ci.yml

name: CI

on:
  push:
    branches: [main, develop, 'feature/**']
  pull_request:
    branches: [main, develop]
  schedule:
    # Nightly extended fuzz run (03:17 UTC). Odd minute avoids the top-of-hour
    # scheduling pileup on GitHub's side.
    - cron: '17 3 * * *'

jobs:
  build:
    # The nightly cron is workflow-wide; only fuzz-nightly should run on it.
    # Gate every non-fuzz job on non-schedule so idle-branch nights don't burn
    # runners (and can't spuriously trip the perf-regression gate).
    if: github.event_name != 'schedule'
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux - GCC (primary)
          - os: ubuntu-24.04
            compiler: gcc
            cc: gcc-14
            cxx: g++-14
            name: Linux GCC 14

          # Linux - Clang
          - os: ubuntu-24.04
            compiler: clang
            cc: clang-18
            cxx: clang++-18
            name: Linux Clang 18

          # Windows - MSVC
          - os: windows-latest
            compiler: msvc
            name: Windows MSVC

          # macOS - Apple Clang
          - os: macos-latest
            compiler: apple-clang
            cc: clang
            cxx: clang++
            name: macOS Apple Clang

    runs-on: ${{ matrix.os }}
    name: ${{ matrix.name }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build libc++-18-dev libc++abi-18-dev

      - name: Install dependencies (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install ninja

      - name: Setup MSVC (Windows)
        if: runner.os == 'Windows'
        uses: ilammy/msvc-dev-cmd@v1

      - name: Configure (Unix)
        if: runner.os != 'Windows'
        env:
          CC: ${{ matrix.cc }}
          CXX: ${{ matrix.cxx }}
        run: |
          cmake -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DNFX_BUILD_TESTS=ON \
            -DNFX_BUILD_BENCHMARKS=OFF \
            -DNFX_BUILD_EXAMPLES=OFF \
            -DNFX_ENABLE_SIMD=OFF \
            -DNFX_ENABLE_LOGGING=OFF \
            -DNFX_ENABLE_ABSEIL=OFF

      - name: Configure (Windows)
        if: runner.os == 'Windows'
        run: |
          cmake -B build -G Ninja `
            -DCMAKE_BUILD_TYPE=Release `
            -DNFX_BUILD_TESTS=ON `
            -DNFX_BUILD_BENCHMARKS=OFF `
            -DNFX_BUILD_EXAMPLES=OFF `
            -DNFX_ENABLE_SIMD=OFF `
            -DNFX_ENABLE_LOGGING=OFF `
            -DNFX_ENABLE_ABSEIL=OFF

      - name: Build
        run: cmake --build build --config Release

      - name: Test
        run: ctest --test-dir build --output-on-failure -C Release

  # Code coverage (Linux GCC, Debug build for accurate line coverage)
  coverage:
    runs-on: ubuntu-24.04
    name: Coverage
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'pull_request'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build lcov

      # Two configurations are captured and merged so SIMD and logging branches
      # appear in the report. ubuntu-24.04 runners are AVX2-capable, so the
      # SIMD-ON config exercises simd_scanner / structural_index AVX2 paths.
      # AVX-512 branches are runner-dependent and excluded from the gate when
      # unavailable (they simply stay uncovered in the merged tracefile).
      - name: Configure (SIMD OFF, logging OFF)
        env:
          CC: gcc-14
          CXX: g++-14
        run: |
          cmake -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Debug \
            -DNFX_BUILD_TESTS=ON \
            -DNFX_BUILD_BENCHMARKS=OFF \
            -DNFX_BUILD_EXAMPLES=OFF \
            -DNFX_ENABLE_SIMD=OFF \
            -DNFX_ENABLE_LOGGING=OFF \
            -DNFX_ENABLE_ABSEIL=OFF \
            -DNFX_ENABLE_COVERAGE=ON

      - name: Build (SIMD OFF)
        run: cmake --build build

      - name: Test (SIMD OFF)
        run: ctest --test-dir build --output-on-failure

      - name: Capture branch + line coverage (SIMD OFF)
        run: |
          lcov --capture --directory build --output-file cov-simd-off.info \
            --rc branch_coverage=1 --gcov-tool gcov-14 \
            --ignore-errors mismatch
          lcov --remove cov-simd-off.info \
            '/usr/*' '*/tests/*' '*/build/*' '*/benchmarks/*' \
            '*/examples/*' '*/_deps/*' \
            --rc branch_coverage=1 --ignore-errors unused \
            --output-file cov-simd-off.info

      - name: Configure (SIMD ON, logging ON)
        env:
          CC: gcc-14
          CXX: g++-14
        run: |
          cmake -B build-simd -G Ninja \
            -DCMAKE_BUILD_TYPE=Debug \
            -DNFX_BUILD_TESTS=ON \
            -DNFX_BUILD_BENCHMARKS=OFF \
            -DNFX_BUILD_EXAMPLES=OFF \
            -DNFX_ENABLE_SIMD=ON \
            -DNFX_ENABLE_LOGGING=ON \
            -DNFX_ENABLE_ABSEIL=OFF \
            -DNFX_ENABLE_COVERAGE=ON

      - name: Build (SIMD ON)
        run: cmake --build build-simd

      - name: Test (SIMD ON)
        run: ctest --test-dir build-simd --output-on-failure

      - name: Capture branch + line coverage (SIMD ON)
        run: |
          lcov --capture --directory build-simd --output-file cov-simd-on.info \
            --rc branch_coverage=1 --gcov-tool gcov-14 \
            --ignore-errors mismatch
          lcov --remove cov-simd-on.info \
            '/usr/*' '*/tests/*' '*/build/*' '*/build-simd/*' '*/benchmarks/*' \
            '*/examples/*' '*/_deps/*' \
            --rc branch_coverage=1 --ignore-errors unused \
            --output-file cov-simd-on.info

      - name: Merge tracefiles
        run: |
          lcov --add-tracefile cov-simd-off.info \
               --add-tracefile cov-simd-on.info \
               --rc branch_coverage=1 --ignore-errors unused \
               --output-file coverage.info
          lcov --list coverage.info --rc branch_coverage=1
          # lcov 2.0 --list omits the branch column; --summary reports it.
          lcov --summary coverage.info --rc branch_coverage=1

      - name: Generate HTML branch report
        run: |
          genhtml --branch-coverage \
            --output-directory coverage-html \
            --ignore-errors source,category \
            coverage.info

      - name: Upload HTML coverage artifact
        uses: actions/upload-artifact@v4
        with:
          name: coverage-html-branch
          path: coverage-html
          retention-days: 14

      - name: Upload to Codecov
        if: env.CODECOV_TOKEN != ''
        uses: codecov/codecov-action@v4
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
          file: coverage.info
          # Hard gate: a broken upload now fails the job instead of passing
          # silently. The no-token skip above keeps forks (which never get the
          # secret) green.
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}

      # Hard lcov branch-coverage gate, independent of Codecov availability.
      # Parses `lcov --summary` in-job and fails if overall branch coverage or
      # any per-module floor drops below the Phase 1/Phase 5 anchor (measured
      # 2026-07-16, achieved-minus-2%). Floors, not the exact achieved number,
      # so run-to-run template-instantiation jitter in branch totals cannot flake
      # the gate red. sbe/ is floored at its GCC-artifact ceiling (~53%; 169 of
      # its uncovered branches are compiler-instrumented memcpy/memset dispatch
      # that no source-level test can flip, see TICKET_497 Phase 1 notes).
      - name: Branch-coverage gate (lcov)
        run: scripts/coverage_gate.sh coverage.info

  # Static analysis: clang-tidy bounds-safety checks (TICKET_491)
  clang-tidy:
    if: github.event_name != 'schedule'
    runs-on: ubuntu-24.04
    name: Clang-Tidy

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build clang-tidy-18 clang-18 libc++-18-dev libc++abi-18-dev

      - name: Configure
        env:
          CC: clang-18
          CXX: clang++-18
        run: |
          cmake -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
            -DNFX_BUILD_TESTS=ON \
            -DNFX_BUILD_BENCHMARKS=OFF \
            -DNFX_BUILD_EXAMPLES=OFF \
            -DNFX_ENABLE_SIMD=OFF \
            -DNFX_ENABLE_LOGGING=OFF \
            -DNFX_ENABLE_ABSEIL=OFF

      - name: Run clang-tidy
        run: |
          find include/nexusfix -name '*.hpp' | \
            xargs clang-tidy-18 -p build --warnings-as-errors='*' \
              --extra-arg=-std=c++23 \
              --extra-arg=-stdlib=libc++ \
              --extra-arg=-I"$(pwd)"/include \
              2>&1 | \
            tee clang-tidy-output.txt
          if grep -q 'error:' clang-tidy-output.txt; then
            echo "::error::clang-tidy found violations"
            exit 1
          fi

  # Linux with full features (io_uring, SIMD, Abseil)
  linux-full:
    if: github.event_name != 'schedule'
    runs-on: ubuntu-24.04
    name: Linux Full Features

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build liburing-dev jq

      - name: Configure
        env:
          CC: gcc-14
          CXX: g++-14
        run: |
          cmake -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DNFX_BUILD_TESTS=ON \
            -DNFX_BUILD_BENCHMARKS=ON \
            -DNFX_ENABLE_SIMD=ON \
            -DNFX_ENABLE_IO_URING=ON \
            -DNFX_ENABLE_LOGGING=ON \
            -DNFX_ENABLE_ABSEIL=ON

      - name: Build
        run: cmake --build build --config Release

      - name: Test
        run: ctest --test-dir build --output-on-failure

      - name: Performance Regression Check
        run: ./scripts/check_perf_regression.sh 10000

  # Sanitizers (TICKET_497 Phase 5): run the full test suite under ASan+UBSan
  # with SIMD ON. Closes config-matrix gap #1 (the main suite, including the
  # Phase 2 fault-injection and Phase 4 boundary suites, never ran under a
  # sanitizer in CI). Debug build so assertion bodies are live; leak detection on.
  sanitizers:
    if: github.event_name != 'schedule'
    runs-on: ubuntu-24.04
    name: Sanitizers (ASan+UBSan)

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build

      - name: Configure
        env:
          CC: gcc-14
          CXX: g++-14
          CFLAGS: -fsanitize=address,undefined -fno-sanitize-recover=all -fno-omit-frame-pointer
          CXXFLAGS: -fsanitize=address,undefined -fno-sanitize-recover=all -fno-omit-frame-pointer
          LDFLAGS: -fsanitize=address,undefined
        run: |
          cmake -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Debug \
            -DNFX_BUILD_TESTS=ON \
            -DNFX_BUILD_BENCHMARKS=OFF \
            -DNFX_BUILD_EXAMPLES=OFF \
            -DNFX_ENABLE_SIMD=ON \
            -DNFX_ENABLE_LOGGING=ON \
            -DNFX_ENABLE_ABSEIL=OFF

      - name: Build
        run: cmake --build build

      - name: Test (ASan+UBSan, leak detection on)
        env:
          ASAN_OPTIONS: detect_leaks=1
          UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
        run: ctest --test-dir build --output-on-failure

  # mimalloc (TICKET_497 Phase 5): normal build with NFX_ENABLE_MIMALLOC=ON so
  # the SessionHeap path and its Phase 2 OOM loop (test_mimalloc.cpp,
  # NFX_HAS_MIMALLOC guard) run in CI. Closes config-matrix gap #2. Not a
  # sanitized job by design: mimalloc's allocator collides with the ASan
  # interceptor, so its honest CI home is a plain build.
  mimalloc:
    if: github.event_name != 'schedule'
    runs-on: ubuntu-24.04
    name: mimalloc SessionHeap

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build

      - name: Configure
        env:
          CC: gcc-14
          CXX: g++-14
        run: |
          cmake -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DNFX_BUILD_TESTS=ON \
            -DNFX_BUILD_BENCHMARKS=OFF \
            -DNFX_BUILD_EXAMPLES=OFF \
            -DNFX_ENABLE_SIMD=ON \
            -DNFX_ENABLE_MIMALLOC=ON

      - name: Build
        run: cmake --build build --config Release

      - name: Test
        run: ctest --test-dir build --output-on-failure

  # Fuzzing smoke (TICKET_497 Phase 3): build the libFuzzer harnesses and run a
  # short bounded pass over the seed corpus on every PR/push. A crash fails CI
  # and the crashing input is uploaded for triage. Clang + libFuzzer only; the
  # harnesses link libstdc++ because the packaged libFuzzer runtime uses its ABI.
  fuzz-smoke:
    if: github.event_name != 'schedule'
    runs-on: ubuntu-24.04
    name: Fuzz Smoke
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # clang-19 (not 18): libstdc++'s <expected> is gated on
      # __cpp_concepts >= 202002L, which clang-18 does not define (it reports
      # 201907L), so the parser's std::expected use fails to compile with the
      # libstdc++ the packaged libFuzzer runtime is built against. clang-19
      # defines 202002L and keeps the libstdc++ ABI pairing intact.
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build clang-19 libstdc++-14-dev

      - name: Configure
        env:
          CC: clang-19
          CXX: clang++-19
        run: |
          cmake -B build-fuzz -G Ninja \
            -DCMAKE_BUILD_TYPE=Debug \
            -DNFX_BUILD_FUZZERS=ON \
            -DNFX_BUILD_TESTS=OFF \
            -DNFX_BUILD_BENCHMARKS=OFF \
            -DNFX_BUILD_EXAMPLES=OFF \
            -DNFX_ENABLE_LOGGING=OFF \
            -DNFX_ENABLE_ABSEIL=OFF \
            -DNFX_ENABLE_SIMD=ON \
            -DNFX_ENABLE_XSIMD=ON

      - name: Build harnesses
        run: cmake --build build-fuzz

      - name: Smoke run (60s per harness)
        run: |
          set -e
          for h in fuzz_structural_index fuzz_runtime_parser \
                   fuzz_session_input fuzz_serializer_roundtrip \
                   fuzz_sbe_decode; do
            echo "== smoke: $h =="
            # Scratch dir first (writable): new inputs land there, not in the
            # checked-in seed corpus. The seed corpus is a read-only second arg.
            mkdir -p "smoke-corpus/$h"
            ./build-fuzz/fuzz/$h \
              -max_total_time=60 -print_final_stats=1 \
              "smoke-corpus/$h" "fuzz/corpus/$h"
          done

      - name: Upload crash inputs
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-crashes
          path: |
            crash-*
            timeout-*
            oom-*
          if-no-files-found: ignore
          retention-days: 14

  # Nightly extended fuzz: longer run per harness with corpus caching so coverage
  # accumulates across runs. Keyed on the seed-corpus hash so a corpus change
  # starts a fresh cache line rather than reusing a stale one.
  fuzz-nightly:
    if: github.event_name == 'schedule'
    runs-on: ubuntu-24.04
    name: Fuzz Nightly
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # clang-19: same std::expected / __cpp_concepts constraint as fuzz-smoke.
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build clang-19 libstdc++-14-dev

      - name: Hash seed corpus
        id: corpus
        run: echo "hash=${{ hashFiles('fuzz/corpus/**') }}" >> "$GITHUB_OUTPUT"

      # The primary key must be unique per run, otherwise actions/cache sees an
      # exact hit on the constant seed hash and skips the save at job end, so the
      # corpus never grows past night 1. run_id makes every night save a fresh
      # entry; the seed hash is a restore-key prefix so a corpus change starts a
      # clean line and an unchanged corpus restores the most recent accumulation.
      - name: Restore accumulated corpus
        uses: actions/cache@v4
        with:
          path: fuzz-corpus-cache
          key: fuzz-corpus-${{ steps.corpus.outputs.hash }}-${{ github.run_id }}
          restore-keys: |
            fuzz-corpus-${{ steps.corpus.outputs.hash }}-
            fuzz-corpus-

      - name: Configure
        env:
          CC: clang-19
          CXX: clang++-19
        run: |
          cmake -B build-fuzz -G Ninja \
            -DCMAKE_BUILD_TYPE=Debug \
            -DNFX_BUILD_FUZZERS=ON \
            -DNFX_BUILD_TESTS=OFF \
            -DNFX_BUILD_BENCHMARKS=OFF \
            -DNFX_BUILD_EXAMPLES=OFF \
            -DNFX_ENABLE_LOGGING=OFF \
            -DNFX_ENABLE_ABSEIL=OFF \
            -DNFX_ENABLE_SIMD=ON \
            -DNFX_ENABLE_XSIMD=ON

      - name: Build harnesses
        run: cmake --build build-fuzz

      - name: Extended run (600s per harness)
        run: |
          set -e
          for h in fuzz_structural_index fuzz_runtime_parser \
                   fuzz_session_input fuzz_serializer_roundtrip \
                   fuzz_sbe_decode; do
            mkdir -p "fuzz-corpus-cache/$h"
            echo "== nightly: $h =="
            ./build-fuzz/fuzz/$h \
              -max_total_time=600 -print_final_stats=1 \
              "fuzz-corpus-cache/$h" "fuzz/corpus/$h"
          done

      - name: Upload crash inputs
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-nightly-crashes
          path: |
            crash-*
            timeout-*
            oom-*
          if-no-files-found: ignore
          retention-days: 30