ci.yaml

name: CI
permissions: {}

on:
  merge_group:
  pull_request:
    types: [opened, synchronize, reopened]
  schedule:
    # Run CI on `main` daily so there is a cache available for merge queues.
    # See <https://github.com/orgs/community/discussions/66430>
    - cron: "0 8 * * *"
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  CARGO_TERM_VERBOSE: true
  LIBC_BUILD_VERBOSE: true
  LIBC_CI: 1
  RUSTDOCFLAGS: -Dwarnings
  RUSTFLAGS: -Dwarnings
  RUST_BACKTRACE: full
  # Base branch for PRs or for merges, current ref for cron runs on a branch.
  TARGET_REF: ${{ github.base_ref || github.event.merge_group.base_ref || github.ref }}

defaults:
  run:
    shell: bash

jobs:
  style_check:
    name: Style check
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Rust toolchain
        run: ./ci/install-rust.sh && rustup component add rustfmt
      - name: Check style
        run: ./ci/style.py

  clippy:
    name: Clippy on ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-26.04, macos-26, windows-2025]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - run: rustup update stable --no-self-update
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      # Here we use the latest stable Rust toolchain already installed by GitHub
      # Ideally we should run it for every target, but we cannot rely on unstable toolchains
      # due to Clippy not being consistent between them.
      - run: cargo clippy --locked --workspace --exclude libc-test --exclude ctest-test --all-targets -- -D warnings

  # This runs `cargo build --target ...` for all T1 and T2 targets`
  verify_build:
    name: Verify build
    strategy:
      matrix:
        toolchain: [stable, 1.65.0]
        include:
          # Nightly has a lot of targets, so split it in half
          - toolchain: nightly
            half: 1
          - toolchain: nightly
            half: 2
          - toolchain: beta
            only: "(aarch64|x86_64)" # just a spot check for beta
          - toolchain: stable
          - toolchain: 1.65.0 # msrv
    runs-on: ubuntu-26.04
    timeout-minutes: 25
    env:
      TOOLCHAIN: ${{ matrix.toolchain }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Rust toolchain
        run: ./ci/install-rust.sh

      - name: Install semver-checks
        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
        if: matrix.toolchain == 'stable'
        with:
          tool: cargo-semver-checks

      - name: Retrieve semver baseline
        if: matrix.toolchain == 'stable'
        run: ./ci/prep-semver-baseline.sh

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: ${{ matrix.os }}-${{ matrix.toolchain }}

      - name: Execute build check
        run: |
          set -eux
          if [ "${{ matrix.toolchain }}" = "1.65.0" ]; then
              # * Remove `-Dwarnings` at the MSRV since lints may be different
              # * Allow `improper_ctypes` since pointers to ZSTs got the warning prior
              #   to 1.72.
              # * Enable `unknown_lints` since we have some config not known at this
              #   version.
              # FIXME(msrv): update this list when possible.
              export RUSTFLAGS="-Aimproper_ctypes -Aunknown_lints"
              # Remove `ctest` which uses the 2024 edition
              perl -i -ne 'print unless /"ctest(-test)?",/ || /"libc-test",/' Cargo.toml
          fi

          python3 ci/verify-build.py \
            --toolchain "$TOOLCHAIN" \
            ${BASELINE_CRATE_DIR:+"--baseline-crate-dir" "$BASELINE_CRATE_DIR"} \
            ${{ matrix.only && format('--only "{0}"', matrix.only) }} \
            ${{ matrix.half && format('--half "{0}"', matrix.half) }}

  test_tier1:
    name: Test tier1
    strategy:
      matrix:
        include:
          - target: aarch64-apple-darwin
            os: macos-26
          - target: aarch64-pc-windows-msvc
            os: windows-11-arm
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-26.04-arm
          - target: i686-pc-windows-msvc
            os: windows-2025
            host: x86_64-pc-windows-msvc # Tier 1 without host tools
          - target: i686-unknown-linux-gnu
          - target: x86_64-pc-windows-gnu
            os: windows-2025
          - target: x86_64-pc-windows-msvc
            os: windows-2025
          - target: x86_64-unknown-linux-gnu
    runs-on: ${{ matrix.os && matrix.os || 'ubuntu-26.04' }}
    timeout-minutes: 25
    env:
      RUST_HOST: ${{ matrix.host }}
      TARGET: ${{ matrix.target }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Rust toolchain
        run: ./ci/install-rust.sh
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: ${{ matrix.target }}

      - name: Add matrix env variables to the environment
        if: matrix.env
        run: |
          echo '${{ toJson(matrix.env) }}' |
            jq -r 'to_entries | map("\(.key)=\(.value|tostring)") | .[]' >>$GITHUB_ENV
        shell: bash

      - name: Run natively
        if: runner.os != 'Linux'
        run: ./ci/run.sh ${{ matrix.target }}
      - name: Run in Docker
        if: runner.os == 'Linux'
        run: ./ci/run-docker.sh ${{ matrix.target }}

      - name: Create CI artifacts
        id: create_artifacts
        if: always()
        run: echo "step is actually running" && python3 ci/create-artifacts.py
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always() && steps.create_artifacts.outcome == 'success'
        with:
          name: ${{ env.ARCHIVE_NAME }}-${{ matrix.target }}${{ matrix.artifact-tag && format('-{0}', matrix.artifact-tag) }}
          path: ${{ env.ARCHIVE_PATH }}
          retention-days: 5

  test_tier2:
    name: Test tier2
    needs: [test_tier1, style_check]
    strategy:
      fail-fast: true
      max-parallel: 16
      matrix:
        include:
          - target: aarch64-linux-android
          - target: aarch64-unknown-linux-musl
          - target: aarch64-unknown-linux-musl
            env: { TEST_MUSL_V1_2: 1 }
            artifact-tag: new-musl
          - target: arm-linux-androideabi
          - target: arm-unknown-linux-gnueabihf
          - target: arm-unknown-linux-musleabihf
          - target: arm-unknown-linux-musleabihf
            env: { TEST_MUSL_V1_2: 1 }
            artifact-tag: new-musl
          # FIXME(#4297): Disabled due to spurious failue
          # - target: i686-linux-android
          - target: i686-unknown-linux-musl
          - target: i686-unknown-linux-musl
            env: { TEST_MUSL_V1_2: 1 }
            artifact-tag: new-musl
          - target: loongarch64-unknown-linux-gnu
          - target: loongarch64-unknown-linux-musl
          - target: loongarch64-unknown-linux-musl
            env: { TEST_MUSL_V1_2: 1 }
            artifact-tag: new-musl
          - target: powerpc64-unknown-linux-gnu
          - target: powerpc64-unknown-linux-musl
          - target: powerpc64-unknown-linux-musl
            env: { TEST_MUSL_V1_2: 1 }
            artifact-tag: new-musl
          - target: powerpc64le-unknown-linux-gnu
          - target: powerpc64le-unknown-linux-musl
          - target: powerpc64le-unknown-linux-musl
            env: { TEST_MUSL_V1_2: 1 }
            artifact-tag: new-musl
          - target: riscv64gc-unknown-linux-gnu
          - target: riscv64gc-unknown-linux-musl
          - target: riscv64gc-unknown-linux-musl
            env: { TEST_MUSL_V1_2: 1 }
            artifact-tag: new-musl
          - target: s390x-unknown-linux-gnu
          - target: sparc64-unknown-linux-gnu
          - target: wasm32-unknown-emscripten
          - target: wasm32-wasip1
          - target: wasm32-wasip2
          - target: x86_64-apple-darwin
            os: macos-26-intel
          - target: x86_64-linux-android
            # Keep in sync with the Android build pinned in ci/cuttlefish-setup.sh
            artifact-tag: android17
          # FIXME: Exec format error (os error 8)
          # - target: x86_64-unknown-linux-gnux32
          - target: x86_64-unknown-linux-musl
          - target: x86_64-unknown-linux-musl
            env: { TEST_MUSL_V1_2: 1 }
            artifact-tag: new-musl
          # FIXME: https://github.com/rust-lang/libc/issues/5520
          # - target: x86_64-unknown-redox

          # FIXME(ppc): SIGILL running tests, see
          # https://github.com/rust-lang/libc/pull/4254#issuecomment-2636288713
          # - target: powerpc-unknown-linux-gnu

          # Testing iOS and tvOS should give us reasonably good coverage for Apple platforms.
          # (watchOS is similar to tvOS, and visionOS is similar to iOS).
          - target: aarch64-apple-ios-sim
            os: macos-26
            cargo-apple-runner: true
          - target: aarch64-apple-tvos-sim
            os: macos-26
            cargo-apple-runner: true
    runs-on: ${{ matrix.os && matrix.os || 'ubuntu-26.04' }}
    timeout-minutes: 25
    env:
      TARGET: ${{ matrix.target }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Rust toolchain
        run: ./ci/install-rust.sh
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: ${{ matrix.target }}

      - name: Add matrix env variables to the environment
        if: matrix.env
        run: |
          echo '${{ toJson(matrix.env) }}' |
            jq -r 'to_entries | map("\(.key)=\(.value|tostring)") | .[]' >>$GITHUB_ENV
        shell: bash

      - name: Install `cargo-apple-runner`
        if: matrix.cargo-apple-runner
        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
        with:
          tool: cargo-apple-runner

      - name: Run natively
        if: runner.os != 'Linux' && !matrix.cargo-apple-runner
        run: ./ci/run.sh ${{ matrix.target }}
      - name: Run in Docker
        if: runner.os == 'Linux' && !matrix.cargo-apple-runner
        run: ./ci/run-docker.sh ${{ matrix.target }}
      - name: Run on Apple's simulator
        if: matrix.cargo-apple-runner
        run: ./ci/run-apple-simulator.sh ${{ matrix.target }}

      - name: Create CI artifacts
        id: create_artifacts
        if: always()
        run: ./ci/create-artifacts.py
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always() && steps.create_artifacts.outcome == 'success'
        with:
          name: ${{ env.ARCHIVE_NAME }}-${{ matrix.target }}${{ matrix.artifact-tag && format('-{0}', matrix.artifact-tag) }}
          path: ${{ env.ARCHIVE_PATH }}
          retention-days: 5

  test_tier2_vm:
    name: Test tier2 VM
    needs: [test_tier1, style_check]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        include:
          - release: "15.0"
            target: i686-unknown-freebsd
          - release: "14.4"
            target: x86_64-unknown-freebsd
          - release: "15.0"
            target: x86_64-unknown-freebsd
          - target: x86_64-pc-solaris
          - target: x86_64-unknown-netbsd
          - target: x86_64-unknown-illumos
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Test on FreeBSD
        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
        if: contains(matrix.target, 'freebsd')
        with:
          release: ${{ matrix.release }}
          envs: CARGO_TERM_COLOR CARGO_TERM_VERBOSE RUSTDOCFLAGS RUSTFLAGS RUST_BACKTRACE
          usesh: true
          copyback: false
          prepare: ./ci/bsd-prepare.sh ${{ matrix.target }}
          run: |
            set -ex
            . "$HOME/.cargo/env"
            LIBC_CI=1 ./ci/run.sh ${{ matrix.target }}
            ./ci/run.sh ${{ matrix.target }}

      - name: Test on Solaris
        uses: vmactions/solaris-vm@87d3c436511cef802cd1637f86f73b1a97715c8c # v1.4.1
        if: contains(matrix.target, 'solaris')
        with:
          release: "11.4-gcc"
          envs: CARGO_TERM_COLOR CARGO_TERM_VERBOSE RUSTDOCFLAGS RUSTFLAGS RUST_BACKTRACE
          usesh: true
          mem: 4096
          copyback: false
          prepare: ./ci/bsd-prepare.sh ${{ matrix.target }}
          run: ./ci/bsd-run.sh ${{ matrix.target }}

      - name: Test on NetBSD
        uses: vmactions/netbsd-vm@c8a0d7ddb84619a7a8cc4e652efa7950b3fd9f92 # v1.5.2
        if: contains(matrix.target, 'netbsd')
        with:
          release: "10.1"
          envs: CARGO_TERM_COLOR CARGO_TERM_VERBOSE RUSTDOCFLAGS RUSTFLAGS RUST_BACKTRACE
          usesh: true
          mem: 4096
          copyback: false
          prepare: ./ci/bsd-prepare.sh ${{ matrix.target }}
          run: ./ci/bsd-run.sh ${{ matrix.target }}

      - name: Test on illumos
        uses: vmactions/omnios-vm@9576f0b6d15e7696548409baa533bc0a339caf42 # v1.3.7
        if: contains(matrix.target, 'illumos')
        with:
          # Use the latest LTS
          release: "r151054-build"
          envs: CARGO_TERM_COLOR CARGO_TERM_VERBOSE RUSTDOCFLAGS RUSTFLAGS RUST_BACKTRACE
          usesh: true
          mem: 4096
          copyback: false
          prepare: ./ci/bsd-prepare.sh ${{ matrix.target }}
          run: ./ci/bsd-run.sh ${{ matrix.target }}

  ctest_msrv:
    name: Check ctest MSRV
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    env:
      RUSTFLAGS: "" # No need to check warnings on old MSRV, clear `-Dwarnings`
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - run: |
          msrv="$(
            cargo metadata --format-version 1 |
            jq -r --arg CRATE_NAME ctest '.packages | map(select((.name == $CRATE_NAME) and (.id | startswith("path+file")))) | first | .rust_version'
          )"
          echo "MSRV: $msrv"
          echo "MSRV=$msrv" >> "$GITHUB_ENV"
      - name: Install Rust
        run: rustup update "$MSRV" --no-self-update && rustup default "$MSRV"
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - run: cargo build -p ctest

  zizmor:
    name: Zizmor (Static analysis for GitHub Actions)
    runs-on: ubuntu-26.04
    permissions:
      security-events: write
    timeout-minutes: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4

  # One job that "summarizes" the success state of this pipeline. This can then be added to branch
  # protection, rather than having to add each job separately.
  success:
    name: success
    runs-on: ubuntu-26.04
    needs:
      - style_check
      - test_tier1
      - test_tier2
      - test_tier2_vm
      - verify_build
      - ctest_msrv
      - clippy
      - zizmor
    # GitHub branch protection is exceedingly silly and treats "jobs skipped because a dependency
    # failed" as success. So we have to do some contortions to ensure the job fails if any of its
    # dependencies fails.
    if: always() # make sure this is never "skipped"
    env:
      NEEDS: ${{ toJson(needs) }}
    steps:
      # Manually check the status of all dependencies. `if: failure()` does not work.
      - name: check if any dependency failed
        run: jq --exit-status 'all(.result == "success")' <<< "$NEEDS"