ci_new.yml

name: Quality Assurance new

on:
  push:
  pull_request:

jobs:
  build-modsecurity-v3:
    name: ModSecurity v3 (warn-only hardening build)
    runs-on: ubuntu-24.04
    env:
      CC: gcc
      CXX: g++
      MODSECURITY_WARN_ONLY: "1"
      COMMON_CC_OPT: "-O2 -pipe -fstack-protector-strong -fstack-clash-protection -ffunction-sections -fdata-sections -D_FORTIFY_SOURCE=2"
      COMMON_LD_OPT: "-Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,--as-needed -Wl,--gc-sections"
      PIC_CC_OPT: "-fPIC"
      MODSECURITY_CC_OPT: "-Wall -Wextra -Wformat -Wformat-security"
      MODSECURITY_CXX_OPT: "-Wall -Wextra -Wformat -Wformat-security"
      MODSECURITY_LD_OPT: ""
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Detect latest Lua dev package
        id: detect_lua
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update -y -qq
          CANDIDATES="$(apt-cache pkgnames | grep -E '^liblua[0-9]+\.[0-9]+-dev$' || true)"
          if [ -z "$CANDIDATES" ]; then
            echo "No libluaX.Y-dev package found"
            exit 1
          fi

          BEST_PKG="$(
            printf '%s\n' "$CANDIDATES" \
            | sed -E 's/^liblua([0-9]+\.[0-9]+)-dev$/\1 &/' \
            | sort -V \
            | tail -n1 \
            | awk '{print $2}'
          )"
          if [ -z "$BEST_PKG" ]; then
            echo "Failed to determine Lua package"
            exit 1
          fi

          echo "lua_pkg=$BEST_PKG" >> "$GITHUB_OUTPUT"
          echo "Using $BEST_PKG"

      - name: Install dependencies
        run: |
          sudo apt-get install -y \
            autoconf automake libtool pkg-config bison flex \
            libyajl-dev libcurl4-openssl-dev liblmdb-dev \
            ${{ steps.detect_lua.outputs.lua_pkg }} \
            libmaxminddb-dev libpcre2-dev libxml2-dev libfuzzy-dev

      - name: Build preparation
        run: ./build.sh

      - name: Configure ModSecurity v3 flags
        shell: bash
        run: |
          set -euo pipefail

          C_WARNINGS="${MODSECURITY_CC_OPT}"
          CXX_WARNINGS="${MODSECURITY_CXX_OPT}"

          if [ "${MODSECURITY_WARN_ONLY:-0}" = "1" ]; then
            C_WARNINGS="$(echo " ${C_WARNINGS} " | sed -E 's/[[:space:]]-Werror(=format-security)?[[:space:]]/ /g')"
            CXX_WARNINGS="$(echo " ${CXX_WARNINGS} " | sed -E 's/[[:space:]]-Werror(=format-security)?[[:space:]]/ /g')"
          fi

          echo "CFLAGS=${COMMON_CC_OPT} ${PIC_CC_OPT} ${C_WARNINGS}" >> "$GITHUB_ENV"
          echo "CXXFLAGS=${COMMON_CC_OPT} ${PIC_CC_OPT} ${CXX_WARNINGS}" >> "$GITHUB_ENV"
          echo "CPPFLAGS=-D_FORTIFY_SOURCE=2" >> "$GITHUB_ENV"
          echo "LDFLAGS=${COMMON_LD_OPT}${MODSECURITY_LD_OPT:+ ${MODSECURITY_LD_OPT}}" >> "$GITHUB_ENV"

      - name: Print toolchain and build configuration
        shell: bash
        run: |
          set -euo pipefail
          echo "compiler version:"
          ${CC} --version
          echo
          echo "linker version:"
          ${CC} -Wl,--version 2>&1 | sed -n '1p' || ld --version 2>&1 | sed -n '1p'
          echo
          echo "CFLAGS=${CFLAGS}"
          echo "CXXFLAGS=${CXXFLAGS}"
          echo "CPPFLAGS=${CPPFLAGS}"
          echo "LDFLAGS=${LDFLAGS}"
          echo "configure options: --enable-assertions=yes"
          echo "MODSECURITY_WARN_ONLY=${MODSECURITY_WARN_ONLY}"
          echo "Note: no LuaJIT rpath and no nginx/OpenResty-specific flags are used in this job."

      - name: Configure
        run: ./configure --enable-assertions=yes

      - name: Build (verbose)
        run: make -j "$(nproc)" V=1

  build-linux:
    name: Linux (${{ matrix.platform.label }}, ${{ matrix.compiler.label }}, ${{ matrix.configure.label }})

    # Ubuntu 24.04 does not provide native 32-bit (i386) installation images.
    # Only amd64 (x86_64) is officially supported. 32-bit has been removed from this matrix.
    runs-on: ubuntu-24.04

    strategy:
      fail-fast: false
      matrix:
        platform:
          - { label: "x64", arch: "amd64", configure: "" }

        compiler:
          - { label: "gcc",   cc: "gcc",   cxx: "g++" }
          - { label: "clang", cc: "clang", cxx: "clang++" }

        configure:
          - { label: "with parser generation", opt: "--enable-parser-generation" }
          - { label: "without curl",    opt: "--without-curl" }
          - { label: "without lua",     opt: "--without-lua" }
          - { label: "without maxmind", opt: "--without-maxmind" }
          - { label: "without libxml",  opt: "--without-libxml" }
          - { label: "without geoip",   opt: "--without-geoip" }
          - { label: "without ssdeep",  opt: "--without-ssdeep" }
          - { label: "with lmdb",       opt: "--with-lmdb" }
          - { label: "with pcre2 (default)", opt: "" }
          - { label: "with pcre",        opt: "--with-pcre" }

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Detect latest Lua dev package
        id: detect_lua
        shell: bash
        run: |
          set -euo pipefail

          sudo apt-get update -y -qq

          CANDIDATES="$(apt-cache pkgnames | grep -E '^liblua[0-9]+\.[0-9]+-dev$' || true)"

          if [ -z "$CANDIDATES" ]; then
            echo "No libluaX.Y-dev package found"
            exit 1
          fi

          BEST_PKG="$(
            printf '%s\n' "$CANDIDATES" \
            | sed -E 's/^liblua([0-9]+\.[0-9]+)-dev$/\1 &/' \
            | sort -V \
            | tail -n1 \
            | awk '{print $2}'
          )"

          if [ -z "$BEST_PKG" ]; then
            echo "Failed to determine Lua package"
            exit 1
          fi

          echo "lua_pkg=$BEST_PKG" >> "$GITHUB_OUTPUT"
          echo "Using $BEST_PKG"


      - name: Install dependencies
        run: |
          sudo apt-get install -y \
            libyajl-dev \
            libcurl4-openssl-dev \
            liblmdb-dev \
            ${{ steps.detect_lua.outputs.lua_pkg }} \
            libmaxminddb-dev \
            libpcre2-dev \
            libxml2-dev \
            libfuzzy-dev \
            pcre2-utils \
            libpcre3-dev \
            bison \
            flex \
            pkg-config \
            python3 \
            python3-venv

      - name: Show Lua installation
        run: |
          which lua || true
          lua -v || true
          dpkg -l | grep lua || true

      - name: Run build preparation script
        run: ./build.sh

      - name: Configure
        env:
          CC: ${{ matrix.compiler.cc }}
          CXX: ${{ matrix.compiler.cxx }}
        run: ./configure ${{ matrix.platform.configure }} ${{ matrix.configure.opt }} --enable-assertions=yes

      - uses: ammaraskar/gcc-problem-matcher@master

      - name: Compile
        run: make -j "$(nproc)"

      - name: Run tests
        run: make check

  build-macos:
    name: macOS (${{ matrix.configure.label }})
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        os: [macos-15, macos-26]
        configure:
          - { label: "with parser generation", opt: "--enable-parser-generation" }
          - { label: "without curl",    opt: "--without-curl" }
          - { label: "without lua",     opt: "--without-lua" }
          - { label: "without maxmind", opt: "--without-maxmind" }
          - { label: "without libxml",  opt: "--without-libxml" }
          - { label: "without geoip",   opt: "--without-geoip" }
          - { label: "without ssdeep",  opt: "--without-ssdeep" }
          - { label: "with lmdb",       opt: "--with-lmdb" }
          - { label: "with pcre2 (default)", opt: "" }
          - { label: "with pcre",       opt: "--with-pcre" }

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: recursive
          
      - name: Install dependencies
        # curl and pcre2 are typically already available in the macOS runner image
        run: |
          brew install autoconf \
                       automake \
                       libtool \
                       yajl \
                       lmdb \
                       lua \
                       libmaxminddb \
                       libxml2 \
                       ssdeep \
                       pcre \
                       bison \
                       flex

      - name: Run build preparation script
        run: ./build.sh

      - name: Configure
        run: ./configure ${{ matrix.configure.opt }} --enable-assertions=yes

      - uses: ammaraskar/gcc-problem-matcher@master

      - name: Compile
        run: make -j "$(sysctl -n hw.logicalcpu)"

      - name: Run tests
        run: make check

  build-windows:
    name: Windows (${{ matrix.platform.label }}, ${{ matrix.configure.label }})
    runs-on: windows-2022

    strategy:
      fail-fast: false
      matrix:
        platform:
          - { label: "x64", arch: "x86_64" }
        configuration: [Release]
        configure:
          - { label: "full",             opt: "" }
          - { label: "without curl",     opt: "-DWITH_CURL=OFF" }
          - { label: "without lua",      opt: "-DWITH_LUA=OFF" }
          - { label: "without maxmind",  opt: "-DWITH_MAXMIND=OFF" }
          - { label: "without libxml",   opt: "-DWITH_LIBXML2=OFF" }
          - { label: "with lmdb",        opt: "-DWITH_LMDB=ON" }

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Install Conan package manager
        run: |
          pip3 install conan --upgrade
          conan profile detect

      - uses: ammaraskar/msvc-problem-matcher@master

      - name: Build project
        shell: cmd
        run: vcbuild.bat ${{ matrix.configuration }} ${{ matrix.platform.arch }} NO_ASAN "${{ matrix.configure.opt }}"

      - name: Prepare test environment
        working-directory: build\win32\build\${{ matrix.configuration }}
        env:
          BASE_DIR: ..\..\..\..
        shell: cmd
        run: |
          copy unit_tests.exe %BASE_DIR%\test
          copy regression_tests.exe %BASE_DIR%\test
          copy libModSecurity.dll %BASE_DIR%\test
          copy %BASE_DIR%\unicode.mapping %BASE_DIR%\test
          md \tmp
          md \bin
          copy "C:\Program Files\Git\usr\bin\echo.exe" \bin
          copy "C:\Program Files\Git\usr\bin\echo.exe" \bin\echo

      - name: Disable unsupported tests on Windows
        working-directory: test\test-cases\regression
        shell: cmd
        run: |
          jq "map(if .title == \"Test match variable (1/n)\" then .enabled = 0 else . end)" issue-2423-msg-in-chain.json > tmp.json && move /Y tmp.json issue-2423-msg-in-chain.json
          jq "map(if .title == \"Test match variable (2/n)\" then .enabled = 0 else . end)" issue-2423-msg-in-chain.json > tmp.json && move /Y tmp.json issue-2423-msg-in-chain.json
          jq "map(if .title == \"Test match variable (3/n)\" then .enabled = 0 else . end)" issue-2423-msg-in-chain.json > tmp.json && move /Y tmp.json issue-2423-msg-in-chain.json
          jq "map(if .title == \"Variable offset - FILES_NAMES\" then .enabled = 0 else . end)" offset-variable.json > tmp.json && move /Y tmp.json offset-variable.json

      - name: Run tests
        working-directory: build\win32\build
        run: ctest -C ${{ matrix.configuration }} --output-on-failure

  cppcheck:
    name: Static analysis (cppcheck)
    runs-on: macos-26

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Install cppcheck
        run: |
          brew install autoconf automake libtool cppcheck libmaxminddb yajl lua lmdb ssdeep

      - name: Configure project
        run: |
          ./build.sh
          ./configure

      - name: Run cppcheck
        run: make check-static

  cppcheck-linux:
    name: Static analysis (cppcheck, Linux, debian:sid)
    runs-on: ubuntu-latest
    container: debian:sid

    steps:
      - name: Install basic tools
        run: |
          apt-get update
          apt-get install -y git

      - name: Mark repo as safe for git
        run: git config --global --add safe.directory $GITHUB_WORKSPACE
        
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: recursive
          
      - name: Detect latest Lua packages
        id: detect_lua
        shell: bash
        run: |
          set -euo pipefail

          apt-get update

          CANDIDATES="$(apt-cache pkgnames | grep -E '^liblua[0-9]+\.[0-9]+-dev$' || true)"

          if [ -z "$CANDIDATES" ]; then
            echo "No libluaX.Y-dev package found"
            exit 1
          fi

          BEST_PKG="$(
            printf '%s\n' "$CANDIDATES" \
            | sed -E 's/^liblua([0-9]+\.[0-9]+)-dev$/\1 &/' \
            | sort -V \
            | tail -n1 \
            | awk '{print $2}'
          )"

          if [ -z "$BEST_PKG" ]; then
            echo "Failed to determine Lua dev package"
            printf '%s\n' "$CANDIDATES"
            exit 1
          fi

          BEST_VER="$(printf '%s\n' "$BEST_PKG" | sed -E 's/^liblua([0-9]+\.[0-9]+)-dev$/\1/')"
          LUA_PKG="lua$BEST_VER"

          echo "lua_dev_pkg=$BEST_PKG" >> "$GITHUB_OUTPUT"
          echo "lua_pkg=$LUA_PKG" >> "$GITHUB_OUTPUT"

          echo "Using dev package: $BEST_PKG"
          echo "Using interpreter: $LUA_PKG"

      - name: Install dependencies (v2 style)
        run: |
          apt-get install -y \
            autoconf \
            automake \
            build-essential \
            libtool \
            pkg-config \
            cppcheck \
            libyajl-dev \
            libcurl4-openssl-dev \
            liblmdb-dev \
            ${{ steps.detect_lua.outputs.lua_dev_pkg }} \
            ${{ steps.detect_lua.outputs.lua_pkg }} \
            libmaxminddb-dev \
            libpcre2-dev \
            libxml2-dev \
            libfuzzy-dev \
            pcre2-utils \
            bison \
            flex \
            python3 \
            python3-venv
            
      - name: Show Lua installation
        run: |
          which lua || true
          lua -v || true
          dpkg -l | grep lua || true
            
      - name: Run build preparation script
        run: ./build.sh

      - name: Configure project
        run: ./configure

      - name: Run cppcheck
        run: make check-static