build.yml

# SPDX-FileCopyrightText: Team OpenVPI
# SPDX-License-Identifier: Apache-2.0

name: Build

on:
  workflow_call:
    inputs:
      source_sha:
        required: true
        type: string
      build_type:
        required: true
        type: string
      version_identifier:
        required: false
        type: string
        default: ''
      use_cache:
        required: false
        type: boolean
        default: true
      use_ccache:
        required: false
        type: boolean
        default: false
    outputs:
      semver:
        value: ${{ jobs.Prepare.outputs.semver }}
      tag:
        value: ${{ jobs.Prepare.outputs.tag }}
      application_name:
        value: ${{ jobs.Prepare.outputs.application_name }}

defaults:
  run:
    shell: pwsh

jobs:
  Prepare:
    runs-on: ubuntu-latest
    outputs:
      semver: ${{ steps.prepare.outputs.semver }}
      tag: ${{ steps.prepare.outputs.tag }}
      application_name: ${{ steps.prepare.outputs.application_name }}
      version_identifier: ${{ steps.prepare.outputs.version_identifier }}
    steps:
      - name: Checkout source
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.source_sha }}
      - name: Prepare build version
        id: prepare
        uses: diffscope/catalogs/actions/nightly@main
        with:
          operation: prepare
          source-sha: ${{ inputs.source_sha }}
          build-type: ${{ inputs.build_type }}
          version-identifier: ${{ inputs.version_identifier }}

  Build:
    needs: Prepare
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-2025
            platform: Windows
            arch: amd64
          - os: ubuntu-24.04
            platform: Linux
            arch: amd64
          - os: macos-15
            platform: macOS
            arch: arm64
    runs-on: ${{ matrix.os }}
    env:
      QT_VERSION: 6.11.2
      VCPKG_REF: 39344dff01c5a5a0134caf2624cdd492f05d30ea
      VCPKG_DISABLE_METRICS: '1'
      INNOSETUP_REF: is-6_5_4
      DSSP_CHANNEL: nightly
      DSSP_VERSION: 0.1.0-nightly.20261021.2
      DSPM_CHANNEL: nightly
      DSPM_VERSION: 0.1.0-nightly.20261021.1
      MACOSX_DEPLOYMENT_TARGET: '13.3'
      BUILD_DIR: ${{ github.workspace }}/build/build
      INSTALL_DIR: ${{ github.workspace }}/build/install
      CCACHE_DIR: ${{ github.workspace }}/build/ccache
      BUILD_TYPE: ${{ inputs.build_type }}
      VERSION_IDENTIFIER: ${{ needs.Prepare.outputs.version_identifier }}
      EXPECTED_SEMVER: ${{ needs.Prepare.outputs.semver }}
      ARTIFACT_PLATFORM: ${{ matrix.platform }}
      ARTIFACT_ARCH: ${{ matrix.arch }}
      USE_CCACHE: ${{ inputs.build_type != 'nightly' && inputs.use_cache && inputs.use_ccache }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.source_sha }}
          submodules: recursive

      # The checkout of a commit detaches HEAD, and the build information then records the branch
      # as unknown. A local branch at the same commit, named after the branch that triggered the
      # run, gives the build information its name.
      - name: Name the branch of the checkout
        env:
          SOURCE_BRANCH: ${{ github.head_ref || github.ref_name }}
        run: git checkout -B $env:SOURCE_BRANCH

      - name: Initialize building environment
        uses: ./.github/actions/initialize-build-environment
        with:
          qt_version: ${{ env.QT_VERSION }}
          use_cache: ${{ inputs.build_type != 'nightly' && inputs.use_cache }}

      - name: Download dspm
        id: download_dspm
        uses: diffscope/catalogs/actions/download-product@main
        with:
          product: dspm
          channel: ${{ env.DSPM_CHANNEL }}
          version: ${{ env.DSPM_VERSION }}
          platform: ${{ matrix.platform }}
          arch: ${{ matrix.arch }}
          variant: standalone
          directory: ${{ runner.temp }}/dspm-download
          fail-on-no-match: 'true'
          cache: ${{ inputs.build_type != 'nightly' && inputs.use_cache }}

      - name: Download dssp
        id: download_dssp
        uses: diffscope/catalogs/actions/download-product@main
        with:
          product: dssp
          channel: ${{ env.DSSP_CHANNEL }}
          version: ${{ env.DSSP_VERSION }}
          platform: ${{ matrix.platform }}
          arch: ${{ matrix.arch }}
          variant: portable
          directory: ${{ runner.temp }}/dssp-download
          fail-on-no-match: 'true'
          cache: ${{ inputs.build_type != 'nightly' && inputs.use_cache }}

      - name: Extract dssp
        if: steps.download_dssp.outputs.matched == 'true'
        env:
          DSSP_ARCHIVE: ${{ steps.download_dssp.outputs.path }}
        run: |
          $ErrorActionPreference = 'Stop'
          $extractionDirectory = Join-Path $env:RUNNER_TEMP ("dssp-" + [guid]::NewGuid())
          New-Item -ItemType Directory -Path $extractionDirectory | Out-Null
          if ($IsWindows) {
            Expand-Archive -LiteralPath $env:DSSP_ARCHIVE -DestinationPath $extractionDirectory
          } else {
            & /usr/bin/tar -xJf $env:DSSP_ARCHIVE -C $extractionDirectory
            if ($LASTEXITCODE -ne 0) {
              throw 'dssp artifact extraction failed'
            }
          }
          $dsspDirectory = Join-Path $extractionDirectory 'dssp_nightly'
          $executable = Join-Path $dsspDirectory ($IsWindows ? 'bin/dssp.exe' : 'bin/dssp')
          if (-not (Test-Path -LiteralPath $executable -PathType Leaf)) {
            throw 'The dssp artifact does not contain the expected executable'
          }
          "DSSP_DIRECTORY=$dsspDirectory" >> $env:GITHUB_ENV

      - name: Initialize Vcpkg
        uses: ./.github/actions/initialize-vcpkg
        with:
          ref: ${{ env.VCPKG_REF }}
          use_cache: ${{ inputs.build_type != 'nightly' && inputs.use_cache }}

      - name: Restore CCache cache
        if: inputs.build_type != 'nightly' && inputs.use_cache && inputs.use_ccache
        uses: actions/cache/restore@v4
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ${{ runner.os }}-ccache-${{ inputs.source_sha }}
          restore-keys: |
            ${{ runner.os }}-ccache-

      - name: Build
        env:
          DSPM_EXECUTABLE: ${{ steps.download_dspm.outputs.path }}
        run: |
          $expectedRunnerArch = $env:ARTIFACT_ARCH -eq 'amd64' ? 'X64' : 'ARM64'
          if ($env:RUNNER_ARCH -ne $expectedRunnerArch) {
            throw "Unexpected runner architecture: $env:RUNNER_ARCH"
          }
          $output = & ./scripts/ci/Build.ps1 `
            -BuildType $env:BUILD_TYPE `
            -VcpkgRootDir $env:VCPKG_ROOT_DIR `
            -BuildDir $env:BUILD_DIR `
            -InstallDir $env:INSTALL_DIR `
            -VersionIdentifier $env:VERSION_IDENTIFIER `
            -DsspDirectory $env:DSSP_DIRECTORY `
            -DspmExecutable $env:DSPM_EXECUTABLE `
            -ArtifactPlatform $env:ARTIFACT_PLATFORM `
            -ArtifactArchitecture $env:ARTIFACT_ARCH `
            -CCache:($env:USE_CCACHE -eq 'true')
          if ($output.Semver -ne $env:EXPECTED_SEMVER) {
            throw 'Built application version differs from the reserved version'
          }
          "ARTIFACT_NAME=$($output.ArtifactFileBase)" >> $env:GITHUB_ENV
          "APPLICATION_SEMVER=$($output.Semver)" >> $env:GITHUB_ENV
          "APPLICATION_DISPLAY_NAME=$($output.ApplicationDisplayName)" >> $env:GITHUB_ENV
          "APPLICATION_NAME=$($output.ApplicationName)" >> $env:GITHUB_ENV
          "INSTALLER_FILE_BASE=$($output.InstallerFileBase)" >> $env:GITHUB_ENV

      - name: Save CCache cache
        if: inputs.build_type != 'nightly' && inputs.use_cache && inputs.use_ccache
        uses: actions/cache/save@v4
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ${{ runner.os }}-ccache-${{ inputs.source_sha }}

      - name: Collect symbol files
        run: |
          $output = & ./scripts/ci/Collect-Symbol-Files.ps1 `
            -VcpkgRootDir $env:VCPKG_ROOT_DIR `
            -InstallDir $env:INSTALL_DIR `
            -ArchivePath "$($env:ARTIFACT_NAME)_debug_symbols.7z"
          "SYMBOL_FILES_PATH=$output" >> $env:GITHUB_ENV

      - name: Create InnoSetup installer (Windows)
        if: runner.os == 'Windows'
        run: |
          $output = & ./scripts/ci/Pack.ps1 -BuildDir $env:BUILD_DIR -InstallerFileBase $env:INSTALLER_FILE_BASE -InnoSetupCommit $env:INNOSETUP_REF
          "PACKAGE_PATH=$($output.Path)" >> $env:GITHUB_ENV
          "PACKAGE_ARTIFACT_NAME=$env:INSTALLER_FILE_BASE" >> $env:GITHUB_ENV

      - name: Create portable archive (Windows)
        if: runner.os == 'Windows'
        run: |
          $output = & ./scripts/ci/Create-Portable.ps1 `
            -InstallDir $env:INSTALL_DIR `
            -ApplicationName $env:APPLICATION_NAME `
            -ArchivePath "$($env:ARTIFACT_NAME)_portable.zip"
          "PORTABLE_PATH=$output" >> $env:GITHUB_ENV

      - name: Create DMG installer (macOS)
        if: runner.os == 'macOS'
        run: |
          $output = & ./scripts/ci/Create-DMG.ps1 `
            -AppPath (Join-Path $env:INSTALL_DIR "$($env:APPLICATION_NAME).app") `
            -Semver $env:APPLICATION_SEMVER `
            -ApplicationDisplayName $env:APPLICATION_DISPLAY_NAME `
            -InstallerFileBase $env:INSTALLER_FILE_BASE
          "PACKAGE_PATH=$output" >> $env:GITHUB_ENV
          "PACKAGE_ARTIFACT_NAME=$env:INSTALLER_FILE_BASE" >> $env:GITHUB_ENV

      - name: Create portable archive (Linux)
        if: runner.os == 'Linux'
        run: |
          $output = & ./scripts/ci/Create-Portable.ps1 `
            -InstallDir $env:INSTALL_DIR `
            -ApplicationName $env:APPLICATION_NAME `
            -ArchivePath "$($env:ARTIFACT_NAME)_portable.tar.xz"
          "PACKAGE_PATH=$output" >> $env:GITHUB_ENV
          "PACKAGE_ARTIFACT_NAME=$($env:ARTIFACT_NAME)_portable" >> $env:GITHUB_ENV

      - name: Upload symbol files
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.ARTIFACT_NAME }}_debug_symbols
          path: ${{ env.SYMBOL_FILES_PATH }}
          if-no-files-found: error
          overwrite: true
          compression-level: 0

      - name: Upload package
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.PACKAGE_ARTIFACT_NAME }}
          path: ${{ env.PACKAGE_PATH }}
          if-no-files-found: error
          overwrite: true
          compression-level: 0

      - name: Upload portable archive
        if: runner.os == 'Windows'
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.ARTIFACT_NAME }}_portable
          path: ${{ env.PORTABLE_PATH }}
          if-no-files-found: error
          overwrite: true
          compression-level: 0