ohos.yml

# Copyright (c) 2026 [Ribose Inc](https://www.ribose.com).
# All rights reserved.
# This file is a part of rnp
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.

# Smoke test: cross-compile librnp + dependencies to aarch64-linux-ohos
# (OpenHarmony). No test execution -- OHOS binaries cannot run on Linux CI
# runners without QEMU, which is out of scope. The check is "did the static
# archive link cleanly with the OHOS sysroot, and does 'file' confirm the
# expected target architecture?"

name: ohos

on:
  push:
    branches:
      - main
      - 'release/**'
    paths-ignore:
      - '/*.sh'
      - '/.*'
      - '/_*'
      - 'Brewfile'
      - 'docs/**'
      - '**.adoc'
      - '**.md'
      - '**.nix'
      - 'flake.lock'
      - '.github/workflows/*.yml'
      - '!.github/workflows/ohos.yml'
  pull_request:
    paths:
      - 'CMakeLists.txt'
      - 'cmake/**'
      - 'src/lib/CMakeLists.txt'
      - 'src/libsexpp/CMakeLists.txt'
      - '.github/workflows/ohos.yml'

concurrency:
  group: '${{ github.workflow }}-${{ github.job }}-${{ github.head_ref || github.ref_name }}'
  cancel-in-progress: true

jobs:
  aarch64-ohos-smoke:
    name: aarch64-linux-ohos cross-compile (Botan backend)
    runs-on: ubuntu-latest
    if: "!contains(github.event.head_commit.message, 'skip ci')"
    timeout-minutes: 45
    continue-on-error: true
    env:
      # SDK version supported by openharmony-rs/setup-ohos-sdk; must match a
      # release tag of the openharmony-rs/ohos-sdk GitHub mirror.
      OHOS_SDK_VERSION: "6.1"
      # The OHOS NDK ships clang 15, whose bundled libc++ lacks the C++20
      # ranges *algorithms* (std::ranges::equal et al.). Botan 3.10+ uses
      # them unguarded, so 3.9.0 is the newest release that cross-compiles
      # with this SDK (still >= 3.7 for legacy_ec_point, and unlike 3.6.x
      # it has no arm64 legacy-EC crash, see #2456).
      BOTAN_VERSION: "3.9.0"
    steps:
      - name: Checkout rnp
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          submodules: true

      - name: Install host build deps
        run: |
          sudo apt-get -y update
          sudo apt-get -y install cmake ninja-build python3 bzip2 libbz2-dev zlib1g-dev

      # Huawei's SDK download CDN (repo/contentcenter hosts) is geo-restricted
      # to China; GitHub Actions runners get HTTP 403. openharmony-rs mirrors
      # the released SDKs as GitHub release assets and ships an installer
      # action with caching; the Rust-for-OHOS ecosystem uses this in CI.
      - name: Set up OHOS SDK (native NDK component)
        uses: openharmony-rs/setup-ohos-sdk@v1.0.0
        with:
          version: ${{ env.OHOS_SDK_VERSION }}
          components: 'native'

      - name: Locate OHOS toolchain & sysroot
        run: |
          # The action exports OHOS_NDK_HOME pointing at the host SDK dir;
          # the native/ component inside it holds the NDK.
          NDK="${OHOS_NDK_HOME}/native"
          TOOLCHAIN="${NDK}/build/cmake/ohos.toolchain.cmake"
          SYSROOT="${NDK}/sysroot"
          test -f "$TOOLCHAIN"
          test -d "$SYSROOT/usr/lib/aarch64-linux-ohos"
          echo "TOOLCHAIN=$TOOLCHAIN" >> $GITHUB_ENV
          echo "SYSROOT=$SYSROOT" >> $GITHUB_ENV

      - name: Cache cross-built Botan
        id: cache-botan
        uses: actions/cache@v4
        with:
          path: ~/ohos-deps/botan
          key: ohos-botan-${{ env.BOTAN_VERSION }}-${{ env.OHOS_SDK_VERSION }}

      - name: Cross-build Botan 3 for aarch64-linux-ohos
        if: steps.cache-botan.outputs.cache-hit != 'true'
        run: |
          mkdir -p ~/ohos-deps && cd ~/ohos-deps
          curl -L --retry 3 -o botan.tgz \
            "https://botan.randombit.net/releases/Botan-${BOTAN_VERSION}.tar.xz"
          tar xf botan.tgz
          cd "Botan-${BOTAN_VERSION}"
          # 3.9.0 has a single ranges-algorithm call; the member function is
          # the exact equivalent for its std::array argument.
          sed -i 's/std::ranges::fill(m_value, 0)/m_value.fill(0)/' \
            src/lib/math/pcurves/pcurves.h
          python3 ./configure.py \
            --cc=clang \
            --cpu=aarch64 \
            --cc-abi-flags="--target=aarch64-linux-ohos --sysroot=${SYSROOT}" \
            --cc-bin="${OHOS_NDK_HOME}/native/llvm/bin/clang++ --target=aarch64-linux-ohos --sysroot=${SYSROOT}" \
            --build-targets=static \
            --without-documentation \
            --disable-shared-library \
            --minimized-build \
            --enable-modules="$(cat "$GITHUB_WORKSPACE/ci/botan3-pqc-modules" | tr '\n' ',')" \
            --prefix="$HOME/ohos-deps/botan"
          # Botan declares explicit_bzero for all linux targets (build-data
          # os/linux.txt), but OHOS musl's declaration is feature-gated out
          # of the sysroot string.h. Drop the define from every generated
          # header (it appears in both build.h and target_info.h) so the
          # portable volatile-memset fallback is used.
          find build -name '*.h' -exec sed -i \
            '/define BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO/d' {} +
          make -j"$(nproc)"
          make install

      - name: Configure librnp for aarch64-linux-ohos
        run: |
          cmake -B build -G Ninja \
            -DCMAKE_TOOLCHAIN_FILE="${TOOLCHAIN}" \
            -DOHOS_ARCH=arm64-v8a \
            -DCMAKE_SYSROOT="${SYSROOT}" \
            -DCMAKE_BUILD_TYPE=Release \
            -DBUILD_SHARED_LIBS=OFF \
            -DBUILD_TESTING=OFF \
            -DENABLE_DOC=OFF \
            -DDOWNLOAD_GTEST=OFF \
            -DCRYPTO_BACKEND=botan \
            -DBOTAN_INCLUDE_DIR="$HOME/ohos-deps/botan/include/botan-3" \
            -DBOTAN_LIBRARY="$HOME/ohos-deps/botan/lib/libbotan-3.a"

      - name: Build librnp.a
        run: cmake --build build --parallel "$(nproc)"

      - name: Verify archive architecture
        run: |
          file build/src/lib/librnp.a
          # The thin archive should contain aarch64-linux-ohos objects.
          ar t build/src/lib/librnp.a | head -5
          # Extract one object and verify its arch matches.
          OBJ=$(ar t build/src/lib/librnp.a | head -1)
          ar x build/src/lib/librnp.a "$OBJ"
          file "$OBJ" | tee /dev/stderr | grep -q 'ELF 64-bit LSB.*aarch64'

      - name: Upload librnp artifact
        uses: actions/upload-artifact@v4
        with:
          name: librnp-aarch64-linux-ohos
          path: |
            build/src/lib/librnp.a
            build/src/lib/rnp/rnp_export.h
            build/src/lib/version.h
            include/rnp/rnp.h
            include/rnp/rnp_err.h
          retention-days: 14