build-test-deploy.yaml

name: Build, test, and deploy

on:
  # Run this workflow every day at 3:00 UTC to update caches.
  schedule: [cron: '0 3 * * *']
  # Allow manual trigger.
  workflow_dispatch:
  pull_request:
    branches: ["master"]
  push:
    branches: ["master"]
    tags: ["v*"]

# Cancel old PR builds when pushing new commits.
concurrency:
  group: build-test-deploy-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:

  ################################################################################################
  # Preparation jobs
  ################################################################################################

  validate-pr:
    # All expensive jobs below depend on this one, so they will not run if the validation fails.
    name: Validate PR
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        if: github.event_name == 'pull_request'
        with:
          # Fetch all history so that we can check for changes in the entire history.
          fetch-depth: 0
      - name: Validate PR
        if: github.event_name == 'pull_request'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          .ci-scripts/create-identity.sh
          tools/validate_pr.py

  verify-release:
    name: Verify release/signatures
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0  # We need "master", which we only get with a full fetch.
      - name: Import developer public keys
        run: .ci-scripts/import-developer-keys.sh
      - name: Create identity and release branch
        id: create-identity
        run: |
          .ci-scripts/create-identity.sh
          if ${{ contains(github.head_ref, 'release/v') }}; then
            VERSION=$(echo '${{ github.head_ref }}' | grep -o 'release/v.*' | grep -o 'v[^/]*$')
            echo "next-version=$VERSION" >>$GITHUB_OUTPUT
            git branch "release/$VERSION" HEAD
            git branch release-head 'HEAD~1'
            git checkout master
            git checkout release-head
          fi
      - name: Verify release
        if: steps.create-identity.outputs.next-version != ''
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: tools/create_release.py
          --version "${{ steps.create-identity.outputs.next-version }}"
          --upstream origin
          --branch "release-head"
          --resume
          --verify
          --dryrun
      - name: Verify signatures
        # We only check this on release PRs to avoid downloading our release
        # assets too often. We're inflating our numbers a lot this way. It's
        # easy to calculate the real number of downloads by looking at the
        # number of .asc downloads, but it feels a bit wrong.
        if: steps.create-identity.outputs.next-version != ''
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: tools/create_release.py
          --version latest
          --upstream origin
          --dryrun

  update-nightly-tag:
    name: Update nightly release tag
    needs: [validate-pr]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: Move nightly tag to head for nightly release
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        run: git tag -f nightly && git push origin nightly -f

  ################################################################################################
  # Static analysis and other checks
  ################################################################################################

  translation-check:
    name: Check for translatable strings
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - name: Install deps
        run: sudo apt-get update && sudo apt-get install qt6-l10n-tools
      - name: Test for modified translatable strings
        run: |
          export PATH="/usr/lib/qt6/bin:$PATH"
          tools/update-translation-files.sh ALL
          tools/translate.py
          git diff --exit-code

  clang-tidy:
    name: Clang-Tidy
    needs: [validate-pr]
    if: github.event_name != 'push'
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: |
            .cache/ccache
            .cache/clangd
            .lsp_tidy_cache
          key: ${{ github.job }}-ccache
      - name: Run build
        run: docker compose run --rm fedora .ci-scripts/build-qtox-linux.sh --build-type Debug --full --tidy || (git diff --exit-code && false)

  ################################################################################################
  # Build and test jobs (PR)
  ################################################################################################

  build-alpine:
    name: Alpine
    needs: [validate-pr]
    if: github.event_name != 'push'
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        features: [full]
        build_type: [Debug]
    steps:
      - uses: actions/checkout@v4
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: ".cache/ccache"
          key: ${{ github.job }}-ccache
      - name: Run build
        run: docker compose run --rm alpine .ci-scripts/build-qtox-linux.sh --build-type ${{ matrix.build_type }} --${{ matrix.features }}

  build-alpine-static:
    name: Alpine (static)
    needs: [validate-pr]
    if: github.event_name != 'push'
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        build_type: [Release]
    steps:
      - uses: actions/checkout@v4
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: ".cache/ccache"
          key: ${{ github.job }}-ccache
      - name: Run build
        run: docker compose run --rm alpine-static .ci-scripts/build-qtox-linux-static.sh --build-type ${{ matrix.build_type }}

  build-debian:
    name: Debian
    needs: [validate-pr]
    if: github.event_name != 'push'
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        features: [minimal]
        build_type: [Debug]
    steps:
      - uses: actions/checkout@v4
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: ".cache/ccache"
          key: ${{ github.job }}-ccache
      - name: Run build
        run: docker compose run --rm debian .ci-scripts/build-qtox-linux.sh --build-type ${{ matrix.build_type }} --${{ matrix.features }}

  build-fedora:
    name: Fedora with ASAN
    needs: [validate-pr]
    if: github.event_name != 'push'
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        features: [full]
        build_type: [Debug]
    steps:
      - uses: actions/checkout@v4
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: ".cache/ccache"
          key: ${{ github.job }}-ccache
      - name: Run build
        run: docker compose run --rm fedora .ci-scripts/build-qtox-linux.sh --build-type ${{ matrix.build_type }} --${{ matrix.features }} --sanitize

  build-ubuntu:
    name: Ubuntu LTS
    needs: [validate-pr]
    if: github.event_name != 'push'
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        features: [full]
        build_type: [Release]
    steps:
      - uses: actions/checkout@v4
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: ".cache/ccache"
          key: ${{ github.job }}-ccache
      - name: Run build
        run: docker compose run --rm ubuntu_lts .ci-scripts/build-qtox-linux.sh --build-type ${{ matrix.build_type }} --${{ matrix.features }}
      - name: Code coverage
        run: |
          # https://github.com/actions/runner/issues/491
          if [ "${{ matrix.build_type }}" == "Release" ] && [ "${{ matrix.features }}" == "full" ]; then
            docker compose run --rm ubuntu_lts .ci-scripts/lcov.sh
            # Upload report to codecov.io
            bash <(curl -s https://codecov.io/bash) -f coverage.info || echo "Codecov did not collect coverage reports"
          fi

  ################################################################################################
  # Build, test, and deploy jobs (PR and push)
  ################################################################################################

  build-appimage:
    name: AppImage on Alpine
    runs-on: ubuntu-24.04
    needs: [update-nightly-tag]
    strategy:
      matrix:
        features: [full]
        build_type: [Release]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: ".cache/ccache"
          key: ${{ github.job }}-ccache
      - name: Run build
        run: docker compose run --rm -e GITHUB_REPOSITORY="$GITHUB_REPOSITORY" -e GITHUB_REF="$GITHUB_REF" alpine-appimage ./appimage/build.sh --src-dir /qtox
      - name: Upload AppImage
        uses: actions/upload-artifact@v4
        with:
          name: qTox-${{ github.sha }}-x86_64-AppImage
          path: |
            qTox-*.AppImage
            qTox-*.AppImage.zsync
      - name: Get tag name for AppImage release file name
        if: contains(github.ref, 'refs/tags/v')
        id: get_version
        run: |
          VERSION="$(echo "$GITHUB_REF" | cut -d / -f 3)"
          echo "release_appimage=qTox-$VERSION-x86_64.AppImage" >>$GITHUB_OUTPUT
      - name: Rename AppImage for release upload
        if: contains(github.ref, 'refs/tags/v')
        run: |
          cp qTox-*-x86_64.AppImage "${{ steps.get_version.outputs.release_appimage }}"
          sha256sum "${{ steps.get_version.outputs.release_appimage }}" > "${{ steps.get_version.outputs.release_appimage }}.sha256"
          cp qTox-*-x86_64.AppImage.zsync "${{ steps.get_version.outputs.release_appimage }}.zsync"
      - name: Upload to versioned release
        if: contains(github.ref, 'refs/tags/v')
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          draft: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "${{ steps.get_version.outputs.release_appimage }},${{ steps.get_version.outputs.release_appimage }}.sha256,${{ steps.get_version.outputs.release_appimage }}.zsync"
      - name: Rename AppImage for nightly upload
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        run: |
          cp qTox-*-x86_64.AppImage qTox-nightly-x86_64.AppImage
          sha256sum qTox-nightly-x86_64.AppImage > qTox-nightly-x86_64.AppImage.sha256
          cp qTox-*-x86_64.AppImage.zsync qTox-nightly-x86_64.AppImage.zsync
      - name: Upload to nightly release
        uses: ncipollo/release-action@v1
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        with:
          allowUpdates: true
          tag: nightly
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          prerelease: true
          replacesArtifacts: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "qTox-nightly-x86_64.AppImage,qTox-nightly-x86_64.AppImage.sha256,qTox-nightly-x86_64.AppImage.zsync"

  test-appimage:
    name: Test AppImage
    needs: [build-appimage]
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
        with:
          # Fetch tags if we're not already in a tag build.
          fetch-tags: ${{ !contains(github.ref, 'refs/tags/v') }}
          sparse-checkout: |
            .ci-scripts
            test/resources/profile
      - name: Download artifact from AppImage
        uses: actions/download-artifact@v4
        with:
          name: qTox-${{ github.sha }}-x86_64-AppImage
      - name: Run AppImage
        run: |
          chmod +x qTox-*.AppImage
          .ci-scripts/smoke-test.sh xvfb-run --auto-servernum ./qTox-*.AppImage
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          QTOX_SCREENSHOT: qtox-appimage.png
      - name: Upload screenshot artifact
        uses: actions/upload-artifact@v4
        with:
          name: qtox-appimage.png
          path: qtox-appimage.png
      - name: Upload screenshot to nightly release
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          tag: nightly
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          prerelease: true
          replacesArtifacts: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "qtox-appimage.png"


  build-android:
    name: Android
    needs: [update-nightly-tag]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    strategy:
      matrix:
        arch: [armeabi-v7a, arm64-v8a]
        build_type: [Debug, Release]
        version: [6.2.4, 6.8.1]
        exclude:
          - arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'armeabi-v7a' }}
          - build_type: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') || contains(github.ref, 'refs/tags/v')) && 'Debug' }}
          - version: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && '6.8.1' }}
    steps:
      - name: Compute values for remaining steps
        id: computed
        run: |
          ARTIFACT_TYPE="$(echo '${{ matrix.build_type }}' | tr '[:upper:]' '[:lower:]')"
          echo "artifact_type=$ARTIFACT_TYPE" >>$GITHUB_OUTPUT
          if [ "${{ matrix.version }}" == "6.2.4" ]; then
            SUFFIX="-android7"
            echo "built_apk=_build/android-build/build/outputs/apk/debug/android-build-debug.apk" >>$GITHUB_OUTPUT
          else
            SUFFIX=""
            echo "built_apk=_build/android-build/build/outputs/apk/$ARTIFACT_TYPE/android-build-$ARTIFACT_TYPE-signed.apk" >>$GITHUB_OUTPUT
          fi
          echo "suffix=$SUFFIX" >>$GITHUB_OUTPUT
          echo "nightly_apk=qTox-nightly-${{ matrix.arch }}-$ARTIFACT_TYPE$SUFFIX.apk" >>$GITHUB_OUTPUT
      - uses: actions/checkout@v4
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: ".cache/ccache"
          key: ${{ github.job }}-${{ matrix.arch }}-${{ matrix.build_type }}-${{ matrix.version }}-ccache
      - name: Run build
        run: docker compose run --rm "android_builder.${{ matrix.arch }}.${{ steps.computed.outputs.artifact_type }}_${{ matrix.version }}" ./android/cross-compile/build.sh --arch "${{ matrix.arch }}" --build-type "${{ matrix.build_type }}"
      - name: Upload Android apk
        uses: actions/upload-artifact@v4
        with:
          name: qTox-${{ github.sha }}-${{ matrix.arch }}-${{ steps.computed.outputs.artifact_type }}${{ steps.computed.outputs.suffix }}.apk
          path: ${{ steps.computed.outputs.built_apk }}
      - name: Get tag name for Android release file name
        if: contains(github.ref, 'refs/tags/v')
        id: get_version
        run: |
          VERSION="$(echo "$GITHUB_REF" | cut -d / -f 3)"
          echo "release_apk=qTox-$VERSION-${{ matrix.arch }}-${{ steps.computed.outputs.artifact_type }}${{ steps.computed.outputs.suffix }}.apk" >>$GITHUB_OUTPUT
      - name: Rename Android APK for release upload
        if: contains(github.ref, 'refs/tags/v')
        run: |
          cp "${{ steps.computed.outputs.built_apk }}" "${{ steps.get_version.outputs.release_apk }}"
          sha256sum "${{ steps.get_version.outputs.release_apk }}" > "${{ steps.get_version.outputs.release_apk }}.sha256"
      - name: Upload to versioned release
        if: contains(github.ref, 'refs/tags/v')
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          draft: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "${{ steps.get_version.outputs.release_apk }},${{ steps.get_version.outputs.release_apk }}.sha256"
      - name: Rename Android APK for nightly upload
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        run: |
          cp "${{ steps.computed.outputs.built_apk }}" "${{ steps.computed.outputs.nightly_apk }}"
          sha256sum "${{ steps.computed.outputs.nightly_apk }}" > "${{ steps.computed.outputs.nightly_apk }}.sha256"
      - name: Upload to nightly release
        uses: ncipollo/release-action@v1
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        with:
          allowUpdates: true
          tag: nightly
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          prerelease: true
          replacesArtifacts: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "${{ steps.computed.outputs.nightly_apk }},${{ steps.computed.outputs.nightly_apk }}.sha256"

  build-flatpak:
    name: Flatpak
    needs: [update-nightly-tag]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Cache flatpak-builder cache (except ccache)
        uses: actions/cache@v4
        with:
          path: |
            .flatpak-builder/cache
            .flatpak-builder/checksums
            .flatpak-builder/downloads
          key: ${{ github.job }}-builder
      - name: Cache flatpak-builder cache (only ccache)
        uses: actions/cache@v4
        with:
          path: ".flatpak-builder/ccache"
          key: ${{ github.job }}-ccache
      - name: Get tag name for flatpak release file name
        if: contains(github.ref, 'refs/tags/v')
        id: get_version
        run: |
          VERSION="$(echo "$GITHUB_REF" | cut -d / -f 3)"
          echo "version_tag=$VERSION" >>$GITHUB_OUTPUT
          echo "release_flatpak=qTox-$VERSION.x86_64.flatpak" >>$GITHUB_OUTPUT
      - name: Point flathub descriptor at the release tag
        if: contains(github.ref, 'refs/tags/v')
        run: flatpak/localize_flathub_descriptor.py
          --flathub-manifest flatpak/io.github.qtox.qTox.json
          --output flatpak/io.github.qtox.qTox.json
          --git-tag "${{ steps.get_version.outputs.version_tag }}"
      - name: Run build
        run: docker compose run --rm flatpak ./flatpak/build.sh
      - name: Upload flatpak
        uses: actions/upload-artifact@v4
        with:
          name: qTox-${{ github.sha }}.x86_64.flatpak
          path: qtox.flatpak
      - name: Rename flatpak for release upload
        if: contains(github.ref, 'refs/tags/v')
        run: |
          cp qtox.flatpak "${{ steps.get_version.outputs.release_flatpak }}"
          sha256sum "${{ steps.get_version.outputs.release_flatpak }}" > "${{ steps.get_version.outputs.release_flatpak }}.sha256"
      - name: Upload to versioned release
        if: contains(github.ref, 'refs/tags/v')
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          draft: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "${{ steps.get_version.outputs.release_flatpak }},${{ steps.get_version.outputs.release_flatpak }}.sha256"
      - name: Rename flatpak for nightly upload
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        run: |
          cp qtox.flatpak qTox-nightly.flatpak
          sha256sum qTox-nightly.flatpak > qTox-nightly.flatpak.sha256
      - name: Upload to nightly release
        uses: ncipollo/release-action@v1
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        with:
          allowUpdates: true
          tag: nightly
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          prerelease: true
          replacesArtifacts: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "qTox-nightly.flatpak,qTox-nightly.flatpak.sha256"

  test-flatpak:
    name: Test Flatpak
    needs: [build-flatpak]
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
        with:
          # Fetch tags if we're not already in a tag build.
          fetch-tags: ${{ !contains(github.ref, 'refs/tags/v') }}
          sparse-checkout: |
            .ci-scripts
            test/resources/profile
      - name: Download artifact from Flatpak
        uses: actions/download-artifact@v4
        with:
          name: qTox-${{ github.sha }}.x86_64.flatpak
      - name: Install flatpak runner
        run: sudo apt-get install -y flatpak
      - name: Install KDE runtime
        run: |
          flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
          flatpak install --user -y --noninteractive flathub org.kde.Platform/x86_64/6.8
      - name: Install flatpak
        run: flatpak install --user -y --bundle qtox.flatpak
      - name: Run flatpak
        run: .ci-scripts/smoke-test.sh flatpak run io.github.qtox.qTox
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          QT_QPA_PLATFORM: offscreen

  build-macos-distributable:
    name: macOS distributable
    needs: [update-nightly-tag]
    strategy:
      matrix:
        arch: [arm64, x86_64]
        exclude:
          - arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'x86_64' }}
    runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-13' }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Fetch build scripts
        run: git clone --depth=1 https://github.com/TokTok/dockerfiles ".ci-scripts/dockerfiles"
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: ".cache/ccache"
          key: ${{ github.job }}-${{ matrix.arch }}-ccache
      - name: Cache dependencies (only Qt)
        id: cache-qt
        uses: actions/cache@v4
        with:
          path: |
            .ci-scripts/dockerfiles/local-deps/qt
          key: ${{ github.job }}-${{ matrix.arch }}-qt
      - name: Cache dependencies (except Qt)
        id: cache-deps
        uses: actions/cache@v4
        with:
          path: |
            .ci-scripts/dockerfiles/local-deps/bin
            .ci-scripts/dockerfiles/local-deps/include
            .ci-scripts/dockerfiles/local-deps/lib
            .ci-scripts/dockerfiles/local-deps/share
          key: ${{ github.job }}-${{ matrix.arch }}-local-deps
      - name: Homebrew dependencies to build dependencies
        run: |
          brew bundle --file ./macos/Brewfile-DepBuildDeps
          sed -i '' -e 's/MAXIMUM_UNMOUNTING_ATTEMPTS=3/MAXIMUM_UNMOUNTING_ATTEMPTS=15/' "$(realpath "$(which create-dmg)")"
      - name: Set up ccache
        run: ccache --set-config=max_size=200M --set-config=cache_dir="$PWD/.cache/ccache" && ccache --show-config
      - name: Build dependencies (only Qt)
        if: steps.cache-qt.outputs.cache-hit != 'true'
        run: .ci-scripts/build-local-qt.sh ${{ matrix.arch }}
      - name: Build dependencies (except Qt)
        if: steps.cache-deps.outputs.cache-hit != 'true'
        run: .ci-scripts/build-local-deps.sh ${{ matrix.arch }}
      - name: Install the Apple certificate
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.APPLE_BUILD_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets.APPLE_P12_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
        run: .github/scripts/install_apple_cert >/dev/null
      - name: Build qTox
        run: .ci-scripts/build-qtox-macos.sh dist ${{ matrix.arch }}
      - name: Upload dmg
        uses: actions/upload-artifact@v4
        with:
          name: qTox-${{ github.sha }}-${{ matrix.arch }}.dmg
          path: qTox-${{ matrix.arch }}.dmg
      - name: Upload to versioned release
        if: contains(github.ref, 'refs/tags/v')
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          draft: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "qTox-${{ matrix.arch }}.dmg,qTox-${{ matrix.arch }}.dmg.sha256"
      - name: Rename artifact for nightly upload
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        run: |
          cp qTox-${{ matrix.arch }}.dmg qTox-nightly-${{ matrix.arch }}.dmg
          cp qTox-${{ matrix.arch }}.dmg.sha256 qTox-nightly-${{ matrix.arch }}.dmg.sha256
      - name: Upload to nightly release
        uses: ncipollo/release-action@v1
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        with:
          allowUpdates: true
          tag: nightly
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          prerelease: true
          replacesArtifacts: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "qTox-nightly-${{ matrix.arch }}.dmg,qTox-nightly-${{ matrix.arch }}.dmg.sha256"

  test-macos-distributable:
    name: Test macOS distributable
    needs: [build-macos-distributable]
    strategy:
      matrix:
        arch: [arm64, x86_64]
        exclude:
          - arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'x86_64' }}
    runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-13' }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          # Fetch tags if we're not already in a tag build.
          fetch-tags: ${{ !contains(github.ref, 'refs/tags/v') }}
          sparse-checkout: |
            .ci-scripts
            test/resources/profile
      - name: Download artifact from macOS distributable (${{ matrix.arch }})
        uses: actions/download-artifact@v4
        with:
          name: qTox-${{ github.sha }}-${{ matrix.arch }}.dmg
          path: qTox.dmg
      - name: Install 7zip
        run: brew install 7zip
      - name: Unpack dmg
        run: 7zz x qTox.dmg qtox.app
      - name: Run qTox
        run: .ci-scripts/smoke-test.sh qtox.app/Contents/MacOS/qTox
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          QTOX_SCREENSHOT: qtox-macos-${{ matrix.arch }}.png
      - name: Upload screenshot artifact
        uses: actions/upload-artifact@v4
        with:
          name: qtox-macos-${{ matrix.arch }}.png
          path: qtox-macos-${{ matrix.arch }}.png
      - name: Upload screenshot to nightly release
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          tag: nightly
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          prerelease: true
          replacesArtifacts: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "qtox-macos-${{ matrix.arch }}.png"

  build-macos-user:
    name: macOS user
    needs: [validate-pr]
    if: github.event_name != 'push'
    strategy:
      matrix:
        arch: [arm64, x86_64]
        exclude:
          - arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'arm64' }}
    runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-13' }}
    steps:
      - uses: actions/checkout@v4
      - name: Fetch build scripts
        run: git clone --depth=1 https://github.com/TokTok/dockerfiles ".ci-scripts/dockerfiles"
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: ".cache/ccache"
          key: ${{ github.job }}-${{ matrix.arch }}-ccache
      - name: Homebrew
        run: |
          brew bundle --file ./macos/Brewfile
          sed -i '' -e 's/MAXIMUM_UNMOUNTING_ATTEMPTS=3/MAXIMUM_UNMOUNTING_ATTEMPTS=15/' "$(realpath "$(which create-dmg)")"
      - name: Set up ccache
        run: ccache --set-config=max_size=200M --set-config=cache_dir="$PWD/.cache/ccache" && ccache --show-config
      - name: Install toxcore
        run: .ci-scripts/dockerfiles/qtox/build_toxcore_system.sh sudo
      - name: Build qTox
        run: .ci-scripts/build-qtox-macos.sh user ${{ matrix.arch }}

  build-windows:
    name: Windows
    needs: [update-nightly-tag]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    strategy:
      matrix:
        arch: [i686, x86_64]
        build_type: [Debug, Release]
        exclude:
          - arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'i686' }}
          - build_type: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') || contains(github.ref, 'refs/tags/v')) && 'Debug' }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Cache compiler output
        uses: actions/cache@v4
        with:
          path: ".cache/ccache"
          key: ${{ github.job }}-${{ matrix.arch }}-${{ matrix.build_type }}-ccache
      - name: Run build
        run: docker compose run --rm windows_builder.${{ matrix.arch }} ./windows/cross-compile/build.sh --arch ${{ matrix.arch }} --build-type ${{ matrix.build_type }} --run-tests --src-dir /qtox
      - name: Upload installer
        if: matrix.build_type == 'release'
        uses: actions/upload-artifact@v4
        with:
          name: setup-qtox-${{ matrix.arch }}-${{ matrix.build_type }}.exe
          path: package-prefix/setup-qtox.exe
      - name: Upload zip
        uses: actions/upload-artifact@v4
        with:
          name: qtox-${{ matrix.arch }}-${{ matrix.build_type }}.zip
          path: install-prefix/qtox-${{ matrix.arch }}-${{ matrix.build_type }}.zip
      - name: Rename exe for release upload
        if: contains(github.ref, 'refs/tags/v')
        run: |
          cp package-prefix/setup-qtox.exe setup-qtox-${{ matrix.arch }}-release.exe
          sha256sum setup-qtox-${{ matrix.arch }}-release.exe > setup-qtox-${{ matrix.arch }}-release.exe.sha256
      - name: Upload to versioned release
        if: contains(github.ref, 'refs/tags/v')
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          draft: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "setup-qtox-${{ matrix.arch }}-release.exe,setup-qtox-${{ matrix.arch }}-release.exe.sha256"
      - name: Rename zip for nightly upload
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        run: |
          cp install-prefix/qtox-${{ matrix.arch }}-${{ matrix.build_type }}.zip qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.zip
          sha256sum qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.zip > qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.zip.sha256
      - name: Upload zip to nightly release
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          tag: nightly
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          prerelease: true
          replacesArtifacts: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.zip,qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.zip.sha256"
      - name: Rename exe for nightly upload
        if: github.event_name == 'push' && github.ref == 'refs/heads/master' && matrix.build_type == 'release'
        run: |
          cp package-prefix/setup-qtox.exe qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.exe
          sha256sum qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.exe > qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.exe.sha256
      - name: Upload exe to nightly release
        if: github.event_name == 'push' && github.ref == 'refs/heads/master' && matrix.build_type == 'release'
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          tag: nightly
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          prerelease: true
          replacesArtifacts: true
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.exe,qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.exe.sha256"

  test-windows:
    name: Test Windows
    needs: [build-windows]
    runs-on: windows-latest
    strategy:
      matrix:
        arch: [i686, x86_64]
        build_type: [Release]
        exclude:
          - arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'i686' }}
    steps:
      - uses: actions/checkout@v4
        with:
          # Fetch tags if we're not already in a tag build.
          fetch-tags: ${{ !contains(github.ref, 'refs/tags/v') }}
          sparse-checkout: .ci-scripts
      - name: Download artifact from Windows
        uses: actions/download-artifact@v4
        with:
          name: setup-qtox-${{ matrix.arch }}-${{ matrix.build_type }}.exe
      - name: Install 7zip
        run: choco install -y 7zip
      - name: Unpack exe
        run: 7z x setup-qtox.exe -oqtox
      - name: Run qTox
        shell: bash
        run: .ci-scripts/smoke-test.sh qtox/bin/qtox.exe
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  ################################################################################################
  # Documentation/website jobs
  ################################################################################################

  build-docs:
    name: Docs
    needs: [update-nightly-tag]
    runs-on: ubuntu-24.04
    env:
      DOXYGEN_CONFIG_FILE: doxygen.conf
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run
        run: .ci-scripts/build-docs.sh
      - name: Deploy
        if: github.ref == 'refs/heads/master' && github.repository_owner == 'qTox'
        env:
          access_key: ${{ secrets.DOXYGEN_DEPLOY_KEY }}
        run: .ci-scripts/deploy-docs.sh