Reticulum-Go/.github/workflows/ci.yml

# Pinned actions (bump tag and SHA together when upgrading):
#   actions/checkout@v7.0.0            9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
#   dorny/paths-filter@v3.0.2          de90cc6fb38fc0963ad72b210f1f284cd68cea36
#   actions/setup-node@v6.4.0          48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
#   actions/setup-java@v4.7.1          c5195efecf7bdfc987ee8bae7a71cb8b11521c00
#   vmactions/freebsd-vm@v1.5.0        5a72679103d223925653750faa878a143340fbd0
#   vmactions/openbsd-vm@v1.4.5        c941015845c0f0c429676840963dc63b226d4f69
#   vmactions/haiku-vm@v1.1.3          0ba6b98c8d7e5626f9defdd7403af49ad72b51df
#
name: CI

on:
  push:
    branches: [master, dev]
  pull_request:
    branches: [master, dev]

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  actions: read
  pull-requests: read

env:
  CI_GO_VERSION: "1.26.6"
  CI_GO_LEGACY_WIN7_VERSION: "1.26.6-1"
  CI_GO_LEGACY_WINXP_VERSION: "1.26.6"
  CI_TASK_VERSION: "3.46.3"
  CI_REVIVE_VERSION: "v1.15.0"
  CI_STATICCHECK_VERSION: "v0.6.1"
  CI_NODE_MAJOR: "22"
  CI_ODIN_VERSION: "dev-2026-06"
  CI_ZIG_VERSION: "0.16.0"
  CI_DART_VERSION: "3.11.4"
  CI_SWIFT_VERSION: "6.0.3"
  CI_KOTLIN_VERSION: "2.1.10"
  GOFLAGS: -mod=vendor
  GOPROXY: "off"
  GOTOOLCHAIN: local
  TESTSUMMARY_QUIET: "1"
  RNS_REQUIRED_SIGNER: e46112d44649266d71fe2193e00a4710

jobs:
  changes:
    name: Path filter
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      docs_only: ${{ steps.filter.outputs.docs_only }}
      core: ${{ steps.filter.outputs.core }}
      bindings: ${{ steps.filter.outputs.bindings }}
      ci: ${{ steps.filter.outputs.ci }}
      examples: ${{ steps.filter.outputs.examples }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Detect changed paths
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            docs_only:
              - 'docs/**'
              - '**/*.md'
              - '!CONTRIBUTING.md'
              - '!COMPATIBILITY.md'
              - '!CHANGELOG.md'
            core:
              - 'pkg/**'
              - 'cmd/**'
              - 'internal/**'
              - 'tests/**'
              - 'go.mod'
              - 'go.sum'
              - 'vendor/**'
              - 'include/**'
              - 'scripts/**'
              - 'reticulum-go.rsm'
            bindings:
              - 'bindings/**'
              - 'pkg/librns/**'
              - 'pkg/controlapi/**'
            ci:
              - '.github/**'
              - 'Taskfile.yml'
              - 'taskfiles/**'
              - 'Makefile'
              - 'cliff.toml'
              - 'mise.toml'
            examples:
              - 'examples/**'

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}
          revive_version: ${{ env.CI_REVIVE_VERSION }}

      - name: Format check
        run: task fmt-check

      - name: Vet
        run: task vet

      - name: Revive
        run: task lint

      - name: Staticcheck
        run: |
          sh scripts/ci/setup-staticcheck.sh "${{ env.CI_STATICCHECK_VERSION }}"
          task staticcheck

      - name: Installer script
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y shellcheck
          sh scripts/ci/test-install.sh

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test:
    name: Test (${{ matrix.os }}, ${{ matrix.goarch }})
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.docs_only != 'true'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            goarch: amd64
          - os: ubuntu-24.04-arm
            goarch: arm64

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Python venv and RNS
        run: sh scripts/ci/setup-venv-pip.sh 'rns==1.5.2'

      - name: Generate crossref vectors
        run: task test-crossref -- generate

      - name: Run binary smoke test
        run: task test-binary-smoke

      - name: Run self-check
        run: task test-self-check

      - name: Run tests
        run: task test

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-os-matrix:
    name: OS runtime (${{ matrix.os }})
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true' || needs.changes.outputs.bindings == 'true'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Python venv and RNS
        run: sh scripts/ci/setup-venv-pip.sh 'rns==1.5.2'

      - name: Generate crossref vectors
        run: task test-crossref -- generate

      - name: Run OS matrix tests
        run: task test-os-matrix

      - name: Run binary smoke test
        run: task test-binary-smoke

      - name: Run self-check
        run: task test-self-check

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-freebsd:
    name: FreeBSD self-check
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Run FreeBSD VM tests
        uses: vmactions/freebsd-vm@5a72679103d223925653750faa878a143340fbd0 # v1.5.0
        with:
          release: "14.3"
          usesh: true
          prepare: |
            set -eu
            pkg install -y curl git
            curl -fsSL -o /tmp/go.tgz https://go.dev/dl/go${{ env.CI_GO_VERSION }}.freebsd-amd64.tar.gz
            rm -rf /usr/local/go
            tar -C /usr/local -xzf /tmp/go.tgz
          run: |
            set -eu
            export PATH=/usr/local/go/bin:$PATH
            export GOFLAGS=-mod=vendor
            export GOPROXY=off
            export GOTOOLCHAIN=local
            go version
            go test -buildvcs=false -short -count=1 -timeout 10m ./pkg/selfcheck/ ./pkg/sandbox/ ./pkg/protect/
            go test -buildvcs=false -short -count=1 -timeout 10m ./pkg/transport/ -run 'Protect|HandlePacket'
            mkdir -p bin
            go build -buildvcs=false -ldflags="-s -w" -o bin/reticulum-go ./cmd/reticulum-go
            ./bin/reticulum-go self-check --binary "$(pwd)/bin/reticulum-go" --json --full

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-openbsd:
    name: OpenBSD self-check
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Run OpenBSD VM tests
        uses: vmactions/openbsd-vm@c941015845c0f0c429676840963dc63b226d4f69 # v1.4.5
        with:
          release: "7.7"
          usesh: true
          prepare: |
            set -eu
            pkg_add -I curl
            curl -fsSL -o /tmp/go.tgz https://go.dev/dl/go${{ env.CI_GO_VERSION }}.openbsd-amd64.tar.gz
            rm -rf /usr/local/go
            tar -C /usr/local -xzf /tmp/go.tgz
          run: |
            set -eu
            export PATH=/usr/local/go/bin:$PATH
            export GOFLAGS=-mod=vendor
            export GOPROXY=off
            export GOTOOLCHAIN=local
            go version
            go test -buildvcs=false -short -count=1 -timeout 10m ./pkg/selfcheck/ ./pkg/sandbox/ ./pkg/protect/
            go test -buildvcs=false -short -count=1 -timeout 10m ./pkg/transport/ -run 'Protect|HandlePacket'
            mkdir -p bin
            go build -buildvcs=false -ldflags="-s -w" -o bin/reticulum-go ./cmd/reticulum-go
            ./bin/reticulum-go self-check --binary "$(pwd)/bin/reticulum-go" --json --full

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-haiku:
    name: Haiku self-check
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Run Haiku VM tests
        uses: vmactions/haiku-vm@0ba6b98c8d7e5626f9defdd7403af49ad72b51df # v1.1.3
        with:
          release: "r1beta5"
          usesh: true
          copyback: false
          prepare: |
            set -eu
            pkgman install -y curl
            curl -fsSL -o /tmp/go-bootstrap.tbz https://github.com/korli/go/releases/download/go1.26.1-haiku1/go-1.26.1-haiku-amd64-bootstrap.tbz
            rm -rf /boot/home/user/go
            mkdir -p /boot/home/user/go
            tar -xjf /tmp/go-bootstrap.tbz -C /boot/home/user/go --strip-components=1
          run: |
            set -eu
            export GOROOT=/boot/home/user/go
            export PATH="$GOROOT/bin:$PATH"
            export GOFLAGS=-mod=vendor
            export GOPROXY=off
            export GOTOOLCHAIN=local
            export GOCACHE=/boot/home/user/.cache/go-build
            mkdir -p "$GOCACHE"
            go version
            # Official go.mod targets a newer patch than korli Haiku Go 1.26.1.
            sed -i 's/^go 1\.26\.[0-9][0-9]*$/go 1.26.1/' go.mod
            sed -i 's/go 1\.26\.[2-9][0-9]*/go 1.26.1/g; s/go 1\.26\.[0-9][0-9][0-9]*/go 1.26.1/g' vendor/modules.txt
            # korli Haiku Go 1.26.1 vet crashes on some deps (lxstamper exit 255).
            go test -buildvcs=false -vet=off -short -count=1 -timeout 15m ./pkg/selfcheck/ ./pkg/sandbox/ ./pkg/protect/
            go test -buildvcs=false -vet=off -short -count=1 -timeout 10m ./pkg/transport/ -run 'Protect|HandlePacket'
            mkdir -p bin
            go build -buildvcs=false -ldflags="-s -w" -o bin/reticulum-go ./cmd/reticulum-go
            ./bin/reticulum-go self-check --binary "$(pwd)/bin/reticulum-go" --json --full

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-qemu-arch:
    name: Linux ${{ matrix.goarch }} self-check (qemu-user)
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        include:
          - goarch: riscv64
            qemu: qemu-riscv64-static
          - goarch: "386"
            qemu: qemu-i386-static
          - goarch: arm
            qemu: qemu-arm-static
            goarm: "6"
          - goarch: ppc64le
            qemu: qemu-ppc64le-static
          - goarch: ppc64
            qemu: qemu-ppc64-static
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Install qemu-user-static
        run: |
          set -eu
          sudo apt-get update -qq
          sudo apt-get install -y qemu-user-static
          command -v "${QEMU_BIN}"
          "${QEMU_BIN}" --version | head -1
        env:
          QEMU_BIN: ${{ matrix.qemu }}

      - name: Run ${{ matrix.goarch }} self-check
        env:
          GOARM: ${{ matrix.goarm || '' }}
          GOARCH_TARGET: ${{ matrix.goarch }}
        run: sh scripts/ci/run-qemu-arch-self-check.sh "${GOARCH_TARGET}"

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-odin:
    name: Odin bindings
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Setup Odin
        run: sh scripts/ci/setup-odin.sh "${{ env.CI_ODIN_VERSION }}"

      - name: Run Odin bindings tests
        run: task test-odin

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-zig:
    name: Zig bindings
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Setup Zig
        run: sh scripts/ci/setup-zig.sh "${{ env.CI_ZIG_VERSION }}"

      - name: Run Zig bindings tests
        run: task test-zig

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-cpp:
    name: C++ bindings
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Install C++ toolchain
        run: sudo apt-get update && sudo apt-get install -y cmake g++

      - name: Run C++ bindings tests
        run: task test-cpp

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-c:
    name: C librns examples
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Build C ABI examples
        run: task test-c

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-rust:
    name: Rust bindings
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Run Rust bindings tests and examples
        run: task test-rust

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-swift:
    name: Swift bindings
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Setup Swift
        run: sh scripts/ci/setup-swift.sh "${{ env.CI_SWIFT_VERSION }}"

      - name: Run Swift bindings tests and examples
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          task test-swift

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-lua:
    name: Lua bindings
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Install LuaJIT
        run: sudo apt-get update && sudo apt-get install -y luajit

      - name: Run Lua bindings tests and examples
        run: task test-lua

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-java:
    name: Java bindings
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Setup Java
        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
          distribution: temurin
          java-version: "17"

      - name: Run Java bindings tests and examples
        run: task test-java

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-kotlin:
    name: Kotlin bindings
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Setup Java
        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
          distribution: temurin
          java-version: "17"

      - name: Setup Kotlin
        run: sh scripts/ci/setup-kotlin.sh "${{ env.CI_KOTLIN_VERSION }}"

      - name: Run Kotlin bindings tests and examples
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          task test-kotlin

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-python:
    name: Python bindings
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Run Python bindings tests and examples
        run: task test-python

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-dart:
    name: Dart bindings
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.bindings == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup Dart
        uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
        with:
          sdk: ${{ env.CI_DART_VERSION }}

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Run Dart bindings tests
        run: task test-dart

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-mutation:
    name: Mutation testing
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 50
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Run mutation tests
        run: task test-mutation

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  test-extra:
    name: Extra (${{ matrix.suite }})
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true' || needs.changes.outputs.examples == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        suite: [race, leaks, sim, fuzz-guided, chaos, soak, bench-gate, wasm]

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Set up Node.js
        if: matrix.suite == 'wasm'
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "${{ env.CI_NODE_MAJOR }}"

      - name: Python venv and RNS
        run: sh scripts/ci/setup-venv-pip.sh 'rns==1.5.2'

      - name: Generate crossref vectors
        run: task test-crossref -- generate

      - name: Run suite
        env:
          SUITE: ${{ matrix.suite }}
        run: |
          set -euo pipefail
          case "${SUITE}" in
            race) task test-race ;;
            leaks) task test-leaks ;;
            sim) task test-sim ;;
            network) task test-sim ;;
            fuzz) task test-fuzz-guided ;;
            fuzz-guided) task test-fuzz-guided ;;
            chaos) task test-chaos ;;
            soak) task test-soak && task test-soak-protect ;;
            bench-gate) task test-bench-gate ;;
            wasm) task test-wasm ;;
            *) echo "unknown suite: ${SUITE}" >&2; exit 1 ;;
          esac

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  build:
    name: Build (${{ matrix.goos }}, ${{ matrix.goarch }})
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true' || needs.changes.outputs.bindings == 'true' || needs.changes.outputs.ci == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        # Keep in sync with scripts/build-release-targets.sh
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: "386"
          - goos: linux
            goarch: arm64
          - goos: linux
            goarch: arm
          - goos: linux
            goarch: riscv64
          - goos: linux
            goarch: ppc64le
          - goos: linux
            goarch: ppc64
          - goos: linux
            goarch: mips
          - goos: linux
            goarch: mipsle
          - goos: linux
            goarch: mips64
          - goos: linux
            goarch: mips64le
          - goos: linux
            goarch: s390x
          - goos: windows
            goarch: amd64
          - goos: windows
            goarch: arm64
          - goos: windows
            goarch: "386"
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64
          - goos: freebsd
            goarch: amd64
          - goos: freebsd
            goarch: arm64
          - goos: freebsd
            goarch: arm
          - goos: freebsd
            goarch: "386"
          - goos: freebsd
            goarch: riscv64
          - goos: openbsd
            goarch: amd64
          - goos: openbsd
            goarch: arm64
          - goos: openbsd
            goarch: arm
          - goos: openbsd
            goarch: "386"
          - goos: openbsd
            goarch: ppc64
          - goos: openbsd
            goarch: riscv64
          - goos: netbsd
            goarch: amd64
          - goos: netbsd
            goarch: arm64
          - goos: netbsd
            goarch: arm
          - goos: netbsd
            goarch: "386"
          - goos: dragonfly
            goarch: amd64
          - goos: solaris
            goarch: amd64
          - goos: illumos
            goarch: amd64
          - goos: aix
            goarch: ppc64
          - goos: android
            goarch: arm64
          - goos: js
            goarch: wasm

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Build
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          GOARM: ${{ matrix.goarch == 'arm' && '6' || '' }}
          CGO_ENABLED: "0"
          DEST_DIR: bin
        run: sh scripts/ci/build-named-release-binary.sh

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  build-windows-legacy:
    name: Build (windows, ${{ matrix.goarch }}, win7)
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true' || needs.changes.outputs.ci == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        goarch: [amd64, arm64]

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up go-legacy-win7
        run: sh scripts/ci/setup-go-legacy-win7.sh "${{ env.CI_GO_LEGACY_WIN7_VERSION }}"

      - name: Setup Task
        run: sh scripts/ci/setup-task.sh "${{ env.CI_TASK_VERSION }}"

      - name: Build with go-legacy-win7
        env:
          GOOS: windows
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "0"
        run: |
          set -euo pipefail
          LEGACY_GO=/usr/local/go-legacy-win7/bin/go
          want="go${CI_GO_LEGACY_WIN7_VERSION%-*}"
          got="$("$LEGACY_GO" env GOVERSION)"
          echo "go-legacy: $got (want $want)"
          case "$got" in
            "$want"|"$want "*) ;;
            *)
              echo "go-legacy version mismatch: got '$got' want '$want'" >&2
              exit 1
              ;;
          esac
          mkdir -p bin
          "$LEGACY_GO" build -ldflags="-s -w" \
            -o "bin/reticulum-go-windows-${{ matrix.goarch }}-win7.exe" \
            ./cmd/reticulum-go

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  build-windows-xp:
    name: Build (windows, ${{ matrix.goarch }}, winxp)
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true' || needs.changes.outputs.ci == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        goarch: [386, amd64]

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up go-legacy-winxp
        run: sh scripts/ci/setup-go-legacy-winxp.sh "${{ env.CI_GO_LEGACY_WINXP_VERSION }}"

      - name: Setup Task
        run: sh scripts/ci/setup-task.sh "${{ env.CI_TASK_VERSION }}"

      - name: Build with go-legacy-winxp
        env:
          GOOS: windows
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "0"
        run: |
          set -euo pipefail
          LEGACY_GO=/usr/local/go-legacy-winxp/bin/go
          want="go${CI_GO_LEGACY_WINXP_VERSION%-*}"
          got="$("$LEGACY_GO" env GOVERSION)"
          echo "go-legacy-winxp: $got (want $want)"
          case "$got" in
            "$want"|"$want "*) ;;
            *)
              echo "go-legacy-winxp version mismatch: got '$got' want '$want'" >&2
              exit 1
              ;;
          esac
          mkdir -p bin
          "$LEGACY_GO" build -ldflags="-s -w" \
            -o "bin/reticulum-go-windows-${{ matrix.goarch }}-winxp.exe" \
            ./cmd/reticulum-go

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  examples:
    name: Examples (pageserver, wasm)
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true' || needs.changes.outputs.examples == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Build pageserver (linux/amd64)
        env:
          GOOS: linux
          GOARCH: amd64
          CGO_ENABLED: "0"
        run: |
          set -euo pipefail
          mkdir -p bin
          cd examples/pageserver
          go build -ldflags="-s -w" -o ../../bin/reticulum-go-example-pageserver-linux-amd64 .

      - name: Build pageserver (linux/arm64)
        env:
          GOOS: linux
          GOARCH: arm64
          CGO_ENABLED: "0"
        run: |
          set -euo pipefail
          cd examples/pageserver
          go build -ldflags="-s -w" -o ../../bin/reticulum-go-example-pageserver-linux-arm64 .

      - name: Build pageserver (linux/arm v6)
        env:
          GOOS: linux
          GOARCH: arm
          GOARM: "6"
          CGO_ENABLED: "0"
        run: |
          set -euo pipefail
          cd examples/pageserver
          go build -ldflags="-s -w" -o ../../bin/reticulum-go-example-pageserver-linux-arm .

      - name: Build wasm example (vendor)
        env:
          CGO_ENABLED: "0"
        run: |
          set -euo pipefail
          mkdir -p bin
          cd examples/wasm
          GOOS=js GOARCH=wasm go build -ldflags="-s -w" -o ../../bin/reticulum-go-example-wasm.wasm .

      - name: Build daemon wasm
        run: task build-wasm

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  reproducibility:
    name: Reproducible build
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true' || needs.changes.outputs.ci == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Verify byte-identical release builds
        run: task reproducibility

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean

  benchmark:
    name: Benchmark gate
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup CI
        uses: ./.github/actions/setup-ci
        with:
          go_version: ${{ env.CI_GO_VERSION }}
          task_version: ${{ env.CI_TASK_VERSION }}

      - name: Run benchmark thresholds
        run: task test-bench-gate

      - name: Verify workspace clean
        uses: ./.github/actions/verify-workspace-clean