ci.yml

name: CI
on:
  pull_request:
  push:
    branches:
      - '**'
    tags-ignore:
      - '**'

concurrency:
  group: ${{ github.event_name != 'pull_request' && github.run_id || github.ref }}
  cancel-in-progress: true

env:
  ### compiler options
  HOST:
  WRAPPER_CMD:
  # Specific warnings can be disabled with -Wno-error=foo.
  # -pedantic-errors is not equivalent to -Werror=pedantic and thus not implied by -Werror according to the GCC manual.
  WERROR_CFLAGS: '-Werror -pedantic-errors'
  MAKEFLAGS: '-j4'
  BUILD: 'check'
  ### secp256k1 config
  ECMULTWINDOW: 15
  ECMULTGENKB: 86
  ASM: 'no'
  WIDEMUL: 'auto'
  WITH_VALGRIND: 'yes'
  EXTRAFLAGS:
  ### secp256k1 modules
  EXPERIMENTAL: 'no'
  ECDH: 'no'
  RECOVERY: 'no'
  EXTRAKEYS: 'no'
  SCHNORRSIG: 'no'
  MUSIG: 'no'
  ELLSWIFT: 'no'
  ### test options
  SECP256K1_TEST_ITERS: 64
  BENCH: 'yes'
  SECP256K1_BENCH_ITERS: 2
  CTIMETESTS: 'yes'
  # Compile and run the examples.
  EXAMPLES: 'yes'

jobs:
  test-each-commit:
    name: 'test each commit'
    runs-on: ubuntu-24.04
    if: github.event_name == 'pull_request' && github.event.pull_request.commits != 1
    timeout-minutes: 360  # Use maximum time, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idtimeout-minutes. Assuming a worst case time of 1 hour per commit, this leads to a --max-count=6 below.
    env:
      MAX_COUNT: 6
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: ${{ env.FETCH_DEPTH }}
      - name: Determine commit range
        run: |
          # Checkout HEAD~ and find the test base commit
          # Checkout HEAD~ because it would be wasteful to rerun tests on the PR
          # head commit that are already run by other jobs.
          git checkout HEAD~
          # Figure out test base commit by listing ancestors of HEAD, excluding
          # ancestors of the most recent merge commit, limiting the list to the
          # newest MAX_COUNT ancestors, ordering it from oldest to newest, and
          # taking the first one.
          #
          # If the branch contains up to MAX_COUNT ancestor commits after the
          # most recent merge commit, all of those commits will be tested. If it
          # contains more, only the most recent MAX_COUNT commits will be
          # tested.
          #
          # In the command below, the ^@ suffix is used to refer to all parents
          # of the merge commit as described in:
          # https://git-scm.com/docs/git-rev-parse#_other_rev_parent_shorthand_notations
          # and the ^ prefix is used to exclude these parents and all their
          # ancestors from the rev-list output as described in:
          # https://git-scm.com/docs/git-rev-list
          MERGE_BASE=$(git rev-list -n1 --merges HEAD)
          EXCLUDE_MERGE_BASE_ANCESTORS=
          # MERGE_BASE can be empty due to limited fetch-depth
          if test -n "$MERGE_BASE"; then
            EXCLUDE_MERGE_BASE_ANCESTORS=^${MERGE_BASE}^@
          fi
          echo "TEST_BASE=$(git rev-list -n$((${{ env.MAX_COUNT }} + 1)) --reverse HEAD $EXCLUDE_MERGE_BASE_ANCESTORS | head -1)" >> "$GITHUB_ENV"
      - run: |
          sudo apt-get update
          sudo apt-get install clang ccache build-essential cmake pkg-config python3-zmq libevent-dev libboost-dev libsqlite3-dev libdb++-dev systemtap-sdt-dev libzmq3-dev qtbase5-dev qttools5-dev qttools5-dev-tools qtwayland5 libqrencode-dev -y
      - name: Compile and run tests
        run: |
          # Run tests on commits after the last merge commit and before the PR head commit
          # Use clang++, because it is a bit faster and uses less memory than g++
          git rebase --exec "echo Running test-one-commit on \$( git log -1 ) && CC=clang CXX=clang++ cmake -B build -DWERROR=ON -DWITH_ZMQ=ON -DBUILD_GUI=ON -DBUILD_BENCH=ON -DBUILD_FUZZ_BINARY=ON -DWITH_BDB=ON -DWITH_USDT=ON -DCMAKE_CXX_FLAGS='-Wno-error=unused-member-function' && cmake --build build -j $(nproc) && ctest --output-on-failure --stop-on-failure --test-dir build -j $(nproc) && ./build/test/functional/test_runner.py -j $(( $(nproc) * 2 ))" ${{ env.TEST_BASE }}

  macos-native-arm64:
    name: ${{ matrix.job-name }}
    # Use latest image, but hardcode version to avoid silent upgrades (and breaks).
    # See: https://github.com/actions/runner-images#available-images.
    runs-on: macos-14

    # When a contributor maintains a fork of the repo, any pull request they make
    # to their own fork, or to the main repository, will trigger two CI runs:
    # one for the branch push and one for the pull request.
    # This can be avoided by setting SKIP_BRANCH_PUSH=true as a custom env variable
    # in Github repository settings.
    if: ${{ vars.SKIP_BRANCH_PUSH != 'true' || github.event_name == 'pull_request' }}

    timeout-minutes: 120

    strategy:
      fail-fast: false
      matrix:
        job-type: [standard, fuzz]
        include:
          - job-type: standard
            file-env: './ci/test/00_setup_env_mac_native.sh'
            job-name: 'macOS 14 native, arm64, no depends, sqlite only, gui'
          - job-type: fuzz
            file-env: './ci/test/00_setup_env_mac_native_fuzz.sh'
            job-name: 'macOS 14 native, arm64, fuzz'

    env:
      DANGER_RUN_CI_ON_HOST: 1
      BASE_ROOT_DIR: ${{ github.workspace }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Clang version
        run: |
          sudo xcode-select --switch /Applications/Xcode_15.0.app
          clang --version

      - name: Install Homebrew packages
        env:
          HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: 1
        run: |
          # A workaround for "The `brew link` step did not complete successfully" error.
          brew install --quiet python@3 || brew link --overwrite python@3
          brew install --quiet coreutils ninja pkgconf gnu-getopt ccache boost libevent zeromq qt@5 qrencode

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Restore Ccache cache
        id: ccache-cache
        uses: actions/cache/restore@v4
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ${{ github.job }}-${{ matrix.job-type }}-ccache-${{ github.run_id }}
          restore-keys: ${{ github.job }}-${{ matrix.job-type }}-ccache-

      - name: CI script
        run: ./ci/test_run_all.sh
        env:
          FILE_ENV: ${{ matrix.file-env }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: CI script
        uses: ./.github/actions/run-in-docker-action
        with:
          path: ${{ env.CCACHE_DIR }}
          # https://github.com/actions/cache/blob/main/tips-and-workarounds.md#update-a-cache
          key: ${{ github.job }}-${{ matrix.job-type }}-ccache-${{ github.run_id }}

  win64-native:
    name: ${{ matrix.job-name }}
    # Use latest image, but hardcode version to avoid silent upgrades (and breaks).
    # See: https://github.com/actions/runner-images#available-images.
    runs-on: windows-2022

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: CI script
        env: ${{ matrix.configuration.env_vars }}
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image

      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}

  arm64_debian:
    name: "ARM64: Linux (Debian stable, QEMU)"
    runs-on: ubuntu-latest
    needs: docker_cache

    env:
      WRAPPER_CMD: 'qemu-aarch64'
      SECP256K1_TEST_ITERS: 16
      HOST: 'aarch64-linux-gnu'
      WITH_VALGRIND: 'no'
      ECDH: 'yes'
      RECOVERY: 'yes'
      EXTRAKEYS: 'yes'
      SCHNORRSIG: 'yes'
      MUSIG: 'yes'
      ELLSWIFT: 'yes'
      CTIMETESTS: 'no'

    strategy:
      fail-fast: false
      matrix:
        configuration:
          - env_vars: { } # gcc
          - env_vars: # clang
              CC: 'clang --target=aarch64-linux-gnu'
          - env_vars: # clang-snapshot
              CC: 'clang-snapshot --target=aarch64-linux-gnu'

    if: ${{ vars.SKIP_BRANCH_PUSH != 'true' || github.event_name == 'pull_request' }}

    env:
      WRAPPER_CMD: 'qemu-ppc64le'
      SECP256K1_TEST_ITERS: 16
      HOST: 'powerpc64le-linux-gnu'
      WITH_VALGRIND: 'no'
      ECDH: 'yes'
      RECOVERY: 'yes'
      EXTRAKEYS: 'yes'
      SCHNORRSIG: 'yes'
      MUSIG: 'yes'
      ELLSWIFT: 'yes'
      CTIMETESTS: 'no'

    strategy:
      fail-fast: false
      matrix:
        job-type: [standard, fuzz]
        include:
          - job-type: standard
            generate-options: '-DBUILD_GUI=ON -DWITH_BDB=ON -DWITH_ZMQ=ON -DBUILD_BENCH=ON -DWERROR=ON'
            job-name: 'Win64 native, VS 2022'
          - job-type: fuzz
            generate-options: '-DVCPKG_MANIFEST_NO_DEFAULT_FEATURES=ON -DVCPKG_MANIFEST_FEATURES="sqlite" -DBUILD_GUI=OFF -DBUILD_FOR_FUZZING=ON -DWERROR=ON'
            job-name: 'Win64 native fuzz, VS 2022'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure Developer Command Prompt for Microsoft Visual C++
        # Using microsoft/setup-msbuild is not enough.
        uses: ilammy/msvc-dev-cmd@v1
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image

      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}

  valgrind_debian:
    name: "Valgrind (memcheck)"
    runs-on: ubuntu-latest
    needs: docker_cache

    strategy:
      fail-fast: false
      matrix:
        configuration:
          - env_vars: { CC: 'clang',                                      ASM: 'auto' }
          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'auto' }
          - env_vars: { CC: 'clang',                                      ASM: 'no', ECMULTGENKB: 2, ECMULTWINDOW: 2 }
          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'no', ECMULTGENKB: 2, ECMULTWINDOW: 2 }

    env:
      # The `--error-exitcode` is required to make the test fail if valgrind found errors,
      # otherwise it will return 0 (https://www.valgrind.org/docs/manual/manual-core.html).
      WRAPPER_CMD: 'valgrind --error-exitcode=42'
      ECDH: 'yes'
      RECOVERY: 'yes'
      EXTRAKEYS: 'yes'
      SCHNORRSIG: 'yes'
      MUSIG: 'yes'
      ELLSWIFT: 'yes'
      CTIMETESTS: 'no'
      SECP256K1_TEST_ITERS: 2

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: CI script
        env: ${{ matrix.configuration.env_vars }}
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image

      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}

  sanitizers_debian:
    name: "UBSan, ASan, LSan"
    runs-on: ubuntu-latest
    needs: docker_cache

    strategy:
      fail-fast: false
      matrix:
        configuration:
          - env_vars: { CC: 'clang',                                      ASM: 'auto' }
          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'auto' }
          - env_vars: { CC: 'clang',                                      ASM: 'no', ECMULTGENKB: 2, ECMULTWINDOW: 2 }
          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'no', ECMULTGENKB: 2, ECMULTWINDOW: 2 }

    env:
      ECDH: 'yes'
      RECOVERY: 'yes'
      EXTRAKEYS: 'yes'
      SCHNORRSIG: 'yes'
      MUSIG: 'yes'
      ELLSWIFT: 'yes'
      CTIMETESTS: 'no'
      CFLAGS: '-fsanitize=undefined,address -g'
      UBSAN_OPTIONS: 'print_stacktrace=1:halt_on_error=1'
      ASAN_OPTIONS: 'strict_string_checks=1:detect_stack_use_after_return=1:detect_leaks=1'
      LSAN_OPTIONS: 'use_unaligned=1'
      SECP256K1_TEST_ITERS: 32

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: vcpkg tools cache
        uses: actions/cache@v4
        with:
          path: C:/vcpkg/downloads/tools
          key: ${{ github.job }}-vcpkg-tools

  msan_debian:
    name: "MSan"
    runs-on: ubuntu-latest
    needs: docker_cache

    strategy:
      fail-fast: false
      matrix:
        configuration:
          - env_vars:
              CTIMETESTS: 'yes'
              CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -g'
          - env_vars:
              ECMULTGENKB: 2
              ECMULTWINDOW: 2
              CTIMETESTS: 'yes'
              CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -g -O3'
          - env_vars:
              # -fsanitize-memory-param-retval is clang's default, but our build system disables it
              # when ctime_tests when enabled.
              CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -fsanitize-memory-param-retval -g'
              CTIMETESTS: 'no'

    env:
      ECDH: 'yes'
      RECOVERY: 'yes'
      EXTRAKEYS: 'yes'
      SCHNORRSIG: 'yes'
      MUSIG: 'yes'
      ELLSWIFT: 'yes'
      CC: 'clang'
      SECP256K1_TEST_ITERS: 32
      ASM: 'no'
      WITH_VALGRIND: 'no'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: CI script
        env: ${{ matrix.configuration.env_vars }}
        uses: ./.github/actions/run-in-docker-action
        with:
          path: ~/AppData/Local/vcpkg/archives
          key: ${{ github.job }}-vcpkg-binary-${{ hashFiles('cmake_version', 'msbuild_version', 'toolset_version', 'vcpkg.json') }}

      - name: Generate build system
        run: |
          cmake -B build --preset vs2022-static -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_INSTALLATION_ROOT\scripts\buildsystems\vcpkg.cmake" ${{ matrix.generate-options }}

      - name: Save vcpkg binary cache
        uses: actions/cache/save@v4
        if: github.event_name != 'pull_request' && steps.vcpkg-binary-cache.outputs.cache-hit != 'true' && matrix.job-type == 'standard'
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image

      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}

  x86_64-macos-native:
    name: "x86_64: macOS Ventura, Valgrind"
    # See: https://github.com/actions/runner-images#available-images.
    runs-on: macos-13

    env:
      CC: 'clang'
      HOMEBREW_NO_AUTO_UPDATE: 1
      HOMEBREW_NO_INSTALL_CLEANUP: 1

    strategy:
      fail-fast: false
      matrix:
        env_vars:
          - { WIDEMUL: 'int64',  RECOVERY: 'yes', ECDH: 'yes', EXTRAKEYS: 'yes', SCHNORRSIG: 'yes', MUSIG: 'yes', ELLSWIFT: 'yes' }
          - { WIDEMUL: 'int128_struct', ECMULTGENKB: 2, ECMULTWINDOW: 4 }
          - { WIDEMUL: 'int128',                  ECDH: 'yes', EXTRAKEYS: 'yes', SCHNORRSIG: 'yes', MUSIG: 'yes', ELLSWIFT: 'yes' }
          - { WIDEMUL: 'int128', RECOVERY: 'yes' }
          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', EXTRAKEYS: 'yes', SCHNORRSIG: 'yes', MUSIG: 'yes', ELLSWIFT: 'yes' }
          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', EXTRAKEYS: 'yes', SCHNORRSIG: 'yes', MUSIG: 'yes', ELLSWIFT: 'yes', CC: 'gcc' }
          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', EXTRAKEYS: 'yes', SCHNORRSIG: 'yes', MUSIG: 'yes', ELLSWIFT: 'yes',            WRAPPER_CMD: 'valgrind --error-exitcode=42', SECP256K1_TEST_ITERS: 2 }
          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', EXTRAKEYS: 'yes', SCHNORRSIG: 'yes', MUSIG: 'yes', ELLSWIFT: 'yes', CC: 'gcc', WRAPPER_CMD: 'valgrind --error-exitcode=42', SECP256K1_TEST_ITERS: 2 }
          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', EXTRAKEYS: 'yes', SCHNORRSIG: 'yes', MUSIG: 'yes', ELLSWIFT: 'yes', CPPFLAGS: '-DVERIFY', CTIMETESTS: 'no' }
          - BUILD: 'distcheck'

      - name: Build
        working-directory: build
        run: |
          brew install --quiet automake libtool gcc
          ln -s $(brew --prefix gcc)/bin/gcc-?? /usr/local/bin/gcc

      - name: Run test suite
        if: matrix.job-type == 'standard'
        working-directory: build
        run: |
          cd build/bin/RelWithDebInfo && file *tests.exe bench*.exe libsecp256k1-*.dll || true

      - name: Check
        run: |
          ctest --output-on-failure --stop-on-failure -j $env:NUMBER_OF_PROCESSORS -C Release

      - name: Run functional tests
        if: matrix.job-type == 'standard'
        working-directory: build
        env:
          BGLD: '${{ github.workspace }}\build\src\Release\BGLd.exe'
          BGLCLI: '${{ github.workspace }}\build\src\Release\BGL-cli.exe'
          BGLUTIL: '${{ github.workspace }}\build\src\Release\BGL-util.exe'
          BGLWALLET: '${{ github.workspace }}\build\src\Release\BGL-wallet.exe'
          TEST_RUNNER_EXTRA: ${{ github.event_name != 'pull_request' && '--extended' || '' }}
        shell: cmd
        run: py -3 test\functional\test_runner.py --jobs %NUMBER_OF_PROCESSORS% --ci --quiet --tmpdirprefix=%RUNNER_TEMP% --combinedlogslen=99999999 --timeout-factor=%TEST_RUNNER_TIMEOUT_FACTOR% %TEST_RUNNER_EXTRA%

      - name: Clone corpora
        if: matrix.job-type == 'fuzz'
        run: |
          git clone --depth=1 https://github.com/bitcoin-core/qa-assets "$env:RUNNER_TEMP\qa-assets"
          Set-Location "$env:RUNNER_TEMP\qa-assets"
          Write-Host "Using qa-assets repo from commit ..."
          git log -1

      - name: Run fuzz tests
        if: matrix.job-type == 'fuzz'
        working-directory: build
        env:
          BITCOINFUZZ: '${{ github.workspace }}\build\src\test\fuzz\Release\fuzz.exe'
        shell: cmd
        run: |
          py -3 test\fuzz\test_runner.py --par %NUMBER_OF_PROCESSORS% --loglevel DEBUG %RUNNER_TEMP%\qa-assets\fuzz_corpora

  asan-lsan-ubsan-integer-no-depends-usdt:
    name: 'ASan + LSan + UBSan + integer, no depends, USDT'
    runs-on: ubuntu-24.04 # has to match container in ci/test/00_setup_env_native_asan.sh for tracing tools
    if: ${{ vars.SKIP_BRANCH_PUSH != 'true' || github.event_name == 'pull_request' }}
    timeout-minutes: 120
    env:
      FILE_ENV: "./ci/test/00_setup_env_native_asan.sh"
      DANGER_CI_ON_HOST_CACHE_FOLDERS: 1
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Add cl.exe to PATH
        uses: ilammy/msvc-dev-cmd@v1

      - name: C++ (public headers)
        run: |
          cl.exe -c -WX -TP include/*.h

  cxx_fpermissive_debian:
    name: "C++ -fpermissive (entire project)"
    runs-on: ubuntu-latest
    needs: docker_cache

    env:
      CC: 'g++'
      CFLAGS: '-fpermissive -g'
      CPPFLAGS: '-DSECP256K1_CPLUSPLUS_TEST_OVERRIDE'
      WERROR_CFLAGS:
      ECDH: 'yes'
      RECOVERY: 'yes'
      EXTRAKEYS: 'yes'
      SCHNORRSIG: 'yes'
      MUSIG: 'yes'
      ELLSWIFT: 'yes'

      - name: Save Ccache cache
        uses: actions/cache/save@v4
        if: github.event_name != 'pull_request' && steps.ccache-cache.outputs.cache-hit != 'true'
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image

      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}

  cxx_headers_debian:
    name: "C++ (public headers)"
    runs-on: ubuntu-latest
    needs: docker_cache

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: CI script
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
          command: |
            g++ -Werror include/*.h
            clang -Werror -x c++-header include/*.h

  sage:
    name: "SageMath prover"
    runs-on: ubuntu-latest
    container:
      image: sagemath/sagemath:latest
      options: --user root

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: CI script
        run: |
          cd sage
          sage prove_group_implementations.sage

  release:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - run: ./autogen.sh && ./configure --enable-dev-mode && make distcheck

      - name: Check installation with Autotools
        env:
          CI_INSTALL: ${{ runner.temp }}/${{ github.run_id }}${{ github.action }}/install
        run: |
          ./autogen.sh && ./configure --prefix=${{ env.CI_INSTALL }} && make clean && make install && ls -RlAh ${{ env.CI_INSTALL }}
          gcc -o ecdsa examples/ecdsa.c $(PKG_CONFIG_PATH=${{ env.CI_INSTALL }}/lib/pkgconfig pkg-config --cflags --libs libsecp256k1) -Wl,-rpath,"${{ env.CI_INSTALL }}/lib" && ./ecdsa

      - name: Run functional tests
        env:
          TEST_RUNNER_EXTRA: ${{ github.event_name != 'pull_request' && '--extended' || '' }}
        shell: cmd
        run: py -3 test\functional\test_runner.py --jobs %NUMBER_OF_PROCESSORS% --ci --quiet --tmpdirprefix=%RUNNER_TEMP% --combinedlogslen=99999999 --timeout-factor=%TEST_RUNNER_TIMEOUT_FACTOR% %TEST_RUNNER_EXTRA%

      - name: Clone fuzz corpus
        run: |
          cmake -B ${{ env.CI_BUILD }} -DCMAKE_INSTALL_PREFIX=${{ env.CI_INSTALL }} && cmake --build ${{ env.CI_BUILD }} && cmake --install ${{ env.CI_BUILD }} && ls -RlAh ${{ env.CI_INSTALL }}
          gcc -o ecdsa examples/ecdsa.c -I ${{ env.CI_INSTALL }}/include -L ${{ env.CI_INSTALL }}/lib*/ -l secp256k1 -Wl,-rpath,"${{ env.CI_INSTALL }}/lib",-rpath,"${{ env.CI_INSTALL }}/lib64" && ./ecdsa