name: linux-ci

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - linux-*.*.x
    tags:
      - linux-*

  pull_request:
    branches:
      - '*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  # INFO: We are cancelling the concurrency group if the change is on PR. For workflow dispatch, this will not work.
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

permissions:
  id-token: write         # needed for AWS
  actions: read           # needed for CodeQL
  contents: read          # needed for CodeQL
  security-events: write  # needed for CodeQL

env:
  EGL_PLATFORM: surfaceless

jobs:
  pre_job:
    runs-on: ubuntu-24.04
    outputs:
      should_skip: ${{ github.event_name != 'workflow_dispatch' && steps.changed-files.outputs.linux_any_modified != 'true' }}
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
        with:
          submodules: recursive
          persist-credentials: false

      - name: Get all Linux files that have changed
        if: github.event_name != 'workflow_dispatch'
        id: changed-files

        uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1
        with:
          files_yaml_from_source_file: .github/changed-files.yml

      - name: List changed files
        if: steps.changed-files.outputs.linux_any_modified == 'true'
        run: |
          echo "Changed file(s): ${{ steps.changed-files.outputs.linux_all_changed_files }}"

  linux-build-and-test:
    if: needs.pre_job.outputs.should_skip != 'true'
    needs: pre_job
    strategy:
      fail-fast: true
      matrix:
        variant:
          - renderer: vulkan
            rust: false
          - renderer: opengl
            rust: false
          - renderer: opengl
            rust: true
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
        with:
          submodules: recursive
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
        with:
          languages: cpp

      - name: Install dependencies
        run: .github/scripts/install-linux-deps

      - uses: taiki-e/install-action@020705266844b275b711684191e11281be48860c # v2
        with:
          tool: armerge@2

      - if: matrix.variant.rust
        run: cargo install cxxbridge-cmd --version 1.0.157 --locked

      - uses: ./.github/actions/install-sccache

      - name: Install ctcache
        run: |
          # pending open PR https://github.com/matus-chochlik/ctcache/pull/94
          git clone https://github.com/louwers/ctcache.git
          cd ctcache
          cd ..
          mv ctcache /usr/local/bin

      - name: Configure AWS Credentials
        if: vars.OIDC_AWS_ROLE_TO_ASSUME
        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v4
        with:
          aws-region: us-west-2
          role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }}
          role-session-name: ${{ github.run_id }}

      - name: Build MapLibre Native
        env:
          CI: 1
        run: |
          cmake --version

          # sccache configuration
          export SCCACHE_BUCKET=maplibre-native-sccache
          export SCCACHE_REGION=eu-central-1

          if [ -z "${AWS_SECRET_ACCESS_KEY}" ]; then
            echo "AWS_SECRET_ACCESS_KEY not set; not uploading sccache cache to S3"
            export SCCACHE_S3_NO_CREDENTIALS=1
          fi

          # ctcache configuration
          export CTCACHE_HOST=34.229.50.221
          export CTCACHE_PORT=5000
          export CTCACHE_PROTO=http

          if [ -n "${{ secrets.CTCACHE_AUTH_KEY }}" ]; then
            echo "setting CTCACHE_AUTH_KEY"
            export CTCACHE_AUTH_KEY=${{ secrets.CTCACHE_AUTH_KEY }}
          else
            # do not write to cache if CTCACHE_AUTH_KEY not set
            export CTCACHE_HOST_READ_ONLY=1
          fi

          cmake --preset linux-${{ matrix.variant.renderer }} \
            -DMLN_WITH_CLANG_TIDY=ON \
            -DCLANG_TIDY_COMMAND=/usr/local/bin/ctcache/clang-tidy \
            -DCMAKE_C_COMPILER_LAUNCHER=sccache \
            -DCMAKE_CXX_COMPILER_LAUNCHER=sccache \
            -DMLN_WITH_COVERAGE=ON
          cmake --build build-linux-${{ matrix.variant.renderer }} --target mbgl-core mbgl-test-runner mbgl-render-test-runner mbgl-expression-test mbgl-render mbgl-benchmark-runner

      # mbgl-render (used for size test) & mbgl-benchmark-runner

      - name: Show sccache stats
        run: sccache --show-stats

      - name: Upload mbgl-render as artifact
        if: matrix.variant.renderer == 'opengl' && !matrix.variant.rust && github.event_name == 'pull_request'
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: mbgl-render
          path: |
            build-linux-${{ matrix.variant.renderer }}/bin/mbgl-render

      - name: Upload mbgl-benchmark-runner as artifact
        if: matrix.variant.renderer == 'opengl' && !matrix.variant.rust && github.event_name == 'pull_request'
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: mbgl-benchmark-runner
          path: |
            build-linux-${{ matrix.variant.renderer }}/mbgl-benchmark-runner

      - name: Upload mbgl-render & mbgl-benchmark-runner to S3
        if: matrix.variant.renderer == 'opengl' && !matrix.variant.rust && github.ref == 'refs/heads/main' && vars.OIDC_AWS_ROLE_TO_ASSUME
        run: |
          aws s3 cp build-linux-${{ matrix.variant.renderer }}/bin/mbgl-render s3://maplibre-native/mbgl-render-main
          aws s3 cp build-linux-${{ matrix.variant.renderer }}/mbgl-benchmark-runner s3://maplibre-native/mbgl-benchmark-runner-main

      # CodeQL

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
        with:
          category: "/language:cpp"

      # unit tests

      - run: chmod +x build-linux-${{ matrix.variant.renderer }}/mbgl-test-runner

      - name: Run C++ tests
        continue-on-error: ${{ matrix.variant.renderer == 'vulkan' }}
        run: xvfb-run -a build-linux-${{ matrix.variant.renderer }}/mbgl-test-runner

      # render tests

      - run: chmod +x build-linux-${{ matrix.variant.renderer }}/mbgl-render-test-runner

      - name: Run render test
        id: render_test
        run: |
          renderer="${{ matrix.variant.renderer }}"
          if [[ "$renderer" == *-rust ]]; then
            renderer=${renderer%-rust}
          fi
          xvfb-run -a build-linux-${{ matrix.variant.renderer }}/mbgl-render-test-runner --manifestPath=metrics/linux-"$renderer".json

      - name: Upload render test result
        if: always() && steps.render_test.outcome == 'failure'
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: render-test-result-${{ matrix.variant.renderer }}
          path: |
            metrics/linux-${{ matrix.variant.renderer }}.html

      # expression tests

      - run: chmod +x build-linux-${{ matrix.variant.renderer }}/expression-test/mbgl-expression-test

      - name: Run expression test
        run: build-linux-${{ matrix.variant.renderer }}/expression-test/mbgl-expression-test

  linux-coverage:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
        with:
          submodules: recursive
          persist-credentials: false

      - name: Install dependencies
        run: .github/scripts/install-linux-deps

      - name: Cache Bazel
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          key: ${{ runner.os }}-bazel-${{ hashFiles('.bazelversion', '.bazelrc', 'WORKSPACE', 'WORKSPACE.bazel', 'MODULE.bazel') }}
          restore-keys: |
            ${{ runner.os }}-bazel-
          path: ~/.cache/bazel

      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v4
        with:
          node-version-file: '.nvmrc'

      - name: Start server
        run: |
          npm install
          node test/storage/server.js &

      - name: Generate coverage report
        run: |
          xvfb-run -a \
            bazel coverage --combined_report=lcov  --instrumentation_filter="//:mbgl-core" \
            --test_output=errors --local_test_jobs=1 \
            --repo_env=GCOV="$PWD/.github/scripts/gcov_wrapper" \
            --test_env=DISPLAY --test_env=XAUTHORITY --copt="-DCI_BUILD" \
            //test:core //render-test:render-test //expression-test:test --//:renderer=drawable
          echo coverage_report="$(bazel info output_path)"/_coverage/_coverage_report.dat >> "$GITHUB_ENV"

      - name: Upload coverage report
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: coverage-report
          path: ${{ env.coverage_report }}

  linux-ci-result:
    name: Linux CI Result
    if: needs.pre_job.outputs.should_skip != 'true' && always()
    runs-on: ubuntu-22.04
    needs:
      - pre_job
      - linux-build-and-test
      - linux-coverage
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4

      - if: github.event_name == 'pull_request'
        uses: ./.github/actions/save-pr-number

      - name: Mark result as failed
        if: needs.linux-build-and-test.result != 'success' || needs.linux-coverage.result != 'success'
        run: exit 1