build.yml

---
on:
  workflow_dispatch:
  push:
    paths-ignore:
      - 'certdb/**'
      - 'debian/**'
      - 'demo/**'
      - 'doc/**'
      - 'js/**'
      - 'prototypes/**'
      - 'python/**'
      - 'systemd/**'
      - 'tools/**'
    branches:
      - master
  pull_request:
    paths-ignore:
      - 'certdb/**'
      - 'debian/**'
      - 'demo/**'
      - 'doc/**'
      - 'js/**'
      - 'prototypes/**'
      - 'python/**'
      - 'systemd/**'
      - 'tools/**'
    branches:
      - master

permissions:
  contents: read #  to fetch code (actions/checkout)

jobs:
  build:
    runs-on: ubuntu-24.04
    steps:
      - id: checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            meson \
            ccache \
            nlohmann-json3-dev \
            libavahi-client-dev \
            libbrotli-dev \
            libcap-dev \
            libcurl4-openssl-dev \
            libdbus-1-dev \
            libfmt-dev \
            libgtest-dev \
            libluajit-5.1-dev \
            libnghttp2-dev \
            libpcre2-dev \
            libpq-dev \
            libseccomp-dev \
            libsodium-dev \
            libssl-dev \
            libsystemd-dev \
            liburing-dev

      - id: cache-ccache
        uses: hendrikmuhs/ccache-action@v1
        with:
          key: ${{github.job}}

      - name: Configure
        run: |
          meson setup \
            -Dauto_features=enabled \
            -Ddocumentation=disabled \
            -Dcertdb=true \
            --force-fallback-for=libcm4all-was-protocol,libcm4all-http \
            -Dwrap_mode=nofallback \
            output

      - name: Build
        run: ninja -C output -v

      - name: Unit Tests
        run: meson test -C output

      - name: Dump Unit Test Log
        if: ${{ failure() }}
        continue-on-error: true
        run: cat output/meson-logs/testlog.txt

  mini:
    runs-on: ubuntu-24.04
    steps:
      - id: checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            meson \
            ccache \
            libfmt-dev \
            libgtest-dev \
            libpcre2-dev \
            libsodium-dev \
            libssl-dev

      - id: cache-ccache
        uses: hendrikmuhs/ccache-action@v1
        with:
          key: ${{github.job}}

      - name: Configure
        run: |
          meson setup \
            -Dauto_features=disabled \
            -Dcertdb=false \
            -Dwrap_mode=nofallback \
            output

      - name: Build
        run: ninja -C output -v

      - name: Unit Tests
        run: meson test -C output

      - name: Dump Unit Test Log
        if: ${{ failure() }}
        continue-on-error: true
        run: cat output/meson-logs/testlog.txt

  certdb:
    runs-on: ubuntu-24.04
    steps:
      - id: checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            meson \
            ccache \
            nlohmann-json3-dev \
            libfmt-dev \
            libsystemd-dev libdbus-1-dev \
            libcurl4-openssl-dev \
            libgtest-dev \
            libpcre2-dev \
            libsodium-dev \
            libssl-dev \
            libpq-dev \
            pebble

      - id: cache-ccache
        uses: hendrikmuhs/ccache-action@v1
        with:
          key: ${{github.job}}

      - name: Configure
        run: |
          meson setup \
            -Dauto_features=disabled \
            -Dsystemd=enabled \
            -Dcertdb=true \
            -Dwrap_mode=nofallback \
            output

      - name: Build
        run: ninja -C output -v cm4all-certdb cm4all-beng-lb test/acme/pebble-cert.pem

      - name: Set up certdb
        run: |
          sudo systemctl start postgresql.service
          pg_isready
          sudo -u postgres createuser runner
          sudo -u postgres createuser cm4all-beng-lb
          sudo -u postgres createdb certdb
          sudo -u postgres psql certdb <certdb/certdb.sql
          sudo -u postgres psql certdb <certdb/acme_account.sql
          sudo -u postgres psql certdb --command='GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA public TO runner'
          sudo -u postgres psql certdb --command='GRANT UPDATE,SELECT ON server_certificate_id_seq TO runner'
          sudo -u postgres psql certdb --command='GRANT UPDATE,SELECT ON server_certificate_alt_name_id_seq TO runner'
          sudo -u postgres psql certdb --command='GRANT UPDATE,SELECT ON acme_account_id_seq TO runner'
          sudo -u postgres psql certdb --command='GRANT SELECT ON server_certificate, server_certificate_alt_name TO "cm4all-beng-lb"'

      - name: Start beng-lb
        run: |
          sudo mkdir -vp /etc/cm4all/beng/lb /usr/lib/cm4all/beng-lb/systemd
          sudo cp -v test/acme/lb.conf /etc/cm4all/beng/
          sudo cp -v output/test/acme/ca-cert.pem /etc/cm4all/beng/lb/ca.pem
          sudo cp -v output/test/acme/pebble-cert.pem /etc/cm4all/beng/lb/cert.pem
          sudo cp -v output/test/acme/pebble-key.pem /etc/cm4all/beng/lb/key.pem
          sudo cp -v systemd/lb/run.sh /usr/lib/cm4all/beng-lb/systemd/
          sudo cp -v debian/cm4all-beng-lb.sysusers /lib/sysusers.d/cm4all-beng-lb.conf
          sudo cp -v debian/cm4all-beng-lb.service /etc/systemd/system/
          sudo cp -v output/cm4all-beng-lb /usr/sbin/
          sudo systemd-sysusers
          sudo systemctl daemon-reload
          sudo systemctl start cm4all-beng-lb

      - name: Test ACME client
        run: |
          set -x
          pebble -strict -config output/test/acme/pebble-config.json &
          sleep 1
          sudo mkdir -vp /etc/cm4all/beng
          sudo cp -v test/acme/certdb.conf /etc/cm4all/beng/
          ACME="./output/cm4all-certdb acme --debug --tls-ca output/test/acme/ca-cert.pem --directory-url https://0.0.0.0:14000/dir --account-db --alpn"
          $ACME new-account nobody@example.com
          $ACME new-order foo localhost
          $ACME renew-cert foo
          ./output/cm4all-certdb tail
          ./output/cm4all-certdb get foo