cproof/.github/workflows/ci-code.yml

name: CI Code

on:
  push:
    branches: [master]
    paths-ignore:
      - 'docs/**'
      - 'apidocs/**'
      - 'README.md'
  pull_request:
    branches: [master]
    paths-ignore:
      - 'docs/**'
      - 'apidocs/**'
      - 'README.md'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  linux:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        flavor: [arch, debian, ubuntu]

    name: Linux
    steps:
      - uses: actions/checkout@v4
      - name: Build
        run: docker build -f ci/Dockerfile.${{ matrix.flavor }} -t profanity .
      - name: Run tests
        run: docker run profanity ./ci-build.sh

  code-style:
    runs-on: ubuntu-latest
    name: Check coding style
    continue-on-error: true
    env:
      GITHUB_WORKSPACE: ${{ runner.workspace }}
    steps:
      - uses: actions/checkout@v4
      # if this check fails, you have to update the number of auto types known and the list of auto types in the check below
      - name: Check auto types are up-to-date
        run: |
          [[ "$(find src -type f -name '*.[ch]' -exec awk '/^#define auto_[\W]*/ {print $2}' '{}' \; | sort -u | wc -l)" == "8" ]] || exit -1
      - name: Check auto types are initialized
        run: |
          grep -P 'auto_(char|gchar|gcharv|guchar|jid|sqlite|gfd|FILE)[\w *]*;$' -r src && exit -1 || true

      - name: Check CWE-134 format string vulnerabilities
        run: ./check-cwe134.sh

      - name: Install clang-format
        run: |
          sudo apt-get update
          sudo apt-get install -y clang-format

      - name: Run clang-format check
        run: |
          echo $(clang-format --version)
          # Find all source files you care about
          INCLUDE_REGEX='^.*\.((((c|C)(c|pp|xx|\+\+)?$)|((h|H)h?(pp|xx|\+\+)?$))|(ino|pde|proto|cu))$'
          CHECK_PATH='src'
          files=$(find "$CHECK_PATH" -name .git -prune -o -regextype posix-egrep -regex "$INCLUDE_REGEX" -print)
          if [ -z "$files" ]; then
            echo "✅ No source files found to check."
            exit 0
          fi
          
          # Run clang-format in dry-run mode and collect any improperly formatted files
          failed=0
          for file in $files; do
            if ! output=$(clang-format --dry-run --Werror --style=file "$file" 2>&1); then
              echo "❌ Failed on file: $file"
              echo "$output"
              echo "----------------------------------------"
              failed=1
            fi
          done

          if [ $failed -ne 0 ]; then
            echo "🚫 One or more files are not properly formatted."
          else
            echo "✅ All files are properly formatted."
          fi
          exit $failed

  spell-check:
    runs-on: ubuntu-latest
    name: Check spelling
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: |
          sudo apt update
          sudo apt install -y --no-install-recommends codespell
      - name: Check spelling
        run: |
          codespell

  coverage:
    runs-on: ubuntu-latest
    name: Code Coverage
    steps:
      - uses: actions/checkout@v4
      - name: Build
        run: docker build -f ci/Dockerfile.arch -t profanity-cov .
      - name: Run coverage
        run: docker run profanity-cov ./ci-build.sh --coverage-only