ci.yml

############################################################
# Map2Check CI — Build, Test, Static & Dynamic Analysis
#
# Runs on every push and pull request.
# Installs LLVM 16 directly on ubuntu-22.04 runner.
# Unit tests use -DSKIP_KLEE=ON -DSKIP_LIB_FUZZER=ON,
# so the full Dockerfile.dev dependencies are not needed.
#
# Phase 1.5 — OpenSSF Best Practices Badge (Analysis section)
############################################################
name: CI

on:
  push:
    branches: [develop, main, master, 'feat-*']
  pull_request:
    branches: [develop, main, master]

jobs:
  # ===========================================================
  # Job 1: Build + Unit Tests
  # ===========================================================
  build-and-test:
    name: Build & Unit Tests
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install LLVM 16 + WABT
        run: |
          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
          echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-16 main" | sudo tee /etc/apt/sources.list.d/llvm-16.list
          sudo apt-get update
          sudo apt-get install -y \
            clang-16 llvm-16 llvm-16-dev libclang-16-dev \
            cmake ninja-build libboost-all-dev zlib1g-dev
          # WABT 1.0.41 (apt tem 1.0.27, API incompatível com WasmRuntimeStubs.c)
          wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
          sudo tar xzf /tmp/wabt.tar.gz -C /opt
          sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c

      - name: Configure CMake
        run: |
          mkdir -p build && cd build
          cmake .. -G Ninja \
            -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \
            -DSKIP_LIB_FUZZER=ON \
            -DSKIP_KLEE=ON \
            -DENABLE_TEST=ON
        env:
          CC: /usr/bin/clang-16
          CXX: /usr/bin/clang++-16

      - name: Build
        run: cd build && ninja

      - name: Run Unit Tests
        run: cd build && ctest --output-on-failure

  # ===========================================================
  # Job 2: Static Analysis (cppcheck + clang-tidy)
  # ===========================================================
  static-analysis:
    name: Static Analysis
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install LLVM 16 + cppcheck + WABT
        run: |
          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
          echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-16 main" | sudo tee /etc/apt/sources.list.d/llvm-16.list
          sudo apt-get update
          sudo apt-get install -y \
            clang-16 clang-tidy-16 llvm-16 llvm-16-dev libclang-16-dev \
            cmake ninja-build libboost-all-dev zlib1g-dev \
            cppcheck
          # WABT 1.0.41 (apt tem 1.0.27, API incompatível com WasmRuntimeStubs.c)
          wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
          sudo tar xzf /tmp/wabt.tar.gz -C /opt
          sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c

      - name: Generate compile_commands.json
        run: |
          mkdir -p build && cd build
          cmake .. -G Ninja \
            -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \
            -DSKIP_LIB_FUZZER=ON \
            -DSKIP_KLEE=ON \
            -DENABLE_TEST=ON \
            -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
        env:
          CC: /usr/bin/clang-16
          CXX: /usr/bin/clang++-16

      - name: Run cppcheck (C++)
        run: |
          cppcheck \
            --enable=warning,portability \
            --suppress=missingIncludeSystem \
            --suppress=unknownMacro \
            --suppress=unusedFunction \
            --suppress=passedByValue \
            --suppressions-list=.cppcheck-suppressions.txt \
            --inline-suppr \
            --error-exitcode=1 \
            --std=c++17 \
            --language=c++ \
            -I modules/ \
            modules/frontend/ \
            tests/unit/

      - name: Run cppcheck (C backend)
        # Blocking since the backend was cleared of all findings
        # (migration-schedule item 2.0.12 / OpenSSF static_analysis_fixed)
        run: |
          cppcheck \
            --enable=warning,portability \
            --suppress=missingIncludeSystem \
            --suppress=unknownMacro \
            --suppress=unusedFunction \
            --suppressions-list=.cppcheck-suppressions.txt \
            --inline-suppr \
            --error-exitcode=1 \
            --std=c11 \
            --language=c \
            -I modules/ \
            modules/backend/library/

      - name: Build (for clang-tidy)
        run: cd build && ninja
        env:
          CC: /usr/bin/clang-16
          CXX: /usr/bin/clang++-16

      - name: Run clang-tidy
        run: |
          find modules/frontend -name '*.cpp' | \
            xargs -I{} clang-tidy-16 -p build/ \
              --config-file=.clang-tidy \
              --warnings-as-errors='clang-analyzer-core.*,clang-analyzer-security.*,bugprone-use-after-move' \
              {} 2>&1 || true

  # ===========================================================
  # Job 3: Dynamic Analysis (ASan + UBSan)
  # ===========================================================
  sanitizer-tests:
    name: Sanitizer Tests (ASan + UBSan)
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install LLVM 16 + WABT
        run: |
          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
          echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-16 main" | sudo tee /etc/apt/sources.list.d/llvm-16.list
          sudo apt-get update
          sudo apt-get install -y \
            clang-16 llvm-16 llvm-16-dev libclang-16-dev \
            cmake ninja-build libboost-all-dev zlib1g-dev
          # WABT 1.0.41 (apt tem 1.0.27, API incompatível com WasmRuntimeStubs.c)
          wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
          sudo tar xzf /tmp/wabt.tar.gz -C /opt
          sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c

      - name: Configure CMake with Sanitizers
        run: |
          mkdir -p build && cd build
          cmake .. -G Ninja \
            -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \
            -DSKIP_LIB_FUZZER=ON \
            -DSKIP_KLEE=ON \
            -DENABLE_TEST=ON \
            -DMAP2CHECK_ENABLE_SANITIZERS=ON
        env:
          CC: /usr/bin/clang-16
          CXX: /usr/bin/clang++-16

      - name: Build with Sanitizers
        run: cd build && ninja
        env:
          CC: /usr/bin/clang-16
          CXX: /usr/bin/clang++-16

      - name: Run Tests with ASan + UBSan
        env:
          # Strict mode (OpenSSF dynamic_analysis_fixed): any leak or UB
          # fails the job. The findings that once justified relaxing these
          # flags (BTree.c off-by-one, test leaks) are fixed.
          ASAN_OPTIONS: "detect_leaks=1:halt_on_error=1:abort_on_error=1"
          UBSAN_OPTIONS: "print_stacktrace=1:halt_on_error=1"
        run: cd build && ctest --output-on-failure

  # ===========================================================
  # Job 4: WASM End-to-End Tests (Docker)
  # ===========================================================
  # Runs the full pipeline inside the published map2check-dev image,
  # which already contains LLVM 16 + KLEE 3.1 + WABT + wasi-sdk.
  # This catches regressions that unit tests miss (KLEE flags,
  # isRequired, target function, wasm-rt linking, etc.).
  e2e-wasm:
    name: WASM E2E Tests (Docker)
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    needs: [build-and-test]

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
          sudo docker image prune -a -f || true

      - name: Pull map2check-dev image
        run: docker pull ghcr.io/hbgit/map2check-dev:latest

      - name: Build + install Map2Check in container
        run: |
          docker run --rm \
            -u root \
            -v "${{ github.workspace }}:/workspace" \
            -w /workspace \
            -e CC=/usr/bin/clang-16 \
            -e CXX=/usr/bin/clang++-16 \
            ghcr.io/hbgit/map2check-dev:latest bash -c '
              # Install WABT + wasi-sdk (published image lacks them)
              if [ ! -f /opt/wabt-1.0.41/include/wasm-rt.h ]; then
                wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
                tar xzf /tmp/wabt.tar.gz -C /opt && rm /tmp/wabt.tar.gz
                ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c
              fi
              if [ ! -d /opt/wasi-sdk-33.0-x86_64-linux ]; then
                wget -q "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-33/wasi-sdk-33.0-x86_64-linux.tar.gz" -O /tmp/wasi-sdk.tar.gz
                tar xzf /tmp/wasi-sdk.tar.gz -C /opt && rm /tmp/wasi-sdk.tar.gz
              fi

              # Build and install to a release-style layout
              rm -rf build_e2e install_e2e
              mkdir -p build_e2e && cd build_e2e
              cmake .. -G Ninja \
                -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \
                -DENABLE_TEST=ON \
                -DMAP2CHECK_DYNAMIC_LINK=ON \
                -DCMAKE_INSTALL_PREFIX=/workspace/install_e2e
              ninja
              ninja install

              # Symlink KLEE runtime + compiler-rt files missing from install rules
              mkdir -p /workspace/install_e2e/lib/klee
              ln -sf /opt/klee/lib/klee/runtime /workspace/install_e2e/lib/klee/runtime
              ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_e2e/lib/clang
            '

      - name: Run WASM integration tests
        run: |
          docker run --rm \
            -u root \
            -v "${{ github.workspace }}:/workspace" \
            -w /workspace \
            -e MAP2CHECK_PATH=/workspace/install_e2e \
            -e WASI_SDK_PATH=/opt/wasi-sdk-33.0-x86_64-linux \
            ghcr.io/hbgit/map2check-dev:latest bash -c '
              # Ensure WABT + wasi-sdk are available in this fresh container
              if [ ! -f /opt/wabt-1.0.41/include/wasm-rt.h ]; then
                wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
                tar xzf /tmp/wabt.tar.gz -C /opt && rm /tmp/wabt.tar.gz
                ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c
              fi
              if [ ! -d /opt/wasi-sdk-33.0-x86_64-linux ]; then
                wget -q "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-33/wasi-sdk-33.0-x86_64-linux.tar.gz" -O /tmp/wasi-sdk.tar.gz
                tar xzf /tmp/wasi-sdk.tar.gz -C /opt && rm /tmp/wasi-sdk.tar.gz
              fi
              bash tests/integration/test_wasm_pipeline.sh
              bash tests/integration/test_wasm_entrypoint.sh
            '

  # ===========================================================
  # Job 5: Dynamic Analysis — Valgrind memcheck (OpenSSF)
  # ===========================================================
  # Build ISOLADO e SEM sanitizers: a shadow memory do ASan/UBSan
  # conflita com a VM do Valgrind. Debug + DWARF-4 para stacks
  # legíveis (Valgrind 3.18 não lê bem o DWARF-5 do clang-16).
  valgrind-memcheck:
    name: Valgrind Memcheck (ctest)
    runs-on: ubuntu-22.04
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install LLVM 16 + Valgrind + WABT
        run: |
          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
          echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-16 main" | sudo tee /etc/apt/sources.list.d/llvm-16.list
          sudo apt-get update
          sudo apt-get install -y \
            clang-16 llvm-16 llvm-16-dev libclang-16-dev \
            cmake ninja-build libboost-all-dev zlib1g-dev \
            valgrind
          # WABT 1.0.41 (apt tem 1.0.27, API incompatível com WasmRuntimeStubs.c)
          wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
          sudo tar xzf /tmp/wabt.tar.gz -C /opt
          sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c

      - name: Configure CMake (Debug, sem sanitizers)
        run: |
          mkdir -p build && cd build
          cmake .. -G Ninja \
            -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \
            -DSKIP_LIB_FUZZER=ON \
            -DSKIP_KLEE=ON \
            -DENABLE_TEST=ON \
            -DCMAKE_BUILD_TYPE=Debug \
            -DCMAKE_C_FLAGS="-gdwarf-4" \
            -DCMAKE_CXX_FLAGS="-gdwarf-4" \
            -DMEMORYCHECK_COMMAND=/usr/bin/valgrind \
            -DMEMORYCHECK_SUPPRESSIONS_FILE="${{ github.workspace }}/valgrind.supp" \
            -DMEMORYCHECK_COMMAND_OPTIONS="--tool=memcheck --leak-check=full --show-leak-kinds=all --errors-for-leak-kinds=definite --track-origins=yes --num-callers=40 --error-exitcode=1 --gen-suppressions=all"
        env:
          CC: /usr/bin/clang-16
          CXX: /usr/bin/clang++-16

      - name: Build
        run: cd build && ninja

      - name: Run ctest under Valgrind (memcheck)
        run: cd build && ctest -T memcheck --output-on-failure

      - name: Enforce zero memcheck defects
        # Rede de segurança além do --error-exitcode=1: falha se qualquer
        # log do memcheck registrar erros ou "definitely lost".
        run: |
          cd build
          shopt -s nullglob
          defects=0
          for log in Testing/Temporary/MemoryChecker.*.log; do
            if grep -qE "ERROR SUMMARY: [1-9][0-9]* errors|definitely lost: [1-9]" "$log"; then
              echo "::error::Valgrind encontrou defeitos em $log"
              cat "$log"
              defects=1
            fi
          done
          exit $defects

      - name: Upload memcheck logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: valgrind-memcheck-logs
          path: build/Testing/Temporary/MemoryChecker.*.log
          if-no-files-found: ignore