# Enforce Tier 2 support tier.

# If you change the supported platforms in this workflow, please also
# update docs/support-tiers.md to match the changes you're making.

# Gating (see docs/support-tiers.md and docs/release-process.md): Tier 2 runs
# automatically on any PR whose base is a release-line (`stable`, `v0.*`) or
# release-candidate (`*-rc*`) branch -- this includes backport PRs and the
# release-plz release PR. For a PR against `main`, add the "check-release" label
# to run this suite on demand.
#
# On top of that scope, the suite only runs for trusted PRs (those whose branch
# lives in this repository, plus fork PRs a maintainer has labeled `safe to
# test`/`check-release`); see tier-1a.yml for why trust keys off the PR's head
# repository rather than `author_association`.

name: Tier 2

on:
  # Daily full-suite run against main (nightly). Scheduled runs use the default
  # branch (main).
  schedule:
    - cron: '0 8 * * *'
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - labeled
  # Also run continuously on release-candidate branches during a train's bake
  # (there is no PR label on these push events, so the per-job `if:` conditions
  # below also accept `github.event_name == 'push'`).
  push:
    branches:
      - '*-rc*'

jobs:
  c-library-mobile-builds:
    name: C library mobile builds

    # Trusted (same-repo branch, or fork PR labeled `safe to test`/
    # `check-release`) AND in scope for the release-oriented Tier 2 suite.
    if: >-
      (github.event_name != 'pull_request' ||
        github.event.pull_request.head.repo.full_name == github.repository ||
        contains(github.event.pull_request.labels.*.name, 'safe to test') ||
        contains(github.event.pull_request.labels.*.name, 'check-release')) &&
      (github.event_name == 'push' || github.event_name == 'schedule' ||
        github.event.pull_request.base.ref == 'stable' ||
        startsWith(github.event.pull_request.base.ref, 'v0.') ||
        contains(github.event.pull_request.base.ref, '-rc') ||
        contains(github.event.pull_request.labels.*.name, 'release') ||
        contains(github.event.pull_request.labels.*.name, 'check-release'))
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: aarch64-apple-ios
          - os: macos-latest
            target: x86_64-apple-ios
          - os: macos-latest
            target: aarch64-apple-ios-sim
          - os: ubuntu-latest
            target: aarch64-linux-android
          - os: ubuntu-latest
            target: armv7-linux-androideabi
          - os: ubuntu-latest
            target: i686-linux-android
          - os: ubuntu-latest
            target: x86_64-linux-android
          - os: ubuntu-latest
            target: wasm32-unknown-emscripten

    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install Rust toolchain
        if: matrix.target != 'wasm32-unknown-emscripten'
        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master@2026-06-30
        with:
          toolchain: stable

      # Use a separate target directory for Android cross builds to prevent
      # host-compiled build scripts from being reused inside the cross Docker
      # container, which causes glibc version mismatches on x86_64 targets.
      # See: https://github.com/cross-rs/cross/issues/724
      - name: Set CARGO_TARGET_DIR for Android builds
        if: contains(matrix.target, 'android')
        run: |
          echo "CARGO_TARGET_DIR=${{ github.workspace }}/target-${{ matrix.target }}" >> $GITHUB_ENV
          echo "TARGET_DIR=${{ github.workspace }}/target-${{ matrix.target }}" >> $GITHUB_ENV

      - name: Install Rust nightly toolchain for Emscripten
        if: matrix.target == 'wasm32-unknown-emscripten'
        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master@2026-06-30
        with:
          toolchain: nightly
          targets: wasm32-unknown-emscripten
          components: rust-src

      - name: Checkout Emscripten SDK
        if: matrix.target == 'wasm32-unknown-emscripten'
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          repository: emscripten-core/emsdk
          path: emsdk

      - name: Set up Emscripten
        if: matrix.target == 'wasm32-unknown-emscripten'
        run: |
          cd emsdk
          ./emsdk install latest
          ./emsdk activate latest
          source ./emsdk_env.sh
          echo "PATH=$PATH" >> $GITHUB_ENV
          emcc --version

      - name: Cache emsdk
        if: matrix.target == 'wasm32-unknown-emscripten'
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: emsdk
          key: emsdk-${{ runner.os }}-latest

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

      - name: Build C library for mobile target
        if: matrix.target != 'wasm32-unknown-emscripten'
        run: make release TARGET=${{ matrix.target }}
        working-directory: ./c2pa_c_ffi

      - name: Build C library for emscripten
        if: matrix.target == 'wasm32-unknown-emscripten'
        env:
          RUSTFLAGS: -C target-feature=+atomics,+bulk-memory -C link-arg=-pthread -C link-arg=-sUSE_PTHREADS=1 -C link-arg=-sSIDE_MODULE=1 -C link-arg=-flto
        run: make release TARGET=${{ matrix.target }}
        working-directory: ./c2pa_c_ffi
