ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

permissions:
  contents: read

jobs:
  build-linux-gcc:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset debug

      - name: Build and test
        run: cmake --build --preset debug --target junit BddTargetTests SolidSyslogBddTarget

      - name: Run BDD target tests
        run: cd build/debug && ./Tests/Bdd/Targets/BddTargetTests -ojunit -k BddTargetTests

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (GCC)
          path: build/debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-build-linux-gcc
          path: build/debug/cpputest_*.xml
          retention-days: 1

      - name: Upload BDD target binaries
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: solid-syslog-bdd-targets
          path: |
            build/debug/Bdd/Targets/SolidSyslogBddTarget
          retention-days: 1
          compression-level: 0

      # BDD-side mirror of build-time tunables, generated by configure_file.
      # bdd-linux-syslog-ng downloads this into Bdd/features/steps/ so behave
      # can `import solidsyslog_tunables` (the file is gitignored, not in checkout).
      - name: Upload BDD Python tunables (Linux)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bdd-tunables-linux
          path: Bdd/features/steps/solidsyslog_tunables.py
          retention-days: 1

  integration-linux-openssl:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset debug

      - name: Build integration tests
        run: cmake --build --preset debug --target OpenSslIntegrationTests

      - name: Run integration tests
        run: cd build/debug && ./Tests/OpenSslIntegration/OpenSslIntegrationTests -v -ojunit -k OpenSslIntegrationTests

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (OpenSSL Integration)
          path: build/debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-integration-linux-openssl
          path: build/debug/cpputest_*.xml
          retention-days: 1

  integration-linux-mbedtls:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    # cpputest-freertos image carries /opt/mbedtls (and exports MBEDTLS_DIR);
    # Tests/MbedTlsIntegration/CMakeLists.txt requires that env var.
    container:
      image: ghcr.io/davidcozens/cpputest-freertos:sha-0b93766
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset debug

      - name: Build integration tests
        run: cmake --build --preset debug --target MbedTlsIntegrationTests

      - name: Run integration tests
        run: cd build/debug && ./Tests/MbedTlsIntegration/MbedTlsIntegrationTests -v -ojunit -k MbedTlsIntegrationTests

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (mbedTLS Integration)
          path: build/debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-integration-linux-mbedtls
          path: build/debug/cpputest_*.xml
          retention-days: 1

  integration-windows-openssl:
    runs-on: windows-latest
    permissions:
      contents: read
      checks: write
    env:
      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Enable vcpkg binary cache
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      # Cache vcpkg's classic-mode installed tree across runs and branches.
      # x-gha (above) is per-workflow scope and goes cold on a fresh branch;
      # actions/cache survives across branches with a static key. Bump the
      # `v1` suffix to force a rebuild (e.g. when adding a package).
      # C:\vcpkg is the standard VCPKG_INSTALLATION_ROOT on github-hosted
      # windows runners — hardcoded here so the cache step doesn't depend
      # on a runner-image-set env var (the linter can't see those).
      - name: Cache vcpkg installed tree
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        # The cache is a pure speed optimisation — a flaky restore must never
        # skip the build+test. actions/cache can fail mid-restore (even after
        # reporting a hit); without continue-on-error that failure trips the
        # default `if: success()` on every following step, so Install / Configure
        # / Build-and-test all skip and the job goes red without ever compiling.
        # On a miss or partial restore the `vcpkg install` below rebuilds the
        # tree (backed by the x-gha binary cache), so the only cost is a slower
        # run.
        continue-on-error: true
        with:
          path: C:\vcpkg\installed
          key: ${{ runner.os }}-vcpkg-cpputest-openssl-v1

      - name: Install CppUTest and OpenSSL
        run: |
          vcpkg install cpputest openssl
          echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" >> $env:GITHUB_ENV

      - name: Configure
        run: cmake --preset msvc-debug

      - name: Build integration tests
        run: cmake --build --preset msvc-debug --target OpenSslIntegrationTests

      - name: Run integration tests
        shell: pwsh
        run: |
          Set-Location build/msvc-debug/Tests/OpenSslIntegration/Debug
          ./OpenSslIntegrationTests.exe -v -ojunit -k OpenSslIntegrationTests

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (OpenSSL Integration Windows)
          path: build/msvc-debug/Tests/OpenSslIntegration/Debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-integration-windows-openssl
          path: build/msvc-debug/Tests/OpenSslIntegration/Debug/cpputest_*.xml
          retention-days: 1

  build-linux-tunable-override:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure with tunable override
        run: cmake --preset tunable-override-debug

      - name: Build and test
        run: cmake --build --preset tunable-override-debug --target junit

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (Tunable Override)
          path: build/tunable-override-debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-build-linux-tunable-override
          path: build/tunable-override-debug/cpputest_*.xml
          retention-days: 1

  build-linux-clang:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/davidcozens/cpputest-clang:sha-7eac3ab
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset clang-debug

      - name: Build and test
        run: cmake --build --preset clang-debug --target junit

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (Clang)
          path: build/clang-debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-build-linux-clang
          path: build/clang-debug/cpputest_*.xml
          retention-days: 1

  sanitize-linux-gcc:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset sanitize

      - name: Build and test
        run: cmake --build --preset sanitize --target junit

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (Sanitize)
          path: build/sanitize/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-sanitize-linux-gcc
          path: build/sanitize/cpputest_*.xml
          retention-days: 1

  coverage-linux-gcc:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
      pages: write
      id-token: write
    container:
      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset coverage

      - name: Build and generate coverage report
        run: cmake --build --preset coverage --target coverage

      - name: Post coverage summary
        run: |
          echo '## Coverage Summary' >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          lcov --summary build/coverage/coverage.filtered.info --rc branch_coverage=1 2>&1 >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

      - name: Enforce coverage thresholds
        env:
          LINE_THRESHOLD: 90
          BRANCH_THRESHOLD: 90
        run: |
          SUMMARY=$(lcov --summary build/coverage/coverage.filtered.info --rc branch_coverage=1 2>&1)
          LINE_COV=$(echo "$SUMMARY" | sed -n 's/.*lines\.*: \([0-9.]*\)%.*/\1/p')
          BRANCH_COV=$(echo "$SUMMARY" | sed -n 's/.*branches\.*: \([0-9.]*\)%.*/\1/p')
          FAIL=0
          if [ -n "$LINE_COV" ]; then
            echo "Line coverage:   ${LINE_COV}% (threshold: ${LINE_THRESHOLD}%)"
            if awk "BEGIN{exit !($LINE_COV < $LINE_THRESHOLD)}"; then
              echo "FAIL: line coverage ${LINE_COV}% is below ${LINE_THRESHOLD}%"
              FAIL=1
            fi
          else
            echo "FAIL: could not determine line coverage"
            FAIL=1
          fi
          if [ -n "$BRANCH_COV" ]; then
            echo "Branch coverage: ${BRANCH_COV}% (threshold: ${BRANCH_THRESHOLD}%)"
            if awk "BEGIN{exit !($BRANCH_COV < $BRANCH_THRESHOLD)}"; then
              echo "FAIL: branch coverage ${BRANCH_COV}% is below ${BRANCH_THRESHOLD}%"
              FAIL=1
            fi
          else
            echo "Branch coverage: no branch data found (skipping threshold check)"
          fi
          exit $FAIL

      - name: Upload pages artifact
        if: github.ref == 'refs/heads/main'
        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
        with:
          path: build/coverage/coverage_report/

  deploy-coverage-pages:
    needs: coverage-linux-gcc
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}

    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

  analyze-tidy:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset tidy

      - name: Build with clang-tidy
        shell: bash
        run: set -o pipefail && cmake --build --preset tidy 2>&1 | tee build/tidy/clang-tidy-output.txt

      - name: Upload clang-tidy output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: clang-tidy-report
          path: build/tidy/clang-tidy-output.txt
          retention-days: 1

  analyze-iwyu:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/davidcozens/cpputest-clang:sha-7eac3ab
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset iwyu

      # IWYU is advisory: the two-pass "should add / should remove" output is
      # hard to interpret correctly under time pressure, and the per-PR
      # friction it causes outweighs the steady-state value (S24.13 / E24).
      # Findings still surface via the uploaded artifact below; release prep
      # is responsible for clearing them.
      - name: Run include-what-you-use (advisory)
        shell: bash
        continue-on-error: true
        run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 | tee build/iwyu/iwyu-output.txt

      - name: Upload iwyu output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: iwyu-report
          path: build/iwyu/iwyu-output.txt
          retention-days: 1

  # Mirrors analyze-tidy but runs on cpputest-freertos so the Platform/{FreeRtos,
  # PlusTcp,LwipRaw,MbedTls,FatFs} trees and their Tests/* siblings enter the
  # CMake configure (gated by FREERTOS_KERNEL_PATH / MBEDTLS_DIR / LWIP_PATH /
  # FATFS_PATH, all set in the freertos image). The base lane on cpputest skips
  # those trees because the env vars are absent.
  analyze-tidy-freertos-plustcp:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/davidcozens/cpputest-freertos:sha-0b93766
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset tidy

      - name: Build with clang-tidy
        shell: bash
        run: set -o pipefail && cmake --build --preset tidy 2>&1 | tee build/tidy/clang-tidy-output.txt

      - name: Upload clang-tidy output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: clang-tidy-report-freertos-plustcp
          path: build/tidy/clang-tidy-output.txt
          retention-days: 1

  # Same freertos coverage rationale as analyze-tidy-freertos-plustcp. Overrides
  # CMAKE_C_COMPILER explicitly to clang-19 because the cpputest-freertos image
  # (chained from the cpputest gcc base) ships clang-19/clang++-19 but no
  # `clang`/`clang++` alternative — only the cpputest-clang image creates that
  # alias. A future image bump could add the alternative to the gcc base and
  # drop these overrides.
  analyze-iwyu-freertos-plustcp:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/davidcozens/cpputest-freertos:sha-0b93766
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset iwyu -DCMAKE_C_COMPILER=clang-19 -DCMAKE_CXX_COMPILER=clang++-19

      # Advisory per S24.13 — see analyze-iwyu above for rationale.
      - name: Run include-what-you-use (advisory)
        shell: bash
        continue-on-error: true
        run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 | tee build/iwyu/iwyu-output.txt

      - name: Upload iwyu output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: iwyu-report-freertos-plustcp
          path: build/iwyu/iwyu-output.txt
          retention-days: 1

  # NET=LWIP twin of analyze-tidy-freertos-plustcp. Same cpputest-freertos image
  # and tidy preset, but SOLIDSYSLOG_FREERTOS_NET=LWIP so the configure exercises
  # the lwIP wiring path (Platform/PlusTcp library target dropped; the LwipRaw
  # adapter pack is the active FreeRTOS networking backend). Guards the NET=LWIP
  # configure + the LwipRaw tree / Tests under clang-tidy as a named required check.
  analyze-tidy-freertos-lwip:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/davidcozens/cpputest-freertos:sha-0b93766
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset tidy -DSOLIDSYSLOG_FREERTOS_NET=LWIP

      - name: Build with clang-tidy
        shell: bash
        run: set -o pipefail && cmake --build --preset tidy 2>&1 | tee build/tidy/clang-tidy-output.txt

      - name: Upload clang-tidy output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: clang-tidy-report-freertos-lwip
          path: build/tidy/clang-tidy-output.txt
          retention-days: 1

  # NET=LWIP twin of analyze-iwyu-freertos-plustcp — see that lane for the
  # clang-19 override rationale and analyze-tidy-freertos-lwip for the NET scope.
  # Advisory per S24.13.
  analyze-iwyu-freertos-lwip:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/davidcozens/cpputest-freertos:sha-0b93766
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset iwyu -DSOLIDSYSLOG_FREERTOS_NET=LWIP -DCMAKE_C_COMPILER=clang-19 -DCMAKE_CXX_COMPILER=clang++-19

      # Advisory per S24.13 — see analyze-iwyu above for rationale.
      - name: Run include-what-you-use (advisory)
        shell: bash
        continue-on-error: true
        run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 | tee build/iwyu/iwyu-output.txt

      - name: Upload iwyu output
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: iwyu-report-freertos-lwip
          path: build/iwyu/iwyu-output.txt
          retention-days: 1

  analyze-format:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Check clang-format
        run: |
          find Core/Interface Core/Source Platform Tests Bdd/Targets -name '*.c' -o -name '*.cpp' -o -name '*.h' \
            | xargs clang-format --dry-run --Werror

  analyze-cppcheck:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure
        run: cmake --preset cppcheck

      - name: Build with cppcheck
        run: cmake --build --preset cppcheck

      - name: Generate cppcheck XML report
        if: success() || failure()
        run: >
          cppcheck
          --enable=warning,style,performance,portability
          --suppress=missingIncludeSystem
          --suppressions-list=cppcheck_suppressions_tests.txt
          --inline-suppr
          --std=c11
          -ICore/Interface
          -IPlatform/Atomics/Interface
          -IPlatform/Posix/Interface
          -IPlatform/Windows/Interface
          -IPlatform/OpenSsl/Interface
          -IPlatform/MbedTls/Interface
          -IPlatform/FreeRtos/Interface
          -IPlatform/PlusTcp/Interface
          -IPlatform/LwipRaw/Interface
          -IPlatform/FatFs/Interface
          -IPlatform/PlusFat/Interface
          --xml --xml-version=2
          Core/Source/
          Platform/Atomics/Source/
          Platform/Posix/Source/
          Platform/Windows/Source/
          Platform/OpenSsl/Source/
          Platform/MbedTls/Source/
          Platform/FreeRtos/Source/
          Platform/PlusTcp/Source/
          Platform/LwipRaw/Source/
          Platform/FatFs/Source/
          Platform/PlusFat/Source/
          2> build/cppcheck/cppcheck-report.xml

      - name: Upload cppcheck report
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cppcheck-report
          path: build/cppcheck/cppcheck-report.xml
          retention-days: 1

      # ----------------------------------------------------------------
      # cppcheck-misra addon — runs the MISRA C:2012 addon over Strict +
      # Pragmatic tiers (Core/Source/ + Platform/*/Source/). Findings
      # fail CI (--error-exitcode=1); suppressions live in
      # misra_suppressions.txt with rationales in docs/misra-deviations.md.
      # ----------------------------------------------------------------

      - name: Run cppcheck-misra
        if: success() || failure()
        run: >
          cppcheck
          --addon=misra
          --suppressions-list=misra_suppressions.txt
          --error-exitcode=1
          --inline-suppr
          --std=c11
          -ICore/Interface
          -IPlatform/Atomics/Interface
          -IPlatform/Posix/Interface
          -IPlatform/Windows/Interface
          -IPlatform/OpenSsl/Interface
          -IPlatform/MbedTls/Interface
          -IPlatform/FreeRtos/Interface
          -IPlatform/PlusTcp/Interface
          -IPlatform/LwipRaw/Interface
          -IPlatform/FatFs/Interface
          -IPlatform/PlusFat/Interface
          Core/Source/
          Platform/Atomics/Source/
          Platform/Posix/Source/
          Platform/Windows/Source/
          Platform/OpenSsl/Source/
          Platform/MbedTls/Source/
          Platform/FreeRtos/Source/
          Platform/PlusTcp/Source/
          Platform/LwipRaw/Source/
          Platform/FatFs/Source/
          Platform/PlusFat/Source/

      - name: Generate cppcheck-misra XML report
        if: success() || failure()
        run: |
          mkdir -p build/cppcheck-misra
          cppcheck \
            --addon=misra \
            --suppressions-list=misra_suppressions.txt \
            --error-exitcode=1 \
            --inline-suppr \
            --std=c11 \
            -ICore/Interface \
            -IPlatform/Atomics/Interface \
            -IPlatform/Posix/Interface \
            -IPlatform/Windows/Interface \
            -IPlatform/OpenSsl/Interface \
            -IPlatform/MbedTls/Interface \
            -IPlatform/FreeRtos/Interface \
            -IPlatform/PlusTcp/Interface \
            -IPlatform/LwipRaw/Interface \
            -IPlatform/FatFs/Interface \
            -IPlatform/PlusFat/Interface \
            --xml --xml-version=2 \
            Core/Source/ \
            Platform/Atomics/Source/ \
            Platform/Posix/Source/ \
            Platform/Windows/Source/ \
            Platform/OpenSsl/Source/ \
            Platform/MbedTls/Source/ \
            Platform/FreeRtos/Source/ \
            Platform/PlusTcp/Source/ \
            Platform/LwipRaw/Source/ \
            Platform/FatFs/Source/ \
            Platform/PlusFat/Source/ \
            2> build/cppcheck-misra/cppcheck-misra-report.xml

      - name: Upload cppcheck-misra report
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cppcheck-misra-report
          path: build/cppcheck-misra/cppcheck-misra-report.xml
          retention-days: 1

  build-windows-msvc:
    runs-on: windows-latest
    permissions:
      contents: read
      checks: write
    env:
      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Enable vcpkg binary cache
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      # Same cache as integration-windows-openssl — both jobs share one
      # entry. See that job's comment for rationale and key-bump policy.
      - name: Cache vcpkg installed tree
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        # The cache is a pure speed optimisation — a flaky restore must never
        # skip the build+test. actions/cache can fail mid-restore (even after
        # reporting a hit); without continue-on-error that failure trips the
        # default `if: success()` on every following step, so Install / Configure
        # / Build-and-test all skip and the job goes red without ever compiling.
        # On a miss or partial restore the `vcpkg install` below rebuilds the
        # tree (backed by the x-gha binary cache), so the only cost is a slower
        # run.
        continue-on-error: true
        with:
          path: C:\vcpkg\installed
          key: ${{ runner.os }}-vcpkg-cpputest-openssl-v1

      - name: Install CppUTest and OpenSSL
        run: |
          vcpkg install cpputest openssl
          echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" >> $env:GITHUB_ENV

      - name: Configure
        run: cmake --preset msvc-debug

      - name: Build and test
        run: cmake --build --preset msvc-debug --target junit SolidSyslogBddTarget

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (MSVC)
          path: build/msvc-debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-build-windows-msvc
          path: build/msvc-debug/cpputest_*.xml
          retention-days: 1

      - name: Upload Windows BDD target binary
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: solid-syslog-bdd-target-windows
          path: build/msvc-debug/Bdd/Targets/Debug/SolidSyslogBddTarget.exe
          retention-days: 1
          compression-level: 0

      - name: Upload BDD Python tunables (Windows)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bdd-tunables-windows
          path: Bdd/features/steps/solidsyslog_tunables.py
          retention-days: 1

  bdd-windows-otel:
    needs: build-windows-msvc
    runs-on: windows-2025
    permissions:
      contents: read
      checks: write
    defaults:
      run:
        shell: bash

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: solid-syslog-bdd-target-windows
          path: build/msvc-debug/Bdd/Targets/Debug/

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: bdd-tunables-windows
          path: Bdd/features/steps/

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.13'

      - name: Install behave
        run: pip install -r Bdd/requirements.txt

      - name: Install otelcol-contrib
        shell: pwsh
        run: ./Bdd/otel/Install-OtelCollector.ps1

      - name: Prepare BDD directories
        run: mkdir -p Bdd/output Bdd/junit

      - name: Start OTel Collector
        # Use bash `&` backgrounding (what works locally) rather than pwsh
        # Start-Process — the latter launched silently on windows-2025 with
        # empty redirect files and no UDP bind, suggesting the child was
        # either killed with the parent console or never actually executed.
        run: |
          nohup ./Bdd/otel/bin/otelcol-contrib.exe \
            --config=Bdd/otel/config.yaml \
            > Bdd/output/otelcol.out 2> Bdd/output/otelcol.err &
          echo "otelcol backgrounded with PID $!"

      - name: Wait for oracle to bind UDP 5514 + TCP 6514/6515
        shell: pwsh
        run: |
          $deadline = (Get-Date).AddSeconds(30)
          while ((Get-Date) -lt $deadline) {
              $udp5514  = Get-NetUDPEndpoint -LocalPort 5514 -ErrorAction SilentlyContinue
              $tcp6514  = Get-NetTCPConnection -LocalPort 6514 -State Listen -ErrorAction SilentlyContinue
              $tcp6515  = Get-NetTCPConnection -LocalPort 6515 -State Listen -ErrorAction SilentlyContinue
              if ($udp5514 -and $tcp6514 -and $tcp6515) {
                  Write-Host "otelcol is listening on UDP 5514 + TCP 6514 (TLS) + TCP 6515 (mTLS)"
                  exit 0
              }
              Start-Sleep -Milliseconds 500
          }
          Write-Host "otelcol did not bind all expected ports within 30 seconds"
          Write-Host "--- tasklist otelcol-contrib ---"
          tasklist /FI "IMAGENAME eq otelcol-contrib.exe"
          Write-Host "--- UDP endpoints (top 20) ---"
          Get-NetUDPEndpoint | Select-Object -First 20 | Format-Table -AutoSize
          Write-Host "--- TCP listeners (top 20) ---"
          Get-NetTCPConnection -State Listen | Select-Object -First 20 | Format-Table -AutoSize
          Write-Host "--- Bdd/output contents ---"
          Get-ChildItem Bdd/output -ErrorAction SilentlyContinue | Format-Table
          Write-Host "--- otelcol.out ---"
          Get-Content Bdd/output/otelcol.out -ErrorAction SilentlyContinue
          Write-Host "--- otelcol.err ---"
          Get-Content Bdd/output/otelcol.err -ErrorAction SilentlyContinue
          exit 1

      - name: Run BDD tests
        env:
          BDD_TARGET: windows
          EXAMPLE_BINARY: build/msvc-debug/Bdd/Targets/Debug/SolidSyslogBddTarget.exe
          RECEIVED_LOG: Bdd/output/received.jsonl
          ORACLE_FORMAT: otel-jsonl
        run: >
          behave --junit --junit-directory Bdd/junit
          --tags='not @wip and not @windows_wip and not @no_rtc and not @aesgcm'
          Bdd/features/

      - name: BDD Test Report (Windows)
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (BDD Windows)
          path: Bdd/junit/TESTS-*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-bdd-windows-otel
          path: Bdd/junit/TESTS-*.xml
          retention-days: 1

      - name: OTel collector logs on failure
        if: failure()
        run: |
          echo "--- otelcol.out ---"
          cat Bdd/output/otelcol.out || true
          echo "--- otelcol.err ---"
          cat Bdd/output/otelcol.err || true

  bdd-linux-syslog-ng:
    needs: build-linux-gcc
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: solid-syslog-bdd-targets
          path: build/debug/Bdd/Targets/

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: bdd-tunables-linux
          path: Bdd/features/steps/

      - name: Make example binary executable
        run: chmod +x build/debug/Bdd/Targets/SolidSyslogBddTarget

      - name: Prepare BDD output directory
        run: mkdir -p Bdd/junit && chmod 777 Bdd/junit

      - name: Run BDD tests
        run: >
          docker compose -f ci/docker-compose.bdd.yml
          up --abort-on-container-exit --exit-code-from behave-linux
          behave-linux syslog-ng-linux

      - name: BDD Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (BDD)
          path: Bdd/junit/TESTS-*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-bdd-linux-syslog-ng
          path: Bdd/junit/TESTS-*.xml
          retention-days: 1

      - name: Compose logs on failure
        if: failure()
        run: docker compose -f ci/docker-compose.bdd.yml logs --no-color

  build-freertos-host-tdd-plustcp:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    container:
      image: ghcr.io/davidcozens/cpputest-freertos:sha-0b93766
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      # Smoke check: configure + build the regular host preset under the
      # cpputest-freertos image. FREERTOS_KERNEL_PATH is set, so
      # Platform/FreeRtos and the FreeRtosFakes / Tests/FreeRtos placeholder
      # directories are added — placeholders today, real fakes from S08.04.
      - name: Configure
        run: cmake --preset debug

      - name: Build and test
        run: cmake --build --preset debug --target junit BddTargetTests SolidSyslogBddTarget

      - name: Run BDD target tests
        run: cd build/debug && ./Tests/Bdd/Targets/BddTargetTests -ojunit -k BddTargetTests

      - name: Test Report
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (FreeRTOS host)
          path: build/debug/cpputest_*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-build-freertos-host-tdd-plustcp
          path: build/debug/cpputest_*.xml
          retention-days: 1

  build-freertos-target-plustcp:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: ghcr.io/davidcozens/cpputest-freertos-cross:sha-0b93766
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure (ARM cross)
        run: cmake --preset freertos-cross

      - name: Cross-build FreeRTOS BDD target ELF
        run: cmake --build --preset freertos-cross --target SolidSyslogBddTarget

      - name: Upload FreeRTOS BDD target ELF
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: solid-syslog-bdd-target-freertos
          path: build/freertos-cross/Bdd/Targets/FreeRtos/SolidSyslogBddTarget.elf
          retention-days: 1
          compression-level: 0

      - name: Upload BDD Python tunables (FreeRTOS)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bdd-tunables-freertos
          path: Bdd/features/steps/solidsyslog_tunables.py
          retention-days: 1

  # Required as of S28.11 (in the `summary` needs list). Proves the
  # Platform/LwipRaw tree cross-builds for FreeRTOS/ARM under
  # SOLIDSYSLOG_FREERTOS_NET=LWIP with zero PlusTcp dependency (the symbol
  # assertion below enforces that). No QEMU run. Adding it to the GitHub
  # branch-protection required-checks set is a separate manual step (David).
  build-freertos-target-lwip:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: ghcr.io/davidcozens/cpputest-freertos-cross:sha-0b93766
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Configure (ARM cross, NET=LWIP)
        run: cmake --preset freertos-cross-lwip

      - name: Cross-build FreeRTOS+lwIP BDD target ELF
        run: cmake --build --preset freertos-cross-lwip --target SolidSyslogBddTargetLwip

      - name: Assert no PlusTcp / Plus-TCP symbols linked
        run: |
          elf=build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/SolidSyslogBddTargetLwip.elf
          arm-none-eabi-nm "$elf" > /tmp/lwip-symbols.txt
          if grep -E -i 'PlusTcp|FreeRTOS_socket|FreeRTOS_sendto|FreeRTOS_recv|FreeRTOS_IPInit' /tmp/lwip-symbols.txt; then
            echo "::error::PlusTcp / FreeRTOS-Plus-TCP symbol linked into the lwIP BDD target ELF"
            exit 1
          fi
          echo "OK: no PlusTcp / FreeRTOS-Plus-TCP symbols in the lwIP BDD target ELF"

      - name: Upload FreeRTOS+lwIP BDD target ELF
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: solid-syslog-bdd-target-freertos-lwip
          path: build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/SolidSyslogBddTargetLwip.elf
          retention-days: 1
          compression-level: 0

      # BDD-side mirror of build-time tunables (configure_file). The lwIP bdd
      # lane consumes this so environment.py's runtime tag gates track the lwIP
      # target's SOLIDSYSLOG_MAX_MESSAGE_SIZE (512, same as +TCP).
      - name: Upload BDD Python tunables (FreeRTOS+lwIP)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bdd-tunables-freertos-lwip
          path: Bdd/features/steps/solidsyslog_tunables.py
          retention-days: 1

  bdd-freertos-qemu-plustcp:
    needs: build-freertos-target-plustcp
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: solid-syslog-bdd-target-freertos
          path: build/freertos-cross/Bdd/Targets/FreeRtos/

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: bdd-tunables-freertos
          path: Bdd/features/steps/

      - name: Make ELF readable
        run: chmod +r build/freertos-cross/Bdd/Targets/FreeRtos/SolidSyslogBddTarget.elf

      - name: Prepare BDD output directory
        run: mkdir -p Bdd/junit && chmod 777 Bdd/junit

      - name: Run BDD tests
        run: >
          docker compose -f ci/docker-compose.bdd.yml
          up --abort-on-container-exit --exit-code-from behave-freertos
          behave-freertos syslog-ng-freertos

      - name: BDD Test Report (FreeRTOS)
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (BDD FreeRTOS)
          path: Bdd/junit/TESTS-*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-bdd-freertos-qemu-plustcp
          path: Bdd/junit/TESTS-*.xml
          retention-days: 1

      - name: Compose logs on failure
        if: failure()
        run: docker compose -f ci/docker-compose.bdd.yml logs --no-color

  # Required as of S28.11 (in the `summary` needs list): runs the lwIP BDD
  # target on QEMU against the syslog-ng oracle over UDP / TCP / TLS / mTLS.
  # Adding it to the GitHub branch-protection required-checks set is a
  # separate manual step (David).
  bdd-freertos-qemu-lwip:
    needs: build-freertos-target-lwip
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: solid-syslog-bdd-target-freertos-lwip
          path: build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: bdd-tunables-freertos-lwip
          path: Bdd/features/steps/

      - name: Make ELF readable
        run: chmod +r build/freertos-cross-lwip/Bdd/Targets/FreeRtosLwip/SolidSyslogBddTargetLwip.elf

      - name: Prepare BDD output directory
        run: mkdir -p Bdd/junit && chmod 777 Bdd/junit

      - name: Run BDD tests
        run: >
          docker compose -f ci/docker-compose.bdd.yml
          up --abort-on-container-exit --exit-code-from behave-freertos-lwip
          behave-freertos-lwip syslog-ng-freertos-lwip

      - name: BDD Test Report (FreeRTOS+lwIP)
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: success() || failure()
        with:
          name: Test Results (BDD FreeRTOS+lwIP)
          path: Bdd/junit/TESTS-*.xml
          reporter: java-junit

      - name: Upload JUnit XML
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-bdd-freertos-qemu-lwip
          path: Bdd/junit/TESTS-*.xml
          retention-days: 1

      - name: Compose logs on failure
        if: failure()
        run: docker compose -f ci/docker-compose.bdd.yml logs --no-color

  # Anti-drift gate (S30.03): regenerate the committed beta-stack integration
  # manifest from CMake and fail if it differs from what is checked in. Keeps
  # docs/generated/beta-stack-manifest.txt honest against the pack source lists
  # (the generator reads each pack's INTERFACE_SOURCES). Uses the cpputest-freertos
  # image because it exports the FreeRTOS / lwIP / Mbed TLS / FatFs upstream paths,
  # so every SolidSyslog::* pack target the manifest references is defined.
  verify-manifest:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/davidcozens/cpputest-freertos:sha-0b93766
      options: --user root
    env:
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.directory
      GIT_CONFIG_VALUE_0: '*'

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Regenerate the beta-stack manifest
        shell: bash
        run: |
          cmake -S . -B build/manifest -DBUILD_TESTING=OFF \
            -DSOLIDSYSLOG_MANIFEST_PACKS="LwipRaw;LwipRawDnsResolver;MbedTls;FreeRtos;FatFs" \
            -DSOLIDSYSLOG_MANIFEST_OUTPUT="$(pwd)/docs/generated/beta-stack-manifest.txt"

      - name: Fail on drift
        shell: bash
        run: |
          git diff --exit-code docs/generated/beta-stack-manifest.txt \
            || { echo "::error::docs/generated/beta-stack-manifest.txt is stale — regenerate with the manifest target (see docs/getting-started.md)"; exit 1; }

  summary:
    if: always() && github.event_name == 'pull_request'
    needs: [build-linux-gcc, build-linux-tunable-override, build-linux-clang, sanitize-linux-gcc, coverage-linux-gcc, analyze-tidy, analyze-tidy-freertos-plustcp, analyze-tidy-freertos-lwip, analyze-cppcheck, analyze-format, analyze-iwyu, analyze-iwyu-freertos-plustcp, analyze-iwyu-freertos-lwip, bdd-linux-syslog-ng, build-windows-msvc, bdd-windows-otel, integration-linux-openssl, integration-linux-mbedtls, integration-windows-openssl, build-freertos-host-tdd-plustcp, build-freertos-target-plustcp, bdd-freertos-qemu-plustcp, build-freertos-target-lwip, bdd-freertos-qemu-lwip, verify-manifest]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
      pull-requests: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Download JUnit artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: junit-*
          path: quality-reports/

      - name: Download clang-tidy report
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: clang-tidy-report
          path: quality-reports/

      - name: Download cppcheck report
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: cppcheck-report
          path: quality-reports/

      - name: Download iwyu report
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: iwyu-report
          path: quality-reports/

      - name: Quality Monitor
        uses: uhafner/quality-monitor@778e3a640bb5bf89d0f9d2f446bd4802d4821838 # v1.14.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          pr-number: ${{ github.event.pull_request.number }}
          checks-name: Quality Summary
          config: >
            {
              "tests": {
                "name": "Tests",
                "tools": [
                  {
                    "id": "junit",
                    "name": "build-linux-gcc",
                    "pattern": "**/junit-build-linux-gcc/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "build-freertos-host-tdd-plustcp",
                    "pattern": "**/junit-build-freertos-host-tdd-plustcp/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "build-linux-clang",
                    "pattern": "**/junit-build-linux-clang/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "sanitize-linux-gcc",
                    "pattern": "**/junit-sanitize-linux-gcc/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "integration-linux-openssl",
                    "pattern": "**/junit-integration-linux-openssl/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "integration-linux-mbedtls",
                    "pattern": "**/junit-integration-linux-mbedtls/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "integration-windows-openssl",
                    "pattern": "**/junit-integration-windows-openssl/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "bdd-linux-syslog-ng",
                    "pattern": "**/junit-bdd-linux-syslog-ng/TESTS-*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "bdd-windows-otel",
                    "pattern": "**/junit-bdd-windows-otel/TESTS-*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "bdd-freertos-qemu-plustcp",
                    "pattern": "**/junit-bdd-freertos-qemu-plustcp/TESTS-*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "bdd-freertos-qemu-lwip",
                    "pattern": "**/junit-bdd-freertos-qemu-lwip/TESTS-*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "build-windows-msvc",
                    "pattern": "**/junit-build-windows-msvc/cpputest_*.xml"
                  },
                  {
                    "id": "junit",
                    "name": "build-linux-tunable-override",
                    "pattern": "**/junit-build-linux-tunable-override/cpputest_*.xml"
                  }
                ]
              },
              "analysis": [
                {
                  "name": "analyze-tidy",
                  "id": "analyze-tidy",
                  "tools": [
                    {
                      "id": "clang-tidy",
                      "pattern": "**/clang-tidy-output.txt"
                    }
                  ]
                },
                {
                  "name": "analyze-cppcheck",
                  "id": "analyze-cppcheck",
                  "tools": [
                    {
                      "id": "cppcheck",
                      "pattern": "**/cppcheck-report.xml"
                    }
                  ]
                }
              ]
            }