name: linux-ci

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - linux-*.*.x
    tags:
      - linux-*

  pull_request:
    branches:
      - '*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  # INFO: We are cancelling the concurrency group if the change is on PR. For workflow dispatch, this will not work.
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

permissions:
  id-token: write         # needed for AWS
  actions: read           # needed for CodeQL
  contents: read          # needed for CodeQL
  security-events: write  # needed for CodeQL

env:
  EGL_PLATFORM: surfaceless

jobs:
  pre_job:
    runs-on: ubuntu-24.04
    outputs:
      should_skip: ${{ github.event_name != 'workflow_dispatch' && steps.changed-files.outputs.linux_any_modified != 'true' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false

      - name: Get all Linux files that have changed
        if: github.event_name != 'workflow_dispatch'
        id: changed-files

        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          files_yaml_from_source_file: .github/changed-files.yml

      - name: List changed files
        if: steps.changed-files.outputs.linux_any_modified == 'true'
        run: |
          echo "Changed file(s): ${{ steps.changed-files.outputs.linux_all_changed_files }}"

  linux-build-and-test:
    if: needs.pre_job.outputs.should_skip != 'true'
    needs: pre_job
    strategy:
      fail-fast: true
      matrix:
        variant:
          - renderer: vulkan
            rust: false
          - renderer: opengl
            rust: false
          - renderer: opengl
            rust: true
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
        with:
          languages: cpp

      - name: Install dependencies
        run: .github/scripts/install-linux-deps

      - uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5
        with:
          tool: armerge@2

      - if: matrix.variant.rust
        run: cargo install cxxbridge-cmd --version 1.0.157 --locked

      - name: Install ctcache
        run: |
          # pending open PR https://github.com/matus-chochlik/ctcache/pull/94
          git clone https://github.com/louwers/ctcache.git
          cd ctcache
          cd ..
          mv ctcache /usr/local/bin

      - name: Configure sccache
        uses: ./.github/actions/configure-sccache-s3
        with:
          vars: ${{ toJSON(vars) }}

      - name: Build MapLibre Native
        env:
          CI: 1
        run: |
          cmake --version

          # ctcache configuration
          export CTCACHE_HOST=34.229.50.221
          export CTCACHE_PORT=5000
          export CTCACHE_PROTO=http

          if [ -n "${{ secrets.CTCACHE_AUTH_KEY }}" ]; then
            echo "setting CTCACHE_AUTH_KEY"
            export CTCACHE_AUTH_KEY=${{ secrets.CTCACHE_AUTH_KEY }}
          else
            # do not write to cache if CTCACHE_AUTH_KEY not set
            export CTCACHE_HOST_READ_ONLY=1
          fi

          cmake --preset linux-${{ matrix.variant.renderer }} \
            -DMLN_WITH_CLANG_TIDY=ON \
            -DCLANG_TIDY_COMMAND=/usr/local/bin/ctcache/clang-tidy \
            -DCMAKE_C_COMPILER_LAUNCHER=sccache \
            -DCMAKE_CXX_COMPILER_LAUNCHER=sccache \
            -DMLN_WITH_COVERAGE=ON
          cmake --build build-linux-${{ matrix.variant.renderer }} --target mbgl-core mbgl-test-runner mbgl-render-test-runner mbgl-expression-test mbgl-render mbgl-benchmark-runner

      # mbgl-render (used for size test) & mbgl-benchmark-runner

      - name: Show sccache stats
        run: sccache --show-stats

      - name: Upload mbgl-render as artifact
        if: matrix.variant.renderer == 'opengl' && !matrix.variant.rust && github.event_name == 'pull_request'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mbgl-render
          path: |
            build-linux-${{ matrix.variant.renderer }}/bin/mbgl-render

      - name: Upload mbgl-benchmark-runner as artifact
        if: matrix.variant.renderer == 'opengl' && !matrix.variant.rust && github.event_name == 'pull_request'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mbgl-benchmark-runner
          path: |
            build-linux-${{ matrix.variant.renderer }}/mbgl-benchmark-runner

      - name: Upload mbgl-render & mbgl-benchmark-runner to S3
        if: matrix.variant.renderer == 'opengl' && !matrix.variant.rust && github.ref == 'refs/heads/main' && vars.OIDC_AWS_ROLE_TO_ASSUME
        run: |
          aws s3 cp build-linux-${{ matrix.variant.renderer }}/bin/mbgl-render s3://maplibre-native/mbgl-render-main
          aws s3 cp build-linux-${{ matrix.variant.renderer }}/mbgl-benchmark-runner s3://maplibre-native/mbgl-benchmark-runner-main

      # CodeQL

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
        with:
          category: "/language:cpp"

      # unit tests

      - run: chmod +x build-linux-${{ matrix.variant.renderer }}/mbgl-test-runner

      - name: Run C++ tests
        continue-on-error: ${{ matrix.variant.renderer == 'vulkan' }}
        run: xvfb-run -a build-linux-${{ matrix.variant.renderer }}/mbgl-test-runner

      # render tests

      - run: chmod +x build-linux-${{ matrix.variant.renderer }}/mbgl-render-test-runner

      - name: Run render test
        id: render_test
        run: |
          renderer="${{ matrix.variant.renderer }}"
          if [[ "$renderer" == *-rust ]]; then
            renderer=${renderer%-rust}
          fi
          xvfb-run -a build-linux-${{ matrix.variant.renderer }}/mbgl-render-test-runner --manifestPath=metrics/linux-"$renderer".json

      - name: Upload render test result
        if: always() && steps.render_test.outcome == 'failure'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: render-test-result-${{ matrix.variant.renderer }}
          path: |
            metrics/linux-${{ matrix.variant.renderer }}.html

      # expression tests

      - run: chmod +x build-linux-${{ matrix.variant.renderer }}/expression-test/mbgl-expression-test

      - name: Run expression test
        run: build-linux-${{ matrix.variant.renderer }}/expression-test/mbgl-expression-test

  linux-coverage:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false

      - name: Install dependencies
        run: .github/scripts/install-linux-deps

      - name: Cache Bazel
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          key: ${{ runner.os }}-bazel-${{ hashFiles('.bazelversion', '.bazelrc', 'WORKSPACE', 'WORKSPACE.bazel', 'MODULE.bazel') }}
          restore-keys: |
            ${{ runner.os }}-bazel-
          path: ~/.cache/bazel

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: '.nvmrc'

      - name: Start server
        run: |
          npm install
          node test/storage/server.js &

      - name: Generate coverage report
        run: |
          xvfb-run -a \
            bazel coverage --combined_report=lcov  --instrumentation_filter="//:mbgl-core" \
            --test_output=errors --local_test_jobs=1 \
            --repo_env=GCOV="$PWD/.github/scripts/gcov_wrapper" \
            --test_env=DISPLAY --test_env=XAUTHORITY --copt="-DCI_BUILD" \
            //test:core //render-test:render-test //expression-test:test --//:renderer=drawable
          echo coverage_report="$(bazel info output_path)"/_coverage/_coverage_report.dat >> "$GITHUB_ENV"

      - name: Upload coverage report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-report
          path: ${{ env.coverage_report }}

  linux-ci-result:
    name: Linux CI Result
    if: needs.pre_job.outputs.should_skip != 'true' && always()
    runs-on: ubuntu-24.04
    needs:
      - pre_job
      - linux-build-and-test
      - linux-coverage
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - if: github.event_name == 'pull_request'
        uses: ./.github/actions/save-pr-number

      - name: Mark result as failed
        if: needs.linux-build-and-test.result != 'success' || needs.linux-coverage.result != 'success'
        run: exit 1