build.yml

# ----------------------------------------------------------------------------
# GitHub Action workflow to build FPC to be
# bundled with CGE downloads on https://castle-engine.io/download .
#
# See https://docs.github.com/en/actions for docs.
# ----------------------------------------------------------------------------

name: Build

# workflow_dispatch allows to call it manually
# See https://docs.github.com/en/actions/using-workflows/manually-running-a-workflow
on: [push, pull_request, workflow_dispatch]

defaults:
  run:
    shell: bash

# Necessary permissions to:
# - sign into Azure by GitHub Actions, to sign Windows executables.
#   (id-token: write, contents: at least read).
# - send to GitHub release (contents: write).
permissions:
  id-token: write
  contents: write

jobs:
  build_native:
    name: Build Native
    strategy:
      matrix:
        runner: [
          ubuntu-latest,
          windows-latest,
          # last macOS using Intel
          macos-15-intel,
          macos-latest
        ]
        fpc_version: [
          stable,
          unstable
        ]
        include:
          # Set matrix.build_os, matrix.build_cpu .
          # These are OS and CPU names following FPC naming convention,
          # exactly as if from
          # - fpc -iTO / -iSO (target/source OS)
          # - fpc -iTP / -iSP (target/source CPU)
          # They describe both source and target OS/CPU in our scenario.
          - build_os: linux
            build_cpu: x86_64
          - runner: windows-latest
            build_os: win64
            build_cpu: x86_64
          - runner: macos-latest
            build_os: darwin
            build_cpu: aarch64
          - runner: macos-15-intel
            build_os: darwin
            build_cpu: x86_64

    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v7

      # To write multi-line scripts in steps below,
      # we have to set SHELLOPTS=igncr, otherwise Cygwin/MinGW bash
      # fails because GitHub Actions create temp scripts with CRLF
      # line endings.
      # See https://github.com/cygwinports/bash for docs of "igncr".
      - name: Make bash multi-line scripts execute OK on Windows
        if: ${{ runner.os == 'Windows' }}
        run: echo "SHELLOPTS=igncr" >> $GITHUB_ENV

      # Old approach:
      # Get last stable FPC to bootstrap.
      # Now: This is no longer used: we rely fully on our bootstrap-fpc/ subdirectory.
      #
      # - name: Install FPC+Lazarus (not macOS)
      #   if: ${{ ! matrix.is_macos }}
      #   uses: gcarreno/setup-lazarus@v3.3.1
      #   with:
      #     lazarus-version: stable
      #
      # - name: Install FPC+Lazarus (macOS)
      #   if: ${{ matrix.is_macos }}
      #   run: brew install fpc

      - name: Get Castle Game Engine CI scripts (for signing)
        if: ${{ matrix.build_os == 'darwin' || matrix.build_os == 'win64' }}
        run: |
          cd /tmp/ # temporary directory, to be separate from the current project files
          git clone https://github.com/castle-engine/castle-build-ci.git \
            --depth=1 --single-branch --branch=master

      - name: Azure Login (for signing on Windows)
        if: ${{ matrix.build_os == 'win64' && github.ref == 'refs/heads/master' }}
        uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Build FPC
        env:
          # for Apple codesigning
          APPLE_IDENTITY: ${{ vars.APPLE_IDENTITY }}
          APPLE_BUILD_CERTIFICATE_BASE64: ${{ secrets.APPLE_BUILD_CERTIFICATE_BASE64 }}
          APPLE_P12_PASSWORD: ${{ secrets.APPLE_P12_PASSWORD }}
          APPLE_KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
          # for Azure codesigning
          AZURE_ENDPOINT: ${{ vars.AZURE_ENDPOINT }}
          AZURE_CODESIGNING_ACCOUNT_NAME: ${{ vars.AZURE_CODESIGNING_ACCOUNT_NAME }}
          AZURE_CERTIFICATE_PROFILE_NAME: ${{ vars.AZURE_CERTIFICATE_PROFILE_NAME }}
        run: |
          # prepare signing for macOS
          if [[ "${{ matrix.build_os }}" = "darwin" && "${{ github.ref }}" = "refs/heads/master" ]]; then
            /tmp/castle-build-ci/apple/setup_signing
            export SIGN_EXECUTABLES="/tmp/castle-build-ci/apple/sign_executables"
          fi
          # prepare signing for Windows
          if [[ "${{ matrix.build_os }}" = "win64" && "${{ github.ref }}" = "refs/heads/master" ]]; then
            export AZURE_SIGNING_CLIENT_PARENT="$RUNNER_TEMP/sign-tools/"
            export SIGN_EXECUTABLES="/tmp/castle-build-ci/windows/sign_executables"
            /tmp/castle-build-ci/windows/setup_signing
          fi
          ./build_fpc ${{ matrix.build_os }} ${{ matrix.build_cpu }} ${{ matrix.fpc_version }}

      - name: Release Artifacts
        if: ${{ github.ref == 'refs/heads/master' }}
        run: gh release --repo ${{ github.repository }} upload snapshot --clobber fpc-*.zip
        env:
          GH_TOKEN: ${{ github.token }}

      # Additionally, when on Win64, build and release also Win32 FPC.
      - name: Build FPC (for Win32)
        if: ${{ matrix.build_os == 'win64' && matrix.build_cpu == 'x86_64' }}
        env:
          # for Azure codesigning
          AZURE_ENDPOINT: ${{ vars.AZURE_ENDPOINT }}
          AZURE_CODESIGNING_ACCOUNT_NAME: ${{ vars.AZURE_CODESIGNING_ACCOUNT_NAME }}
          AZURE_CERTIFICATE_PROFILE_NAME: ${{ vars.AZURE_CERTIFICATE_PROFILE_NAME }}
        run: |
          if [[ "${{ matrix.build_os }}" = "win64" && "${{ github.ref }}" = "refs/heads/master" ]]; then
            export AZURE_SIGNING_CLIENT_PARENT="$RUNNER_TEMP/sign-tools/"
            export SIGN_EXECUTABLES="/tmp/castle-build-ci/windows/sign_executables"
          fi
          ./build_fpc win32 i386 ${{ matrix.fpc_version }}
      - name: Release Artifacts (for Win32)
        if: ${{ matrix.build_os == 'win64' && matrix.build_cpu == 'x86_64' && github.ref == 'refs/heads/master' }}
        run: gh release --repo ${{ github.repository }} upload snapshot --clobber fpc-*.zip
        env:
          GH_TOKEN: ${{ github.token }}

  build_arm_runner:
    name: Build on ARM Runner (for Raspberry Pi)
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [raspberry-pi-32, raspberry-pi-64]
        fpc_version: [
          stable,
          unstable
        ]
        include:

        # additional defines for Raspberry Pi 32-bit (Arm)
        - arch: raspberry-pi-32
          # Arguments for pguyot/arm-runner-action
          cpu: cortex-a7
          base_image: raspios_lite:latest
          # Arguments for build_fpc script.
          build_os: linux
          build_cpu: arm

        # additional defines for Raspberry Pi 64-bit (Aarch64)
        - arch: raspberry-pi-64
          # Arguments for pguyot/arm-runner-action
          cpu: cortex-a53
          base_image: raspios_lite_arm64:latest
          # Arguments for build_fpc script.
          build_os: linux
          build_cpu: aarch64

    steps:
      - uses: actions/checkout@v7
      - uses: pguyot/arm-runner-action@v2
        with:
          base_image: ${{ matrix.base_image }}
          cpu: ${{ matrix.cpu }}
          shell: /bin/bash -eo pipefail
          image_additional_mb: 6000
          # Avoids the need for copy_artifact_path later.
          bind_mount_repository: true
          commands: |

            # get dependencies
            sudo apt-get update
            sudo apt-get --no-install-recommends -y install git make zip

            # on 32-bit Raspberry Pi, we rely on system-wide FPC
            if [ "${{ matrix.arch }}" = "raspberry-pi-32" ]; then
              sudo apt-get --no-install-recommends -y install fpc
            fi

            # run build_fpc
            ./build_fpc ${{ matrix.build_os }} ${{ matrix.build_cpu }} ${{ matrix.fpc_version }}

      - name: Release Artifacts
        if: ${{ github.ref == 'refs/heads/master' }}
        run: gh release --repo ${{ github.repository }} upload snapshot --clobber fpc-*.zip
        env:
          GH_TOKEN: ${{ github.token }}

  # once everything is successfull, move forward the "snapshot" tag.
  # This makes the "XXX commits to master since this release"
  # on https://github.com/castle-engine/castle-fpc/releases/tag/snapshot right.
  update_release_tag:
    name: Update Release Tag
    runs-on: ubuntu-latest
    needs: [build_native, build_arm_runner]
    env:
      release_tag: snapshot
    steps:
    - uses: actions/checkout@v7
    - name: Update Release Tag
      if: ${{ github.ref == 'refs/heads/master' }}
      run: |
        # --force allows to overwrite previous tag
        git tag --force ${{ env.release_tag }}
        # --force allows to push with overwritten tag
        git push --force origin ${{ env.release_tag }}