineViewer.Linux/runtimes/linux-x64/native
          cp native/build/linux-x64/libdiffengine_viewer.so src/DiffEngineViewer.Linux/runtimes/linux-x64/native/

      # Same reason as the Linux build above, and the same trade. Before it, a change to
      # native/swift did not reach this job at all until build-native had run and its binaries PR
      # had been merged, so the macOS baselines described the previous rebuild and a Swift change
      # could not go red here however wrong it was.
      #
      # Only this runner's own architecture, because this is the only thing that loads it. The
      # committed universal binary is still loaded and still checked, by the native job below —
      # which is the job that exists to prove what actually ships.
      #
      # Not cached: this is six Swift files against system frameworks, twenty-odd seconds, and a
      # stale cache here would reintroduce exactly the staleness the step removes.
      - name: Build native renderer
        if: runner.os == 'macOS'
        run: |
          swift build -c release --package-path native/swift
          mkdir -p src/DiffEngineViewer.Mac/runtimes/osx-arm64/native
          cp "$(swift build -c release --package-path native/swift --show-bin-path)/libdiffengine_viewer.dylib" \
            src/DiffEngineViewer.Mac/runtimes/osx-arm64/native/

      # Release-NotWindows drops the WinForms tray and its tests from the solution.
      - name: Build
        run: dotnet build src --configuration Release-NotWindows

      - name: Test
        run: dotnet test --solution src/DiffEngine.slnx --configuration Release-NotWindows --no-build --no-restore

      # Pinned to one rasteriser rather than one platform: llvmpipe is pure software and so more
      # reproducible than any GPU driver, and ImGui rasterises glyphs itself.
      - name: Pixel snapshots
        if: runner.os == 'Linux'
        env:
          DIFFENGINE_VIEWER_PIXEL_TESTS: 'true'
          LIBGL_ALWAYS_SOFTWARE: '1'
          GALLIUM_DRIVER: llvmpipe
        # Release, not Release-NotWindows: that is a solution level configuration which the slnx
        # maps to a project configuration of Release, so the output lives in bin/Release. Naming
        # the solution configuration here points at a directory that never exists.
        run: >
          xvfb-run -a --server-args="-screen 0 1920x1080x24"
          dotnet test src/DiffEngineViewer.Tests/DiffEngineViewer.Tests.csproj
          --configuration Release --no-build --no-restore

      # No xvfb and no GL flags: deview_capture on this platform draws into a bitmap context of its
      # own making, so it needs neither a window nor a window server. Determinism is pinned inside
      # that call rather than by the environment.
      - name: Pixel snapshots
        if: runner.os == 'macOS'
        env:
          DIFFENGINE_VIEWER_PIXEL_TESTS: 'true'
        run: >
          dotnet test src/DiffEngineViewer.Tests/DiffEngineViewer.Tests.csproj
          --configuration Release --no-build --no-restore

      - name: Upload received on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: received-${{ matrix.os }}
          path: '**/*.received.*'
          if-no-files-found: ignore
          retention-days: 14

  # Neither job above loads a committed binary any more: both build the shim from source so their
  # pixel baselines track it. That leaves nothing testing what actually ships, which is this job.
  # It loads the committed binaries as they are, which is what catches a wrong architecture, a file
  # corrupted by a text mode checkout, an unsatisfied runtime dependency, or simply a rebuild that
  # was never merged.
  #
  # It runs DiffEngineViewer.Tests rather than the whole suite: that is where the native smoke test
  # lives, it takes seconds, and it gives the screen and IPC tests some cross architecture coverage
  # for free.
  native:
    name: native ${{ matrix.rid }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          # osx-x64 has no entry: GitHub's Intel macOS runners are being retired and a job
          # targeting one now sits queued indefinitely. Both macOS RIDs ship the same universal
          # dylib, so loading it here covers the arm64 slice and the step below checks that the
          # x86_64 slice is present.
          #
          # linux-x64 is here because it is the RID most people run and nothing else loads its
          # committed binary: the Ubuntu job above overwrites that file with a fresh build before
          # testing, so a linux-x64 rebuild that was never merged would have shipped unnoticed.
          #
          # No Windows entry either, since that head renders with WinForms and loads nothing.
          - rid: osx-arm64
            os: macos-14
          - rid: linux-x64
            os: ubuntu-24.04
          - rid: linux-arm64
            os: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up .NET
        uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      # Runtime libraries only, not the -dev packages: the shim links X11 and GL, so loading it
      # needs them present even though nothing here opens a window.
      - name: Install runtime dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libx11-6 libxrandr2 libxi6 libxcursor1 libxinerama1 libgl1 libglx-mesa0

      # The runtime load above only exercises the arm64 slice. Assert the x86_64 one is there too,
      # since osx-x64 ships this identical file and cannot be loaded anywhere in CI.
      - name: Check the macOS dylib is universal
        if: matrix.rid == 'osx-arm64'
        run: |
          for rid in osx-arm64 osx-x64; do
            dylib="src/DiffEngineViewer.Mac/runtimes/$rid/native/libdiffengine_viewer.dylib"
            archs=$(lipo -archs "$dylib")
            echo "$rid: $archs"
            for arch in x86_64 arm64; do
              case " $archs " in
                *" $arch "*) ;;
                *) echo "::error::$dylib is missing the $arch slice"; exit 1 ;;
              esac
            done
          done

      - name: Test
        run: dotnet test src/DiffEngineViewer.Tests/DiffEngineViewer.Tests.csproj --configuration Release

      - name: Upload received on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: received-${{ matrix.rid }}
          path: '**/*.received.*'
          if-no-files-found: ignore
          retention-days: 14

  # Trusted publishing: no stored API key. nuget.org validates GitHub's OIDC token against the
  # policy naming this repository and this workflow file, and returns a key good for an hour.
  # Waits on every job, so a package only ships once all platforms and the committed native
  # binaries have passed.
  publish:
    needs: [windows, unix, native]
    environment: nuget
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Download packages
        uses: actions/download-artifact@v8
        with:
          name: nupkgs
          path: packages

      - name: NuGet login
        id: login
        uses: NuGet/login@v1
        with:
          user: SimonCropp

      - name: Push to nuget.org
        run: >
          dotnet nuget push "packages/**/*.nupkg"
          --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
          --source https://api.nuget.org/v3/index.json
          --skip-duplicate