allInOne.yml

name: Build and Publish for all Platforms

# The Linux natives are compiled inside a container (`container: ubuntu:22.04` in the
# swig and build jobs below), not directly on the runner. That is deliberate.
#
# CMakeLists.txt already links libgcc and libstdc++ statically, so glibc is the only
# remaining dynamic dependency of the published .so -- which makes the build host's
# glibc the *minimum supported Linux* for everything that consumes JNBullet, and
# Terasology ships these natives to players. Building on the runner directly leaves
# that floor to drift upward silently every time GitHub retires a runner image.
#
# Two different numbers are involved and it is worth keeping them apart. The build
# image supplies glibc 2.35, but that is only a ceiling -- what actually constrains
# consumers is the highest GLIBC_* symbol version the linker ends up referencing,
# which today is 2.34 (the release that folded libpthread and libdl into libc).
# GLIBC_FLOOR in the build job asserts that measured value, not the image's, so a
# change that started pulling in 2.35 symbols fails rather than quietly narrowing
# who can run the result.
#
# At 2.34 the natives load on Debian 12, Ubuntu 22.04, and RHEL 9. Raising either
# number drops distros for downstream users; do it on purpose, not as a side effect
# of a runner bump.
#
# The image also has to stay at or above 22.04 while LLVM_MINGW_VERSION is pinned to
# an ubuntu-22.04 build, since that cross-compiler runs in the same job.

on: [push]

# Container jobs default to `sh`, not `bash` -- GitHub cannot assume bash exists in an
# arbitrary image. The steps below use `==` and other bashisms, so pin the shell rather
# than rewrite them to be POSIX-portable.
defaults:
  run:
    shell: bash

env:
  SWIG_VERSION: 4.0.2
  LLVM_MINGW_VERSION: 20260616
  # Part of every SWIG cache key. Bump it whenever the environment SWIG is built
  # in changes: the cached binary is linked against that environment's glibc and
  # pcre, so a stale entry restores a binary that cannot run. Bumped to 2 when the
  # Linux jobs moved into a container.
  SWIG_CACHE_VERSION: 2

jobs:
  validate-gradle-wrapper:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate Gradle Wrapper
        uses: gradle/wrapper-validation-action@v2
  swig:
    strategy:
      matrix:
        include:
          # Built inside the same image the natives are, so the cached binary runs in
          # every Linux job that consumes it -- both build and publish are containers.
          - os: ubuntu-24.04
            container: ubuntu:22.04
          - os: ubuntu-24.04-arm
            container: ubuntu:22.04
          - os: macos-26-intel
          - os: macos-26
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    steps:
      - name: Prepare container
        if: matrix.container != ''
        # The image is bare: no git for checkout, no sudo for the apt steps below,
        # no toolchain. Runs before every other step for that reason. bison is
        # needed because we build SWIG from a git tag archive rather than a release
        # tarball, so its parser is not pre-generated; the hosted runners happen to
        # ship it preinstalled and this image does not.
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            bison build-essential ca-certificates curl git sudo wget xz-utils
      - name: SWIG from cache
        id: cache-swig
        uses: actions/cache@v4
        with:
          path: ${{ github.workspace }}/swig
          key: ${{ runner.os }}-${{ runner.arch }}-swig-${{ env.SWIG_VERSION }}-v${{ env.SWIG_CACHE_VERSION }}
      - name: Install SWIG dependencies
        # Always install, even on a cache hit: this also provides the pcre runtime
        # library the cached swig binary is linked against, which isn't persisted
        # across runner VMs by the actions/cache step above.
        run: |
          if [ "${{ runner.os }}" == 'Linux' ]; then
            sudo apt-get install -y autoconf automake libtool libpcre3-dev
          elif [ "${{ runner.os }}" == 'macOS' ]; then
            brew install autoconf automake libtool pcre
          else
            echo "Unsupported OS: ${{ runner.os }}"
            exit 1
          fi
      - name: Build SWIG v${{ env.SWIG_VERSION }}
        if: steps.cache-swig.outputs.cache-hit != 'true'
        run: |
          wget https://github.com/swig/swig/archive/refs/tags/v${{ env.SWIG_VERSION }}.tar.gz
          tar xzf v${{ env.SWIG_VERSION }}.tar.gz
          cd swig-${{ env.SWIG_VERSION }}
          ./autogen.sh
          ./configure --prefix=$GITHUB_WORKSPACE/swig
          make
          make install
      - name: Check SWIG version
        run: $GITHUB_WORKSPACE/swig/bin/swig -version
  build:
    strategy:
      matrix:
        include:
          # Linux natives build in the container, not on the runner -- see the
          # glibc-floor note at the top of this file before changing the image.
          - os: ubuntu-24.04
            container: ubuntu:22.04
          - os: ubuntu-24.04-arm
            container: ubuntu:22.04
          - os: macos-26-intel
          - os: macos-26
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    needs: [validate-gradle-wrapper, swig]
    steps:
      - name: Prepare container
        if: matrix.container != ''
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            build-essential ca-certificates cmake curl git sudo unzip wget xz-utils
      - uses: actions/checkout@v4
        with:
          submodules: true
      - name: Restore SWIG from cache
        uses: actions/cache@v4
        with:
          path: ${{ github.workspace }}/swig
          key: ${{ runner.os }}-${{ runner.arch }}-swig-${{ env.SWIG_VERSION }}-v${{ env.SWIG_CACHE_VERSION }}
          fail-on-cache-miss: true
      - name: Add SWIG to $PATH
        # $GITHUB_WORKSPACE, not ${{ github.workspace }}: the expression resolves to the
        # host path, which does not exist inside a container. The env var is set per
        # environment. actions/cache maps the two itself, so its `path:` input is fine
        # either way -- a plain run step is not.
        run: echo "$GITHUB_WORKSPACE/swig/bin" >> $GITHUB_PATH
      - name: Install libpcre3
        if: runner.os == 'Linux'
        run: sudo apt-get install -y libpcre3-dev
      - name: Install MinGW-w64
        if: runner.os == 'Linux'
        run: sudo apt-get install -y mingw-w64
      - name: Install llvm-mingw (Windows arm64 cross-compiler)
        # Classic mingw-w64 (GCC) has no Windows/ARM64 target; only needed on the job
        # that actually builds linux_windows_arm64_llvm_mingw32, see build.gradle.
        if: runner.os == 'Linux' && runner.arch == 'X64'
        run: |
          curl -fL -o llvm-mingw.tar.xz "https://github.com/mstorsjo/llvm-mingw/releases/download/${{ env.LLVM_MINGW_VERSION }}/llvm-mingw-${{ env.LLVM_MINGW_VERSION }}-ucrt-ubuntu-22.04-x86_64.tar.xz"
          tar xf llvm-mingw.tar.xz
          echo "$PWD/llvm-mingw-${{ env.LLVM_MINGW_VERSION }}-ucrt-ubuntu-22.04-x86_64/bin" >> $GITHUB_PATH
      - name: Install pcre
        if: runner.os == 'macOS'
        run: brew install pcre
      - name: Check SWIG version
        run: swig -version      
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3
      - name: Build
        run: ./gradlew build buildNatives
      - name: Check the glibc floor of the Linux natives
        # Turns the container choice into something enforced rather than assumed. If a
        # future change builds these on a newer base, this fails here instead of as an
        # UnsatisfiedLinkError on a user's machine. Only glibc is checked because
        # CMakeLists.txt links libgcc and libstdc++ statically.
        if: matrix.container != ''
        env:
          # The measured requirement of the built natives, not the build image's glibc.
          # See the note at the top of this file for why those differ.
          GLIBC_FLOOR: '2.34'
        run: |
          natives=$(ls build/natives/linux_*_gcc/*.so 2>/dev/null || true)
          if [ -z "$natives" ]; then
            echo "::error::No Linux natives found under build/natives/linux_*_gcc/ — nothing to check."
            exit 1
          fi
          if ! symbols=$(objdump -T $natives); then
            echo "::error::objdump could not read the built natives."
            exit 1
          fi
          required=$(printf '%s\n' "$symbols" | grep -o 'GLIBC_[0-9]\+\.[0-9]\+' | sed 's/GLIBC_//' | sort -uV || true)
          if [ -z "$required" ]; then
            echo "::error::No GLIBC_* symbol versions found — the floor is unverified, which is not the same as satisfied."
            exit 1
          fi
          echo "glibc symbol versions required by the built natives:"
          printf '%s\n' "$required" | sed 's/^/  /'
          highest=$(printf '%s\n' "$required" | tail -1)
          if [ "$(printf '%s\n%s\n' "$GLIBC_FLOOR" "$highest" | sort -V | tail -1)" != "$GLIBC_FLOOR" ]; then
            echo "::error::Natives require glibc $highest, above the declared floor of $GLIBC_FLOOR. See the note at the top of this workflow."
            exit 1
          fi
          echo "OK: highest requirement $highest is within the declared floor $GLIBC_FLOOR."
      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ runner.os }}-${{ runner.arch }}-artifacts
          path: |
            build/natives/*/*.so
            build/natives/*/*.dll
            build/natives/*/*.dylib
  publish:
    runs-on: ubuntu-24.04
    # Same container as the Linux build jobs. Not for the ABI floor -- this job only
    # repackages natives built elsewhere -- but because SWIG bakes its --prefix in at
    # configure time. The cached binary looks for its runtime library under the
    # workspace path it was configured with, and that path differs between a
    # container job and a host job.
    container: ubuntu:22.04
    needs: [validate-gradle-wrapper, swig, build]
    if: github.ref == 'refs/heads/master'
    steps:
      - name: Prepare container
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            build-essential ca-certificates curl git sudo unzip wget xz-utils
      - uses: actions/checkout@v4
        with:
          submodules: true
      - name: Restore SWIG from cache
        uses: actions/cache@v4
        with:
          path: ${{ github.workspace }}/swig
          key: ${{ runner.os }}-${{ runner.arch }}-swig-${{ env.SWIG_VERSION }}-v${{ env.SWIG_CACHE_VERSION }}
          fail-on-cache-miss: true
      - name: Add SWIG to $PATH
        # $GITHUB_WORKSPACE, not ${{ github.workspace }}: the expression resolves to the
        # host path, which does not exist inside a container. The env var is set per
        # environment. actions/cache maps the two itself, so its `path:` input is fine
        # either way -- a plain run step is not.
        run: echo "$GITHUB_WORKSPACE/swig/bin" >> $GITHUB_PATH
      - name: Install libpcre3
        run: sudo apt-get install -y libpcre3-dev
      - name: Check SWIG version
        run: swig -version
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: build/natives
          merge-multiple: true
      - name: Build and Zip Natives
        run: ./gradlew build zipNatives
      - name: Publish
        run: ./gradlew -Dorg.gradle.internal.publish.checksums.insecure=true publish -PmavenUser=${artifactoryUser} -PmavenPass=${artifactoryPass}
        env:
          artifactoryUser: ${{ secrets.ARTIFACTORY_USER }}
          artifactoryPass: ${{ secrets.ARTIFACTORY_PASS }}