ci_fortify.yml

# SPDX-FileCopyrightText: 2006-2024 Knut Reinert & Freie Universität Berlin
# SPDX-FileCopyrightText: 2016-2024 Knut Reinert & MPI für molekulare Genetik
# SPDX-License-Identifier: CC0-1.0

name: Fortify

on:
  schedule:
    - cron: "0 8 * * SAT"
  workflow_dispatch:

concurrency:
  group: fortify-actions
  cancel-in-progress: true

env:
  SHARG_NO_VERSION_CHECK: 1
  TZ: Europe/Berlin

defaults:
  run:
    shell: bash -Eeuxo pipefail {0}

jobs:
  build:
    name: Fortify ${{ matrix.build_type }}
    runs-on: ubuntu-latest
    if: github.repository_owner == 'seqan' || github.event_name == 'workflow_dispatch'
    strategy:
      fail-fast: false
      matrix:
        include:
          - build_type: Release
            cxx_flags: "-fcf-protection=check"

          - build_type: Debug
            cxx_flags: "-fcf-protection=full"
    container:
      image: ghcr.io/seqan/gcc-14
      volumes:
        - /home/runner:/home/runner
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure tests
        run: |
          mkdir build && cd build
          cmake ../test/unit -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} \
                             -DCMAKE_CXX_FLAGS="-fexceptions -g -grecord-gcc-switches -pipe -Werror=format -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -mtune=native -fasynchronous-unwind-tables -fstack-clash-protection -Wno-interference-size ${{ matrix.cxx_flags }}"
          make gtest_main

      - name: Build tests
        working-directory: build
        run: make -k

      - name: Run tests
        working-directory: build
        run: ctest . -j --output-on-failure