release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  pull_request:
  workflow_dispatch:
    inputs:
      version:
        description: Version to validate without publishing
        required: true
        default: "0.3.7"
      scope:
        description: Validation jobs to run
        required: true
        type: choice
        options:
          - all
          - windows
        default: all

permissions:
  contents: read

jobs:
  traceability:
    name: PR traceability
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04

    steps:
      - name: Require a single plan boundary and acceptance record
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
        shell: bash
        run: |
          body_file="$RUNNER_TEMP/pr-body.md"
          printf '%s\n' "$PR_BODY" > "$body_file"
          grep -Eq '^Plan: PR [0-9]+$' "$body_file"
          grep -Eq '^Issues: [A-Z][A-Z0-9]*-[0-9]+(, [A-Z][A-Z0-9]*-[0-9]+)*$' "$body_file"
          grep -Eq '^Focused tests: .+$' "$body_file"
          grep -Eq '^Acceptance: .+$' "$body_file"

  linux:
    name: Linux ${{ matrix.architecture }}
    if: github.event_name == 'push' || inputs.scope != 'windows'
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-22.04
            architecture: x86_64
            deb_architecture: amd64
            host_machine: x86_64
            file_pattern: x86-64
            predefined_macro: __x86_64__
          - runner: ubuntu-22.04-arm
            architecture: aarch64
            deb_architecture: arm64
            host_machine: aarch64
            file_pattern: ARM aarch64
            predefined_macro: __aarch64__
    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@v4

      - name: Resolve version
        env:
          REQUESTED_VERSION: ${{ inputs.version }}
        shell: bash
        run: |
          if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
            [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
            version="${GITHUB_REF_NAME#v}"
          elif [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
            version="$REQUESTED_VERSION"
          else
            version="$(sed -n 's/^  VERSION \([0-9.]*\)$/\1/p' CMakeLists.txt)"
          fi
          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
          test "$version" = "$(sed -n 's/^  VERSION \([0-9.]*\)$/\1/p' CMakeLists.txt)"
          echo "HITSIMPLE_VERSION=$version" >> "$GITHUB_ENV"

      - name: Install build dependencies
        run: |
          . /etc/os-release
          if [[ "$ID:$VERSION_ID" == "ubuntu:22.04" ]]; then
            sudo install -d -m 0755 /etc/apt/keyrings
            curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key | \
              sudo tee /etc/apt/keyrings/apt.llvm.org.asc >/dev/null
            echo "deb [signed-by=/etc/apt/keyrings/apt.llvm.org.asc] https://apt.llvm.org/${VERSION_CODENAME}/ llvm-toolchain-${VERSION_CODENAME}-18 main" | \
              sudo tee /etc/apt/sources.list.d/llvm-18.list >/dev/null
          fi
          sudo apt-get update
          sudo apt-get install -y bison bubblewrap cargo clang-18 dpkg-dev file gdb llvm-18-dev ninja-build re2c

      - name: Configure and build
        run: |
          cmake -S . -B build-release -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DBUILD_TESTING=ON \
            -DLLVM_DIR="$(llvm-config-18 --cmakedir)"
          cmake --build build-release --parallel

      - name: Verify compiler identity
        run: |
          test "$(uname -m)" = "${{ matrix.host_machine }}"
          ./build-release/hsc --version | grep -Fx "hsc $HITSIMPLE_VERSION"
          ./build-release/hsc --target-info | tee target-info.txt
          grep -Fx "runtime.kind: static-library" target-info.txt
          grep -Fx "f128.backend: native.fp128" target-info.txt
          grep -Fx "stdlib.provider.selection: optimized is the default; reference uses a manifest-declared reference implementation when available and otherwise keeps the default provider" target-info.txt
          grep -Fx "stdlib.provider.dispatch: provider selection is compile-time and does not change the public View contract or safety mode" target-info.txt

      - name: Run x86_64 regression suite
        if: matrix.architecture == 'x86_64'
        run: cmake -DBUILD_DIR=build-release -P cmake/RunQuietTests.cmake

      - name: Run aarch64 front-end and executable regression
        if: matrix.architecture == 'aarch64'
        run: |
          ./build-release/hsc_unit_tests \
            SourceLocation_ Diagnostic_ CCompat_ Lexer_ Parser_ \
            Preprocessor_ Sema_ ResourcePaths_ Process_ Toolchain_
          ./build-release/hsc --checked examples/hello.hs -o hello-checked
          ./hello-checked | grep -Fx 42
          ./build-release/hsc tests/cases/run/f16_f128_fallback.hs -o f128-smoke
          ./f128-smoke
          ./build-release/hsc --checked tests/cases/run/f128_format_scan.hs \
            -o f128-format-scan
          printf '1.5\n' | ./f128-format-scan | grep -Fx 1.5
          for mode in --unchecked --static-checked --checked; do
            for provider in optimized reference; do
              ./build-release/hsc --stdlib-provider="$provider" "$mode" \
                tests/cases/run/ctype_reference.hs -o "ctype-$provider-${mode#--}"
              ./"ctype-$provider-${mode#--}"
            done
          done
          ./build-release/hsc --checked tests/cases/run/checked_memcpy_bounds.hs \
            -o checked-memcpy-bounds
          if printf '2\n' | ./checked-memcpy-bounds >stdout 2>stderr; then
            echo 'checked memcpy bounds unexpectedly succeeded' >&2
            exit 1
          fi
          grep -Fq 'hitsimple runtime error: invalid memcpy destination range' stderr
          ./build-release/hsc --checked tests/cases/run/checked_memcpy_overlap.hs \
            -o checked-memcpy-overlap
          if printf '1\n' | ./checked-memcpy-overlap >stdout 2>stderr; then
            echo 'checked memcpy overlap unexpectedly succeeded' >&2
            exit 1
          fi
          grep -Fq 'hitsimple runtime error: overlapping memcpy ranges' stderr
          ./build-release/hsc --checked tests/cases/run/checked_dynamic_scan_target.hs \
            -o checked-dynamic-scan-target
          if printf 'x\n' | ./checked-dynamic-scan-target >stdout 2>stderr; then
            echo 'checked dynamic scan target unexpectedly succeeded' >&2
            exit 1
          fi
          grep -Fq 'hitsimple runtime error: scan string target must leave room for a NUL terminator' stderr
          cmake -DBUILD_DIR=build-release '-DTEST_REGEX=^(hsc_sanitize_address_(heap_runtime|stack_runtime|global_runtime|disabled_has_no_instrumentation)|hsc_sanitize_undefined_runtime|hsc_emits_default_target_object|hsc_object_and_staticlib_succeed_without_clang|hsc_optimization_levels_build_all_artifact_types|hsc_native_object_emission_skips_clang_backend|hsc_pgo_instrument_and_use)$' -P cmake/RunQuietTests.cmake
          cmake -DBUILD_DIR=build-release '-DTEST_REGEX=^(hsc_debug_info_gdb|hsc_emits_target_object|hsc_c_abi_object_native_to_hsc|hsc_c_abi_object_hsc_to_native|hsc_c_abi_staticlib_native_to_hsc|hsc_rejects_multifile_object_output|hsc_rejects_object_with_llvm_ir_action|hsc_reports_missing_llvm_ar|hsc_mixed_.*|hsc_cxx_staticlib_calls_hsc|hsc_cargo_.*|hsc_checked_runtime_source_locations|hsc_runtime_source_location_ir_policy)$' -P cmake/RunQuietTests.cmake
          cmake -DBUILD_DIR=build-release '-DTEST_REGEX=^hsc_t8_.*$' \
            -P cmake/RunQuietTests.cmake

      - name: Verify native preprocessor macro
        shell: bash
        run: |
          printf '$ifndef %s\n$error "wrong native architecture macro"\n$endif\nfunc main() { return 0 }\n' \
            "${{ matrix.predefined_macro }}" > "$RUNNER_TEMP/native-architecture.hs"
          ./build-release/hsc -E "$RUNNER_TEMP/native-architecture.hs" >/dev/null

      - name: Build relocatable tar and DEB
        shell: bash
        run: |
          mkdir -p dist
          package_name="hitsimple-${HITSIMPLE_VERSION}-linux-${{ matrix.architecture }}"
          package_root="$PWD/dist/$package_name"
          cmake --install build-release --prefix "$package_root" --strip

          file "$package_root/bin/hsc" | grep -F "${{ matrix.file_pattern }}"
          test -f "$package_root/lib/hitsimple/libhitsimple_runtime.a"
          test -f "$package_root/share/hitsimple/runtime/hitsimple_runtime.c"
          test -f "$package_root/share/hitsimple/runtime/hitsimple_f128_native.c"
          "$package_root/bin/hsc" --version | grep -Fx "hsc $HITSIMPLE_VERSION"

          smoke_root="$RUNNER_TEMP/hitsimple-package-smoke"
          mkdir -p "$smoke_root"
          cp examples/hello.hs "$smoke_root/hello.hs"
          cp tests/cases/run/f16_f128_fallback.hs "$smoke_root/f128.hs"
          cp tests/cases/run/f128_format_scan.hs "$smoke_root/f128-format-scan.hs"
          cp tests/cases/run/ctype_reference.hs "$smoke_root/ctype-reference.hs"
          (
            cd "$smoke_root"
            "$package_root/bin/hsc" hello.hs -o hello
            ./hello | grep -Fx 42
            "$package_root/bin/hsc" f128.hs -o f128
            ./f128
            "$package_root/bin/hsc" f128-format-scan.hs -o f128-format-scan
            printf '1.5\n' | ./f128-format-scan | grep -Fx 1.5
            "$package_root/bin/hsc" --stdlib-provider=reference --checked \
              ctype-reference.hs -o ctype-reference
            ./ctype-reference
          )

          tar -C "$PWD/dist" -czf "$PWD/dist/${package_name}.tar.gz" "$package_name"
          rm -rf "$package_root"
          cpack --config build-release/CPackConfig.cmake -G DEB -B dist
          test -f "dist/hitsimple_${HITSIMPLE_VERSION}_${{ matrix.deb_architecture }}.deb"

      - name: Install, run and remove DEB
        shell: bash
        run: |
          package="$PWD/dist/hitsimple_${HITSIMPLE_VERSION}_${{ matrix.deb_architecture }}.deb"
          sudo apt-get install -y "$package"
          dpkg-query -W -f='${Architecture} ${Version}\n' hitsimple | \
            grep -Fx "${{ matrix.deb_architecture }} $HITSIMPLE_VERSION"
          test -x /usr/bin/hsc
          test -x /usr/libexec/hitsimple/hsc_mcpp
          test -f /usr/lib/hitsimple/libhitsimple_runtime.a
          test -d /usr/share/hitsimple/stdlib
          /usr/bin/hsc examples/hello.hs -o "$RUNNER_TEMP/deb-hello"
          "$RUNNER_TEMP/deb-hello" | grep -Fx 42
          /usr/bin/hsc tests/cases/run/f16_f128_fallback.hs -o "$RUNNER_TEMP/deb-f128"
          "$RUNNER_TEMP/deb-f128"
          /usr/bin/hsc tests/cases/run/f128_format_scan.hs -o "$RUNNER_TEMP/deb-f128-format-scan"
          printf '1.5\n' | "$RUNNER_TEMP/deb-f128-format-scan" | grep -Fx 1.5
          /usr/bin/hsc --stdlib-provider=reference --checked \
            tests/cases/run/ctype_reference.hs -o "$RUNNER_TEMP/deb-ctype-reference"
          "$RUNNER_TEMP/deb-ctype-reference"
          sudo apt-get remove -y hitsimple
          test ! -e /usr/bin/hsc
          test ! -e /usr/libexec/hitsimple/hsc_mcpp
          test ! -e /usr/lib/hitsimple/libhitsimple_runtime.a
          test ! -e /usr/share/hitsimple/stdlib

      - uses: actions/upload-artifact@v4
        with:
          name: hitsimple-linux-${{ matrix.architecture }}
          path: |
            dist/hitsimple-${{ env.HITSIMPLE_VERSION }}-linux-${{ matrix.architecture }}.tar.gz
            dist/hitsimple_${{ env.HITSIMPLE_VERSION }}_${{ matrix.deb_architecture }}.deb
          if-no-files-found: error

  deb_compatibility:
    name: DEB ${{ matrix.image }} ${{ matrix.architecture }}
    if: github.event_name == 'push' || inputs.scope != 'windows'
    needs: linux
    strategy:
      fail-fast: false
      matrix:
        image: [ubuntu:22.04, ubuntu:24.04, debian:12, debian:13]
        architecture: [amd64, arm64]
        include:
          - architecture: amd64
            runner: ubuntu-24.04
            artifact: hitsimple-linux-x86_64
          - architecture: arm64
            runner: ubuntu-24.04-arm
            artifact: hitsimple-linux-aarch64
    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: deb-artifact

      - name: Remove pre-existing containers
        shell: bash
        run: |
          container_ids="$(docker ps -aq)"
          if [[ -n "$container_ids" ]]; then
            docker rm -f $container_ids
          fi

      - name: Install and remove in clean distribution container
        shell: bash
        env:
          IMAGE: ${{ matrix.image }}
          EXPECTED_ARCH: ${{ matrix.architecture }}
        run: |
          package="$(find "$PWD/deb-artifact" -maxdepth 1 -name '*.deb' -print -quit)"
          test -n "$package"
          for attempt in 1 2 3; do
            if docker pull "$IMAGE"; then
              break
            fi
            if [[ "$attempt" == 3 ]]; then
              exit 1
            fi
            sleep $((attempt * 5))
          done
          docker run --rm \
            -e EXPECTED_ARCH \
            -v "$PWD:/src:ro" \
            -v "$package:/tmp/hitsimple.deb:ro" \
            "$IMAGE" bash -euxo pipefail -c '
              export DEBIAN_FRONTEND=noninteractive
              test "$(dpkg --print-architecture)" = "$EXPECTED_ARCH"
              apt-get update
              apt-get install -y ca-certificates curl gnupg
              . /etc/os-release
              case "$ID:$VERSION_ID" in
                ubuntu:22.04) llvm_suite=jammy ;;
                debian:12) llvm_suite=bookworm ;;
                *) llvm_suite= ;;
              esac
              if [ -n "$llvm_suite" ]; then
                install -d -m 0755 /etc/apt/keyrings
                curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key > /etc/apt/keyrings/apt.llvm.org.asc
                echo "deb [signed-by=/etc/apt/keyrings/apt.llvm.org.asc] https://apt.llvm.org/$llvm_suite/ llvm-toolchain-$llvm_suite-18 main" > /etc/apt/sources.list.d/llvm-18.list
                apt-get update
              fi
              apt-get install -y /tmp/hitsimple.deb
              clang-18 --version
              cd /tmp
              /usr/bin/hsc /src/examples/hello.hs -o hello
              ./hello | grep -Fx 42
              /usr/bin/hsc /src/tests/cases/run/f16_f128_fallback.hs -o f128
              ./f128
              /usr/bin/hsc /src/tests/cases/run/f128_format_scan.hs -o f128-format-scan
              printf "1.5\\n" | ./f128-format-scan | grep -Fx 1.5
              /usr/bin/hsc --stdlib-provider=reference --checked \
                /src/tests/cases/run/ctype_reference.hs -o ctype-reference
              ./ctype-reference
              apt-get remove -y hitsimple
              test ! -e /usr/bin/hsc
              test ! -e /usr/libexec/hitsimple/hsc_mcpp
              test ! -e /usr/lib/hitsimple/libhitsimple_runtime.a
              test ! -e /usr/share/hitsimple/stdlib
            '

  macos:
    name: macOS ${{ matrix.architecture }}
    if: github.event_name == 'push' || inputs.scope != 'windows'
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-15
            architecture: arm64
            host_machine: arm64
            file_pattern: arm64
          - runner: macos-15-intel
            architecture: x86_64
            host_machine: x86_64
            file_pattern: x86_64
    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@v4

      - name: Resolve version
        env:
          REQUESTED_VERSION: ${{ inputs.version }}
        shell: bash
        run: |
          if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
            [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
            version="${GITHUB_REF_NAME#v}"
          elif [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
            version="$REQUESTED_VERSION"
          else
            version="$(sed -n 's/^  VERSION \([0-9.]*\)$/\1/p' CMakeLists.txt)"
          fi
          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
          test "$version" = "$(sed -n 's/^  VERSION \([0-9.]*\)$/\1/p' CMakeLists.txt)"
          echo "HITSIMPLE_VERSION=$version" >> "$GITHUB_ENV"

      - name: Install build dependencies
        shell: bash
        run: |
          brew install llvm@18 bison re2c boost ninja
          echo "$(brew --prefix llvm@18)/bin" >> "$GITHUB_PATH"
          echo "$(brew --prefix bison)/bin" >> "$GITHUB_PATH"

      - name: Configure and build
        shell: bash
        run: |
          llvm_prefix="$(brew --prefix llvm@18)"
          bison_prefix="$(brew --prefix bison)"
          boost_prefix="$(brew --prefix boost)"
          boost_license="$PWD/third_party/licenses/Boost-Software-License-1.0.txt"
          host_clang="$(xcrun --find clang)"
          host_clangxx="$(xcrun --find clang++)"
          test -x "$llvm_prefix/bin/clang"
          test -x "$llvm_prefix/bin/clang++"
          test -f "$boost_license"
          test -x "$host_clang"
          test -x "$host_clangxx"
          export PATH="$llvm_prefix/bin:$bison_prefix/bin:$PATH"
          cmake -S . -B build-macos -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_C_COMPILER="$host_clang" \
            -DCMAKE_CXX_COMPILER="$host_clangxx" \
            -DLLVM_DIR="$llvm_prefix/lib/cmake/llvm" \
            -DBoost_ROOT="$boost_prefix" \
            -DHITSIMPLE_BOOST_LICENSE="$boost_license" \
            -DBUILD_TESTING=ON
          cmake --build build-macos --parallel

      - name: Run macOS regression suite and ABI checks
        shell: bash
        run: |
          test "$(uname -m)" = "${{ matrix.host_machine }}"
          ./build-macos/hsc --version | grep -Fx "hsc $HITSIMPLE_VERSION"
          ./build-macos/hsc --target-info | tee target-info.txt
          grep -E -x "target.triple: ${{ matrix.host_machine }}-apple-.*" target-info.txt
          grep -Fx 'f128.backend: boost.cpp_bin_float.113-bit-software-binary128' target-info.txt
          grep -Fx 'stdlib.provider.selection: optimized is the default; reference uses a manifest-declared reference implementation when available and otherwise keeps the default provider' target-info.txt
          grep -Fx 'stdlib.provider.dispatch: provider selection is compile-time and does not change the public View contract or safety mode' target-info.txt
          cmake -DBUILD_DIR=build-macos -P cmake/RunQuietTests.cmake
          for mode in --unchecked --static-checked --checked; do
            output="$RUNNER_TEMP/hello-${mode#--}"
            ./build-macos/hsc "$mode" examples/hello.hs -o "$output"
            "$output" | grep -Fx 42
          done
          ./build-macos/hsc --c-compat tests/cases/compat/c_unsigned_integer.c \
            -o "$RUNNER_TEMP/c-scalar"
          "$RUNNER_TEMP/c-scalar"
          if aggregate_output="$(./build-macos/hsc --c-compat --emit-llvm \
              tests/cases/compat/c_aggregate_by_value.c 2>&1)"; then
            echo "Darwin C aggregate by-value ABI unexpectedly succeeded" >&2
            exit 1
          fi
          grep -Fq 'only supported for x86_64 SysV ELF' <<<"$aggregate_output"

      - name: Build and relocate macOS tar package
        shell: bash
        run: |
          llvm_prefix="$(brew --prefix llvm@18)"
          package_name="hitsimple-${HITSIMPLE_VERSION}-macos-${{ matrix.architecture }}"
          package_root="$PWD/dist/$package_name"
          mkdir -p dist
          cmake --install build-macos --prefix "$package_root" --strip
          file "$package_root/bin/hsc" | grep -F "${{ matrix.file_pattern }}"
          test -x "$package_root/libexec/hitsimple/hsc_mcpp"
          test -f "$package_root/lib/hitsimple/libhitsimple_runtime.a"
          test -d "$package_root/share/hitsimple/stdlib"
          tar -C dist -czf "dist/${package_name}.tar.gz" "$package_name"
          rm -rf "$package_root"

          smoke_root="$RUNNER_TEMP/hitsimple-macos-relocated"
          rm -rf "$smoke_root"
          mkdir -p "$smoke_root"
          tar -xzf "dist/${package_name}.tar.gz" -C "$smoke_root"
          cp examples/hello.hs "$smoke_root/hello.hs"
          cp tests/cases/run/f16_f128_fallback.hs "$smoke_root/f128.hs"
          cp tests/cases/run/f128_format_scan.hs "$smoke_root/f128-format-scan.hs"
          cp tests/cases/run/ctype_reference.hs "$smoke_root/ctype-reference.hs"
          (
            cd "$smoke_root"
            "./$package_name/bin/hsc" --target-info | \
              grep -Fx 'f128.backend: boost.cpp_bin_float.113-bit-software-binary128'
            "./$package_name/bin/hsc" --clang "$llvm_prefix/bin/clang" hello.hs
            ./a.out | grep -Fx 42
            "./$package_name/bin/hsc" --clang "$llvm_prefix/bin/clang" \
              --checked hello.hs -o hello-checked
            ./hello-checked | grep -Fx 42
            "./$package_name/bin/hsc" --clang "$llvm_prefix/bin/clang" f128.hs -o f128
            ./f128
            "./$package_name/bin/hsc" --clang "$llvm_prefix/bin/clang" \
              f128-format-scan.hs -o f128-format-scan
            printf '1.5\n' | ./f128-format-scan | grep -Fx 1.5
            "./$package_name/bin/hsc" --clang "$llvm_prefix/bin/clang" \
              --stdlib-provider=reference --checked ctype-reference.hs \
              -o ctype-reference
            ./ctype-reference
          )

      - uses: actions/upload-artifact@v4
        with:
          name: hitsimple-macos-${{ matrix.architecture }}
          path: dist/hitsimple-${{ env.HITSIMPLE_VERSION }}-macos-${{ matrix.architecture }}.tar.gz
          if-no-files-found: error

  rpm:
    name: RPM ${{ matrix.distribution }} ${{ matrix.architecture }}
    if: github.event_name == 'push' || inputs.scope != 'windows'
    strategy:
      fail-fast: false
      matrix:
        include:
          - distribution: fedora44
            image: docker.io/library/fedora:44
            rpm_release: 1.fc44
            architecture: x86_64
            runner: ubuntu-24.04
          - distribution: fedora44
            image: docker.io/library/fedora:44
            rpm_release: 1.fc44
            architecture: aarch64
            runner: ubuntu-24.04-arm
          - distribution: el9
            image: docker.io/rockylinux/rockylinux:9
            rpm_release: 1.el9
            architecture: x86_64
            runner: ubuntu-24.04
          - distribution: el9
            image: docker.io/rockylinux/rockylinux:9
            rpm_release: 1.el9
            architecture: aarch64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@v4

      - name: Resolve version
        env:
          REQUESTED_VERSION: ${{ inputs.version }}
        shell: bash
        run: |
          if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
            [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
            version="${GITHUB_REF_NAME#v}"
          elif [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
            version="$REQUESTED_VERSION"
          else
            version="$(sed -n 's/^  VERSION \([0-9.]*\)$/\1/p' CMakeLists.txt)"
          fi
          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
          test "$version" = "$(sed -n 's/^  VERSION \([0-9.]*\)$/\1/p' CMakeLists.txt)"
          echo "HITSIMPLE_VERSION=$version" >> "$GITHUB_ENV"

      - name: Remove pre-existing containers
        shell: bash
        run: |
          container_ids="$(docker ps -aq)"
          if [[ -n "$container_ids" ]]; then
            docker rm -f $container_ids
          fi

      - name: Build and inspect RPM
        shell: bash
        env:
          IMAGE: ${{ matrix.image }}
          DISTRIBUTION: ${{ matrix.distribution }}
          RPM_RELEASE: ${{ matrix.rpm_release }}
          EXPECTED_ARCH: ${{ matrix.architecture }}
        run: |
          mkdir -p dist
          docker run --rm \
            -e HITSIMPLE_VERSION -e DISTRIBUTION -e RPM_RELEASE -e EXPECTED_ARCH \
            -v "$PWD:/src" -w /src "$IMAGE" bash -euxo pipefail -c '
              case "$DISTRIBUTION" in
                fedora44)
                  dnf install -y bison clang cmake file gcc-c++ libxml2-devel llvm-devel ninja-build re2c rpm-build zlib-devel
                  ;;
                el9)
                  dnfInstall() {
                    local attempt
                    for attempt in 1 2 3; do
                      if dnf --refresh install -y "$@"; then
                        return 0
                      fi
                      if [[ "$attempt" -lt 3 ]]; then
                        dnf clean all
                        rm -rf /var/cache/dnf
                        sleep 15
                      fi
                    done
                    return 1
                  }
                  dnfInstall epel-release
                  crb enable
                  dnfInstall bison clang cmake file gcc-c++ gcc-toolset-15-gcc-c++ libxml2-devel llvm-devel ninja-build re2c rpm-build zlib-devel
                  curl -fL --retry 3 -o /tmp/bison-3.8.2.tar.xz \
                    https://ftp.gnu.org/gnu/bison/bison-3.8.2.tar.xz
                  tar -C /tmp -xf /tmp/bison-3.8.2.tar.xz
                  pushd /tmp/bison-3.8.2
                  ./configure --prefix=/usr/local
                  make -j2
                  make install
                  popd
                  export PATH="/usr/local/bin:$PATH"
                  source /opt/rh/gcc-toolset-15/enable
                  test "$(bison --version | awk "NR == 1 { print \$NF }")" = 3.8.2
                  ;;
                *)
                  echo "unknown RPM distribution: $DISTRIBUTION" >&2
                  exit 1
                  ;;
              esac
              test "$(clang -dumpversion | cut -d. -f1)" -ge 18
              test "$HITSIMPLE_VERSION" = "$(sed -n "s/^  VERSION \([0-9.]*\)$/\1/p" CMakeLists.txt)"
              cmake -S . -B "build-rpm-$DISTRIBUTION" -G Ninja \
                -DCMAKE_BUILD_TYPE=Release \
                -DLLVM_DIR="$(llvm-config --cmakedir)" \
                -DHITSIMPLE_RPM_RELEASE="$RPM_RELEASE" \
                -DBUILD_TESTING=OFF
              cmake --build "build-rpm-$DISTRIBUTION" --parallel
              if ldd "build-rpm-$DISTRIBUTION/hsc" | grep -q libLLVM; then
                echo "hsc must not dynamically depend on libLLVM" >&2
                exit 1
              fi
              cpack --config "build-rpm-$DISTRIBUTION/CPackConfig.cmake" -G RPM \
                -B "dist-rpm-$DISTRIBUTION"
              package="$(find "dist-rpm-$DISTRIBUTION" -maxdepth 1 -name "*.rpm" -print -quit)"
              test -n "$package"
              test "$(find "dist-rpm-$DISTRIBUTION" -maxdepth 1 -name "*.rpm" | wc -l)" -eq 1
              rpm -qp --qf "%{ARCH} %{RELEASE}\\n" "$package" | \
                grep -Fx "$EXPECTED_ARCH $RPM_RELEASE"
              rpm -qp --requires "$package" | grep -Fx "clang >= 18"
              rpm -qlp "$package" | \
                grep -Ex "/usr/lib(64)?/hitsimple/libhitsimple_runtime.a"
              cp "$package" "dist/$(basename "$package")"
            '

      - name: Install, run and remove RPM in a fresh container
        shell: bash
        env:
          IMAGE: ${{ matrix.image }}
          DISTRIBUTION: ${{ matrix.distribution }}
          RPM_RELEASE: ${{ matrix.rpm_release }}
          EXPECTED_ARCH: ${{ matrix.architecture }}
        run: |
          package="$PWD/dist/hitsimple-${HITSIMPLE_VERSION}-${RPM_RELEASE}.${EXPECTED_ARCH}.rpm"
          test -f "$package"
          docker run --rm \
            -e DISTRIBUTION -e HITSIMPLE_VERSION -e RPM_RELEASE -e EXPECTED_ARCH \
            -v "$PWD:/src:ro" -v "$package:/tmp/hitsimple.rpm:ro" \
            "$IMAGE" bash -euxo pipefail -c '
              case "$DISTRIBUTION" in
                fedora44|el9) dnf install -y clang ;;
                *) exit 1 ;;
              esac
              test "$(clang -dumpversion | cut -d. -f1)" -ge 18
              dnf install -y /tmp/hitsimple.rpm
              rpm -q --qf "%{ARCH} %{VERSION} %{RELEASE}\\n" hitsimple | \
                grep -Fx "$EXPECTED_ARCH $HITSIMPLE_VERSION $RPM_RELEASE"
              /usr/bin/hsc --version | grep -Fx "hsc $HITSIMPLE_VERSION"
              /usr/bin/hsc --target-info | tee /tmp/target-info.txt
              grep -E -x "runtime.path: /usr/lib(64)?/hitsimple/libhitsimple_runtime.a" /tmp/target-info.txt
              grep -Fx "f128.backend: native.fp128" /tmp/target-info.txt
              cd /tmp
              /usr/bin/hsc /src/examples/hello.hs -o hello
              ./hello | grep -Fx 42
              /usr/bin/hsc --checked /src/examples/hello.hs -o hello-checked
              ./hello-checked | grep -Fx 42
              /usr/bin/hsc /src/tests/cases/run/f16_f128_fallback.hs -o f128
              ./f128
              /usr/bin/hsc /src/tests/cases/run/f128_format_scan.hs -o f128-format-scan
              printf "1.5\\n" | ./f128-format-scan | grep -Fx 1.5
              /usr/bin/hsc --stdlib-provider=reference --checked \
                /src/tests/cases/run/ctype_reference.hs -o ctype-reference
              ./ctype-reference
              dnf remove -y hitsimple
              test ! -e /usr/bin/hsc
              test ! -e /usr/libexec/hitsimple/hsc_mcpp
              test ! -e /usr/lib/hitsimple/libhitsimple_runtime.a
              test ! -e /usr/lib64/hitsimple/libhitsimple_runtime.a
              test ! -e /usr/share/hitsimple/stdlib
            '

      - uses: actions/upload-artifact@v4
        with:
          name: hitsimple-rpm-${{ matrix.distribution }}-${{ matrix.architecture }}
          path: dist/hitsimple-${{ env.HITSIMPLE_VERSION }}-${{ matrix.rpm_release }}.${{ matrix.architecture }}.rpm
          if-no-files-found: error

  windows:
    name: Windows x64 compiler
    runs-on: windows-2022

    steps:
      - uses: actions/checkout@v4
      - uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: x64
          toolset: 14.29

      - name: Resolve version
        shell: pwsh
        env:
          REQUESTED_VERSION: ${{ inputs.version }}
        run: |
          if ($env:GITHUB_EVENT_NAME -eq "push") {
            if ($env:GITHUB_REF_NAME -notmatch '^v[0-9]+\.[0-9]+\.[0-9]+$') { throw "invalid tag" }
            $version = $env:GITHUB_REF_NAME.Substring(1)
          } elseif ($env:GITHUB_EVENT_NAME -eq "workflow_dispatch") {
            $version = $env:REQUESTED_VERSION
          } else {
            $version = ((Select-String -Path CMakeLists.txt -Pattern '^  VERSION ([0-9.]+)$').Matches[0].Groups[1].Value)
          }
          if ($version -notmatch '^[0-9]+\.[0-9]+\.[0-9]+$') { throw "invalid version" }
          "HITSIMPLE_VERSION=$version" | Out-File -FilePath $env:GITHUB_ENV -Append

      - name: Install build tools
        shell: pwsh
        run: choco install re2c ninja -y --no-progress

      - name: Download pinned LLVM, llvm-mingw and Boost
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force tools | Out-Null
          curl.exe -fL --retry 3 -o tools/llvm-sdk.tar.xz https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.8/clang%2Bllvm-18.1.8-x86_64-pc-windows-msvc.tar.xz
          & 7z.exe x tools/llvm-sdk.tar.xz -otools -y
          tar.exe -xf tools/llvm-sdk.tar -C tools
          Remove-Item tools/llvm-sdk.tar
          curl.exe -fL --retry 3 -o tools/llvm-mingw.zip https://github.com/mstorsjo/llvm-mingw/releases/download/20240619/llvm-mingw-20240619-ucrt-x86_64.zip
          & 7z.exe x tools/llvm-mingw.zip -otools -y
          curl.exe -fL --retry 3 -o tools/boost.tar.bz2 https://archives.boost.io/release/1.85.0/source/boost_1_85_0.tar.bz2
          & 7z.exe x tools/boost.tar.bz2 -otools -y
          tar.exe -xf tools/boost.tar -C tools
          Remove-Item tools/boost.tar
          curl.exe -fL --retry 3 -o tools/win_flex_bison.zip https://github.com/lexxmark/winflexbison/releases/download/v2.5.25/win_flex_bison-2.5.25.zip
          & 7z.exe x tools/win_flex_bison.zip -otools/win_flex_bison -y

      - name: Build Windows target runtime with llvm-mingw
        shell: pwsh
        run: |
          $mingw = (Resolve-Path tools/llvm-mingw-20240619-ucrt-x86_64).Path
          $boost = (Resolve-Path tools/boost_1_85_0).Path
          New-Item -ItemType Directory -Force build-runtime | Out-Null
          & "$mingw/bin/x86_64-w64-mingw32-clang.exe" -std=c17 -O2 -Wall -Wextra -c runtime/hitsimple_runtime.c -o build-runtime/hitsimple_runtime.o
          & "$mingw/bin/x86_64-w64-mingw32-clang++.exe" -std=c++20 -O2 -Wall -Wextra "-I$boost" -c runtime/hitsimple_f128.cpp -o build-runtime/hitsimple_f128.o
          & "$mingw/bin/x86_64-w64-mingw32-llvm-ar.exe" rcs build-runtime/libhitsimple_runtime.a build-runtime/hitsimple_runtime.o build-runtime/hitsimple_f128.o
          & "$mingw/bin/x86_64-w64-mingw32-clang++.exe" -std=c++20 tests/runtime/F128RuntimeTests.cpp build-runtime/libhitsimple_runtime.a -static-libgcc -static-libstdc++ -o build-runtime/f128-runtime-tests.exe
          & build-runtime/f128-runtime-tests.exe

      - name: Configure and build compiler
        shell: pwsh
        run: |
          $llvm = (Resolve-Path tools/clang+llvm-18.1.8-x86_64-pc-windows-msvc).Path
          $boost = (Resolve-Path tools/boost_1_85_0).Path
          $runtime = (Resolve-Path build-runtime/libhitsimple_runtime.a).Path
          $dia = Join-Path $env:VSINSTALLDIR 'DIA SDK/lib/amd64/diaguids.lib'
          if (-not (Test-Path $dia)) { throw "missing DIA SDK library: $dia" }
          $oldDia = 'C:/Program Files (x86)/Microsoft Visual Studio/2019/Professional/DIA SDK/lib/amd64/diaguids.lib'
          $newDia = $dia.Replace('\', '/')
          $cmakeFiles = @(Get-ChildItem "$llvm/lib/cmake" -Filter '*.cmake' -Recurse | Where-Object {
            [IO.File]::ReadAllText($_.FullName).Contains($oldDia)
          })
          if ($cmakeFiles.Count -eq 0) { throw 'LLVM CMake exports did not contain the expected LLVM 18 DIA SDK path' }
          $cmakeFiles | ForEach-Object {
            $content = [IO.File]::ReadAllText($_.FullName)
            $updated = $content.Replace($oldDia, $newDia)
            [IO.File]::WriteAllText($_.FullName, $updated)
          }
          $env:PATH = "$llvm/bin;$env:PATH"
          $bison = (Resolve-Path tools/win_flex_bison/win_bison.exe).Path
          $re2c = (Get-Command re2c.exe).Source
          cmake -S . -B build-windows -G Ninja `
            -DCMAKE_BUILD_TYPE=Release `
            "-DCMAKE_C_COMPILER=$llvm/bin/clang-cl.exe" `
            "-DCMAKE_CXX_COMPILER=$llvm/bin/clang-cl.exe" `
            "-DLLVM_DIR=$llvm/lib/cmake/llvm" `
            "-DBISON_EXECUTABLE=$bison" `
            "-DRE2C_EXECUTABLE=$re2c" `
            "-DHITSIMPLE_PREBUILT_RUNTIME_LIBRARY=$runtime" `
            "-DHITSIMPLE_BOOST_LICENSE=$boost/LICENSE_1_0.txt" `
            "-DHITSIMPLE_LLVM_LICENSE=$llvm/LICENSE.TXT" `
            -DBUILD_TESTING=ON
          cmake --build build-windows --parallel

      - name: Run Windows unit and portable CLI tests
        shell: pwsh
        run: |
          $llvm = (Resolve-Path tools/clang+llvm-18.1.8-x86_64-pc-windows-msvc).Path
          & build-windows/hsc_unit_tests.exe
          $unitExitCode = $LASTEXITCODE
          if ($unitExitCode -ne 0) {
            throw "Windows unit tests failed with exit code $unitExitCode"
          }
          $mingwC = (Resolve-Path tools/llvm-mingw-20240619-ucrt-x86_64/bin/clang.exe).Path
          $mingwClang = (Resolve-Path tools/llvm-mingw-20240619-ucrt-x86_64/bin/clang++.exe).Path
          & build-windows/hsc.exe --version | Select-String -SimpleMatch "hsc $env:HITSIMPLE_VERSION"
          & build-windows/hsc.exe --target-info | Tee-Object -FilePath target-info.txt
          Select-String -Path target-info.txt -SimpleMatch 'target.triple: x86_64-w64-windows-gnu'
          Select-String -Path target-info.txt -SimpleMatch 'f128.backend: boost.cpp_bin_float.113-bit-software-binary128'
          Select-String -Path target-info.txt -SimpleMatch 'stdlib.provider.selection: optimized is the default; reference uses a manifest-declared reference implementation when available and otherwise keeps the default provider'
          Select-String -Path target-info.txt -SimpleMatch 'stdlib.provider.dispatch: provider selection is compile-time and does not change the public View contract or safety mode'
          & build-windows/hsc.exe --clang $mingwClang --unchecked examples/hello.hs -o hello-unchecked.exe
          & ./hello-unchecked.exe | Select-String -SimpleMatch '42'
          & build-windows/hsc.exe --clang $mingwClang --static-checked examples/hello.hs -o hello-static.exe
          & ./hello-static.exe | Select-String -SimpleMatch '42'
          & build-windows/hsc.exe --clang $mingwClang --checked examples/hello.hs -o hello-checked.exe
          & ./hello-checked.exe | Select-String -SimpleMatch '42'
          & build-windows/hsc.exe --clang $mingwClang --stdlib-provider=reference --checked tests/cases/run/ctype_reference.hs -o ctype-reference.exe
          & ./ctype-reference.exe
          if ($LASTEXITCODE -ne 0) { throw "Windows reference provider smoke failed with exit code $LASTEXITCODE" }
          & build-windows/hsc.exe --clang $mingwClang --checked tests/cases/run/f128_format_scan.hs -o f128-format-scan.exe
          $f128FormatOutput = "1.5" | & ./f128-format-scan.exe 2>&1
          $f128FormatExitCode = $LASTEXITCODE
          if ($f128FormatExitCode -ne 0 -or "$f128FormatOutput" -notmatch '(?m)^1\.5\r?$') {
            throw "Windows f128 format/scan smoke failed with exit code ${f128FormatExitCode}: $f128FormatOutput"
          }
          & build-windows/hsc.exe --clang $mingwClang --checked tests/cases/run/checked_memcpy_bounds.hs -o checked-memcpy-bounds.exe
          $boundsOutput = "2" | & ./checked-memcpy-bounds.exe 2>&1
          if ($LASTEXITCODE -eq 0 -or "$boundsOutput" -notmatch 'hitsimple runtime error: invalid memcpy destination range at .*checked_memcpy_bounds\.hs:8:26') {
            throw "Windows checked memcpy bounds did not fail as required: $boundsOutput"
          }
          & build-windows/hsc.exe --clang $mingwClang --checked tests/cases/run/checked_double_free.hs -o checked-double-free.exe
          $doubleFreeOutput = & ./checked-double-free.exe 2>&1
          if ($LASTEXITCODE -eq 0 -or "$doubleFreeOutput" -notmatch 'hitsimple runtime error: double free at .*checked_double_free\.hs:6:5') {
            throw "Windows checked double free did not report its source location: $doubleFreeOutput"
          }
          & build-windows/hsc.exe --clang $mingwClang --checked tests/cases/run/checked_dynamic_scan_target.hs -o checked-dynamic-scan-target.exe
          $scanOutput = "x" | & ./checked-dynamic-scan-target.exe 2>&1
          if ($LASTEXITCODE -eq 0 -or "$scanOutput" -notmatch 'hitsimple runtime error: scan string target must leave room for a NUL terminator at .*checked_dynamic_scan_target\.hs:7:5') {
            throw "Windows checked scan target did not report its source location: $scanOutput"
          }
          & build-windows/hsc.exe --clang $mingwClang --checked tests/cases/run/checked_abs_minimum.hs -o checked-abs-minimum.exe
          $absOutput = "-128" | & ./checked-abs-minimum.exe 2>&1
          if ($LASTEXITCODE -eq 0 -or "$absOutput" -notmatch 'hitsimple runtime error: abs of minimum signed value at .*checked_abs_minimum\.hs:11:27') {
            throw "Windows checked abs minimum did not report its source location: $absOutput"
          }
          & build-windows/hsc.exe --clang $mingwClang --checked --emit-llvm tests/cases/run/checked_memcpy_bounds.hs -o checked-runtime-location.ll
          if (-not (Select-String -Path checked-runtime-location.ll -SimpleMatch '@hs_set_source_location' -Quiet)) {
            throw 'Windows checked LLVM IR omitted runtime source-location calls'
          }
          & build-windows/hsc.exe --clang $mingwClang --unchecked --emit-llvm tests/cases/run/checked_memcpy_bounds.hs -o unchecked-runtime-location.ll
          if (Select-String -Path unchecked-runtime-location.ll -SimpleMatch '@hs_set_source_location' -Quiet) {
            throw 'Windows unchecked LLVM IR unexpectedly includes runtime source-location calls'
          }
          & build-windows/hsc.exe --clang $mingwClang --static-checked --emit-llvm tests/cases/run/checked_memcpy_bounds.hs -o static-runtime-location.ll
          if (Select-String -Path static-runtime-location.ll -SimpleMatch '@hs_set_source_location' -Quiet) {
            throw 'Windows static-checked LLVM IR unexpectedly includes runtime source-location calls'
          }
          & build-windows/hsc.exe --clang $mingwClang --checked tests/cases/run/checked_memcpy_overlap.hs -o checked-memcpy-overlap.exe
          $overlapOutput = "1" | & ./checked-memcpy-overlap.exe 2>&1
          if ($LASTEXITCODE -eq 0 -or "$overlapOutput" -notmatch 'hitsimple runtime error: overlapping memcpy ranges') {
            throw "Windows checked memcpy overlap did not fail as required: $overlapOutput"
          }
          & build-windows/hsc.exe --clang $mingwClang -g tests/cases/run/debug_info.hs -o debug-info.exe
          if (-not (Test-Path debug-info.pdb)) { throw 'Windows debug build did not generate debug-info.pdb' }
          $pdbutil = (Resolve-Path "$llvm/bin/llvm-pdbutil.exe").Path
          $pdbSummary = & $pdbutil dump -summary debug-info.pdb 2>&1
          if ($LASTEXITCODE -ne 0 -or "$pdbSummary" -notmatch 'Age:') {
            throw "Windows PDB could not be inspected by llvm-pdbutil: $pdbSummary"
          }
          & build-windows/hsc.exe --clang C:/missing/clang.exe -g --emit-object tests/cases/run/debug_info.hs -o debug-info.obj
          if ($LASTEXITCODE -ne 0) { throw 'Windows direct debug object emission failed' }
          $readobj = (Resolve-Path "$llvm/bin/llvm-readobj.exe").Path
          $objectInfo = & $readobj --file-headers --sections --codeview debug-info.obj 2>&1
          if ($LASTEXITCODE -ne 0 -or "$objectInfo" -notmatch 'Format: COFF-x86-64' -or "$objectInfo" -notmatch '\.debug\$S') {
            throw "Windows direct object is missing COFF or CodeView debug information: $objectInfo"
          }
          & build-windows/hsc.exe --clang C:/missing/clang.exe --crate-type=staticlib tests/cases/interop/c_abi_export.hs -o hsc-export.lib
          if ($LASTEXITCODE -ne 0) { throw 'Windows direct staticlib emission failed' }
          $llvmAr = (Resolve-Path "$llvm/bin/llvm-ar.exe").Path
          $archiveMembers = & $llvmAr t hsc-export.lib 2>&1
          if ($LASTEXITCODE -ne 0 -or "$archiveMembers" -notmatch 'hitsimple_runtime') {
            throw "Windows staticlib is missing its runtime object: $archiveMembers"
          }
          & $mingwC tests/cases/interop/c_abi_export_caller.c hsc-export.lib build-runtime/libhitsimple_runtime.a -lm -o c-abi-staticlib.exe
          if ($LASTEXITCODE -ne 0) { throw 'Windows C ABI staticlib link failed' }
          & ./c-abi-staticlib.exe
          if ($LASTEXITCODE -ne 0) { throw 'Windows C ABI staticlib executable failed' }
          foreach ($optimization in @('-O0', '-O2', '-O3')) {
            $tag = $optimization.Substring(1)
            & build-windows/hsc.exe --clang $mingwClang $optimization examples/hello.hs -o "hello-$tag.exe"
            if ($LASTEXITCODE -ne 0) { throw "Windows $optimization executable build failed" }
            & "./hello-$tag.exe" | Select-String -SimpleMatch '42'
            if ($LASTEXITCODE -ne 0) { throw "Windows $optimization executable failed" }
            & build-windows/hsc.exe --clang C:/missing/clang.exe --emit-object $optimization examples/hello.hs -o "hello-$tag.obj"
            if ($LASTEXITCODE -ne 0) { throw "Windows $optimization object emission failed" }
            & build-windows/hsc.exe --clang C:/missing/clang.exe --crate-type=staticlib $optimization examples/hello.hs -o "hello-$tag.lib"
            if ($LASTEXITCODE -ne 0) { throw "Windows $optimization staticlib emission failed" }
          }
          & build-windows/hsc.exe --clang $mingwClang -O2 --pgo-instrument=windows.profraw tests/cases/run/pgo_hot.hs -o windows-pgo-instrument.exe
          if ($LASTEXITCODE -ne 0) { throw 'Windows PGO instrument build failed' }
          & ./windows-pgo-instrument.exe
          if ($LASTEXITCODE -ne 0 -or -not (Test-Path windows.profraw)) { throw 'Windows PGO instrument run did not create profile data' }
          $profdata = (Resolve-Path "$llvm/bin/llvm-profdata.exe").Path
          & $profdata merge -sparse windows.profraw -o windows.profdata
          if ($LASTEXITCODE -ne 0 -or -not (Test-Path windows.profdata)) { throw 'Windows PGO profile merge failed' }
          & build-windows/hsc.exe --clang $mingwClang -O2 --pgo-use=windows.profdata tests/cases/run/pgo_hot.hs -o windows-pgo-use.exe
          if ($LASTEXITCODE -ne 0) { throw 'Windows PGO use build failed' }
          & ./windows-pgo-use.exe
          if ($LASTEXITCODE -ne 0) { throw 'Windows PGO use executable failed' }
          $sanitizeOutput = & build-windows/hsc.exe --sanitize=address examples/hello.hs -o windows-asan.exe 2>&1
          if ($LASTEXITCODE -eq 0 -or "$sanitizeOutput" -notmatch 'support only Linux and macOS') {
            throw "Windows ASan rejection did not preserve the documented boundary: $sanitizeOutput"
          }
          & build-windows/hsc.exe --clang C:/missing/clang.exe --emit-llvm examples/hello.hs -o hello.ll
          if (-not (Test-Path hello.ll)) { throw '--emit-llvm unexpectedly required clang' }
          $aggregateOutput = & build-windows/hsc.exe --c-compat --emit-llvm tests/cases/compat/c_aggregate_by_value.c 2>&1
          $aggregateExitCode = $LASTEXITCODE
          if ($aggregateExitCode -eq 0 -or "$aggregateOutput" -notmatch 'only supported for x86_64 SysV ELF') {
            throw 'Windows C struct by-value ABI was not rejected'
          }
          $global:LASTEXITCODE = 0

      - name: Run portable Windows CTest cases
        shell: pwsh
        run: |
          cmake -DBUILD_DIR=build-windows '-DTEST_REGEX=^(hsc_help|hsc_version|hsc_target_info|hsc_dump_tokens|hsc_preprocess_only|hsc_emit_llvm|hsc_static_checked_emit_llvm)$' -P cmake/RunQuietTests.cmake

      - name: Assemble full and slim packages
        shell: pwsh
        run: |
          $version = $env:HITSIMPLE_VERSION
          $fullName = "hitsimple-$version-windows-x86_64-full"
          $slimName = "hitsimple-$version-windows-x86_64-slim"
          New-Item -ItemType Directory -Force "dist/$fullName", "dist/$slimName" | Out-Null
          cmake --install build-windows --prefix "dist/$fullName"
          cmake --install build-windows --prefix "dist/$slimName"
          Copy-Item tools/llvm-mingw-20240619-ucrt-x86_64 "dist/$fullName/toolchain" -Recurse

          $crt = Join-Path $env:VCToolsRedistDir 'x64/Microsoft.VC143.CRT'
          Get-ChildItem $crt -Filter '*.dll' | Copy-Item -Destination "dist/$fullName/bin"
          Get-ChildItem $crt -Filter '*.dll' | Copy-Item -Destination "dist/$slimName/bin"

          Compress-Archive -Path "dist/$fullName" -DestinationPath "dist/$fullName.zip" -CompressionLevel Optimal
          Compress-Archive -Path "dist/$slimName" -DestinationPath "dist/$slimName.zip" -CompressionLevel Optimal

      - name: Smoke full package from Unicode path without external toolchain
        shell: pwsh
        run: |
          $source = (Resolve-Path "dist/hitsimple-$env:HITSIMPLE_VERSION-windows-x86_64-full").Path
          $root = Join-Path $env:RUNNER_TEMP 'HitSimple 空格路径'
          Copy-Item $source $root -Recurse
          $savedPath = $env:PATH
          $env:PATH = "$env:SystemRoot/System32;$env:SystemRoot"
          $sourceRoot = Join-Path $root '源码 中文'
          New-Item -ItemType Directory -Force $sourceRoot | Out-Null
          Copy-Item "$env:GITHUB_WORKSPACE/examples/hello.hs" (Join-Path $sourceRoot '你好.hs')
          Copy-Item "$env:GITHUB_WORKSPACE/tests/cases/run/windows_f128_lowering.hs" (Join-Path $sourceRoot '四精度.hs')
          Copy-Item "$env:GITHUB_WORKSPACE/tests/cases/run/f128_format_scan.hs" (Join-Path $sourceRoot '格式.hs')
          Copy-Item "$env:GITHUB_WORKSPACE/tests/cases/run/ctype_reference.hs" (Join-Path $sourceRoot '字母.hs')
          Push-Location $root
          & bin/hsc.exe (Join-Path $sourceRoot '你好.hs') -o '输出 程序.exe'
          & '.\输出 程序.exe' | Select-String -SimpleMatch '42'
          & bin/hsc.exe (Join-Path $sourceRoot '你好.hs')
          if (-not (Test-Path a.exe)) { throw 'Windows default output a.exe was not created' }
          & .\a.exe | Select-String -SimpleMatch '42'
          & bin/hsc.exe (Join-Path $sourceRoot '四精度.hs') -o f128.exe
          $f128CompileExitCode = $LASTEXITCODE
          if ($f128CompileExitCode -ne 0) {
            throw "Full package f128 compilation failed with exit code $f128CompileExitCode"
          }
          & ./f128.exe
          $f128RunExitCode = $LASTEXITCODE
          if ($f128RunExitCode -ne 0) {
            throw "Full package f128 smoke failed with exit code $f128RunExitCode"
          }
          & bin/hsc.exe (Join-Path $sourceRoot '格式.hs') -o f128-format-scan.exe
          $f128FormatOutput = "1.5" | & ./f128-format-scan.exe 2>&1
          if ($LASTEXITCODE -ne 0 -or "$f128FormatOutput" -notmatch '(?m)^1\.5\r?$') {
            throw "Full package f128 format/scan smoke failed: $f128FormatOutput"
          }
          & bin/hsc.exe --stdlib-provider=reference --checked (Join-Path $sourceRoot '字母.hs') -o ctype-reference.exe
          & ./ctype-reference.exe
          if ($LASTEXITCODE -ne 0) { throw "Full package reference provider smoke failed with exit code $LASTEXITCODE" }
          Pop-Location
          $env:PATH = $savedPath

      - name: Smoke slim package toolchain selection and errors
        shell: pwsh
        run: |
          $slim = (Resolve-Path "dist/hitsimple-$env:HITSIMPLE_VERSION-windows-x86_64-slim").Path
          $clang = (Resolve-Path tools/llvm-mingw-20240619-ucrt-x86_64/bin/clang++.exe).Path
          & "$slim/bin/hsc.exe" --clang $clang examples/hello.hs -o slim-explicit.exe
          & ./slim-explicit.exe | Select-String -SimpleMatch '42'
          $env:HITSIMPLE_CLANG = $clang
          & "$slim/bin/hsc.exe" examples/hello.hs -o slim-env.exe
          & ./slim-env.exe | Select-String -SimpleMatch '42'
          & "$slim/bin/hsc.exe" --clang $clang --stdlib-provider=reference --checked tests/cases/run/ctype_reference.hs -o slim-ctype-reference.exe
          & ./slim-ctype-reference.exe
          if ($LASTEXITCODE -ne 0) { throw "Slim package reference provider smoke failed with exit code $LASTEXITCODE" }
          & "$slim/bin/hsc.exe" --clang $clang tests/cases/run/f128_format_scan.hs -o slim-f128-format-scan.exe
          $slimF128FormatOutput = "1.5" | & ./slim-f128-format-scan.exe 2>&1
          if ($LASTEXITCODE -ne 0 -or "$slimF128FormatOutput" -notmatch '(?m)^1\.5\r?$') {
            throw "Slim package f128 format/scan smoke failed: $slimF128FormatOutput"
          }
          Remove-Item Env:HITSIMPLE_CLANG
          $savedPath = $env:PATH
          $env:PATH = "$env:SystemRoot/System32;$env:SystemRoot"
          $output = & "$slim/bin/hsc.exe" examples/hello.hs -o missing.exe 2>&1
          $missingExitCode = $LASTEXITCODE
          if ($missingExitCode -eq 0 -or "$output" -notmatch 'no compatible Clang toolchain found') {
            throw 'missing toolchain diagnostic was not reported'
          }
          $global:LASTEXITCODE = 0
          $env:PATH = $savedPath

      - name: Audit DLL dependencies
        shell: pwsh
        run: |
          $objdump = (Resolve-Path tools/llvm-mingw-20240619-ucrt-x86_64/bin/llvm-objdump.exe).Path
          $executables = @(
            "dist/hitsimple-$env:HITSIMPLE_VERSION-windows-x86_64-full/bin/hsc.exe",
            "dist/hitsimple-$env:HITSIMPLE_VERSION-windows-x86_64-full/libexec/hitsimple/hsc_mcpp.exe",
            "dist/hitsimple-$env:HITSIMPLE_VERSION-windows-x86_64-slim/bin/hsc.exe",
            "dist/hitsimple-$env:HITSIMPLE_VERSION-windows-x86_64-slim/libexec/hitsimple/hsc_mcpp.exe",
            "hello-unchecked.exe",
            "build-runtime/f128-runtime-tests.exe",
            (Join-Path $env:RUNNER_TEMP 'HitSimple 空格路径/输出 程序.exe'),
            (Join-Path $env:RUNNER_TEMP 'HitSimple 空格路径/f128.exe'),
            "dist/hitsimple-$env:HITSIMPLE_VERSION-windows-x86_64-full/toolchain/bin/clang++.exe",
            "dist/hitsimple-$env:HITSIMPLE_VERSION-windows-x86_64-full/toolchain/bin/ld.lld.exe"
          )
          foreach ($exe in $executables) {
            $dependencies = & $objdump -p $exe | Select-String 'DLL Name'
            $dependencies | Out-Host
            if ("$dependencies" -match 'msys|cygwin|libstdc\+\+|libgcc_s|libwinpthread') {
              throw "unexpected runtime dependency in $exe"
            }
          }

      - uses: actions/upload-artifact@v4
        with:
          name: hitsimple-windows-x86_64
          path: dist/*.zip
          if-no-files-found: error

  extension:
    name: VS Code extension Linux x86_64
    if: github.event_name == 'push' || inputs.scope != 'windows'
    needs: linux
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-linux-x86_64
          path: compiler-asset

      - name: Resolve packaged compiler
        shell: bash
        run: |
          version="$(node -p "require('./vscode/hitsimple/package.json').version")"
          tar -xzf "compiler-asset/hitsimple-${version}-linux-x86_64.tar.gz" -C compiler-asset
          echo "HSC_PATH=$PWD/compiler-asset/hitsimple-${version}-linux-x86_64/bin/hsc" >> "$GITHUB_ENV"
          echo "HITSIMPLE_VERSION=$version" >> "$GITHUB_ENV"

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: vscode/hitsimple/package-lock.json

      - name: Test and package extension
        working-directory: vscode/hitsimple
        run: |
          sudo apt-get update
          sudo apt-get install -y gdb xvfb
          npm ci
          npm test
          xvfb-run -a npm run test:extension
          npm run verify:vsix
          mkdir -p dist
          npm run package:vsix
          test -f "dist/hitsimple-vscode-${HITSIMPLE_VERSION}.vsix"

      - uses: actions/upload-artifact@v4
        with:
          name: hitsimple-vscode
          path: vscode/hitsimple/dist/*.vsix
          if-no-files-found: error

  extension_linux_aarch64:
    name: VS Code extension Linux aarch64
    if: github.event_name == 'push' || inputs.scope != 'windows'
    needs: linux
    runs-on: ubuntu-24.04-arm

    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-linux-aarch64
          path: compiler-asset

      - name: Resolve packaged compiler
        shell: bash
        run: |
          version="$(node -p "require('./vscode/hitsimple/package.json').version")"
          tar -xzf "compiler-asset/hitsimple-${version}-linux-aarch64.tar.gz" -C compiler-asset
          echo "HSC_PATH=$PWD/compiler-asset/hitsimple-${version}-linux-aarch64/bin/hsc" >> "$GITHUB_ENV"

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: vscode/hitsimple/package-lock.json

      - name: Test extension with Linux aarch64 release compiler
        working-directory: vscode/hitsimple
        run: |
          sudo apt-get update
          sudo apt-get install -y gdb xvfb
          npm ci
          npm test
          xvfb-run -a npm run test:extension

  extension_macos:
    name: VS Code extension macOS ${{ matrix.architecture }}
    if: github.event_name == 'push' || inputs.scope != 'windows'
    needs: macos
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-15
            architecture: arm64
          - runner: macos-15-intel
            architecture: x86_64
    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-macos-${{ matrix.architecture }}
          path: compiler-asset

      - name: Resolve packaged compiler
        shell: bash
        run: |
          version="$(node -p "require('./vscode/hitsimple/package.json').version")"
          tar -xzf "compiler-asset/hitsimple-${version}-macos-${{ matrix.architecture }}.tar.gz" -C compiler-asset
          echo "HSC_PATH=$PWD/compiler-asset/hitsimple-${version}-macos-${{ matrix.architecture }}/bin/hsc" >> "$GITHUB_ENV"

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: vscode/hitsimple/package-lock.json

      - name: Test extension with macOS release compiler
        working-directory: vscode/hitsimple
        run: |
          brew install llvm@18
          xcrun --find lldb
          export HITSIMPLE_CLANG="$(brew --prefix llvm@18)/bin/clang"
          npm ci
          npm test
          npm run test:extension

  windows_extension:
    name: VS Code extension Windows
    needs: [windows, extension]
    if: always() && needs.windows.result == 'success' && (inputs.scope == 'windows' || needs.extension.result == 'success')
    runs-on: windows-2022

    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-windows-x86_64
          path: compiler-asset
      - uses: actions/download-artifact@v4
        if: inputs.scope != 'windows'
        with:
          name: hitsimple-vscode
          path: vsix-asset
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: vscode/hitsimple/package-lock.json

      - name: Test extension with Windows release compiler
        shell: pwsh
        env:
          VALIDATION_SCOPE: ${{ inputs.scope }}
        run: |
          $version = (Get-Content vscode/hitsimple/package.json | ConvertFrom-Json).version
          Expand-Archive "compiler-asset/hitsimple-$version-windows-x86_64-full.zip" -DestinationPath compiler -Force
          $env:HSC_PATH = (Resolve-Path "compiler/hitsimple-$version-windows-x86_64-full/bin/hsc.exe").Path
          Push-Location vscode/hitsimple
          npm ci
          npm test
          npm run test:extension
          npm run verify:vsix
          New-Item -ItemType Directory -Force dist | Out-Null
          npm run package:vsix
          if (-not (Test-Path "dist/hitsimple-vscode-$version.vsix")) { throw 'missing Windows-built VSIX' }
          Pop-Location
          if ($env:VALIDATION_SCOPE -ne 'windows' -and -not (Test-Path "vsix-asset/hitsimple-vscode-$version.vsix")) {
            throw 'missing release VSIX'
          }

  assemble:
    name: Assemble release assets
    if: github.event_name == 'push' || inputs.scope != 'windows'
    needs: [linux, deb_compatibility, macos, rpm, windows, extension, extension_linux_aarch64, extension_macos, windows_extension]
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@v4
      - name: Resolve version
        env:
          REQUESTED_VERSION: ${{ inputs.version }}
        shell: bash
        run: |
          if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
            version="${GITHUB_REF_NAME#v}"
          elif [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
            version="$REQUESTED_VERSION"
          else
            version="$(sed -n 's/^  VERSION \([0-9.]*\)$/\1/p' CMakeLists.txt)"
          fi
          echo "HITSIMPLE_VERSION=$version" >> "$GITHUB_ENV"

      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-linux-x86_64
          path: release-bundle/assets
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-linux-aarch64
          path: release-bundle/assets
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-macos-arm64
          path: release-bundle/assets
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-macos-x86_64
          path: release-bundle/assets
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-rpm-fedora44-x86_64
          path: release-bundle/assets
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-rpm-fedora44-aarch64
          path: release-bundle/assets
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-rpm-el9-x86_64
          path: release-bundle/assets
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-rpm-el9-aarch64
          path: release-bundle/assets
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-windows-x86_64
          path: release-bundle/assets
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-vscode
          path: release-bundle/assets

      - name: Create and verify release bundle
        shell: bash
        run: |
          cd release-bundle/assets
          printf '%s\n' \
            "hitsimple-${HITSIMPLE_VERSION}-linux-aarch64.tar.gz" \
            "hitsimple-${HITSIMPLE_VERSION}-linux-x86_64.tar.gz" \
            "hitsimple-${HITSIMPLE_VERSION}-macos-arm64.tar.gz" \
            "hitsimple-${HITSIMPLE_VERSION}-macos-x86_64.tar.gz" \
            "hitsimple_${HITSIMPLE_VERSION}_amd64.deb" \
            "hitsimple_${HITSIMPLE_VERSION}_arm64.deb" \
            "hitsimple-${HITSIMPLE_VERSION}-1.fc44.aarch64.rpm" \
            "hitsimple-${HITSIMPLE_VERSION}-1.fc44.x86_64.rpm" \
            "hitsimple-${HITSIMPLE_VERSION}-1.el9.aarch64.rpm" \
            "hitsimple-${HITSIMPLE_VERSION}-1.el9.x86_64.rpm" \
            "hitsimple-${HITSIMPLE_VERSION}-windows-x86_64-full.zip" \
            "hitsimple-${HITSIMPLE_VERSION}-windows-x86_64-slim.zip" \
            "hitsimple-vscode-${HITSIMPLE_VERSION}.vsix" \
            | sort > "$RUNNER_TEMP/expected-assets"
          find . -maxdepth 1 -type f -printf '%f\n' | sort > "$RUNNER_TEMP/actual-assets"
          diff -u "$RUNNER_TEMP/expected-assets" "$RUNNER_TEMP/actual-assets"

          sha256sum $(cat "$RUNNER_TEMP/expected-assets") > SHA256SUMS
          sha256sum -c SHA256SUMS
          printf '%s\n' SHA256SUMS $(cat "$RUNNER_TEMP/expected-assets") | \
            sort > "$RUNNER_TEMP/expected-assets-with-sums"
          find . -maxdepth 1 -type f -printf '%f\n' | sort > "$RUNNER_TEMP/actual-assets"
          diff -u "$RUNNER_TEMP/expected-assets-with-sums" "$RUNNER_TEMP/actual-assets"

          cat > ../release-notes.txt <<EOF
          HitSimple ${HITSIMPLE_VERSION} is a beta release.

          Highlights:
          - The compiler now runs the LLVM optimization pipeline and emits native object files through a unified TargetMachine, without a temporary LLVM IR round trip.
          - Direct object and static-library emission no longer require Clang; Clang remains the linker driver and is used for external C or C++ sources.
          - GitHub-hosted Linux, macOS, and Windows validation now covers native object emission, sanitizer and PGO paths, debug metadata, and C ABI interoperability.
          - Native AArch64 performance baselines and regression gates cover nine representative workloads with reproducible artifacts.
          - Release assets include Linux tarballs and DEBs, macOS tarballs, Fedora 44 and EL9 RPMs, Windows full/slim ZIPs, the VS Code extension VSIX, and SHA256SUMS.
          - The Windows full package bundles llvm-mingw. Slim and macOS packages require a Clang 18 toolchain matching their embedded LLVM; RPM packages require the matching system Clang major.

          C compatibility struct-by-value ABI remains limited to supported x86_64 SysV ELF layouts. Windows and Darwin reject that ABI explicitly.
          EOF

      - uses: actions/upload-artifact@v4
        with:
          name: hitsimple-release-bundle
          path: release-bundle
          if-no-files-found: error
          retention-days: 7

  release:
    name: Publish GitHub Release
    if: github.event_name == 'push'
    permissions:
      contents: write
    needs: assemble
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/download-artifact@v4
        with:
          name: hitsimple-release-bundle
          path: release-bundle

      - name: Create draft release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            test "$(gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --json isDraft --jq .isDraft)" = true
            gh release delete "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --yes
          fi
          gh release create "$GITHUB_REF_NAME" release-bundle/assets/* \
            --repo "$GITHUB_REPOSITORY" \
            --verify-tag \
            --title "HitSimple $GITHUB_REF_NAME" \
            --notes-file release-bundle/release-notes.txt \
            --draft

      - name: Verify draft assets and hashes
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          test "$(gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --json isDraft --jq .isDraft)" = true
          version="${GITHUB_REF_NAME#v}"
          printf '%s\n' SHA256SUMS \
            "hitsimple-${version}-linux-aarch64.tar.gz" \
            "hitsimple-${version}-linux-x86_64.tar.gz" \
            "hitsimple-${version}-macos-arm64.tar.gz" \
            "hitsimple-${version}-macos-x86_64.tar.gz" \
            "hitsimple_${version}_amd64.deb" \
            "hitsimple_${version}_arm64.deb" \
            "hitsimple-${version}-1.fc44.aarch64.rpm" \
            "hitsimple-${version}-1.fc44.x86_64.rpm" \
            "hitsimple-${version}-1.el9.aarch64.rpm" \
            "hitsimple-${version}-1.el9.x86_64.rpm" \
            "hitsimple-${version}-windows-x86_64-full.zip" \
            "hitsimple-${version}-windows-x86_64-slim.zip" \
            "hitsimple-vscode-${version}.vsix" | sort > "$RUNNER_TEMP/expected-assets"
          gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" \
            --json assets --jq '.assets[].name' | sort > "$RUNNER_TEMP/actual-assets"
          diff -u "$RUNNER_TEMP/expected-assets" "$RUNNER_TEMP/actual-assets"
          mkdir -p "$RUNNER_TEMP/downloaded-release"
          gh release download "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" \
            --dir "$RUNNER_TEMP/downloaded-release"
          cd "$RUNNER_TEMP/downloaded-release"
          sha256sum -c SHA256SUMS

      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release edit "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --draft=false \
            --latest