spec:
  inputs:
    release_version:
      description: "Version for release (e.g. v4.18). Leave empty for normal CI runs."
      default: ""
---
# p2pool-salvium GitLab CI/CD
#
# Pipeline stages:
#   1. analysis  - Static analysis (clang-tidy, cppcheck) on free runners
#   2. build     - All compilation jobs on free runners
#   3. test      - Sync tests + sanitizers on free runners (after builds pass)
#   4. build-paid - macOS builds on paid runners (after free builds + tests pass)
#   5. release   - Package & publish (manual, only on version tags)

stages:
  - analysis
  - build
  - test
  - build-paid
  - release

variables:
  GIT_SUBMODULE_STRATEGY: recursive
  GIT_SUBMODULE_DEPTH: 1
  RELEASE_VERSION: $[[ inputs.release_version ]]

# Common libcurl cmake flags (reused across jobs)
.curl_flags: &curl_flags >-
  -DBUILD_CURL_EXE=OFF -DBUILD_SHARED_LIBS=OFF
  -DCURL_DISABLE_INSTALL=ON -DCURL_ENABLE_EXPORT_TARGET=OFF
  -DCURL_DISABLE_HEADERS_API=ON -DCURL_DISABLE_BINDLOCAL=ON
  -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF
  -DCURL_ZLIB=OFF -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF
  -DCURL_DISABLE_ALTSVC=ON -DCURL_DISABLE_COOKIES=ON -DCURL_DISABLE_DOH=ON
  -DCURL_DISABLE_GETOPTIONS=ON -DCURL_DISABLE_HSTS=ON
  -DCURL_DISABLE_LIBCURL_OPTION=ON -DCURL_DISABLE_MIME=ON
  -DCURL_DISABLE_NETRC=ON -DCURL_DISABLE_NTLM=ON
  -DCURL_DISABLE_PARSEDATE=ON -DCURL_DISABLE_PROGRESS_METER=ON
  -DCURL_DISABLE_SHUFFLE_DNS=ON -DCURL_DISABLE_SOCKETPAIR=ON
  -DCURL_DISABLE_VERBOSE_STRINGS=ON -DCURL_DISABLE_WEBSOCKETS=ON
  -DHTTP_ONLY=ON -DCURL_ENABLE_SSL=OFF -DUSE_LIBIDN2=OFF
  -DCURL_USE_LIBPSL=OFF -DCURL_USE_LIBSSH2=OFF -DENABLE_UNIX_SOCKETS=OFF
  -DCURL_DISABLE_TESTS=ON -DUSE_NGHTTP2=OFF -DBUILD_EXAMPLES=OFF
  -DP2POOL_BORINGSSL=ON
  -DCURL_DISABLE_SRP=ON -DCURL_DISABLE_AWS=ON
  -DCURL_DISABLE_BASIC_AUTH=ON -DCURL_DISABLE_BEARER_AUTH=ON
  -DCURL_DISABLE_KERBEROS_AUTH=ON -DCURL_DISABLE_NEGOTIATE_AUTH=ON
  -DOPENSSL_INCLUDE_DIR=../grpc/third_party/boringssl-with-bazel/include

# Default rules: run on push to main, MRs, and manual triggers
# Release jobs override this with tag-only rules
.default_rules:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_PIPELINE_SOURCE == "web"


# ============================================================
# STAGE 1: ANALYSIS (free runners)
# All must pass before any builds start
# ============================================================

clang-tidy:
  stage: analysis
  tags: [linux, x86_64, debian_12]
  timeout: 30 minutes
  extends: .default_rules
  script:
    - mkdir build && cd build
    - cmake .. -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DCMAKE_C_COMPILER=clang-21 -DCMAKE_CXX_COMPILER=clang++-21 -DDEV_CLANG_TIDY=ON -DSTATIC_LIBS=ON -DWITH_GRPC=ON -DWITH_INDEXED_HASHES=ON -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
    - cd ../src
    - clang-tidy-21 *.cpp -p ../build -checks=bugprone-*,clang-analyzer-*,llvm-*,cppcoreguidelines-pro-type-const-cast,cppcoreguidelines-pro-type-cstyle-cast,cppcoreguidelines-rvalue-reference-param-not-moved,hicpp-use-emplace,hicpp-use-override,-bugprone-easily-swappable-parameters,-bugprone-empty-catch,-llvm-include-order -warnings-as-errors=* -header-filter='^[^\./]'

cppcheck-linux:
  stage: analysis
  tags: [linux, x86_64, debian_12]
  timeout: 60 minutes
  extends: .default_rules
  script:
    - mkdir build && cd build
    - cmake .. -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DSTATIC_LIBS=ON -DWITH_GRPC=OFF -DWITH_INDEXED_HASHES=ON -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
    - python3 ../cppcheck/remove_external.py compile_commands.json
    - cd ../cppcheck && ./run.sh
  artifacts:
    when: always
    paths:
      - cppcheck/errors_full.txt
      - cppcheck/checkers_report.txt
    expire_in: 7 days

cppcheck-windows:
  stage: analysis
  tags: [windows, x86_64, win10pro]
  timeout: 120 minutes
  extends: .default_rules
  variables:
    GIT_SUBMODULE_STRATEGY: none
  before_script:
    - git submodule sync --recursive
    - git submodule update --init --force --recursive -- external/src/RandomX external/src/curl external/src/libuv external/src/libzmq external/src/miniupnp external/src/rapidjson external/src/robin-hood-hashing tests/googletest
  script:
    - |
      cd cppcheck
      cmd /c run_ci.cmd
  artifacts:
    when: always
    paths:
      - cppcheck/errors_full.txt
      - cppcheck/checkers_report.txt
    expire_in: 7 days

# GitLab SAST (replaces CodeQL)
sast:
  stage: analysis
  extends: .default_rules

include:
  - template: Security/SAST.gitlab-ci.yml

# ============================================================
# STAGE 2: BUILDS (free runners)
# Only run after all analysis passes
# ============================================================

# --- Alpine Static Builds ---

.build_alpine_static:
  stage: build
  timeout: 90 minutes
  extends: .default_rules
  script:
    - apk add git cmake gcc g++ make linux-headers xz
    # Build libcurl
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" ${CURL_FLAGS}
    - make -j$(nproc) && cd ../../..
    # Build libuv
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    # Build libzmq
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" -DCMAKE_CXX_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    # Build p2pool
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DWITH_GRPC=OFF -DSTATIC_BINARY=ON -DARCH_ID=${ARCH_ID}
    - make -j$(nproc) p2pool-salvium
    # Tests
    - ./p2pool-salvium --test
    - make -j$(nproc) randomx-tests
    - external/src/RandomX/randomx-tests
    - cd ../tests && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DSTATIC_LIBS=ON -DARCH_ID=${ARCH_ID}
    - make -j$(nproc) p2pool_tests
    - unxz *.xz || true
    - ./p2pool_tests
  artifacts:
    paths:
      - build/p2pool-salvium
    expire_in: 7 days

build-alpine-static-x64:
  extends: .build_alpine_static
  tags: [linux, x86_64, alpine]
  variables:
    ARCH_FLAGS: "-ffunction-sections"
    ARCH_ID: "x86_64"
    CURL_FLAGS: *curl_flags


# aarch64: native build on GitLab SaaS ARM64 runner
# aarch64: cross-compile on x86, run tests via QEMU user-mode emulation.
# Runs on self-hosted ubuntu-24.04 runner with cross-compiler + qemu pre-installed.
build-alpine-static-aarch64:
  stage: build
  timeout: 60 minutes
  extends: .default_rules
  tags: [linux, x86_64, ubuntu_24.04]
  variables:
    ARCH_FLAGS: "-fuse-linker-plugin -ffunction-sections"
    ARCH_ID: "aarch64"
    CURL_FLAGS: *curl_flags
    TOOLCHAIN: "-DCMAKE_TOOLCHAIN_FILE=$CI_PROJECT_DIR/cmake/aarch64_toolchain.cmake"
  script:
    # Build libcurl (cross-compiled)
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_C_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" ${CURL_FLAGS}
    - make -j$(nproc) && cd ../../..
    # Build libuv
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_C_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    # Build libzmq
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" -DCMAKE_CXX_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    # Build p2pool (cross-compiled, fully static)
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DWITH_GRPC=OFF -DSTATIC_BINARY=ON -DARCH_ID=${ARCH_ID}
    - make -j$(nproc) p2pool-salvium
    # Run self-test via QEMU (p2pool is fully static, no LD_PREFIX needed)
    - qemu-aarch64-static ./p2pool-salvium --test
    # Set QEMU_LD_PREFIX for all dynamically linked test binaries
    - export QEMU_LD_PREFIX=/usr/aarch64-linux-gnu
    # Build and run RandomX tests
    - make -j$(nproc) randomx-tests
    - qemu-aarch64-static external/src/RandomX/randomx-tests
    # Build and run full test suite
    - cd ../tests && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DSTATIC_LIBS=ON -DARCH_ID=${ARCH_ID}
    - make -j$(nproc) p2pool_tests
    - unxz *.xz || true
    - qemu-aarch64-static ./p2pool_tests
  artifacts:
    paths:
      - build/p2pool-salvium
    expire_in: 7 days

# riscv64: cross-compile on x86, run tests via QEMU user-mode emulation.
# Runs on self-hosted ubuntu-24.04 runner with cross-compiler + qemu pre-installed.
build-alpine-static-riscv64:
  stage: build
  timeout: 60 minutes
  extends: .default_rules
  tags: [linux, x86_64, ubuntu_24.04]
  variables:
    ARCH_FLAGS: "-fuse-linker-plugin -ffunction-sections"
    ARCH_ID: "riscv64"
    CURL_FLAGS: *curl_flags
    TOOLCHAIN: "-DCMAKE_TOOLCHAIN_FILE=$CI_PROJECT_DIR/cmake/riscv64_toolchain.cmake"
  script:
    # Build libcurl (cross-compiled)
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_C_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" ${CURL_FLAGS}
    - make -j$(nproc) && cd ../../..
    # Build libuv
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_C_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    # Build libzmq
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" -DCMAKE_CXX_FLAGS="-Os -flto=auto ${ARCH_FLAGS}" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    # Build p2pool (cross-compiled, fully static)
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DWITH_GRPC=OFF -DSTATIC_BINARY=ON -DARCH_ID=${ARCH_ID}
    - make -j$(nproc) p2pool-salvium
    # Run self-test via QEMU (p2pool is fully static, no LD_PREFIX needed)
    - qemu-riscv64-static ./p2pool-salvium --test
    # Set QEMU_LD_PREFIX for all dynamically linked test binaries
    - export QEMU_LD_PREFIX=/usr/riscv64-linux-gnu
    # Build and run RandomX tests
    - make -j$(nproc) randomx-tests
    - qemu-riscv64-static external/src/RandomX/randomx-tests
    # Build and run full test suite
    - cd ../tests && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="${ARCH_FLAGS} -Wl,-s -Wl,--gc-sections" -DSTATIC_LIBS=ON -DARCH_ID=${ARCH_ID}
    - make -j$(nproc) p2pool_tests
    - unxz *.xz || true
    - qemu-riscv64-static ./p2pool_tests
  artifacts:
    paths:
      - build/p2pool-salvium
    expire_in: 7 days

# --- Debian Builds ---

.build_debian:
  stage: build
  timeout: 60 minutes
  extends: .default_rules
  variables:
    GIT_SUBMODULE_STRATEGY: none
  before_script:
    - git submodule sync --recursive
    - git submodule update --init --force --recursive -- external/src/RandomX external/src/curl external/src/libuv external/src/libzmq external/src/miniupnp external/src/rapidjson external/src/robin-hood-hashing tests/googletest
  script:
    # Build libcurl
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" ${CURL_FLAGS}
    - make -j$(nproc) && cd ../../..
    # Build libuv
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    # Build libzmq
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" -DCMAKE_CXX_FLAGS="-Os -flto=auto -ffunction-sections" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    # Build p2pool
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++ -DCMAKE_C_FLAGS="-ffunction-sections" -DCMAKE_CXX_FLAGS="-ffunction-sections" -DCMAKE_EXE_LINKER_FLAGS="-Wl,-s -Wl,--gc-sections" -DWITH_GRPC=OFF -DSTATIC_LIBS=ON
    - make -j$(nproc) p2pool-salvium
    # Tests
    - ./p2pool-salvium --test
    - make -j$(nproc) randomx-tests
    - external/src/RandomX/randomx-tests
    - cd ../tests && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++ -DCMAKE_C_FLAGS="-ffunction-sections" -DCMAKE_CXX_FLAGS="-ffunction-sections" -DCMAKE_EXE_LINKER_FLAGS="-Wl,-s -Wl,--gc-sections" -DSTATIC_LIBS=ON
    - make -j$(nproc) p2pool_tests
    - unxz *.xz || true
    - ./p2pool_tests
  artifacts:
    paths:
      - build/p2pool-salvium
    expire_in: 7 days

build-debian-12:
  extends: .build_debian
  tags: [linux, x86_64, debian_12]
  variables:
    CURL_FLAGS: *curl_flags


# --- Windows Build ---

build-windows-x64:
  stage: build
  tags: [windows, x86_64, win10pro]
  timeout: 60 minutes
  extends: .default_rules
  variables:
    GIT_SUBMODULE_STRATEGY: none
  before_script:
    - git submodule sync --recursive
    - git submodule update --init --force --recursive -- external/src/RandomX external/src/curl external/src/libuv external/src/libzmq external/src/miniupnp external/src/rapidjson external/src/robin-hood-hashing tests/googletest
    - git submodule update --init --force -- external/src/grpc
    - git -C external/src/grpc submodule update --init --force -- third_party/boringssl-with-bazel third_party/abseil-cpp third_party/cares/cares third_party/re2 third_party/protobuf third_party/zlib third_party/googletest
  script:
    - |
      $vsw = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
      if (Test-Path $vsw) {
        $MSBUILD = & $vsw -latest -requires Microsoft.Component.MSBuild -find MSBuild\**\Bin\amd64\MSBuild.exe | Select-Object -First 1
      }
      if (-not $MSBUILD) {
        $candidates = @(
          "${env:ProgramFiles}\Microsoft Visual Studio\2022\BuildTools\MSBuild\Current\Bin\amd64\MSBuild.exe",
          "${env:ProgramFiles}\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin\amd64\MSBuild.exe",
          "${env:ProgramFiles}\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\MSBuild.exe",
          "${env:ProgramFiles}\Microsoft Visual Studio\2022\Professional\MSBuild\Current\Bin\amd64\MSBuild.exe"
        )
        foreach ($c in $candidates) { if (Test-Path $c) { $MSBUILD = $c; break } }
      }
      if (-not $MSBUILD) {
        $MSBUILD = Get-ChildItem -Path "${env:ProgramFiles}","${env:ProgramFiles(x86)}" -Recurse -Filter "MSBuild.exe" -ErrorAction SilentlyContinue | Where-Object { $_.FullName -match "amd64" } | Select-Object -First 1 -ExpandProperty FullName
      }
      if (-not $MSBUILD) { throw "MSBuild not found anywhere on this runner" }
      Write-Host "Using MSBuild: $MSBUILD"
      git apply --verbose --ignore-whitespace --directory=external/src/grpc/third_party/boringssl-with-bazel patches/boringssl/win7.patch
      # Build p2pool (MSVC handles deps via cmake)
      New-Item -ItemType Directory -Force -Path build
      cd build
      cmake .. -G "Visual Studio 17 2022" -DCMAKE_SYSTEM_VERSION="10.0" -DWITH_RANDOMX=ON -DWITH_UPNP=ON -DWITH_GRPC=OFF -DWITH_TLS=ON -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
      & $MSBUILD -v:m /m /p:Configuration=Release p2pool-salvium.vcxproj
      # Tests
      Release/p2pool-salvium.exe --test
      & $MSBUILD -v:m /m /p:Configuration=Release external\src\RandomX\randomx-tests.vcxproj
      external/src/RandomX/Release/randomx-tests.exe
      cd ../tests
      New-Item -ItemType Directory -Force -Path build
      cd build
      cmake .. -G "Visual Studio 17 2022" -DCMAKE_SYSTEM_VERSION="10.0" -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
      & $MSBUILD -v:m /m /p:Configuration=Release p2pool_tests.vcxproj
      cd Release
      xz -d sidechain_dump.dat.xz
      ./p2pool_tests.exe
  artifacts:
    paths:
      - build/Release/p2pool-salvium.exe
    expire_in: 7 days

# --- Source Snapshot ---

source-snapshot:
  stage: build
  tags: [linux, x86_64, debian_12]
  timeout: 10 minutes
  extends: .default_rules
  script:
    - cd ..
    - tar --exclude=".git" --exclude="build" -cJf p2pool-salvium/build/p2pool_source.tar.xz p2pool-salvium || tar --exclude=".git" --exclude="build" -cJf p2pool_source.tar.xz p2pool-salvium && mv p2pool_source.tar.xz p2pool-salvium/
  artifacts:
    paths:
      - "*.tar.xz"
      - build/p2pool_source.tar.xz
    expire_in: 7 days

# ============================================================
# STAGE 3: TESTS (free runners, after builds)
# ============================================================

sync-test-tsan:
  stage: test
  tags: [saas-linux-small-amd64]
  image: ubuntu:22.04
  timeout: 120 minutes
  extends: .default_rules
  script:
    - apt-get update && apt-get install -y software-properties-common && add-apt-repository -y ppa:ubuntu-toolchain-r/test
    - apt-get update && apt-get install -y gcc-12 g++-12 cmake make git build-essential xz-utils python3 procps libcurl4-openssl-dev libuv1-dev libzmq3-dev libhiredis-dev libgss-dev libidn2-0-dev libgrpc++-dev libprotobuf-dev protobuf-compiler protobuf-compiler-grpc
    # Build libcurl with TSAN
    - cd external/src/curl
    - cmake . -DCMAKE_C_COMPILER=gcc-12 -DCMAKE_C_FLAGS="-fsanitize=thread -Og -fno-omit-frame-pointer -g" ${CURL_FLAGS}
    - make -j$(nproc) && cd ../../..
    # Build libuv with TSAN
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_C_COMPILER=gcc-12 -DCMAKE_C_FLAGS="-fsanitize=thread -Og -fno-omit-frame-pointer -g" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    # Build libzmq with TSAN
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_C_COMPILER=gcc-12 -DCMAKE_CXX_COMPILER=g++-12 -DCMAKE_C_FLAGS="-fsanitize=thread -Og -fno-omit-frame-pointer -g" -DCMAKE_CXX_FLAGS="-fsanitize=thread -Og -fno-omit-frame-pointer -g" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
    - make -j$(nproc) && cd ../../../..
    # Build p2pool with TSAN
    - mkdir -p build && cd build
    - cmake .. -DDEV_TEST_SYNC=ON -DDEV_WITH_TSAN=ON -DCMAKE_C_COMPILER=gcc-12 -DCMAKE_CXX_COMPILER=g++-12 -DCMAKE_C_FLAGS="-fsanitize=thread -Og -fno-omit-frame-pointer -g" -DCMAKE_CXX_FLAGS="-fsanitize=thread -Og -fno-omit-frame-pointer -g" -DWITH_LTO=OFF -DSTATIC_LIBS=ON -DWITH_INDEXED_HASHES=ON -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
    - make -j$(nproc) p2pool-salvium
    # Run sync test
    - mkdir data
    - python3 ../tests/src/stratum_dummy.py 1 &
    - python3 ../tests/src/stratum_dummy.py 2 &
    - python3 ../tests/src/stratum_dummy.py 3 &
    - sysctl vm.mmap_rnd_bits=28 || true
    - TSAN_OPTIONS="suppressions=../tests/src/tsan_sup.txt halt_on_error=1 history_size=4" ./p2pool-salvium --host core2.whiskymine.io --rpc-port 19081 --zmq-port 19084 --wallet SC11n4s2UEj9Rc8XxppPbegwQethVmREpG9JP3aJUBGRCuD3wEvS4qtYtBjhqSx3S1hw3WDCfmbWKHJqa9g5Vqyo3jrsReJ5vp --out-peers 200 --data-api data --local-api --loglevel 4 --no-color 2>&1 | tee p2pool.log || true
    - grep 'Synchronization finished successfully' p2pool.log
    - ../scripts/workflows/test-sync-check.sh
  variables:
    CURL_FLAGS: *curl_flags
  artifacts:
    when: always
    paths:
      - build/*.log
      - build/data/
    expire_in: 7 days

sync-test-msan:
  stage: test
  tags: [saas-linux-small-amd64]
  image: ubuntu:24.04
  timeout: 180 minutes
  extends: .default_rules
  script:
    - apt-get update && apt-get install -y gcc g++ cmake make git ninja-build python3 xz-utils procps wget gnupg lsb-release software-properties-common libcurl4-openssl-dev libuv1-dev libzmq3-dev libhiredis-dev libgrpc++-dev libprotobuf-dev protobuf-compiler protobuf-compiler-grpc
    - wget https://apt.llvm.org/llvm.sh && chmod +x llvm.sh && ./llvm.sh 21 all
    # Build libcxx with MSAN
    - git clone --depth=1 https://github.com/llvm/llvm-project -b release/21.x
    - cd llvm-project && mkdir build
    - cmake -G Ninja -S runtimes -B build -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi" -DCMAKE_C_COMPILER=clang-21 -DCMAKE_CXX_COMPILER=clang++-21 -DLLVM_USE_SANITIZER=MemoryWithOrigins -DLIBCXXABI_USE_LLVM_UNWINDER=OFF
    - ninja -C build cxx cxxabi
    - mkdir -p /tmp/libcxx_msan && cp -r build/include /tmp/libcxx_msan && cp -r build/lib /tmp/libcxx_msan
    - cd ..
    # Build libcurl with MSAN
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER=clang-21 -DCMAKE_C_FLAGS="-fsanitize=memory -fsanitize-recover -O2 -fno-omit-frame-pointer -g" ${CURL_FLAGS}
    - make -j$(nproc) && cd ../../..
    # Build libuv with MSAN
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER=clang-21 -DCMAKE_C_FLAGS="-fsanitize=memory -fsanitize-recover -O2 -fno-omit-frame-pointer -g" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    # Build libzmq with MSAN
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER=clang-21 -DCMAKE_CXX_COMPILER=clang++-21 -DCMAKE_C_FLAGS="-fsanitize=memory -fsanitize-recover -O2 -fno-omit-frame-pointer -g" -DCMAKE_CXX_FLAGS="-nostdinc++ -nostdlib++ -fsanitize=memory -fsanitize-recover -isystem /tmp/libcxx_msan/include/c++/v1 -O2 -fno-omit-frame-pointer -g" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
    - make -j$(nproc) && cd ../../../..
    # Build p2pool with MSAN
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER=clang-21 -DCMAKE_CXX_COMPILER=clang++-21 -DCMAKE_C_FLAGS="-fsanitize=memory -fsanitize-recover -O2 -fno-omit-frame-pointer" -DCMAKE_CXX_FLAGS="-nostdinc++ -nostdlib++ -fsanitize=memory -fsanitize-recover -isystem /tmp/libcxx_msan/include/c++/v1 -L/tmp/libcxx_msan/lib -Wl,-rpath /tmp/libcxx_msan/lib -lc++ -lc++abi -Wno-unused-command-line-argument -fuse-ld=lld-21 -O2 -fno-omit-frame-pointer" -DDEV_TEST_SYNC=ON -DDEV_WITH_MSAN=ON -DWITH_LTO=OFF -DSTATIC_LIBS=ON -DWITH_INDEXED_HASHES=ON -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
    - make -j$(nproc) p2pool-salvium
    # Run sync test
    - mkdir data
    - python3 ../tests/src/stratum_dummy.py 1 &
    - python3 ../tests/src/stratum_dummy.py 2 &
    - python3 ../tests/src/stratum_dummy.py 3 &
    - sysctl vm.mmap_rnd_bits=28 || true
    - MSAN_OPTIONS="halt_on_error=1" ./p2pool-salvium --host core2.whiskymine.io --rpc-port 19081 --zmq-port 19084 --wallet SC11n4s2UEj9Rc8XxppPbegwQethVmREpG9JP3aJUBGRCuD3wEvS4qtYtBjhqSx3S1hw3WDCfmbWKHJqa9g5Vqyo3jrsReJ5vp --out-peers 20 --data-api data --local-api --loglevel 4 --no-color 2>p2pool_msan.log | tee p2pool.log || true
    - grep 'Synchronization finished successfully' p2pool.log
    - ../scripts/workflows/test-sync-check.sh
  variables:
    CURL_FLAGS: *curl_flags
  artifacts:
    when: always
    paths:
      - build/*.log
      - build/data/
    expire_in: 7 days

sync-test-ubsan:
  stage: test
  tags: [saas-linux-small-amd64]
  image: ubuntu:22.04
  timeout: 60 minutes
  extends: .default_rules
  script:
    - apt-get update && apt-get install -y software-properties-common && add-apt-repository -y ppa:ubuntu-toolchain-r/test
    - apt-get update && apt-get install -y gcc-12 g++-12 cmake make git build-essential xz-utils python3 procps libcurl4-openssl-dev libuv1-dev libzmq3-dev libhiredis-dev libgss-dev libidn2-0-dev libgrpc++-dev libprotobuf-dev protobuf-compiler protobuf-compiler-grpc
    - mkdir -p build && cd build
    - cmake .. -DDEV_TEST_SYNC=ON -DDEV_WITH_UBSAN=ON -DCMAKE_C_COMPILER=gcc-12 -DCMAKE_CXX_COMPILER=g++-12 -DWITH_LTO=OFF -DWITH_INDEXED_HASHES=ON -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
    - make -j$(nproc) p2pool-salvium
    - mkdir data
    - python3 ../tests/src/stratum_dummy.py 1 &
    - python3 ../tests/src/stratum_dummy.py 2 &
    - python3 ../tests/src/stratum_dummy.py 3 &
    - sysctl vm.mmap_rnd_bits=28 || true
    - UBSAN_OPTIONS="suppressions=../tests/src/ubsan_sup.txt halt_on_error=1" ./p2pool-salvium --host core2.whiskymine.io --rpc-port 19081 --zmq-port 19084 --wallet SC11n4s2UEj9Rc8XxppPbegwQethVmREpG9JP3aJUBGRCuD3wEvS4qtYtBjhqSx3S1hw3WDCfmbWKHJqa9g5Vqyo3jrsReJ5vp --out-peers 200 --data-api data --local-api --loglevel 4 --no-color 2>&1 | tee p2pool.log || true
    - grep 'Synchronization finished successfully' p2pool.log
    - ../scripts/workflows/test-sync-check.sh
  artifacts:
    when: always
    paths:
      - build/*.log
      - build/data/
    expire_in: 7 days

sync-test-asan:
  stage: test
  tags: [saas-linux-small-amd64]
  image: ubuntu:22.04
  timeout: 60 minutes
  extends: .default_rules
  script:
    - apt-get update && apt-get install -y software-properties-common && add-apt-repository -y ppa:ubuntu-toolchain-r/test
    - apt-get update && apt-get install -y gcc-12 g++-12 cmake make git build-essential xz-utils python3 procps libcurl4-openssl-dev libuv1-dev libzmq3-dev libhiredis-dev libgss-dev libidn2-0-dev libgrpc++-dev libprotobuf-dev protobuf-compiler protobuf-compiler-grpc
    - mkdir -p build && cd build
    - cmake .. -DDEV_TEST_SYNC=ON -DDEV_DEBUG=ON -DDEV_WITH_ASAN=ON -DCMAKE_C_COMPILER=gcc-12 -DCMAKE_CXX_COMPILER=g++-12 -DCMAKE_C_FLAGS="-fno-omit-frame-pointer -fsanitize=address -Og -g" -DCMAKE_CXX_FLAGS="-fno-omit-frame-pointer -fsanitize=address -Og -g" -DWITH_LTO=OFF -DWITH_INDEXED_HASHES=ON -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
    - make -j$(nproc) p2pool-salvium
    - mkdir data
    - python3 ../tests/src/stratum_dummy.py 1 &
    - python3 ../tests/src/stratum_dummy.py 2 &
    - python3 ../tests/src/stratum_dummy.py 3 &
    - sysctl vm.mmap_rnd_bits=28 || true
    - ASAN_OPTIONS="detect_stack_use_after_return=1 atexit=1" ./p2pool-salvium --host core2.whiskymine.io --rpc-port 19081 --zmq-port 19084 --wallet SC11n4s2UEj9Rc8XxppPbegwQethVmREpG9JP3aJUBGRCuD3wEvS4qtYtBjhqSx3S1hw3WDCfmbWKHJqa9g5Vqyo3jrsReJ5vp --out-peers 200 --data-api data --local-api --loglevel 4 --no-color 2>&1 | tee p2pool.log || true
    - grep 'Synchronization finished successfully' p2pool.log
    - ../scripts/workflows/test-sync-check.sh
  artifacts:
    when: always
    paths:
      - build/*.log
      - build/data/
    expire_in: 7 days

# --- Coverage ---

coverage:
  stage: test
  tags: [linux, x86_64, debian_12]
  timeout: 60 minutes
  extends: .default_rules
  script:
    # Build tests with coverage
    - cd tests && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DDEV_DEBUG=ON -DWITH_INDEXED_HASHES=ON -DWITH_COVERAGE=ON -DCMAKE_C_COMPILER=clang-21 -DCMAKE_CXX_COMPILER=clang++-21 -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
    - make -j$(nproc) p2pool_tests
    # Run tests
    - unxz *.xz || true
    - LLVM_PROFILE_FILE="p2pool_tests.profraw" ./p2pool_tests
    # Generate coverage report
    - llvm-profdata-21 merge -sparse ./p2pool_tests.profraw -o ./p2pool_tests.profdata
    - llvm-cov-21 export ./p2pool_tests -format=lcov -instr-profile=./p2pool_tests.profdata > coverage.info
    - genhtml --demangle-cpp -o coverage coverage.info
  artifacts:
    when: always
    paths:
      - tests/build/coverage/
      - tests/build/coverage.info
    expire_in: 7 days
  coverage: '/lines\.*:\s+(\d+\.\d+)%/'

# --- Per-job status badges ---

generate-badges:
  stage: build-paid
  tags: [saas-linux-small-amd64]
  image: alpine:3.21
  when: always
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  script:
    - apk add --no-cache curl jq
    - mkdir -p badges
    - |
      JOBS=$(curl -s --header "JOB-TOKEN: $CI_JOB_TOKEN" \
        "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/pipelines/${CI_PIPELINE_ID}/jobs?per_page=100")
      for JOB_NAME in clang-tidy cppcheck-linux cppcheck-windows coverage \
                       sync-test-tsan sync-test-asan sync-test-ubsan sync-test-msan \
                       build-alpine-static-x64 build-alpine-static-aarch64 \
                       build-alpine-static-riscv64 build-debian-12 build-windows-x64; do
        STATUS=$(echo "$JOBS" | jq -r ".[] | select(.name==\"$JOB_NAME\") | .status" | head -1)
        case "$STATUS" in
          success) LABEL="passing"; COLOR="#4c1" ;;
          failed)  LABEL="failing";  COLOR="#e05d44" ;;
          running) LABEL="running";  COLOR="#dfb317" ;;
          *)       LABEL="unknown";  COLOR="#9f9f9f" ;;
        esac
        sh scripts/ci/gen-badge.sh "$JOB_NAME" "$LABEL" "$COLOR" "badges/${JOB_NAME}.svg"
      done
  artifacts:
    paths:
      - badges/
    when: always
    expire_in: 30 days

# ============================================================
# STAGE 4: PAID BUILDS (macOS, after free stages pass)
# ============================================================

build-macos-x64:
  stage: build-paid
  tags: [saas-macos-medium-m1]
  timeout: 90 minutes
  extends: .default_rules
  script:
    - brew install cmake llvm@18
    # Build libcurl
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" ${CURL_FLAGS}
    - make -j4 && cd ../../..
    # Build libuv
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j4 && cd ../../../..
    # Build libzmq
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_CXX_COMPILER="$(brew --prefix llvm@18)/bin/clang++" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" -DCMAKE_CXX_FLAGS="-Os -flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j4 && cd ../../../..
    # Build p2pool
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_CXX_COMPILER="$(brew --prefix llvm@18)/bin/clang++" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" -DCMAKE_CXX_FLAGS="-flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" -DCMAKE_ASM_FLAGS="-target x86_64-apple-macos10.13" -DSTATIC_LIBS=ON
    - make -j4 p2pool-salvium
    - ./p2pool-salvium --test
  variables:
    CURL_FLAGS: *curl_flags
  artifacts:
    paths:
      - build/p2pool-salvium
    expire_in: 7 days

build-macos-aarch64:
  stage: build-paid
  tags: [saas-macos-medium-m1]
  timeout: 30 minutes
  extends: .default_rules
  script:
    - brew install cmake llvm@18
    # Build libcurl
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -target arm64-apple-macos-11" ${CURL_FLAGS}
    - make -j3 && cd ../../..
    # Build libuv
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -target arm64-apple-macos-11" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j3 && cd ../../../..
    # Build libzmq
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_CXX_COMPILER="$(brew --prefix llvm@18)/bin/clang++" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -target arm64-apple-macos-11" -DCMAKE_CXX_FLAGS="-Os -target arm64-apple-macos-11" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j3 && cd ../../../..
    # Build p2pool
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_CXX_COMPILER="$(brew --prefix llvm@18)/bin/clang++" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-target arm64-apple-macos-11" -DCMAKE_CXX_FLAGS="-target arm64-apple-macos-11" -DSTATIC_LIBS=ON -DWITH_LTO=OFF -DARCH_ID=aarch64
    - make -j3 p2pool-salvium
    - ./p2pool-salvium --test
  variables:
    CURL_FLAGS: *curl_flags
  artifacts:
    paths:
      - build/p2pool-salvium
    expire_in: 7 days

# ============================================================
# STAGE 5: RELEASE (set RELEASE_VERSION in Run Pipeline UI, e.g. v4.18)
# ============================================================

.release_rules:
  rules:
    - if: $RELEASE_VERSION
      when: on_success

release-linux-x64:
  stage: release
  tags: [linux, x86_64, debian_12]
  timeout: 60 minutes
  extends: .release_rules
  script:
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" ${CURL_FLAGS}
    - make -j$(nproc) && cd ../../..
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" -DCMAKE_CXX_FLAGS="-Os -flto=auto -ffunction-sections" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-ffunction-sections -Wl,-s -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="-ffunction-sections -Wl,-s -Wl,--gc-sections" -DWITH_GRPC=OFF -DSTATIC_LIBS=ON
    - make -j$(nproc) p2pool-salvium
    - ./p2pool-salvium --test
    - tar -czf p2pool-salvium-${RELEASE_VERSION}-linux-x64.tar.gz p2pool-salvium
  variables:
    CURL_FLAGS: *curl_flags
  artifacts:
    paths:
      - build/p2pool-salvium-${RELEASE_VERSION}-linux-x64.tar.gz
    expire_in: 30 days

release-linux-x64-static:
  stage: release
  tags: [linux, x86_64, alpine]
  timeout: 60 minutes
  extends: .release_rules
  script:
    - apk add git cmake gcc g++ make linux-headers xz
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" ${CURL_FLAGS}
    - make -j$(nproc) && cd ../../..
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" -DCMAKE_CXX_FLAGS="-Os -flto=auto -ffunction-sections" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-ffunction-sections -Wl,-s -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="-ffunction-sections -Wl,-s -Wl,--gc-sections" -DWITH_GRPC=OFF -DSTATIC_BINARY=ON
    - make -j$(nproc) p2pool-salvium
    - ./p2pool-salvium --test
    - tar -czf p2pool-salvium-${RELEASE_VERSION}-linux-x64-static.tar.gz p2pool-salvium
  variables:
    CURL_FLAGS: *curl_flags
  artifacts:
    paths:
      - build/p2pool-salvium-${RELEASE_VERSION}-linux-x64-static.tar.gz
    expire_in: 30 days

release-linux-aarch64:
  stage: release
  tags: [linux, x86_64, ubuntu_24.04]
  timeout: 60 minutes
  extends: .release_rules
  variables:
    CURL_FLAGS: *curl_flags
    TOOLCHAIN: "-DCMAKE_TOOLCHAIN_FILE=$CI_PROJECT_DIR/cmake/aarch64_toolchain.cmake"
  script:
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" ${CURL_FLAGS}
    - make -j$(nproc) && cd ../../..
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" -DCMAKE_CXX_FLAGS="-Os -flto=auto -ffunction-sections" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-ffunction-sections -Wl,-s -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="-ffunction-sections -Wl,-s -Wl,--gc-sections" -DWITH_GRPC=OFF -DSTATIC_BINARY=ON -DARCH_ID=aarch64
    - make -j$(nproc) p2pool-salvium
    - qemu-aarch64-static ./p2pool-salvium --test
    - tar -czf p2pool-salvium-${RELEASE_VERSION}-linux-aarch64.tar.gz p2pool-salvium
  artifacts:
    paths:
      - build/p2pool-salvium-${RELEASE_VERSION}-linux-aarch64.tar.gz
    expire_in: 30 days

release-linux-riscv64:
  stage: release
  tags: [linux, x86_64, ubuntu_24.04]
  timeout: 60 minutes
  extends: .release_rules
  variables:
    CURL_FLAGS: *curl_flags
    TOOLCHAIN: "-DCMAKE_TOOLCHAIN_FILE=$CI_PROJECT_DIR/cmake/riscv64_toolchain.cmake"
  script:
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" ${CURL_FLAGS}
    - make -j$(nproc) && cd ../../..
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-Os -flto=auto -ffunction-sections" -DCMAKE_CXX_FLAGS="-Os -flto=auto -ffunction-sections" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j$(nproc) && cd ../../../..
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release ${TOOLCHAIN} -DCMAKE_POLICY_VERSION_MINIMUM="3.5" -DCMAKE_C_FLAGS="-ffunction-sections -Wl,-s -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="-ffunction-sections -Wl,-s -Wl,--gc-sections" -DWITH_GRPC=OFF -DSTATIC_BINARY=ON -DARCH_ID=riscv64
    - make -j$(nproc) p2pool-salvium
    - qemu-riscv64-static ./p2pool-salvium --test
    - tar -czf p2pool-salvium-${RELEASE_VERSION}-linux-riscv64.tar.gz p2pool-salvium
  artifacts:
    paths:
      - build/p2pool-salvium-${RELEASE_VERSION}-linux-riscv64.tar.gz
    expire_in: 30 days

release-windows-x64:
  stage: release
  tags: [windows, x86_64, win10pro]
  timeout: 60 minutes
  extends: .release_rules
  variables:
    GIT_SUBMODULE_STRATEGY: none
  before_script:
    - git submodule sync --recursive
    - git submodule update --init --force --recursive -- external/src/RandomX external/src/curl external/src/libuv external/src/libzmq external/src/miniupnp external/src/rapidjson external/src/robin-hood-hashing
    - git submodule update --init --force -- external/src/grpc
    - git -C external/src/grpc submodule update --init --force -- third_party/boringssl-with-bazel third_party/abseil-cpp third_party/cares/cares third_party/re2 third_party/protobuf third_party/zlib third_party/googletest
  script:
    - |
      $vsw = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
      if (Test-Path $vsw) {
        $MSBUILD = & $vsw -latest -requires Microsoft.Component.MSBuild -find MSBuild\**\Bin\amd64\MSBuild.exe | Select-Object -First 1
      }
      if (-not $MSBUILD) {
        $candidates = @(
          "${env:ProgramFiles}\Microsoft Visual Studio\2022\BuildTools\MSBuild\Current\Bin\amd64\MSBuild.exe",
          "${env:ProgramFiles}\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin\amd64\MSBuild.exe",
          "${env:ProgramFiles}\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\MSBuild.exe",
          "${env:ProgramFiles}\Microsoft Visual Studio\2022\Professional\MSBuild\Current\Bin\amd64\MSBuild.exe"
        )
        foreach ($c in $candidates) { if (Test-Path $c) { $MSBUILD = $c; break } }
      }
      if (-not $MSBUILD) {
        $MSBUILD = Get-ChildItem -Path "${env:ProgramFiles}","${env:ProgramFiles(x86)}" -Recurse -Filter "MSBuild.exe" -ErrorAction SilentlyContinue | Where-Object { $_.FullName -match "amd64" } | Select-Object -First 1 -ExpandProperty FullName
      }
      if (-not $MSBUILD) { throw "MSBuild not found anywhere on this runner" }
      Write-Host "Using MSBuild: $MSBUILD"
      git apply --verbose --ignore-whitespace --directory=external/src/grpc/third_party/boringssl-with-bazel patches/boringssl/win7.patch
      New-Item -ItemType Directory -Force -Path build
      cd build
      cmake .. -G "Visual Studio 17 2022" -DCMAKE_SYSTEM_VERSION="10.0" -DWITH_RANDOMX=ON -DWITH_UPNP=ON -DWITH_GRPC=OFF -DWITH_TLS=ON -DCMAKE_POLICY_VERSION_MINIMUM="3.5"
      & $MSBUILD -v:m /m /p:Configuration=Release p2pool-salvium.vcxproj
      Release/p2pool-salvium.exe --test
  artifacts:
    paths:
      - build/Release/p2pool-salvium.exe
    expire_in: 30 days

release-macos-x64:
  stage: release
  tags: [saas-macos-medium-m1]
  timeout: 90 minutes
  extends: .release_rules
  script:
    - brew install cmake llvm@18
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" ${CURL_FLAGS}
    - make -j4 && cd ../../..
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j4 && cd ../../../..
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_CXX_COMPILER="$(brew --prefix llvm@18)/bin/clang++" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" -DCMAKE_CXX_FLAGS="-Os -flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j4 && cd ../../../..
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_CXX_COMPILER="$(brew --prefix llvm@18)/bin/clang++" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" -DCMAKE_CXX_FLAGS="-flto -target x86_64-apple-macos10.13 -Wno-overriding-t-option" -DCMAKE_ASM_FLAGS="-target x86_64-apple-macos10.13" -DSTATIC_LIBS=ON
    - make -j4 p2pool-salvium
    - strip p2pool-salvium
    - ./p2pool-salvium --test
    - tar -czf p2pool-salvium-${RELEASE_VERSION}-macos-x64.tar.gz p2pool-salvium
  variables:
    CURL_FLAGS: *curl_flags
  artifacts:
    paths:
      - build/p2pool-salvium-${RELEASE_VERSION}-macos-x64.tar.gz
    expire_in: 30 days

release-macos-aarch64:
  stage: release
  tags: [saas-macos-medium-m1]
  timeout: 30 minutes
  extends: .release_rules
  script:
    - brew install cmake llvm@18
    - cd external/src/curl
    - cmake . -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -target arm64-apple-macos-11" ${CURL_FLAGS}
    - make -j3 && cd ../../..
    - cd external/src/libuv && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -target arm64-apple-macos-11" -DBUILD_TESTING=OFF -DLIBUV_BUILD_SHARED=OFF
    - make -j3 && cd ../../../..
    - cd external/src/libzmq && mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_CXX_COMPILER="$(brew --prefix llvm@18)/bin/clang++" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-Os -target arm64-apple-macos-11" -DCMAKE_CXX_FLAGS="-Os -target arm64-apple-macos-11" -DWITH_LIBSODIUM=OFF -DWITH_LIBBSD=OFF -DBUILD_TESTS=OFF -DWITH_DOCS=OFF -DENABLE_DRAFTS=OFF -DBUILD_SHARED=OFF
    - make -j3 && cd ../../../..
    - mkdir -p build && cd build
    - cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER="$(brew --prefix llvm@18)/bin/clang" -DCMAKE_CXX_COMPILER="$(brew --prefix llvm@18)/bin/clang++" -DCMAKE_AR="$(brew --prefix llvm@18)/bin/llvm-ar" -DCMAKE_RANLIB="$(brew --prefix llvm@18)/bin/llvm-ranlib" -DCMAKE_C_FLAGS="-target arm64-apple-macos-11" -DCMAKE_CXX_FLAGS="-target arm64-apple-macos-11" -DSTATIC_LIBS=ON -DWITH_LTO=OFF -DARCH_ID=aarch64
    - make -j3 p2pool-salvium
    - strip p2pool-salvium
    - ./p2pool-salvium --test
    - tar -czf p2pool-salvium-${RELEASE_VERSION}-macos-aarch64.tar.gz p2pool-salvium
  variables:
    CURL_FLAGS: *curl_flags
  artifacts:
    paths:
      - build/p2pool-salvium-${RELEASE_VERSION}-macos-aarch64.tar.gz
    expire_in: 30 days

# --- Checksums & GitLab Release ---

create-release:
  stage: release
  tags: [linux, x86_64, debian_12]
  needs:
    - job: release-linux-x64
      artifacts: true
    - job: release-linux-x64-static
      artifacts: true
    - job: release-linux-aarch64
      artifacts: true
    - job: release-linux-riscv64
      artifacts: true
    - job: release-windows-x64
      artifacts: true
    - job: release-macos-x64
      artifacts: true
    - job: release-macos-aarch64
      artifacts: true
  rules:
    - if: $RELEASE_VERSION
      when: on_success
  script:
    # Package source (write to /tmp first to avoid 'file changed as we read it')
    - cd .. && tar --exclude='.git' --exclude='build' -cJf /tmp/p2pool_source-${RELEASE_VERSION}.tar.xz p2pool-salvium && mv /tmp/p2pool_source-${RELEASE_VERSION}.tar.xz p2pool-salvium/ && cd p2pool-salvium
    # Package Windows (MSVC outputs to build/Release/)
    - cd build && zip p2pool-salvium-${RELEASE_VERSION}-windows-x64.zip Release/p2pool-salvium.exe && cd ..
    # Generate checksums
    - |
      cd build
      sha256sum p2pool-salvium-${RELEASE_VERSION}-linux-x64.tar.gz >> sha256sums.txt || true
      sha256sum p2pool-salvium-${RELEASE_VERSION}-linux-x64-static.tar.gz >> sha256sums.txt || true
      sha256sum p2pool-salvium-${RELEASE_VERSION}-linux-aarch64.tar.gz >> sha256sums.txt || true
      sha256sum p2pool-salvium-${RELEASE_VERSION}-linux-riscv64.tar.gz >> sha256sums.txt || true
      sha256sum p2pool-salvium-${RELEASE_VERSION}-windows-x64.zip >> sha256sums.txt || true
      sha256sum p2pool-salvium-${RELEASE_VERSION}-macos-x64.tar.gz >> sha256sums.txt || true
      sha256sum p2pool-salvium-${RELEASE_VERSION}-macos-aarch64.tar.gz >> sha256sums.txt || true
      cd ..
      sha256sum p2pool_source-${RELEASE_VERSION}.tar.xz >> build/sha256sums.txt || true
    # Upload all artifacts to releases repo Generic Package Registry
    - PKG_URL="${CI_API_V4_URL}/projects/${RELEASES_PROJECT_ID}/packages/generic/p2pool-salvium/${RELEASE_VERSION}"
    - |
      upload() {
        local file="$1"
        local name
        name="$(basename "$file")"
        if [ ! -f "$file" ]; then echo "SKIP (missing): ${name}"; return 1; fi
        echo "Uploading ${name}..."
        curl --fail --silent --show-error \
          --header "PRIVATE-TOKEN: ${RELEASES_TOKEN}" \
          --upload-file "${file}" \
          "${PKG_URL}/${name}" && echo " OK" || { echo " FAILED"; return 1; }
      }
      upload build/p2pool-salvium-${RELEASE_VERSION}-linux-x64.tar.gz || true
      upload build/p2pool-salvium-${RELEASE_VERSION}-linux-x64-static.tar.gz || true
      upload build/p2pool-salvium-${RELEASE_VERSION}-linux-aarch64.tar.gz || true
      upload build/p2pool-salvium-${RELEASE_VERSION}-linux-riscv64.tar.gz || true
      upload build/p2pool-salvium-${RELEASE_VERSION}-windows-x64.zip || true
      upload build/p2pool-salvium-${RELEASE_VERSION}-macos-x64.tar.gz || true
      upload build/p2pool-salvium-${RELEASE_VERSION}-macos-aarch64.tar.gz || true
      upload build/sha256sums.txt || true
      upload p2pool_source-${RELEASE_VERSION}.tar.xz || true
    # Build release description
    - |
      cat > /tmp/release_desc.md <<EOF
      ## P2Pool Salvium ${RELEASE_VERSION}

      ### Downloads
      | Platform | Architecture | File |
      |----------|--------------|------|
      | Linux | x64 (glibc) | p2pool-salvium-${RELEASE_VERSION}-linux-x64.tar.gz |
      | Linux | x64 (static/musl) | p2pool-salvium-${RELEASE_VERSION}-linux-x64-static.tar.gz |
      | Linux | aarch64 | p2pool-salvium-${RELEASE_VERSION}-linux-aarch64.tar.gz |
      | Linux | riscv64 | p2pool-salvium-${RELEASE_VERSION}-linux-riscv64.tar.gz |
      | macOS | x64 (Intel) | p2pool-salvium-${RELEASE_VERSION}-macos-x64.tar.gz |
      | macOS | aarch64 (Apple Silicon) | p2pool-salvium-${RELEASE_VERSION}-macos-aarch64.tar.gz |
      | Windows | x64 | p2pool-salvium-${RELEASE_VERSION}-windows-x64.zip |

      ### Verify Downloads
      \`\`\`
      sha256sum -c sha256sums.txt
      \`\`\`
      EOF
    # Create release in the releases repo via API
    - |
      jq -n \
        --arg tag "${RELEASE_VERSION}" \
        --arg name "P2Pool Salvium ${RELEASE_VERSION}" \
        --rawfile desc /tmp/release_desc.md \
        --arg pkg "${PKG_URL}" \
        '{
          tag_name: $tag,
          name: $name,
          ref: "main",
          description: $desc,
          assets: { links: [
            { name: "Linux x64 (glibc)",            url: ($pkg + "/p2pool-salvium-" + $tag + "-linux-x64.tar.gz"),        link_type: "package" },
            { name: "Linux x64 (static/musl)",      url: ($pkg + "/p2pool-salvium-" + $tag + "-linux-x64-static.tar.gz"), link_type: "package" },
            { name: "Linux aarch64",                 url: ($pkg + "/p2pool-salvium-" + $tag + "-linux-aarch64.tar.gz"),    link_type: "package" },
            { name: "Linux riscv64",                 url: ($pkg + "/p2pool-salvium-" + $tag + "-linux-riscv64.tar.gz"),    link_type: "package" },
            { name: "Windows x64",                   url: ($pkg + "/p2pool-salvium-" + $tag + "-windows-x64.zip"),        link_type: "package" },
            { name: "macOS x64 (Intel)",             url: ($pkg + "/p2pool-salvium-" + $tag + "-macos-x64.tar.gz"),       link_type: "package" },
            { name: "macOS aarch64 (Apple Silicon)", url: ($pkg + "/p2pool-salvium-" + $tag + "-macos-aarch64.tar.gz"),   link_type: "package" },
            { name: "SHA256 Checksums",              url: ($pkg + "/sha256sums.txt"),                                     link_type: "other"   },
            { name: "Source",                        url: ($pkg + "/p2pool_source-" + $tag + ".tar.xz"),                  link_type: "other"   }
          ]}
        }' > /tmp/release.json
      curl --fail --header "PRIVATE-TOKEN: ${RELEASES_TOKEN}" \
        --header "Content-Type: application/json" \
        --request POST \
        "${CI_API_V4_URL}/projects/${RELEASES_PROJECT_ID}/releases" \
        --data @/tmp/release.json