xserver/.github/workflows/build-xserver.yml

name: Build X servers

permissions:
    contents: write

env:
    MESON_BUILDDIR:  "__BUILD"
    X11_PREFIX:      /home/runner/x11
    X11_BUILD_DIR:   /home/runner/work/xserver/xserver/WORK/sources/3rdparty
    GOXPROTO_REF:    v0.0.4

on:
    push:
    pull_request:

# If a ref is pushed again (or a PR gets a new commit) while its previous run is
# still in flight, cancel the stale run — only the newest commit needs building.
# Keyed by ref, so each branch/PR is independent.
concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true

jobs:
    ubuntu-fetch-pkg:
        # De-duplicate PR runs without a branch-name convention: on a same-repo
        # pull_request the branch's own push event already builds it, so skip the
        # redundant build here. Fork PRs raise no push event in this repo, so
        # they still build. Every build job chains off this root (and the three
        # other no-needs roots below), so skipping it skips them too. Normal
        # branch pushes are unaffected — they build exactly as before, and the
        # push run's checks still populate the PR's status indicator.
        if: >-
            github.event_name != 'pull_request' ||
            github.event.pull_request.head.repo.full_name != github.repository
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v6
            - uses: ./.github/actions/ubuntu-fetch-pkg

    xserver-build-ubuntu-no-gbm:
        env:
            MESON_ARGS: -Dprefix=/usr -Dxephyr=true -Dwerror=true -Dxcsecurity=true -Dgbm=false -Dxorg=true -Dxvfb=true -Dxnest=true -Dxfbdev=true -Dtest_xephyr_gles=false
            LIBGL_ALWAYS_SOFTWARE: 1
            GALLIUM_DRIVER: llvmpipe
            PIGLIT_PLATFORM: x11_egl
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        steps:
            - name: Check out repository code
              uses: actions/checkout@v4

            - uses: ./.github/actions/ubuntu-install-pkg

            - name: prepare build environment
              run: |
                MACHINE=`gcc -dumpmachine`
                echo "MACHINE=$MACHINE" >> "$GITHUB_ENV"
                echo "PKG_CONFIG_PATH=$X11_PREFIX/share/pkgconfig:$X11_PREFIX/lib/$MACHINE/pkgconfig:$X11_PREFIX/lib/pkgconfig:$PKG_CONFIG_PATH" >> "$GITHUB_ENV"
                sudo chown root /bin/tar && sudo chmod u+s /bin/tar

            - name: X11 prereq cache
              uses: actions/cache@v5
              with:
                path: |
                    ${{ env.X11_PREFIX }}
                    ${{ env.X11_BUILD_DIR }}/xts
                    ${{ env.X11_BUILD_DIR }}/piglit
                    ${{ env.X11_BUILD_DIR }}/goxproto
                key: ${{ runner.name }}-x11-deps-${{ hashFiles('.github/scripts/ubuntu/install-prereq.sh') }}
                restore-keys: ${{ runner.name }}-x11-deps-

            - name: build and test
              run:  .github/scripts/ubuntu/run-xserver-build-and-test.sh

            - name: archive build logs
              uses: actions/upload-artifact@v4
              with:
                  name: build-logs
                  path: |
                      __BUILD/meson-logs/*
                      __BUILD/test/piglit-results/*

    xserver-build-ubuntu:
        env:
            MESON_ARGS: -Dprefix=/usr -Dxephyr=true -Dwerror=true -Dxcsecurity=true -Dxorg=true -Dxvfb=true -Dxnest=true -Dxfbdev=true -Dtest_xephyr_gles=false
            LIBGL_ALWAYS_SOFTWARE: 1
            GALLIUM_DRIVER: llvmpipe
            PIGLIT_PLATFORM: x11_egl
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        steps:
            - name: Check out repository code
              uses: actions/checkout@v6

            - uses: ./.github/actions/ubuntu-install-pkg

            - name: prepare build environment
              run: |
                MACHINE=`gcc -dumpmachine`
                echo "MACHINE=$MACHINE" >> "$GITHUB_ENV"
                echo "PKG_CONFIG_PATH=$X11_PREFIX/share/pkgconfig:$X11_PREFIX/lib/$MACHINE/pkgconfig:$X11_PREFIX/lib/pkgconfig:$PKG_CONFIG_PATH" >> "$GITHUB_ENV"

            - name: X11 prereq cache
              uses: actions/cache@v5
              with:
                path: |
                    ${{ env.X11_PREFIX }}
                    ${{ env.X11_BUILD_DIR }}/xts
                    ${{ env.X11_BUILD_DIR }}/piglit
                    ${{ env.X11_BUILD_DIR }}/goxproto
                key: ${{ runner.name }}-x11-deps-${{ hashFiles('.github/scripts/ubuntu/install-prereq.sh') }}
                restore-keys: ${{ runner.name }}-x11-deps-

            - name: build and test
              run:  .github/scripts/ubuntu/run-xserver-build-and-test.sh

            - name: archive build logs
              uses: actions/upload-artifact@v4
              with:
                  name: build-logs
                  path: |
                      __BUILD/meson-logs/*
                      __BUILD/test/piglit-results/*

    abi-changes-check:
        runs-on: ubuntu-latest
        outputs:
            abi_changed: ${{ steps.filter.outputs.abi_changed }}
        steps:
            - uses: actions/checkout@v6
              with:
                  fetch-depth: 0
            - uses: dorny/paths-filter@v3
              id: filter
              with:
                  filters: |
                      abi_changed:
                          - 'include/**'
                          - 'meson.build'
                          - 'meson_options.txt'
                          - 'xorg-server.pc.in'
                          - 'xlibre-server.pc.in'
                          - 'xorg-server.m4'
                          - 'hw/xfree86/xlibre-server.h.meson.in'
                          - 'hw/xfree86/drivers/input/inputtest/xf86-input-inputtest-protocol.h'

    xserver-build-ubuntu-debug:
        env:
            MESON_ARGS: --buildtype=debug -Dprefix=/usr -Dxephyr=true -Dwerror=true -Dxcsecurity=true -Dxorg=true -Dxvfb=true -Dxnest=true -Dxfbdev=true -Dtest_xephyr_gles=false
            LIBGL_ALWAYS_SOFTWARE: 1
            GALLIUM_DRIVER: llvmpipe
            PIGLIT_PLATFORM: x11_egl
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        steps:
            - name: Check out repository code
              uses: actions/checkout@v6

            - uses: ./.github/actions/ubuntu-install-pkg

            - name: prepare build environment
              run: |
                MACHINE=`gcc -dumpmachine`
                echo "MACHINE=$MACHINE" >> "$GITHUB_ENV"
                echo "PKG_CONFIG_PATH=$X11_PREFIX/share/pkgconfig:$X11_PREFIX/lib/$MACHINE/pkgconfig:$X11_PREFIX/lib/pkgconfig:$PKG_CONFIG_PATH" >> "$GITHUB_ENV"

            - name: X11 prereq cache
              uses: actions/cache@v5
              with:
                path: |
                    ${{ env.X11_PREFIX }}
                    ${{ env.X11_BUILD_DIR }}/xts
                    ${{ env.X11_BUILD_DIR }}/piglit
                key: ${{ runner.name }}-x11-deps-${{ hashFiles('.github/scripts/ubuntu/install-prereq.sh') }}
                restore-keys: ${{ runner.name }}-x11-deps-

            - name: build and test
              run:  .github/scripts/ubuntu/run-xserver-build-and-test.sh

            - name: archive build logs
              uses: actions/upload-artifact@v4
              with:
                  name: build-logs-debug
                  path: |
                      __BUILD/meson-logs/*
                      __BUILD/test/piglit-results/*

    ubuntu-deps-image:
        # Content-addressed base image (apt deps + from-source prereqs baked in),
        # consumed by build-sdk-image below. The tag is a hash of the image's
        # build inputs (Dockerfile + the install scripts + conf.sh/util.sh), and
        # we build only if that tag is missing — an unchanged image is reused on
        # ANY branch (a few-second existence check, no ~15min rebuild); a branch
        # that changes the deps automatically gets its own image, so the SDK it
        # builds is never stale. :latest is only moved by master. Replaces the
        # standalone ubuntu-deps-image.yml. Gated like build-sdk-image since the
        # SDK is its only consumer.
        runs-on: ubuntu-latest
        needs: abi-changes-check
        if: needs.abi-changes-check.outputs.abi_changed == 'true' || startsWith(github.ref, 'refs/tags/')
        permissions:
            contents: read
            packages: write
        outputs:
            tag: ${{ steps.tag.outputs.tag }}
        steps:
            - uses: actions/checkout@v6
            - id: tag
              run: |
                  echo "tag=$(cat .github/docker/ubuntu/Dockerfile \
                                   .github/scripts/ubuntu/install-pkg.sh \
                                   .github/scripts/ubuntu/install-prereq.sh \
                                   .github/scripts/conf.sh \
                                   .github/scripts/util.sh \
                               | sha256sum | cut -c1-16)" >> "$GITHUB_OUTPUT"
            - name: Log in to GHCR
              run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
            - name: Build ubuntu deps image if missing
              run: |
                  set -eux
                  img="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/xserver-ubuntu-build"
                  tag="${{ steps.tag.outputs.tag }}"
                  if docker manifest inspect "$img:$tag" >/dev/null 2>&1; then
                      echo "image $img:$tag already exists — reusing"
                  else
                      docker build -t "$img:$tag" -f .github/docker/ubuntu/Dockerfile .
                      docker push "$img:$tag"
                      if [ "${{ github.ref }}" = "refs/heads/master" ]; then
                          docker tag "$img:$tag" "$img:latest"
                          docker push "$img:latest"
                      fi
                  fi

    build-sdk-image:
        # Build the X-server + SDK from this commit and push it to GHCR as
        # xserver-sdk:<sha>; the driver builds below run in that image. Replaces
        # the old drivers-prepare-ubuntu + actions/cache, whose SDK cache could
        # be evicted under load before the queued driver jobs restored it (then
        # the whole pipeline had to be re-run by hand). A registry image is not
        # subject to that LRU eviction.
        runs-on: ubuntu-latest
        needs:
            - ubuntu-fetch-pkg
            - abi-changes-check
            - ubuntu-deps-image
        if: needs.abi-changes-check.outputs.abi_changed == 'true' || startsWith(github.ref, 'refs/tags/')
        permissions:
            contents: read
            packages: write
        steps:
            - name: Check out repository code
              uses: actions/checkout@v6

            - name: Log in to GHCR
              run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin

            - name: Build and push SDK image (xserver-sdk:<sha>)
              run: |
                  set -eux
                  owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
                  base="ghcr.io/$owner/xserver-ubuntu-build:${{ needs.ubuntu-deps-image.outputs.tag }}"
                  img="ghcr.io/$owner/xserver-sdk"
                  docker build --build-arg BASE="$base" -t "$img:${GITHUB_SHA}" -f .github/docker/sdk/Dockerfile .
                  docker push "$img:${GITHUB_SHA}"

    drivers-build-ubuntu:
        needs:
            - build-sdk-image
            - abi-changes-check
        if: needs.abi-changes-check.outputs.abi_changed == 'true' || startsWith(github.ref, 'refs/tags/')
        runs-on: ubuntu-latest
        # The SDK + prereqs live at /opt/x11 in the image; override the
        # workflow-level X11_PREFIX (which points at the host /home/runner path)
        # so conf.sh derives PKG_CONFIG_PATH from the in-image prefix.
        env:
            X11_PREFIX: /opt/x11
            X11_BUILD_DIR: /opt/x11-build
        # Run in the per-commit SDK image: the xserver SDK + all build deps are
        # baked in under /opt/x11, so each driver job only compiles the driver
        # (no apt, no prereq build, no cache restore). The image is public, so it
        # pulls anonymously — no credentials / packages permission needed.
        container:
            image: ghcr.io/x11libre/xserver-sdk:${{ github.sha }}
        strategy:
            matrix:
                driver:
                    - input-elographics:25.0.0
                    - input-evdev:25.0.0
                    - input-joystick:25.0.0
                    - input-keyboard:25.0.0
                    - input-libinput:25.0.0
                    - input-mouse:25.0.0
                    - input-synaptics:25.0.0
                    - input-vmmouse:25.0.0
                    - input-void:25.0.0
                    - input-wacom:25.0.0
                    - video-amdgpu:25.0.0
                    - video-apm:25.0.0
                    - video-ark:25.0.0
                    - video-ast:25.0.0
                    - video-ati:25.0.0
                    - video-chips:25.0.0
                    - video-cirrus:25.0.0
                    - video-dummy:25.0.0
                    - video-fbdev:25.0.0
                    - video-freedreno:25.0.0
                    - video-geode:25.0.0
                    - video-i128:25.0.0
                    - video-i740:25.0.0
                    - video-intel:25.0.1
                    - video-mach64:25.0.0
                    - video-mga:25.0.0
                    - video-neomagic:25.0.0
                    - video-nested:25.0.0
                    - video-nouveau:25.0.0
                    - video-nv:25.0.0
                    - video-omap:25.0.0
                    - video-qxl:25.0.0
                    - video-r128:25.0.0
                    - video-rendition:25.0.0
                    - video-s3virge:25.0.0
                    - video-savage:25.0.0
                    - video-siliconmotion:25.0.0
                    - video-sis:25.0.0
                    - video-sisusb:25.0.0
                    - video-suncg14:25.0.0
                    - video-suncg3:25.0.0
                    - video-suncg6:25.0.0
                    - video-sunffb:25.0.0
                    - video-suntcx:25.0.0
                    - video-sunleo:25.0.0
                    - video-tdfx:25.0.0
                    - video-trident:25.0.0
                    - video-vesa:25.0.0
                    - video-vmware:25.0.0
                    - video-v4l:25.0.1
                    - video-vbox:25.0.0
                    - video-voodoo:25.0.0
                    - video-xgi:25.0.0
        steps:
            - name: Check out repository code
              uses: actions/checkout@v4

            - name: compile driver ${{ matrix.driver }}
              run: .github/scripts/ubuntu/compile-driver-single.sh ${{ matrix.driver }}

    xserver-build-mingw32-ubuntu:
        runs-on: ubuntu-latest
        env:
            MESON_ARGS: -Dprefix=/home/runner/x11 --cross-file=.github/scripts/mingw32/cross-i686-w64-mingw32.txt -Dwerror=true -Dglx=false -Dlisten_tcp=true -Dxvmc=true -Dxv=true -Dxvfb=true -Dxnest=true -Dxephyr=true -Dxfbdev=false
        needs: ubuntu-fetch-pkg
        steps:
            - name: Check out repository code
              uses: actions/checkout@v6

            - uses: ./.github/actions/ubuntu-install-pkg

            - name: prepare build environment
              run: |
                MACHINE=`gcc -dumpmachine`
                echo "MACHINE=$MACHINE" >> "$GITHUB_ENV"
                echo "PKG_CONFIG_PATH=$X11_PREFIX/share/pkgconfig:$X11_PREFIX/lib/$MACHINE/pkgconfig:$X11_PREFIX/lib/pkgconfig:$PKG_CONFIG_PATH" >> "$GITHUB_ENV"

            - name: X11 prereq cache
              uses: actions/cache@v5
              with:
                path: |
                    ${{ env.X11_PREFIX }}
                    ${{ env.X11_BUILD_DIR }}/xts
                    ${{ env.X11_BUILD_DIR }}/piglit
                key: ${{ runner.name }}-x11-deps-${{ hashFiles('.github/scripts/mingw32/cross-prereqs-build.sh') }}
                restore-keys: ${{ runner.name }}-x11-deps-

            - name: install crosscompiler
              run: sudo apt-get install -y mingw-w64-tools gcc-mingw-w64 gcc-mingw-w64-i686 libz-mingw-w64-dev

            - name: cross prereq
              run: sudo .github/scripts/mingw32/cross-prereqs-build.sh i686-w64-mingw32

            - name: build
              run: .github/scripts/meson-build.sh --run-install

    xserver-build-macos:
        # skip the redundant same-repo PR rebuild (see ubuntu-fetch-pkg)
        if: >-
            github.event_name != 'pull_request' ||
            github.event.pull_request.head.repo.full_name != github.repository
        env:
            MESON_ARGS: -Dprefix=/tmp -Dglx=false -Dxnest=false -Dxfbdev=false
            X11_PREFIX: /Users/runner/x11
            X11_BUILD_DIR: /Users/runner/build-deps
        runs-on: macos-latest
        steps:
            - name: Check out repository code
              uses: actions/checkout@v6

            - name: prepare build environment
              run: |
                echo "PKG_CONFIG_PATH=$X11_PREFIX/share/pkgconfig:$X11_PREFIX/lib/pkgconfig:$PKG_CONFIG_PATH" >> "$GITHUB_ENV"

            - name: homebrew cache
              uses: actions/cache@v5
              with:
                path: /Users/runner/Library/Caches/Homebrew
                key: ${{ runner.os }}-homebrew-cache-${{ hashFiles('.github/scripts/macos/install-pkg.sh') }}
                restore-keys: ${{ runner.os }}-homebrew-cache-

            - name: pkg install
              run:  .github/scripts/macos/install-pkg.sh

            - name: X11 prereq cache
              uses: actions/cache@v5
              with:
                path: |
                    ${{ env.X11_PREFIX }}
                key: ${{ runner.os }}-x11-deps-${{ hashFiles('.github/scripts/macos/install-prereq.sh') }}
                restore-keys: ${{ runner.os }}-x11-deps-

            - name: generic prereq
              run:  .github/scripts/macos/install-prereq.sh

            - name: build
              run:  .github/scripts/meson-build.sh

            - name: tests (may fail)
              continue-on-error: true
              run:  meson test -C "${{ env.MESON_BUILDDIR }}" --print-errorlogs -j1 || true
              env:
                  XTEST_DIR:  ${{ env.X11_BUILD_DIR }}/xts
                  PIGLIT_DIR: ${{ env.X11_BUILD_DIR }}/piglit

            - name: archive build logs
              uses: actions/upload-artifact@v4
              with:
                  name: build-logs-macos
                  path: |
                      __BUILD/meson-logs/*
                      __BUILD/test/piglit-results/*

            - name: ddx build check
              run:  .github/scripts/check-ddx-build.sh
            - name: manpage check
              run:  .github/scripts/manpages-check

    xserver-build-freebsd:
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        timeout-minutes: 90
        env:
            MYTOKEN : ${{ secrets.MYTOKEN }}
            MESON_ARGS: -Dprefix=/usr -Dxephyr=true -Dwerror=true -Dxcsecurity=true -Dxorg=true -Dxvfb=true -Dxnest=true -Dxfbdev=false
        steps:
            - uses: actions/checkout@v6
            - uses: ./.github/actions/ubuntu-pkg-cache

            # VM boot / image provisioning flakes transiently; retry the whole
            # VM step up to 3x, tearing down the leftover domain between tries
            # (see .github/actions/libvirt-cleanup). Only the last attempt is
            # allowed to fail the job; a success short-circuits the rest.
            - name: run in freebsd VM (attempt 1)
              id: freebsd-1
              continue-on-error: true
              uses: vmactions/freebsd-vm@v1
              with:
                  envs: 'MYTOKEN MESON_ARGS'
                  usesh: true
                  release: "14.3"
                  run:     ./.github/scripts/freebsd/run-xserver-build.sh

            - name: cleanup stale VM before retry
              if: steps.freebsd-1.outcome == 'failure'
              uses: ./.github/actions/libvirt-cleanup
              with:
                  guest: freebsd

            - name: run in freebsd VM (attempt 2)
              id: freebsd-2
              if: steps.freebsd-1.outcome == 'failure'
              continue-on-error: true
              uses: vmactions/freebsd-vm@v1
              with:
                  envs: 'MYTOKEN MESON_ARGS'
                  usesh: true
                  release: "14.3"
                  run:     ./.github/scripts/freebsd/run-xserver-build.sh

            - name: cleanup stale VM before final retry
              if: steps.freebsd-1.outcome == 'failure' && steps.freebsd-2.outcome == 'failure'
              uses: ./.github/actions/libvirt-cleanup
              with:
                  guest: freebsd

            - name: run in freebsd VM (attempt 3)
              if: steps.freebsd-1.outcome == 'failure' && steps.freebsd-2.outcome == 'failure'
              uses: vmactions/freebsd-vm@v1
              with:
                  envs: 'MYTOKEN MESON_ARGS'
                  usesh: true
                  release: "14.3"
                  run:     ./.github/scripts/freebsd/run-xserver-build.sh

    xserver-build-dragonflybsd:
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        timeout-minutes: 90
        env:
            MESON_ARGS: -Dwerror=true -Dxephyr=true -Dxorg=true -Dxvfb=true -Dxnest=true -Dxfbdev=false
        steps:
            - uses: actions/checkout@v6
            - uses: ./.github/actions/ubuntu-pkg-cache

            # VM boot / image provisioning flakes transiently; retry the whole
            # VM step up to 3x, tearing down the leftover domain between tries
            # (see .github/actions/libvirt-cleanup). Without that teardown the
            # retry collides with attempt 1's leftover VM
            # ("Guest name 'dragonflybsd' is already in use") and times out.
            - name: run in DragonFlyBSD VM (attempt 1)
              id: dfly-1
              continue-on-error: true
              uses: vmactions/dragonflybsd-vm@v1.1.4
              with:
                  envs: 'MESON_ARGS'
                  usesh: true
                  release: "6.4.2"
                  run:     ./.github/scripts/DragonFlyBSD/run-xserver-build.sh

            - name: cleanup stale VM before retry
              if: steps.dfly-1.outcome == 'failure'
              uses: ./.github/actions/libvirt-cleanup
              with:
                  guest: dragonflybsd

            - name: run in DragonFlyBSD VM (attempt 2)
              id: dfly-2
              if: steps.dfly-1.outcome == 'failure'
              continue-on-error: true
              uses: vmactions/dragonflybsd-vm@v1.1.4
              with:
                  envs: 'MESON_ARGS'
                  usesh: true
                  release: "6.4.2"
                  run:     ./.github/scripts/DragonFlyBSD/run-xserver-build.sh

            - name: cleanup stale VM before final retry
              if: steps.dfly-1.outcome == 'failure' && steps.dfly-2.outcome == 'failure'
              uses: ./.github/actions/libvirt-cleanup
              with:
                  guest: dragonflybsd

            - name: run in DragonFlyBSD VM (attempt 3)
              if: steps.dfly-1.outcome == 'failure' && steps.dfly-2.outcome == 'failure'
              uses: vmactions/dragonflybsd-vm@v1.1.4
              with:
                  envs: 'MESON_ARGS'
                  usesh: true
                  release: "6.4.2"
                  run:     ./.github/scripts/DragonFlyBSD/run-xserver-build.sh

    xserver-build-netbsd:
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        timeout-minutes: 90
        env:
            MESON_ARGS: -Dwerror=true -Dxephyr=true -Dxorg=true -Dxvfb=true -Dxnest=true -Dxfbdev=false
        steps:
            - uses: actions/checkout@v6
            - uses: ./.github/actions/ubuntu-pkg-cache

            # VM boot / image provisioning flakes transiently; retry the whole
            # VM step up to 3x, tearing down the leftover domain between tries
            # (see .github/actions/libvirt-cleanup).
            - name: run in netbsd VM (attempt 1)
              id: netbsd-1
              continue-on-error: true
              uses: vmactions/netbsd-vm@v1.2.3
              with:
                  envs: 'MESON_ARGS'
                  usesh: true
                  release: '10.1'
                  run:     ./.github/scripts/netbsd/run-xserver-build.sh

            - name: cleanup stale VM before retry
              if: steps.netbsd-1.outcome == 'failure'
              uses: ./.github/actions/libvirt-cleanup
              with:
                  guest: netbsd

            - name: run in netbsd VM (attempt 2)
              id: netbsd-2
              if: steps.netbsd-1.outcome == 'failure'
              continue-on-error: true
              uses: vmactions/netbsd-vm@v1.2.3
              with:
                  envs: 'MESON_ARGS'
                  usesh: true
                  release: '10.1'
                  run:     ./.github/scripts/netbsd/run-xserver-build.sh

            - name: cleanup stale VM before final retry
              if: steps.netbsd-1.outcome == 'failure' && steps.netbsd-2.outcome == 'failure'
              uses: ./.github/actions/libvirt-cleanup
              with:
                  guest: netbsd

            - name: run in netbsd VM (attempt 3)
              if: steps.netbsd-1.outcome == 'failure' && steps.netbsd-2.outcome == 'failure'
              uses: vmactions/netbsd-vm@v1.2.3
              with:
                  envs: 'MESON_ARGS'
                  usesh: true
                  release: '10.1'
                  run:     ./.github/scripts/netbsd/run-xserver-build.sh

    # illumos / Solaris build, run in an OpenIndiana VM (vmactions, same
    # mechanism as the BSD jobs above). Exercises the Solaris-specific os/ code
    # paths (procfs/psinfo, the sunos meson branch) that no other CI covers.
    # OpenIndiana packages the full X stack incl. Mesa, so GLX stays enabled.
    # werror is off for now since this platform is freshly added; tighten once
    # it is green.
    xserver-build-solaris:
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        env:
            # dri2/dri3 disabled: illumos has no kernel DRM/KMS, so the
            # libdrm-backed direct-rendering extensions can't work (and OI's
            # xf86drm.h pulls a drm.h that only exists for Linux). glx stays on
            # (Mesa is packaged) for indirect/software GLX.
            MESON_ARGS: -Dwerror=false -Dxvfb=true -Dxnest=true -Dxorg=false -Dxephyr=false -Dxfbdev=false -Ddri2=false -Ddri3=false
        steps:
            - uses: actions/checkout@v6
            - uses: ./.github/actions/ubuntu-pkg-cache
            - name: run in OpenIndiana (illumos) VM
              id: vm
              uses: vmactions/openindiana-vm@v1
              with:
                  envs: 'MESON_ARGS'
                  usesh: true
                  run:     ./.github/scripts/solaris/run-xserver-build.sh

    # OpenBSD build, run in an OpenBSD VM (vmactions, same mechanism as the
    # other BSD jobs). OpenBSD ships X.Org (xenocara) in base, so only build
    # tooling is installed; X libs (incl. Mesa) come from /usr/X11R6. glx stays
    # enabled (indirect/software GLX against the base Mesa); dri2/dri3 stay off
    # (direct rendering needs a working DRM/KMS, n/a in the headless VM).
    # werror off while the platform is freshly added.
    xserver-build-openbsd:
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        timeout-minutes: 90
        env:
            MESON_ARGS: -Dwerror=false -Dxvfb=true -Dxnest=true -Dxorg=false -Dxephyr=false -Dxfbdev=false -Ddri2=false -Ddri3=false
        steps:
            - uses: actions/checkout@v6
            - uses: ./.github/actions/ubuntu-pkg-cache

            # VM boot / image provisioning flakes transiently; retry the whole
            # VM step up to 3x, tearing down the leftover domain between tries
            # (see .github/actions/libvirt-cleanup). Only the last attempt is
            # allowed to fail the job; a success short-circuits the rest.
            - name: run in OpenBSD VM (attempt 1)
              id: openbsd-1
              continue-on-error: true
              uses: vmactions/openbsd-vm@v1
              with:
                  envs: 'MESON_ARGS'
                  usesh: true
                  run:     ./.github/scripts/openbsd/run-xserver-build.sh

            - name: cleanup stale VM before retry
              if: steps.openbsd-1.outcome == 'failure'
              uses: ./.github/actions/libvirt-cleanup
              with:
                  guest: openbsd

            - name: run in OpenBSD VM (attempt 2)
              id: openbsd-2
              if: steps.openbsd-1.outcome == 'failure'
              continue-on-error: true
              uses: vmactions/openbsd-vm@v1
              with:
                  envs: 'MESON_ARGS'
                  usesh: true
                  run:     ./.github/scripts/openbsd/run-xserver-build.sh

            - name: cleanup stale VM before final retry
              if: steps.openbsd-1.outcome == 'failure' && steps.openbsd-2.outcome == 'failure'
              uses: ./.github/actions/libvirt-cleanup
              with:
                  guest: openbsd

            - name: run in OpenBSD VM (attempt 3)
              if: steps.openbsd-1.outcome == 'failure' && steps.openbsd-2.outcome == 'failure'
              uses: vmactions/openbsd-vm@v1
              with:
                  envs: 'MESON_ARGS'
                  usesh: true
                  run:     ./.github/scripts/openbsd/run-xserver-build.sh

    xserver-build-hurd:
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        timeout-minutes: 120
        env:
            REPO: ${{ github.repository }}
            SHA: ${{ github.sha }}
        steps:
            - uses: actions/checkout@v6
            - name: Install QEMU
              run: |
                  sudo apt-get update
                  sudo apt-get install -y qemu-system-x86 qemu-utils openssh-client
            - name: Boot GNU/Hurd VM and build (Xvfb + Xnest)
              run: ./.github/scripts/hurd/run-vm-build.sh

    xserver-build-alpine:
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        container:
            image: alpine:latest
        env:
            MESON_ARGS: -Dprefix=/usr -Dxcsecurity=true -Dxorg=true -Dxephyr=true -Dxvfb=true -Dxnest=true -Dxfbdev=false -Dsystemd_logind=false -Dwerror=false
        steps:
            # actions/checkout is a JS action; GitHub's bundled Node is
            # glibc-linked, so musl-based Alpine needs gcompat to run it.
            - name: prepare JS-action runtime
              run: apk add --no-cache git gcompat libstdc++ nodejs
            - name: Check out repository code
              uses: actions/checkout@v6
            - name: build
              run: ./.github/scripts/alpine/run-xserver-build.sh

    gentoo-deps-image:
        # Content-addressed deps image: tag = hash of the gentoo Dockerfile, and
        # build only if that tag is missing. An unchanged image is reused on ANY
        # branch (a few-second existence check, no 22min rebuild); a branch that
        # edits the Dockerfile automatically gets a fresh image — no waste and no
        # staleness. :latest is only moved by master.
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        permissions:
            contents: read
            packages: write
        outputs:
            tag: ${{ steps.tag.outputs.tag }}
        steps:
            - uses: actions/checkout@v6
            - id: tag
              run: echo "tag=$(sha256sum .github/docker/gentoo/Dockerfile | cut -c1-16)" >> "$GITHUB_OUTPUT"
            - name: Log in to GHCR
              run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
            - name: Build gentoo deps image if missing
              run: |
                  set -eux
                  img="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/xserver-gentoo-deps"
                  tag="${{ steps.tag.outputs.tag }}"
                  if docker manifest inspect "$img:$tag" >/dev/null 2>&1; then
                      echo "image $img:$tag already exists — reusing"
                  else
                      docker build -t "$img:$tag" -f .github/docker/gentoo/Dockerfile .github/docker/gentoo
                      docker push "$img:$tag"
                      if [ "${{ github.ref }}" = "refs/heads/master" ]; then
                          docker tag "$img:$tag" "$img:latest"
                          docker push "$img:latest"
                      fi
                  fi

    xserver-build-gentoo:
        runs-on: ubuntu-latest
        needs: gentoo-deps-image
        # Deps image built/reused by gentoo-deps-image above, addressed by
        # content hash so this always runs against matching deps. Only runs
        # meson (~5 min) instead of emerging 115 packages (~20 min).
        container:
            image: ghcr.io/x11libre/xserver-gentoo-deps:${{ needs.gentoo-deps-image.outputs.tag }}
        env:
            # werror off: Gentoo's hardened toolchain (FORTIFY_SOURCE) trips
            # -Werror=format-truncation in the bundled Xtrans (a bounded snprintf
            # into sun_path) which other platforms don't hit. Matches the other
            # freshly-added lanes (solaris/openbsd) while the platform is new.
            MESON_ARGS: -Dprefix=/usr -Dwerror=false -Dxcsecurity=true -Dxorg=true -Dxephyr=true -Dxvfb=true -Dxnest=true -Dxfbdev=false -Dsystemd_logind=false
        steps:
            - name: Check out repository code
              uses: actions/checkout@v6
            - name: build
              run: ./.github/scripts/gentoo/run-xserver-build.sh

    xserver-build-rhel:
        runs-on: ubuntu-latest
        needs: ubuntu-fetch-pkg
        strategy:
            fail-fast: false
            matrix:
                rhelver: ['9', '10']
        container:
            # AlmaLinux is an ABI-identical RHEL rebuild; it stands in for
            # RHEL here since the real UBI images can't enable CRB without
            # an entitlement on public runners.
            image: almalinux:${{ matrix.rhelver }}
        env:
            MESON_ARGS: -Dprefix=/usr -Dwerror=true -Dxcsecurity=true -Dxorg=true -Dxephyr=true -Dxvfb=true -Dxnest=true -Dxfbdev=false -Dsystemd_logind=false
        steps:
            - name: Check out repository code
              uses: actions/checkout@v6
            - name: build
              run: ./.github/scripts/rhel/run-xserver-build.sh

    xserver-build-cygwin:
        # skip the redundant same-repo PR rebuild (see ubuntu-fetch-pkg)
        if: >-
            github.event_name != 'pull_request' ||
            github.event.pull_request.head.repo.full_name != github.repository
        runs-on: windows-latest
        steps:
            - name: Cygwin packages cache
              uses: actions/cache@v5
              with:
                path: D:\cygwin-packages
                key: ${{ runner.os }}-packages
                restore-keys: ${{ runner.os }}-packages
            - uses: cygwin/cygwin-install-action@master
              with:
                  # FIXME: temporary workaround for cygwin mirror problem
                  # https://github.com/cygwin/cygwin-install-action/issues/39
                  check-installer-sig: false
                  platform: x86_64
                  site: |
                    https://mirror.wisegs.com/cygwin/
                    https://mirrors.sonic.net/cygwin/
                    https://mirror.cpsc.ucalgary.ca/mirror/cygwin.com/
                    https://muug.ca/mirror/cygwin/
                    https://mirror.csclub.uwaterloo.ca/cygwin/
                    https://cygwin.mirror.gtcomm.net/
                    http://cygwin.mirror.rafal.ca/

                  packages: >-
                   binutils, bison, ccache, flex, gcc-core, meson, ninja,
                   pkg-config, python39, windowsdriproto, xorgproto,
                   libepoxy-devel, libfontenc-devel, libfreetype-devel,
                   libGL-devel, libnettle-devel, libpixman1-devel,
                   libtirpc-devel, libXRes-devel, libXaw-devel, libXdmcp-devel,
                   libXext-devel, libXfont2-devel, libXi-devel,
                   libXinerama-devel, libXmu-devel, libXpm-devel,
                   libXrender-devel, libXtst-devel, libxcb-composite-devel,
                   libxcb-ewmh-devel, libxcb-icccm-devel, libxcb-image-devel,
                   libxcb-keysyms-devel, libxcb-randr-devel,
                   libxcb-render-devel, libxcb-render-util-devel,
                   libxcb-shape-devel, libxcb-util-devel, libxcb-xkb-devel,
                   libxcvt-devel, libxkbfile-devel, font-util,
                   khronos-opengl-registry, python39-lxml, xkbcomp-devel,
                   xkeyboard-config, git

            - name: Cygwin ccache cache
              uses: actions/cache@v5
              with:
                path: D:\cygwin\home\runneradmin\.ccache
                key: ${{ runner.os }}-ccache
                restore-keys: ${{ runner.os }}-ccache
            - run: git config --global --add safe.directory /cygdrive/d/a/xserver/xserver
            - uses: actions/checkout@v4
              with:
                  set-safe-directory: false
            - name: set PATH
              run: echo "PATH=/usr/bin:$(cygpath '$SYSTEMROOT')/system32" >> "$GITHUB_ENV"
            - name: build
              run: bash ./.github/scripts/Cygwin/build.sh
            - name: test
              run: bash -c 'ninja -C build test'

    xserver-build-arch:
        # skip the redundant same-repo PR rebuild (see ubuntu-fetch-pkg)
        if: >-
            github.event_name != 'pull_request' ||
            github.event.pull_request.head.repo.full_name != github.repository
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v6
            with: # needed for `git describe` to work
                fetch-tags: true
                fetch-depth: 0
          - name: determine pkg version from git
            run:  git describe | sed -e 's~^xlibre-xserver-~~; s~-[0-9a-z]*$~~' | tr '-' '.' > .github/arch/GIT_VERSION
          - name: build arch package
            uses: callmetango/archlinux-build-package-action@v0.6.0
            with:
                path: .github/arch
                makepkg-opts: -cfse --noconfirm
          - name: upload-artifacts
            uses: actions/upload-artifact@v7
            with:
                name: arch-binpkg
                path: |
                    ./.github/arch/xlibre-xserver-*.tar.zst

    check-sign-off:
        name: Check Signed-Off-By
        if: github.event_name == 'pull_request'
        runs-on: ubuntu-latest
        env:
            FORCE_COLOR: 1
            runs-on: ubuntu-latest
        steps:
          - uses: live627/check-pr-signoff-action@v1
            with:
                token: ${{ secrets.GITHUB_TOKEN }}

    release:
        name: Release pushed tag
        runs-on: ubuntu-latest
        if: ${{ startsWith(github.ref, 'refs/tags/xlibre-xserver-') }}
        needs:
            - xserver-build-alpine
            - xserver-build-ubuntu
            - xserver-build-ubuntu-debug
            - drivers-build-ubuntu
            - xserver-build-mingw32-ubuntu
            - xserver-build-macos
            - xserver-build-freebsd
            - xserver-build-dragonflybsd
            - xserver-build-netbsd
            - xserver-build-arch
            - xserver-build-gentoo
            - xserver-build-rhel
        steps:
            - name: Checkout
              uses: actions/checkout@v6
            - name: Create release
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  tag: ${{ github.ref_name }}
              run: .github/scripts/github/make-release