Build.yml

name: Build

on:
  push:
    branches-ignore:
      - 'unixdomain'

jobs:
  windows-mingw:
    name: Windows (MinGW-w64 cross)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - name: Update OS and Compilers
        run: |
          sudo apt install -y cmake ninja-build
          sudo apt install -y mingw-w64 nasm

      - name: Build proxy
        run: |
          cmake -S . -B build -DCMAKE_TOOLCHAIN_FILE=./cmake/mingw.cmake -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_BUILD_TYPE=Release -DBOOST_EXCLUDE_LIBRARIES="stacktrace;redis;mysql;multiprecision;log;iostreams;charconv;locale" -G Ninja
          cmake --build build --config Release

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-mingw_w64
          path: |
            build/bin/release/proxy_server.exe
            build/bin/release/launcher.exe

  linux-musl-docker:
    name: Linux (musl, docker)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - name: Build proxy
        run: |
          docker build . -t proxy:v1
          docker create --name ps proxy:v1
          mkdir -p build/docker
          docker cp ps:/usr/local/bin/proxy_server build/docker
          docker cp ps:/usr/local/bin/launcher build/docker

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-linux_musl_x64
          path: build/docker/

  ##############################################################################
  # Linux (glibc, gcc): 覆盖 boringssl / openssl(系统) / openssl(内置) / wolfssl
  # 三种 TLS 后端, 并与 snmalloc / mimalloc / io_uring / PAM 组合.
  ##############################################################################
  linux-glibc-gcc:
    name: Linux (glibc, gcc) - ${{ matrix.name }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - { name: boringssl, ssl: boringssl }
          - { name: boringssl-pam, ssl: boringssl, pam: true }
          - { name: boringssl-snmalloc, ssl: boringssl, alloc: snmalloc }
          - { name: boringssl-iouring, ssl: boringssl, uring: true }
          - { name: openssl-system, ssl: openssl-system }
          - { name: openssl-system-snmalloc, ssl: openssl-system, alloc: snmalloc }
          - { name: openssl-system-iouring-snmalloc, ssl: openssl-system, alloc: snmalloc, uring: true }
          - { name: openssl-bundled, ssl: openssl-bundled }
          - { name: wolfssl, ssl: wolfssl }
          - { name: wolfssl-snmalloc, ssl: wolfssl, alloc: snmalloc }
          - { name: mimalloc, ssl: boringssl, alloc: mimalloc }
    steps:
      - uses: actions/checkout@v6

      - name: Install dependencies
        shell: bash
        run: |
          set -euxo pipefail
          sudo apt update
          sudo apt install -y cmake ninja-build
          if [ "${{ matrix.ssl }}" = "openssl-system" ]; then
            sudo apt install -y libssl-dev
          fi
          if [ "${{ matrix.pam }}" = "true" ]; then
            sudo apt install -y libpam0g-dev
          fi
          if [ "${{ matrix.uring }}" = "true" ]; then
            sudo apt install -y liburing-dev
          fi
          if [ "${{ matrix.alloc }}" = "mimalloc" ]; then
            git clone --depth 1 --branch v2.1.2 https://github.com/microsoft/mimalloc.git
            cd mimalloc && mkdir build && cd build
            cmake -DCMAKE_BUILD_TYPE=Release -DENABLE_SNMALLOC_STATIC=OFF \
              -DMI_BUILD_STATIC=ON -DMI_BUILD_SHARED=OFF -DMI_BUILD_TESTS=OFF -DMI_BUILD_OBJECT=ON ..
            make -j4
            sudo make install
          fi

      - name: Build proxy (${{ matrix.name }})
        shell: bash
        run: |
          set -euxo pipefail
          case "${{ matrix.ssl }}" in
            boringssl)
              SSL_ARGS="-DENABLE_USE_OPENSSL=OFF -DENABLE_USE_BORINGSSL=ON -DENABLE_USE_WOLFSSL=OFF" ;;
            openssl-system)
              SSL_ARGS="-DENABLE_USE_OPENSSL=ON -DENABLE_SYSTEM_OPENSSL=ON -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=OFF" ;;
            openssl-bundled)
              SSL_ARGS="-DENABLE_USE_OPENSSL=ON -DENABLE_SYSTEM_OPENSSL=OFF -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=OFF" ;;
            wolfssl)
              SSL_ARGS="-DENABLE_USE_OPENSSL=OFF -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=ON" ;;
          esac
          ALLOC_ARGS=""
          if [ "${{ matrix.alloc }}" = "snmalloc" ]; then ALLOC_ARGS="-DENABLE_SNMALLOC_STATIC=ON"; fi
          if [ "${{ matrix.alloc }}" = "mimalloc" ]; then ALLOC_ARGS="-DENABLE_MIMALLOC_STATIC=ON"; fi
          URING_ARGS=""
          if [ "${{ matrix.uring }}" = "true" ]; then URING_ARGS="-DENABLE_USE_IO_URING=ON"; fi
          PAM_ARGS=""
          if [ "${{ matrix.pam }}" = "true" ]; then PAM_ARGS="-DENABLE_USE_PAM_AUTH=ON"; fi

          cmake -S . -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DENABLE_BUILD_WERROR=OFF -DENABLE_BUILD_EXAMPLES=OFF \
            $SSL_ARGS $ALLOC_ARGS $URING_ARGS $PAM_ARGS
          cmake --build build --config Release

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-linux_glibc_x64_${{ matrix.name }}
          path: |
            build/bin/proxy_server
            build/bin/launcher

  ##############################################################################
  # Linux (glibc, clang): 覆盖 clang 编译下的不同 TLS 后端及 libc++.
  ##############################################################################
  linux-glibc-clang:
    name: Linux (glibc, clang) - ${{ matrix.name }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - { name: boringssl-snmalloc, ssl: boringssl, alloc: snmalloc }
          - { name: openssl-system, ssl: openssl-system }
          - { name: openssl-system-libcxx, ssl: openssl-system, libcxx: true }
          - { name: wolfssl, ssl: wolfssl }
    steps:
      - uses: actions/checkout@v6

      - name: Install dependencies
        shell: bash
        run: |
          set -euxo pipefail
          sudo apt update
          sudo apt install -y cmake ninja-build clang
          if [ "${{ matrix.ssl }}" = "openssl-system" ]; then
            sudo apt install -y libssl-dev
          fi
          if [ "${{ matrix.libcxx }}" = "true" ]; then
            sudo apt install -y libc++-dev
          fi

      - name: Build proxy (${{ matrix.name }})
        shell: bash
        run: |
          set -euxo pipefail
          case "${{ matrix.ssl }}" in
            boringssl)
              SSL_ARGS="-DENABLE_USE_OPENSSL=OFF -DENABLE_USE_BORINGSSL=ON -DENABLE_USE_WOLFSSL=OFF" ;;
            openssl-system)
              SSL_ARGS="-DENABLE_USE_OPENSSL=ON -DENABLE_SYSTEM_OPENSSL=ON -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=OFF" ;;
            wolfssl)
              SSL_ARGS="-DENABLE_USE_OPENSSL=OFF -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=ON" ;;
          esac
          ALLOC_ARGS=""
          if [ "${{ matrix.alloc }}" = "snmalloc" ]; then ALLOC_ARGS="-DENABLE_SNMALLOC_STATIC=ON"; fi
          LIBCXX_ARGS=""
          if [ "${{ matrix.libcxx }}" = "true" ]; then LIBCXX_ARGS="-DENABLE_BUILD_WITH_LIBCXX=ON"; fi

          CC=clang CXX=clang++ cmake -S . -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DENABLE_BUILD_WERROR=OFF -DENABLE_BUILD_EXAMPLES=OFF \
            $SSL_ARGS $ALLOC_ARGS $LIBCXX_ARGS
          cmake --build build --config Release

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-linux_glibc_x64_clang_${{ matrix.name }}
          path: |
            build/bin/proxy_server
            build/bin/launcher

  ##############################################################################
  # Linux (musl / Alpine): 静态构建, 覆盖 boringssl 与 wolfssl+snmalloc.
  ##############################################################################
  linux-musl-alpine:
    name: Linux (musl, alpine, clang) - ${{ matrix.name }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - { name: boringssl, ssl: boringssl }
          - { name: wolfssl-snmalloc, ssl: wolfssl, alloc: snmalloc }
    container:
      image: alpine:3.20.1
    steps:
      - name: Install packages
        run: apk add bash git nasm yasm pkgconfig build-base clang cmake ninja linux-headers linux-pam-dev

      - uses: actions/checkout@v6

      - name: Build proxy (${{ matrix.name }})
        shell: bash
        run: |
          set -euxo pipefail
          case "${{ matrix.ssl }}" in
            boringssl)
              SSL_ARGS="-DENABLE_USE_OPENSSL=OFF -DENABLE_USE_BORINGSSL=ON -DENABLE_USE_WOLFSSL=OFF" ;;
            wolfssl)
              SSL_ARGS="-DENABLE_USE_OPENSSL=OFF -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=ON" ;;
          esac
          ALLOC_ARGS=""
          if [ "${{ matrix.alloc }}" = "snmalloc" ]; then ALLOC_ARGS="-DENABLE_SNMALLOC_STATIC=ON"; fi
          CC=clang CXX=clang++ cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_EXE_LINKER_FLAGS="-static" \
            -DENABLE_BUILD_WERROR=OFF -DENABLE_BUILD_EXAMPLES=OFF \
            $SSL_ARGS $ALLOC_ARGS -G Ninja
          cmake --build build --config Release

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-alpine_musl_x64_${{ matrix.name }}
          path: |
            build/bin/proxy_server
            build/bin/launcher

  linux-clang-lto-pgo-openssl:
    name: Linux (clang, LTO+PGO, system openssl, snmalloc)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - name: Build proxy (clang + snmalloc + system openssl, LTO+PGO)
        run: |
          # 在 ubuntu:22.04 容器内用 clang 14 构建, 保证产物 glibc 符号 <= 2.35,
          # 与 doc/pgo/README.md 的 VPS 高优化构建一致.
          docker run --rm -i \
            -e DEBIAN_FRONTEND=noninteractive \
            -v "$GITHUB_WORKSPACE":/workspace \
            -w /workspace \
            ubuntu:22.04 \
            bash -s <<'PGO_EOF'
          set -euxo pipefail

          # ==== toolchain (ubuntu 22.04 默认 clang 即 clang 14) ====
          apt-get update -qq
          apt-get install -y -qq --no-install-recommends \
            ca-certificates git cmake ninja-build pkg-config \
            clang g++ libssl-dev curl python3 openssl llvm-14

          # 容器以 root 运行, checkout 的仓库属于 runner 用户, 需要放行 safe.directory
          # 否则 gitGetVersion 拿不到 commit hash. (需在安装 git 之后执行)
          git config --global --add safe.directory /workspace

          # ==== Phase 1: PGO 埋点构建 ====
          cmake -S /workspace -B /workspace/build-pgo-instr -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \
            -DENABLE_BUILD_WERROR=OFF \
            -DENABLE_USE_OPENSSL=ON -DENABLE_SYSTEM_OPENSSL=ON \
            -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=OFF \
            -DENABLE_SNMALLOC_STATIC=ON \
            -DENABLE_BUILD_EXAMPLES=OFF \
            -DCMAKE_C_FLAGS="-fprofile-instr-generate" \
            -DCMAKE_CXX_FLAGS="-fprofile-instr-generate -mcx16" \
            -DCMAKE_EXE_LINKER_FLAGS="-fprofile-instr-generate"
          ninja -C /workspace/build-pgo-instr -j2

          # ==== Phase 2: 用真实代理流量采集 PGO profile ====
          # 自签证书, 供 proxy 的 TLS 终结模式使用 (内容嗅探 cert.pem/key.pem).
          mkdir -p /workspace/pgo-ci/cert
          openssl req -x509 -newkey rsa:2048 -keyout /workspace/pgo-ci/cert/key.pem \
            -out /workspace/pgo-ci/cert/cert.pem -days 2 -nodes -subj "/CN=localhost" >/dev/null 2>&1

          mkdir -p /tmp/www
          dd if=/dev/urandom of=/tmp/www/blob.bin bs=1M count=256 status=none
          (cd /tmp/www && python3 -m http.server 18080 --bind 127.0.0.1 >/dev/null 2>&1) &
          HTTP_PID=$!

          wait_port() {
            local port=$1
            for i in $(seq 1 50); do
              (exec 3<>"/dev/tcp/127.0.0.1/$port") 2>/dev/null && break
              sleep 0.2
            done
          }
          wait_proxy() {
            local port=$1 pid=$2
            for i in $(seq 1 50); do
              if ! kill -0 "$pid" 2>/dev/null; then
                echo "FAIL: proxy (pid $pid) died before opening port $port" >&2
                exit 1
              fi
              (exec 3<>"/dev/tcp/127.0.0.1/$port") 2>/dev/null && return 0
              sleep 0.2
            done
            echo "FAIL: proxy (pid $pid) did not open port $port in time" >&2
            exit 1
          }
          wait_exit() {
            local pid=$1
            for i in $(seq 1 100); do
              kill -0 "$pid" 2>/dev/null || return 0
              sleep 0.2
            done
            # 优雅退出失败则强杀, 避免 CI 挂起 (该次 profile 丢失, 不影响整体).
            kill -KILL "$pid" 2>/dev/null || true
            wait "$pid" 2>/dev/null || true
          }

          wait_port 18080
          export LLVM_PROFILE_FILE=/workspace/pgo-ci/pgo-%p.profraw

          # Run 1: TLS 终结代理 -> 覆盖 SSL 引擎 (批量 TLS 写) + CONNECT 隧道 + HTTP 转发
          /workspace/build-pgo-instr/bin/proxy_server \
            --server_listen 127.0.0.1:18081 --auth_users "" --disable_logs 1 \
            --ssl_certificate_dir /workspace/pgo-ci/cert >/dev/null 2>&1 &
          TLS_PID=$!
          wait_proxy 18081 "$TLS_PID"
          curl -sS --proxy-insecure -x https://127.0.0.1:18081/ --proxytunnel -o /dev/null http://127.0.0.1:18080/blob.bin
          curl -sS --proxy-insecure -x https://127.0.0.1:18081/ --proxytunnel -o /dev/null http://127.0.0.1:18080/blob.bin
          curl -sS --proxy-insecure -x https://127.0.0.1:18081/ -o /dev/null http://127.0.0.1:18080/blob.bin
          kill -TERM "$TLS_PID"
          wait_exit "$TLS_PID"

          # Run 2: 明文 HTTP 代理 -> 覆盖非 TLS 转发路径
          /workspace/build-pgo-instr/bin/proxy_server \
            --server_listen 127.0.0.1:18082 --auth_users "" --disable_logs 1 >/dev/null 2>&1 &
          PLAIN_PID=$!
          wait_proxy 18082 "$PLAIN_PID"
          curl -sS -x http://127.0.0.1:18082 -o /dev/null http://127.0.0.1:18080/blob.bin
          kill -TERM "$PLAIN_PID"
          wait_exit "$PLAIN_PID"

          unset LLVM_PROFILE_FILE
          kill "$HTTP_PID" 2>/dev/null || true

          nprof=$(ls /workspace/pgo-ci/*.profraw 2>/dev/null | wc -l)
          echo "collected $nprof profraw file(s)"
          [ "$nprof" -ge 1 ] || { echo "FAIL: no profile collected"; exit 1; }

          # ==== Phase 3: 合并 profile + LTO+PGO 最终构建 ====
          llvm-profdata-14 merge /workspace/pgo-ci/*.profraw -o /workspace/pgo-ci/merged.profdata
          rm -rf /workspace/build-pgo-instr

          cmake -S /workspace -B /workspace/build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \
            -DENABLE_BUILD_WERROR=OFF \
            -DENABLE_USE_OPENSSL=ON -DENABLE_SYSTEM_OPENSSL=ON \
            -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=OFF \
            -DENABLE_SNMALLOC_STATIC=ON \
            -DENABLE_BUILD_EXAMPLES=OFF \
            -DCMAKE_C_FLAGS="-flto=thin -fprofile-instr-use=/workspace/pgo-ci/merged.profdata -Wno-error=profile-instr-unprofiled -Wno-error=profile-instr-out-of-date" \
            -DCMAKE_CXX_FLAGS="-flto=thin -fprofile-instr-use=/workspace/pgo-ci/merged.profdata -Wno-error=profile-instr-unprofiled -Wno-error=profile-instr-out-of-date -mcx16" \
            -DCMAKE_EXE_LINKER_FLAGS="-flto=thin -fprofile-instr-use=/workspace/pgo-ci/merged.profdata"
          ninja -C /workspace/build -j2

          # ==== 验证产物 ====
          ls -la /workspace/build/bin/proxy_server
          /workspace/build/bin/proxy_server --help 2>&1 | head -1 || true
          ldd /workspace/build/bin/proxy_server 2>&1 | grep -E 'ssl|crypto' || true
          PGO_EOF

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-linux_x64_clang_lto_pgo
          path: |
            build/bin/proxy_server
            build/bin/launcher

  linux-clang-lto-pgo-iouring-openssl:
    name: Linux (clang, LTO+PGO, io_uring, system openssl, snmalloc)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      # io_uring 会被 docker 默认 seccomp 拦截, 因此 profile 采集放到宿主机.
      # 埋点二进制在容器内构建 (glibc <= 2.35), 宿主机 glibc 2.39 可直接运行.
      - name: Install host dependencies for profile collection
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq libssl3t64 liburing2 libatomic1 curl python3 openssl

      - name: Build proxy (clang + snmalloc + system openssl + io_uring, LTO+PGO)
        run: |
          set -euxo pipefail

          # ===== Phase 1: 容器内 PGO 埋点构建 (io_uring) =====
          docker run --rm -i \
            -e DEBIAN_FRONTEND=noninteractive \
            -v "$GITHUB_WORKSPACE":/workspace \
            -w /workspace \
            ubuntu:22.04 \
            bash -s <<'PGO_INSTR'
          set -euxo pipefail
          apt-get update -qq
          apt-get install -y -qq --no-install-recommends \
            ca-certificates git cmake ninja-build pkg-config \
            clang g++ libssl-dev liburing-dev curl python3 openssl llvm-14

          # 容器以 root 运行, checkout 的仓库属于 runner 用户, 需要放行 safe.directory
          # 否则 gitGetVersion 拿不到 commit hash. (需在安装 git 之后执行)
          git config --global --add safe.directory /workspace
          cmake -S /workspace -B /workspace/build-pgo-instr -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \
            -DENABLE_BUILD_WERROR=OFF \
            -DENABLE_USE_IO_URING=ON \
            -DENABLE_USE_OPENSSL=ON -DENABLE_SYSTEM_OPENSSL=ON \
            -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=OFF \
            -DENABLE_SNMALLOC_STATIC=ON \
            -DENABLE_BUILD_EXAMPLES=OFF \
            -DCMAKE_C_FLAGS="-fprofile-instr-generate" \
            -DCMAKE_CXX_FLAGS="-fprofile-instr-generate -mcx16" \
            -DCMAKE_EXE_LINKER_FLAGS="-luring -fprofile-instr-generate"
          ninja -C /workspace/build-pgo-instr -j2
          PGO_INSTR

          # ===== Phase 2: 宿主机采集 profile (io_uring 原生可用) =====
          mkdir -p "$GITHUB_WORKSPACE/pgo-ci/cert"
          openssl req -x509 -newkey rsa:2048 \
            -keyout "$GITHUB_WORKSPACE/pgo-ci/cert/key.pem" \
            -out "$GITHUB_WORKSPACE/pgo-ci/cert/cert.pem" \
            -days 2 -nodes -subj "/CN=localhost" >/dev/null 2>&1

          mkdir -p /tmp/www
          dd if=/dev/urandom of=/tmp/www/blob.bin bs=1M count=256 status=none
          (cd /tmp/www && python3 -m http.server 18080 --bind 127.0.0.1 >/dev/null 2>&1) &
          HTTP_PID=$!

          wait_port() {
            local port=$1
            for i in $(seq 1 50); do
              (exec 3<>"/dev/tcp/127.0.0.1/$port") 2>/dev/null && break
              sleep 0.2
            done
          }
          wait_proxy() {
            local port=$1 pid=$2
            for i in $(seq 1 50); do
              if ! kill -0 "$pid" 2>/dev/null; then
                echo "FAIL: proxy (pid $pid) died before opening port $port" >&2
                exit 1
              fi
              (exec 3<>"/dev/tcp/127.0.0.1/$port") 2>/dev/null && return 0
              sleep 0.2
            done
            echo "FAIL: proxy (pid $pid) did not open port $port in time" >&2
            exit 1
          }
          wait_exit() {
            local pid=$1
            for i in $(seq 1 100); do
              kill -0 "$pid" 2>/dev/null || return 0
              sleep 0.2
            done
            # 优雅退出失败则强杀, 避免 CI 挂起 (该次 profile 丢失, 不影响整体).
            kill -KILL "$pid" 2>/dev/null || true
            wait "$pid" 2>/dev/null || true
          }

          wait_port 18080
          export LLVM_PROFILE_FILE="$GITHUB_WORKSPACE/pgo-ci/pgo-%p.profraw"

          # Run 1: TLS 终结代理 -> SSL 引擎 + CONNECT 隧道 + HTTP 转发
          "$GITHUB_WORKSPACE/build-pgo-instr/bin/proxy_server" \
            --server_listen 127.0.0.1:18081 --auth_users "" --disable_logs 1 \
            --ssl_certificate_dir "$GITHUB_WORKSPACE/pgo-ci/cert" >/dev/null 2>&1 &
          TLS_PID=$!
          wait_proxy 18081 "$TLS_PID"
          curl -sS --proxy-insecure -x https://127.0.0.1:18081/ --proxytunnel -o /dev/null http://127.0.0.1:18080/blob.bin
          curl -sS --proxy-insecure -x https://127.0.0.1:18081/ --proxytunnel -o /dev/null http://127.0.0.1:18080/blob.bin
          curl -sS --proxy-insecure -x https://127.0.0.1:18081/ -o /dev/null http://127.0.0.1:18080/blob.bin
          kill -TERM "$TLS_PID"
          wait_exit "$TLS_PID"

          # Run 2: 明文 HTTP 代理 -> 非 TLS 转发路径
          "$GITHUB_WORKSPACE/build-pgo-instr/bin/proxy_server" \
            --server_listen 127.0.0.1:18082 --auth_users "" --disable_logs 1 >/dev/null 2>&1 &
          PLAIN_PID=$!
          wait_proxy 18082 "$PLAIN_PID"
          curl -sS -x http://127.0.0.1:18082 -o /dev/null http://127.0.0.1:18080/blob.bin
          kill -TERM "$PLAIN_PID"
          wait_exit "$PLAIN_PID"

          unset LLVM_PROFILE_FILE
          kill "$HTTP_PID" 2>/dev/null || true

          nprof=$(ls "$GITHUB_WORKSPACE"/pgo-ci/*.profraw 2>/dev/null | wc -l)
          echo "collected $nprof profraw file(s)"
          [ "$nprof" -ge 1 ] || { echo "FAIL: no profile collected"; exit 1; }

          # ===== Phase 3: 容器内合并 profile + LTO+PGO 最终构建 (io_uring) =====
          docker run --rm -i \
            -e DEBIAN_FRONTEND=noninteractive \
            -v "$GITHUB_WORKSPACE":/workspace \
            -w /workspace \
            ubuntu:22.04 \
            bash -s <<'PGO_FINAL'
          set -euxo pipefail
          apt-get update -qq
          apt-get install -y -qq --no-install-recommends \
            ca-certificates git cmake ninja-build pkg-config \
            clang g++ libssl-dev liburing-dev curl python3 openssl llvm-14

          # 容器以 root 运行, checkout 的仓库属于 runner 用户, 需要放行 safe.directory
          # 否则 gitGetVersion 拿不到 commit hash. (需在安装 git 之后执行)
          git config --global --add safe.directory /workspace
          llvm-profdata-14 merge /workspace/pgo-ci/*.profraw -o /workspace/pgo-ci/merged.profdata
          rm -rf /workspace/build-pgo-instr
          cmake -S /workspace -B /workspace/build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \
            -DENABLE_BUILD_WERROR=OFF \
            -DENABLE_USE_IO_URING=ON \
            -DENABLE_USE_OPENSSL=ON -DENABLE_SYSTEM_OPENSSL=ON \
            -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=OFF \
            -DENABLE_SNMALLOC_STATIC=ON \
            -DENABLE_BUILD_EXAMPLES=OFF \
            -DCMAKE_C_FLAGS="-flto=thin -fprofile-instr-use=/workspace/pgo-ci/merged.profdata -Wno-error=profile-instr-unprofiled -Wno-error=profile-instr-out-of-date" \
            -DCMAKE_CXX_FLAGS="-flto=thin -fprofile-instr-use=/workspace/pgo-ci/merged.profdata -Wno-error=profile-instr-unprofiled -Wno-error=profile-instr-out-of-date -mcx16" \
            -DCMAKE_EXE_LINKER_FLAGS="-luring -flto=thin -fprofile-instr-use=/workspace/pgo-ci/merged.profdata"
          ninja -C /workspace/build -j2
          ls -la /workspace/build/bin/proxy_server
          /workspace/build/bin/proxy_server --help 2>&1 | head -1 || true
          PGO_FINAL

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-linux_x64_clang_lto_pgo_iouring
          path: |
            build/bin/proxy_server
            build/bin/launcher

  openwrt-x86-64-musl-clang:
    name: OpenWrt (x86_64, musl, clang, system openssl, io_uring)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - name: Install toolchain
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq --no-install-recommends \
            cmake ninja-build clang lld llvm curl xz-utils make perl

      # OpenWrt 23.05 x86_64: musl libc, 系统 openssl 3.0.16.
      # 使用 buildroot musl 交叉工具链 + 宿主 clang 交叉编译 (与 doc 一致).
      - name: Download musl cross toolchain
        run: |
          curl -fsSL -o /tmp/toolchain.tar.xz \
            https://toolchains.bootlin.com/downloads/releases/toolchains/x86-64/tarballs/x86-64--musl--bleeding-edge-2025.08-1.tar.xz
          mkdir -p "$HOME/crossdevelop"
          tar -xJf /tmp/toolchain.tar.xz -C "$HOME/crossdevelop"

      - name: Cross-build openssl and liburing
        run: |
          set -euxo pipefail
          TC="$HOME/crossdevelop/x86-64--musl--bleeding-edge-2025.08-1"
          SYSROOT="$TC/x86_64-buildroot-linux-musl/sysroot"
          STAGE="$GITHUB_WORKSPACE/owrt-stage"
          mkdir -p "$STAGE/openssl" "$STAGE/liburing/include/liburing" "$STAGE/liburing/lib" "$STAGE/src"

          # openssl 3.0.16: 版本需与 OpenWrt 系统 openssl 一致 (运行时 ABI 匹配).
          curl -fsSL -o /tmp/openssl.tar.gz https://www.openssl.org/source/openssl-3.0.16.tar.gz
          tar -xzf /tmp/openssl.tar.gz -C "$STAGE/src"
          cd "$STAGE/src/openssl-3.0.16"
          ./Configure linux-x86_64-clang \
            --prefix="$STAGE/openssl" --openssldir="$STAGE/openssl/ssl" \
            no-tests no-asm shared \
            CC="clang --target=x86_64-buildroot-linux-musl --gcc-toolchain=$TC --sysroot=$SYSROOT" \
            AR=llvm-ar RANLIB=llvm-ranlib
          make -j"$(nproc)" build_libs
          make install_sw

          # liburing 2.7: 路由器没有该库, 静态链接.
          curl -fsSL -o /tmp/liburing.tar.gz \
            https://github.com/axboe/liburing/archive/refs/tags/liburing-2.7.tar.gz
          tar -xzf /tmp/liburing.tar.gz -C "$STAGE/src"
          cd "$STAGE/src/liburing-liburing-2.7"
          CC="clang --target=x86_64-buildroot-linux-musl --gcc-toolchain=$TC --sysroot=$SYSROOT" ./configure
          make -j"$(nproc)" library \
            CC="clang --target=x86_64-buildroot-linux-musl --gcc-toolchain=$TC --sysroot=$SYSROOT" \
            AR=llvm-ar RANLIB=llvm-ranlib \
            CFLAGS="-fPIC -O2"
          cp src/include/liburing.h "$STAGE/liburing/include/"
          cp src/include/liburing/*.h "$STAGE/liburing/include/liburing/"
          cp src/liburing.a "$STAGE/liburing/lib/"

      - name: Generate clang cross toolchain file
        run: |
          TC="$HOME/crossdevelop/x86-64--musl--bleeding-edge-2025.08-1"
          SYSROOT="$TC/x86_64-buildroot-linux-musl/sysroot"
          STAGE="$GITHUB_WORKSPACE/owrt-stage"
          cat > "$GITHUB_WORKSPACE/openwrt-clang-musl.cmake" <<EOF
          set(CMAKE_SYSTEM_NAME Linux)
          set(CMAKE_SYSTEM_PROCESSOR x86_64)
          set(CMAKE_C_COMPILER clang)
          set(CMAKE_CXX_COMPILER clang++)
          set(CMAKE_C_COMPILER_TARGET x86_64-buildroot-linux-musl)
          set(CMAKE_CXX_COMPILER_TARGET x86_64-buildroot-linux-musl)
          set(TOOLCHAIN_ROOT $TC)
          set(CMAKE_SYSROOT $SYSROOT)
          # 头文件须对所有编译单元可见 (asio ssl/io_uring 后端), 不只链接目标.
          set(CMAKE_C_FLAGS "--gcc-toolchain=$TC -D_GNU_SOURCE -isystem $STAGE/openssl/include -isystem $STAGE/liburing/include" CACHE STRING "" FORCE)
          set(CMAKE_CXX_FLAGS "--gcc-toolchain=$TC -D_GNU_SOURCE -isystem $STAGE/openssl/include -isystem $STAGE/liburing/include" CACHE STRING "" FORCE)
          # 路由器 libstdc++ 较旧须静态链接; --as-needed 丢弃无引用的 libatomic.
          set(CMAKE_EXE_LINKER_FLAGS "-fuse-ld=lld -static-libstdc++ -static-libgcc -Wl,--as-needed" CACHE STRING "" FORCE)
          set(CMAKE_SHARED_LINKER_FLAGS "-fuse-ld=lld" CACHE STRING "" FORCE)
          # 不把宿主 staging 路径写入 ELF RUNPATH; 运行时从路由器 /usr/lib 解析系统 openssl.
          set(CMAKE_SKIP_BUILD_RPATH TRUE CACHE BOOL "" FORCE)
          set(CMAKE_SKIP_RPATH TRUE CACHE BOOL "" FORCE)
          set(CMAKE_AR llvm-ar)
          set(CMAKE_RANLIB llvm-ranlib)
          set(CMAKE_NM llvm-nm)
          set(CMAKE_STRIP llvm-strip)
          set(CMAKE_FIND_ROOT_PATH $STAGE/openssl $STAGE/liburing $SYSROOT)
          set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
          set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
          set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
          set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)
          EOF

      - name: Build proxy (clang + snmalloc + system openssl + io_uring)
        run: |
          cmake -S . -B build-openwrt -G Ninja \
            -DCMAKE_TOOLCHAIN_FILE="$GITHUB_WORKSPACE/openwrt-clang-musl.cmake" \
            -DCMAKE_BUILD_TYPE=Release \
            -DENABLE_SYSTEM_OPENSSL=ON \
            -DENABLE_SNMALLOC_STATIC=ON \
            -DENABLE_USE_IO_URING=ON \
            -DBOOST_FILESYSTEM_DISABLE_STATX=ON \
            -DOPENSSL_INCLUDE_DIR="$GITHUB_WORKSPACE/owrt-stage/openssl/include" \
            -DOPENSSL_SSL_LIBRARY="$GITHUB_WORKSPACE/owrt-stage/openssl/lib64/libssl.so" \
            -DOPENSSL_CRYPTO_LIBRARY="$GITHUB_WORKSPACE/owrt-stage/openssl/lib64/libcrypto.so" \
            -DIOUring_INCLUDE_DIR="$GITHUB_WORKSPACE/owrt-stage/liburing/include" \
            -DIOUring_LIBRARY="$GITHUB_WORKSPACE/owrt-stage/liburing/lib/liburing.a"
          ninja -C build-openwrt proxy_server launcher

      - name: Verify artifacts
        run: |
          file build-openwrt/bin/proxy_server build-openwrt/bin/launcher
          echo "NEEDED:"; readelf -d build-openwrt/bin/proxy_server | grep NEEDED || true
          ls -la build-openwrt/bin/proxy_server build-openwrt/bin/launcher

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-openwrt_x86_64_clang_musl
          path: |
            build-openwrt/bin/proxy_server
            build-openwrt/bin/launcher

  ##############################################################################
  # macOS: Universal Binary (x86_64 + arm64), 覆盖 boringssl 与 wolfssl.
  ##############################################################################
  macos-universal:
    name: macOS (Universal x86_64+arm64) - ${{ matrix.name }}
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - { name: universal, ssl: boringssl }
          - { name: universal-wolfssl, ssl: wolfssl }
    steps:
      - uses: actions/checkout@v6

      - name: Install dependencies
        run: |
          brew install cmake ninja

      - name: "Build proxy (${{ matrix.name }}) (Universal Binary: x86_64 + arm64)"
        shell: bash
        run: |
          case "${{ matrix.ssl }}" in
            boringssl)
              SSL_ARGS="-DENABLE_USE_OPENSSL=OFF -DENABLE_USE_BORINGSSL=ON -DENABLE_USE_WOLFSSL=OFF" ;;
            wolfssl)
              SSL_ARGS="-DENABLE_USE_OPENSSL=OFF -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=ON" ;;
          esac
          cmake -S . -B build \
            -DCMAKE_BUILD_TYPE=Release \
            -DENABLE_BUILD_WERROR=OFF \
            -DCMAKE_OSX_ARCHITECTURES="x86_64;arm64" \
            -DCMAKE_OSX_DEPLOYMENT_TARGET=13.0 \
            $SSL_ARGS -G Ninja
          cmake --build build --config Release

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-macos-${{ matrix.name }}
          path: |
            build/bin/proxy_server
            build/bin/launcher

  ##############################################################################
  # Windows (MSVC): 覆盖 boringssl 与 wolfssl.
  ##############################################################################
  windows-msvc:
    name: Windows (MSVC) - ${{ matrix.name }}
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - { name: boringssl, ssl: boringssl }
          - { name: wolfssl, ssl: wolfssl }
    steps:
      - uses: actions/checkout@v6

      - name: Build proxy (${{ matrix.name }})
        shell: bash
        run: |
          case "${{ matrix.ssl }}" in
            boringssl)
              SSL_ARGS="-DENABLE_USE_OPENSSL=OFF -DENABLE_USE_BORINGSSL=ON -DENABLE_USE_WOLFSSL=OFF" ;;
            wolfssl)
              SSL_ARGS="-DENABLE_USE_OPENSSL=OFF -DENABLE_USE_BORINGSSL=OFF -DENABLE_USE_WOLFSSL=ON" ;;
          esac
          cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DENABLE_BUILD_WERROR=OFF $SSL_ARGS
          cmake --build build --config Release

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-msvc_x64_${{ matrix.name }}
          path: |
            build/bin/release/proxy_server.exe
            build/bin/release/launcher.exe

  android-arm64-apk:
    name: Android (arm64-v8a, boringssl, APK)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - name: Setup Android SDK
        uses: android-actions/setup-android@v4
        with:
          # 安装 NDK: 与 flutter.ndkVersion 一致, native 编译与 gradle 共用.
          packages: 'tools platform-tools ndk;28.2.13676358'

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: stable
          flutter-version: 3.47.1
          cache: true

      - name: Build native libxproxy.so (arm64-v8a)
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build swig cmake
          # 编译 arm64 的 libxproxy.so 并自动同步到 Flutter 工程 jniLibs.
          ./build.android.sh "$GITHUB_WORKSPACE" \
            "$ANDROID_SDK_ROOT/ndk/28.2.13676358" linux-x86_64 arm64-v8a

      - name: Build Android apk
        working-directory: apps/android/xproxy
        run: |
          flutter pub get
          flutter build apk --release

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: proxy_server-android-release-apk
          path: |
            apps/android/xproxy/build/app/outputs/flutter-apk/app-release.apk