path: root/.github/workflows/build.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow

name: Build

on:
  push:
  pull_request:

permissions:
  contents: read #  to fetch code (actions/checkout)

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Ubuntu 22.04 (gcc)
            os: ubuntu-22.04
            cmake_args: >-
              -DWARNINGS_FATAL=ON
              -DBULK=ON
              -DFFMPEG=ON
              -DLOCALECOMPARE=ON
              -DMAD=ON
              -DMODPLUG=ON
              -DWAVPACK=ON
              -DINSTALL_USER_UDEV_RULES=OFF
            ctest_args: []
            compiler_cache: ccache
            compiler_cache_path: ~/.ccache
            cpack_generator: DEB
            buildenv_basepath: /home/runner/buildenv
            buildenv_script: tools/debian_buildenv.sh
            artifacts_name: Ubuntu 22.04 DEB
            artifacts_path: build/*.deb
            artifacts_slug: ubuntu-jammy
            qt_qpa_platform: offscreen
          - name: Ubuntu 22.04 (Qt 6.2, gcc)
            os: ubuntu-22.04
            cmake_args: >-
              -DWARNINGS_FATAL=ON
              -DQT6=ON
              -DBULK=ON
              -DFFMPEG=ON
              -DLOCALECOMPARE=ON
              -DMAD=ON
              -DMODPLUG=ON
              -DWAVPACK=ON
              -DINSTALL_USER_UDEV_RULES=OFF
            ctest_args: []
            compiler_cache: ccache
            compiler_cache_path: ~/.ccache
            cpack_generator: DEB
            buildenv_basepath: /home/runner/buildenv
            buildenv_script: tools/debian_buildenv_qt6.sh
            artifacts_name: Ubuntu 22.04 Qt6 DEB
            artifacts_path: build/*.deb
            artifacts_slug: ubuntu-jammy
            qt_qpa_platform: offscreen
          - name: macOS 11 x64
            os: macos-11
            cmake_args: >-
              -DBULK=ON
              -DCOREAUDIO=ON
              -DHSS1394=ON
              -DMACOS_BUNDLE=ON
              -DMODPLUG=ON
              -DWAVPACK=ON
              -DVCPKG_TARGET_TRIPLET=x64-osx-min1012
              -DVCPKG_DEFAULT_HOST_TRIPLET=x64-osx-min1012
            # TODO: Fix this broken test on macOS
            ctest_args: --exclude-regex DirectoryDAOTest.relocateDirectory
            cpack_generator: DragNDrop
            compiler_cache: ccache
            compiler_cache_path: /Users/runner/Library/Caches/ccache
            buildenv_basepath: /Users/runner/buildenv
            buildenv_script: tools/macos_release_buildenv.sh
            artifacts_name: macOS Intel DMG
            artifacts_path: build/*.dmg
            artifacts_slug: macos-macosintel
            qt_qpa_platform: offscreen
          - name: macOS 11 arm64
            os: macos-11
            cmake_args: >-
              -DBULK=ON
              -DCOREAUDIO=ON
              -DHSS1394=ON
              -DMACOS_BUNDLE=ON
              -DMODPLUG=ON
              -DWAVPACK=ON
              -DVCPKG_TARGET_TRIPLET=arm64-osx-min1100
              -DVCPKG_DEFAULT_HOST_TRIPLET=x64-osx-min1012
            # TODO: Fix this broken test on macOS
            crosscompile: true
            cpack_generator: DragNDrop
            compiler_cache: ccache
            compiler_cache_path: /Users/runner/Library/Caches/ccache
            buildenv_basepath: /Users/runner/buildenv
            buildenv_script: tools/macos_arm64-cross-release_buildenv.sh
            artifacts_name: macOS ARM DMG
            artifacts_path: build/*.dmg
            artifacts_slug: macos-macosarm
            qt_qpa_platform: offscreen
          - name: Windows 2019 (MSVC)
            os: windows-2019
            # TODO: Re-enable FFmpeg after licensing issues have been clarified
            # Attention: If you change the cmake_args for the Windows CI build,
            #            also adjust the for the local Windows build setup in
            #            ./tools/windows_buildenv.bat
            cmake_args: >-
              -DWARNINGS_FATAL=ON
              -DBULK=OFF
              -DFFMPEG=OFF
              -DHSS1394=ON
              -DLOCALECOMPARE=ON
              -DMAD=ON
              -DMEDIAFOUNDATION=ON
              -DMODPLUG=ON
              -DWAVPACK=ON
            cc: cl
            cxx: cl
            # TODO: Fix these broken tests on Windows
            ctest_args: --exclude-regex '^AutoDJProcessorTest.*$'
            cpack_generator: WIX
            compiler_cache: sccache
            compiler_cache_path: C:\Users\runneradmin\AppData\Local\Mozilla\sccache\cache
            buildenv_basepath: C:\buildenv
            buildenv_script: tools/windows_release_buildenv.bat
            artifacts_name: Windows Installer
            artifacts_path: build/*.msi
            artifacts_slug: windows-win64
            qt_qpa_platform: windows

    env:
      SCCACHE_VERSION: "0.3.0"
      # macOS codesigning
      APPLE_CODESIGN_IDENTITY: 2C2B5D3EDCE82BA55E22E9A67F16F8D03E390870
      MACOS_CODESIGN_OPENSSL_PASSWORD: ${{ secrets.MACOS_CODESIGN_OPENSSL_PASSWORD }}
      MACOS_CODESIGN_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CODESIGN_CERTIFICATE_PASSWORD }}

    runs-on: ${{ matrix.os }}
    name: ${{ matrix.name }}
    container: ${{ matrix.container }}
    outputs:
      artifact-macos-macosintel: ${{ steps.prepare_deploy.outputs.artifact-macos-macosintel }}
      artifact-macos-macosarm: ${{ steps.prepare_deploy.outputs.artifact-macos-macosarm }}
      artifact-windows-win64: ${{ steps.prepare_deploy.outputs.artifact-windows-win64 }}
    steps:
      - name: "[Windows] Set up Cargo cache"
        if: runner.os == 'Windows'
        uses: actions/cache@v3
        id: sccache-build-cache
        with:
          path: C:\Users\runneradmin\.cargo
          key: sccache-${{ env.SCCACHE_VERSION }}

      # This needs to be done first because something later messes with $PATH in a way that breaks cargo
      # by causing it to find link.exe from Git for Windows instead of MSVC.
      - name: "[Windows] Build and install sccache"
        shell: bash
        if: runner.os == 'Windows' && steps.sccache-build-cache.outputs.cache-hit != 'true'
        run: cargo install --version "${{ env.SCCACHE_VERSION }}" sccache

      - name: "Check out repository"
        uses: actions/checkout@v3
        with:
          # This is necessary for making `git describe` work.
          fetch-depth: 0

      - name: "[Arch Linux] Workaround for the 'unsafe repository' issue caused by CVE-2022-24765"
        if: matrix.container != null
        # See https://github.com/actions/checkout/issues/760 for details
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: "Ensure that all tags are fetched"
        # Works around an issue where not the latest tag is not fetched when the
        # workflow is triggered by a tag push event.
        # Possibly related: actions/checkout#290
        run: git fetch origin --force --tags

      - name: "[macOS] Set up cmake"
        uses: jwlawson/actions-setup-cmake@v1.14
        # Ubuntu 22.04 should use the CMake version from the repos, and Visual
        # Studio on Windows comes with its own CMake version anyway.
        if: runner.os == 'macOS'
        with:
          # This should always match the minimum required version in
          # our CMakeLists.txt
          cmake-version: "3.19.x"

      - name: "[Windows] Set up MSVC Developer Command Prompt"
        if: runner.os == 'Windows'
        uses: seanmiddleditch/gha-setup-vsdevenv@v4

      - name: "[macOS] install ccache and make"
        if: runner.os == 'macOS'
        run: |
          brew install ccache ninja

      - name: "[macOS/Windows] Get build environment name"
        if: runner.os != 'Linux'
        id: buildenv_name
        run: ${{ matrix.buildenv_script }} name

      - name: "[macOS/Windows] Set up build environment cache"
        if: runner.os != 'Linux'
        uses: actions/cache@v3
        with:
          path: ${{ matrix.buildenv_basepath }}
          key: ${{ runner.os }}-buildenv-${{ env.BUILDENV_NAME }}

      - name: "[macOS] Import Apple code signing identity"
        id: apple_codesign
        if: runner.os == 'macOS' && env.MACOS_CODESIGN_OPENSSL_PASSWORD != null && env.MACOS_CODESIGN_CERTIFICATE_PASSWORD != null
        run: |
          # Decrypt the certificate
          openssl enc -aes-256-cbc -d -md sha512 \
            -k "${MACOS_CODESIGN_OPENSSL_PASSWORD}" \
            -in /Users/runner/work/mixxx/mixxx/packaging/certificates/macos_developer_id_codesign_certificate.p12.enc \
            -out ~/certificate.p12

          # Create a temporary keychain for the certificate and import it.
          security create-keychain -p mixxx Mixxx.keychain
          security unlock-keychain -p mixxx Mixxx.keychain
          security import ~/certificate.p12 -k Mixxx.keychain \
            -P "${MACOS_CODESIGN_CERTIFICATE_PASSWORD}" -A
          security set-key-partition-list -S "apple-tool:,apple:" -k mixxx Mixxx.keychain
          # Add keychain to search list
          security list-keychains -s Mixxx.keychain
          # Prevent keychain access from timing out
          security set-keychain-settings Mixxx.keychain
          echo "CMAKE_ARGS_EXTRA=${CMAKE_ARGS_EXTRA} -DAPPLE_CODESIGN_IDENTITY=${APPLE_CODESIGN_IDENTITY}" >> "${GITHUB_ENV}"

      - name: "[Windows] Set up Windows code signing"
        env:
          WINDOWS_CODESIGN_CERTIFICATE_PATH: ${{ github.workspace }}\packaging\certificates\windows_sectigo_codesign_certificate.pfx
          WINDOWS_CODESIGN_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CODESIGN_CERTIFICATE_PASSWORD }}
          WINDOWS_CODESIGN_SECURE_FILE_SALT: ${{ secrets.WINDOWS_CODESIGN_SECURE_FILE_SALT }}
          WINDOWS_CODESIGN_SECURE_FILE_SECRET: ${{ secrets.WINDOWS_CODESIGN_SECURE_FILE_SECRET }}
        if: runner.os == 'Windows' && env.WINDOWS_CODESIGN_SECURE_FILE_SALT != null && env.WINDOWS_CODESIGN_SECURE_FILE_SECRET != null
        run: |
          iex ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/appveyor/secure-file/master/install.ps1'))
          appveyor-tools/secure-file -decrypt "$Env:WINDOWS_CODESIGN_CERTIFICATE_PATH.enc" -secret "$Env:WINDOWS_CODESIGN_SECURE_FILE_SECRET" -salt "$Env:WINDOWS_CODESIGN_SECURE_FILE_SALT"
          Add-Content -Path "$Env:GITHUB_ENV" -Value "WINDOWS_CODESIGN_CERTIFICATE_PATH=$Env:WINDOWS_CODESIGN_CERTIFICATE_PATH"
          Add-Content -Path "$Env:GITHUB_ENV" -Value "WINDOWS_CODESIGN_CERTIFICATE_PASSWORD=$Env:WINDOWS_CODESIGN_CERTIFICATE_PASSWORD"
          Add-Content -Path "$Env:GITHUB_ENV" -Value "CMAKE_ARGS_EXTRA=-DWINDOWS_CODESIGN=ON"

      - name: "Set up build