ci.yml

name: CI

on:
  push:
    branches-ignore:
      - 'main'
      - 'docs'

env:
  BUILDER_VERSION: v0.9.79
  BUILDER_SOURCE: releases
  BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net
  PACKAGE_NAME: aws-iot-device-sdk-cpp-v2
  LINUX_BASE_IMAGE: ubuntu-18-x64
  HEAD_REF: ${{ github.head_ref }}
  RUN: ${{ github.run_id }}-${{ github.run_number }}
  AWS_DEFAULT_REGION: us-east-1
  DA_TOPIC: test/da
  DA_SHADOW_PROPERTY: datest
  DA_SHADOW_VALUE_SET: ON
  DA_SHADOW_VALUE_DEFAULT: OFF
  CI_FOLDER: "C:/a/work"
  CI_UTILS_FOLDER: "./aws-iot-device-sdk-cpp-v2/utils"
  CI_SAMPLES_CFG_FOLDER: "./aws-iot-device-sdk-cpp-v2/.github/workflows"
  CI_SERVICE_TESTS_CFG_FOLDER: "./test_cases"
  CI_IOT_CONTAINERS: arn:aws:iam::123124136734:role/CRT_IoT_Containers
  CI_CYCLEPUBSUB_ROLE: arn:aws:iam::180635532705:role/CI_CyclePubSub_Role
  CI_FLEET_PROVISIONING_ROLE: arn:aws:iam::180635532705:role/service-role/CI_FleetProvisioning_Role
  CI_DEVICE_ADVISOR: arn:aws:iam::180635532705:role/CI_DeviceAdvisor_Role
  CI_DEVICE_DEFENDER: arn:aws:iam::180635532705:role/CI_DeviceDefender_Role
  CI_SECURE_TUNNEL: arn:aws:iam::180635532705:role/CI_SecureTunnel_Role
  CI_MQTT5_ROLE: arn:aws:iam::180635532705:role/CI_MQTT5_Role
  CI_JOBS_SERVICE_CLIENT_ROLE: arn:aws:iam::180635532705:role/CI_JobsServiceClient_Role
  CI_SHADOW_SERVICE_CLIENT_ROLE: arn:aws:iam::180635532705:role/CI_ShadowServiceClient_Role

jobs:
  linux-compat:
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        image:
          - manylinux2014-x64
          - manylinux2014-x86
          - al2-x64
          - alpine-3.16-x64
          - alpine-3.16-x86
          - alpine-3.16-armv6
          - alpine-3.16-armv7
          - alpine-3.16-arm64
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: Install qemu/docker
        run: docker run --privileged --rm tonistiigi/binfmt --install all
      - name: Build ${{ env.PACKAGE_NAME }}
        run: |
          aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
          ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ matrix.image }} build -p ${{ env.PACKAGE_NAME }} \
          --cmake-extra=-DAWS_CRT_DISABLE_DEPRECATION_WARNINGS=ON
  raspberry:
    runs-on: ubuntu-24.04 # latest
    strategy:
      fail-fast: false
      matrix:
        image:
          - raspbian-bullseye
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      # set arm arch
      - name: Install qemu/docker
        run: docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
      - name: Build ${{ env.PACKAGE_NAME }}
        run: |
          aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
          ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ matrix.image }} build -p ${{ env.PACKAGE_NAME }} \
          --cmake-extra=-DAWS_CRT_DISABLE_DEPRECATION_WARNINGS=ON
  linux-compiler-compat:
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        compiler:
          - clang-6
          - clang-8
          - clang-9
          - clang-10
          - clang-11
          - gcc-4.8
          - gcc-5
          - gcc-6
          - gcc-7
          - gcc-8
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
      - name: Build ${{ env.PACKAGE_NAME }}
        run: |
          aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
          ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --compiler=${{ matrix.compiler }} \
          --cmake-extra=-DAWS_CRT_DISABLE_DEPRECATION_WARNINGS=ON
  byo-crypto:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
    - name: configure AWS credentials (containers)
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
        # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }} --variant=skip_sample \
        --cmake-extra=-DBYO_CRYPTO=ON \
        --cmake-extra=-DAWS_CRT_DISABLE_DEPRECATION_WARNINGS=ON
  linux-no-cpu-extensions:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
    - name: configure AWS credentials (containers)
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
        # We can't use the `uses: docker://image` version yet, GitHub lacks authentication for actions -> packages
    - name: Build ${{ env.PACKAGE_NAME }}
      run: |
        aws s3 cp s3://aws-crt-test-stuff/ci/${{ env.BUILDER_VERSION }}/linux-container-ci.sh ./linux-container-ci.sh && chmod a+x ./linux-container-ci.sh
        ./linux-container-ci.sh ${{ env.BUILDER_VERSION }} aws-crt-${{ env.LINUX_BASE_IMAGE }} build -p ${{ env.PACKAGE_NAME }}  \
          --cmake-extra=-DAWS_CRT_DISABLE_DEPRECATION_WARNINGS=ON \
          --cmake-extra=-DUSE_CPU_EXTENSIONS=OFF
  windows:
    runs-on: windows-latest
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: Build ${{ env.PACKAGE_NAME }} + consumers
        env:
          CL: "/DAWS_CRT_DISABLE_DEPRECATION_WARNINGS /EHsc"
        run: |
          md ${{ env.CI_FOLDER }}
          cd ${{ env.CI_FOLDER }}
          python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz', 'builder.pyz')"
          python builder.pyz build -p ${{ env.PACKAGE_NAME }}
      - name: Running samples in CI setup
        run: |
          python -m pip install boto3
      - name: configure AWS credentials (MQTT5)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_MQTT5_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run MQTT5 PubSub sample
        run: |
          cd ${{ env.CI_FOLDER }}
          python ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_pubsub_windows_cfg.json
      - name: configure AWS credentials (Device Advisor)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_DEVICE_ADVISOR }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run DeviceAdvisor
        run: |
          cd ${{ env.CI_FOLDER }}/aws-iot-device-sdk-cpp-v2
          python ./deviceadvisor/script/DATestRun.py
  windows-vs17:
    runs-on: windows-2025
    strategy:
      fail-fast: false
      matrix:
        arch: [Win32, x64]
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: Build ${{ env.PACKAGE_NAME }} + consumers
        env:
          CL: "/DAWS_CRT_DISABLE_DEPRECATION_WARNINGS /EHsc"
        # The "--cmake-extra=-Tv143" explicitly sets VS 17 2022 to be used for compilation.
        # See https://cmake.org/cmake/help/latest/generator/Visual%20Studio%2017%202022.html#toolset-selection
        run: |
          md ${{ env.CI_FOLDER }}
          cd ${{ env.CI_FOLDER }}
          python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
          python builder.pyz build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-Tv143 --cmake-extra=-A${{ matrix.arch }}
      - name: Running samples in CI setup
        run: |
          python -m pip install boto3
      - name: configure AWS credentials (MQTT5)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_MQTT5_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run MQTT5 PubSub sample
        run: |
          cd ${{ env.CI_FOLDER }}
          python ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_pubsub_windows_cfg.json
      - name: configure AWS credentials (Device Advisor)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_DEVICE_ADVISOR }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run DeviceAdvisor
        run: |
          cd ${{ env.CI_FOLDER }}/aws-iot-device-sdk-cpp-v2
          python ./deviceadvisor/script/DATestRun.py
  windows-no-cpu-extensions:
    runs-on: windows-latest
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: Build ${{ env.PACKAGE_NAME }} + consumers
        env:
          CL: "/DAWS_CRT_DISABLE_DEPRECATION_WARNINGS /EHsc"
        run: |
          md ${{ env.CI_FOLDER }}
          cd ${{ env.CI_FOLDER }}
          python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz', 'builder.pyz')"
          python builder.pyz build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DUSE_CPU_EXTENSIONS=OFF
      - name: Running samples in CI setup
        run: |
          python -m pip install boto3
      - name: configure AWS credentials (MQTT5)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_MQTT5_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run MQTT5 PubSub sample
        run: |
          cd ${{ env.CI_FOLDER }}
          python ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_pubsub_windows_cfg.json
      - name: configure AWS credentials (Device Advisor)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_DEVICE_ADVISOR }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run DeviceAdvisor
        run: |
          cd ${{ env.CI_FOLDER }}/aws-iot-device-sdk-cpp-v2
          python ./deviceadvisor/script/DATestRun.py
  windows-shared-lib:
    runs-on: windows-latest
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: Build ${{ env.PACKAGE_NAME }} + consumers
        env:
          CL: "/DAWS_CRT_DISABLE_DEPRECATION_WARNINGS /EHsc"
        run: |
          md ${{ env.CI_FOLDER }}
          cd ${{ env.CI_FOLDER }}
          python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz', 'builder.pyz')"
          python builder.pyz build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DBUILD_SHARED_LIBS=ON

  osx:
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        runner:
          - macos-13
          - macos-latest
    permissions:
      id-token: write # This is required for requesting the JWT
      security-events: write # This is required for pkcs12 sample to sign the key
    steps:
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: Build ${{ env.PACKAGE_NAME }} + consumers
        run: |
          python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz', 'builder')"
          chmod a+x builder
          ./builder build -p ${{ env.PACKAGE_NAME }} --spec=downstream \
          --cmake-extra=-DAWS_CRT_DISABLE_DEPRECATION_WARNINGS=ON
      - name: Running samples in CI setup
        run: |
          python3 -m venv .venv
          source .venv/bin/activate
          python3 -m pip install boto3
      - name: configure AWS credentials (MQTT5)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_MQTT5_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run MQTT5 PubSub sample
        run: |
          source .venv/bin/activate
          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_pubsub_cfg.json
      - name: configure AWS credentials (Device Advisor)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_DEVICE_ADVISOR }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run DeviceAdvisor
        run: |
          source .venv/bin/activate
          cd ./aws-iot-device-sdk-cpp-v2
          python3 ./deviceadvisor/script/DATestRun.py
  # Not strictly needed, but allows us to run Device Advisor and PubSub on Linux without needing to run all samples
  linux-github-actions:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: Build ${{ env.PACKAGE_NAME }} + consumers
        run: |
          python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
          python builder.pyz build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DAWS_CRT_DISABLE_DEPRECATION_WARNINGS=ON
      - name: Running samples in CI setup
        run: |
          python3 -m pip install boto3
      - name: configure AWS credentials (MQTT5)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_MQTT5_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run MQTT5 PubSub sample
        run: |
          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_pubsub_cfg.json
      - name: configure AWS credentials (Device Advisor)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_DEVICE_ADVISOR }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run DeviceAdvisor
        run: |
          cd ./aws-iot-device-sdk-cpp-v2
          python3 ./deviceadvisor/script/DATestRun.py
      - name: configure AWS credentials (Device Defender)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_DEVICE_DEFENDER }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run DeviceDefender
        run: |
          cd ./aws-iot-device-sdk-cpp-v2
          python3 ./devicedefender/script/DDTestRun.py
      - name: run Mqtt5 DeviceDefender
        run: |
          cd ./aws-iot-device-sdk-cpp-v2
          python3 ./devicedefender/script/DDTestRun.py mqtt5
  # Runs the samples and ensures that everything is working
  linux-smoke-tests:
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
      - name: Setup C++
        run: |
          sudo apt-get -qq update -y
          sudo apt-get -qq install -y build-essential
          sudo apt install cmake
          gcc --version
          cmake --version
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: Build ${{ env.PACKAGE_NAME }} + consumers
        run: |
          echo "Downloading source"
          git clone --recursive https://github.com/aws/aws-iot-device-sdk-cpp-v2.git --branch ${{ env.HEAD_REF || github.ref_name }}
          echo "Running builder"
          python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
          python builder.pyz build -p ${{ env.PACKAGE_NAME }} --cmake-extra=-DAWS_CRT_DISABLE_DEPRECATION_WARNINGS=ON
      - name: Running samples in CI setup
        run: |
          python3 -m pip install boto3
          sudo apt-get update -y
          sudo apt-get install softhsm -y
          softhsm2-util --version
      - name: configure AWS credentials (Fleet provisioning)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_FLEET_PROVISIONING_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run Fleet Provisioning service client test for MQTT311
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt3_fleet_provisioning_cfg.json --thing-name-prefix Fleet_Thing_
      - name: run Fleet Provisioning service client test for MQTT5
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt5_fleet_provisioning_cfg.json --thing-name-prefix Fleet_Thing_
      - name: run Fleet Provisioning with CSR service client test for MQTT311
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt3_fleet_provisioning_with_csr_cfg.json --thing-name-prefix Fleet_Thing_
      - name: run Fleet Provisioning with CSR service client test for MQTT5
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt5_fleet_provisioning_with_csr_cfg.json --thing-name-prefix Fleet_Thing_

      - name: configure AWS credentials (Jobs)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_JOBS_SERVICE_CLIENT_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run mqtt3 Jobs serviceTests
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_jobs_execution.py --config-file ${{ env.CI_SERVICE_TESTS_CFG_FOLDER }}/mqtt3_jobs_cfg.json
      - name: run mqtt5 Jobs serviceTests
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_jobs_execution.py --config-file ${{ env.CI_SERVICE_TESTS_CFG_FOLDER }}/mqtt5_jobs_cfg.json
      - name: configure AWS credentials (Shadow)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_SHADOW_SERVICE_CLIENT_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run Shadow service client test for MQTT5
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt5_shadow_cfg.json
      - name: run Shadow service client test for MQTT311
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt3_shadow_cfg.json
      - name: run Named Shadow service client test for MQTT311
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt3_named_shadow_cfg.json
      - name: run Named Shadow service client test for MQTT5
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt5_named_shadow_cfg.json
      - name: configure AWS credentials (MQTT5)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_MQTT5_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run MQTT5 PubSub sample
        run: |
          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_pubsub_cfg.json
      - name: run MQTT5 Shared Subscription sample
        run: |
          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_shared_subscription_cfg.json
      - name: configure AWS credentials (Secure tunneling)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_SECURE_TUNNEL }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      # Secure Tunneling has special requirements, so it uses a different Python file
      - name: run Secure Tunneling sample
        run: |
          python3 ${{ env.CI_UTILS_FOLDER }}/run_secure_tunnel_ci.py --sample_file "./aws-iot-device-sdk-cpp-v2/build/samples/secure_tunneling/secure_tunnel/secure-tunnel" --sample_region ${{ env.AWS_DEFAULT_REGION }}

  # check that docs can still build
  check-docs:
    runs-on: ubuntu-22.04 # latest
    steps:
      - uses: actions/checkout@v2
        with:
          submodules: recursive
      - name: Check docs
        run: |
          echo "Compiling and installing doxygen 1.8.20 from source"
          sudo apt-get install -y llvm-11 llvm-11-dev clang-11 libclang-11-dev
          git clone https://github.com/doxygen/doxygen.git -b Release_1_8_20
          cd doxygen
          mkdir build
          cd build
          cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr ..
          sudo make -j 4
          sudo make install
          cd ../..
          echo "Finished compiling and installing Doxygen"
          ./make-docs.py
  check-submodules:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Source
        uses: actions/checkout@v2
        with:
          submodules: true
          fetch-depth: 0
      - name: Check Submodules
        # note: using "@main" because "@${{env.BUILDER_VERSION}}" doesn't work
        # https://github.com/actions/runner/issues/480
        uses: awslabs/aws-crt-builder/.github/actions/check-submodules@main

  check-codegen-edits:
    runs-on: ubuntu-22.04 # latest
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - name: Check for edits to code-generated files
        run: |
          ./utils/check_codegen_edits.py

  clang-sanitizers:
    runs-on: ubuntu-24.04 # latest
    strategy:
      fail-fast: false
      matrix:
        sanitizer-variants: ["tsan", "asan"]
    permissions:
      id-token: write # This is required for requesting the JWT
    steps:
      - name: configure AWS credentials (containers)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_IOT_CONTAINERS }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: Build ${{ env.PACKAGE_NAME }} + consumers
        run: |
          echo "Downloading source"
          git clone --recursive https://github.com/aws/aws-iot-device-sdk-cpp-v2.git --branch ${{ env.HEAD_REF || github.ref_name }}
          echo "Running builder"
          python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
          python builder.pyz build -p ${{ env.PACKAGE_NAME }} --variant ${{ matrix.sanitizer-variants }} --cmake-extra=-DAWS_CRT_DISABLE_DEPRECATION_WARNINGS=ON
      - name: Running samples in CI setup
        run: |
          python3 -m pip install boto3
          sudo apt-get update -y
          sudo apt-get install softhsm2 -y
          softhsm2-util --version
      - name: configure AWS credentials (Fleet provisioning)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_FLEET_PROVISIONING_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run Fleet Provisioning service client test for MQTT311
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt3_fleet_provisioning_cfg.json --thing-name-prefix Fleet_Thing_
      - name: run Fleet Provisioning service client test for MQTT5
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt5_fleet_provisioning_cfg.json --thing-name-prefix Fleet_Thing_
      - name: run Fleet Provisioning with CSR service client test for MQTT311
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt3_fleet_provisioning_with_csr_cfg.json --thing-name-prefix Fleet_Thing_
      - name: run Fleet Provisioning with CSR service client test for MQTT5
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt5_fleet_provisioning_with_csr_cfg.json --thing-name-prefix Fleet_Thing_
      - name: configure AWS credentials (Jobs)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_JOBS_SERVICE_CLIENT_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run mqtt3 Jobs serviceTests
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_jobs_execution.py --config-file ${{ env.CI_SERVICE_TESTS_CFG_FOLDER }}/mqtt3_jobs_cfg.json
      - name: run mqtt5 Jobs serviceTests
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_jobs_execution.py --config-file ${{ env.CI_SERVICE_TESTS_CFG_FOLDER }}/mqtt5_jobs_cfg.json
      - name: configure AWS credentials (Shadow)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_SHADOW_SERVICE_CLIENT_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run Shadow service client test for MQTT5
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt5_shadow_cfg.json
      - name: run Shadow service client test for MQTT311
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt3_shadow_cfg.json
      - name: run Named Shadow service client test for MQTT311
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt3_named_shadow_cfg.json
      - name: run Named Shadow service client test for MQTT5
        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
        run: |
          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt5_named_shadow_cfg.json
      - name: configure AWS credentials (MQTT5)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_MQTT5_ROLE }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      - name: run MQTT5 PubSub sample
        run: |
          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_pubsub_cfg.json
      - name: run MQTT5 Shared Subscription sample
        run: |
          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_shared_subscription_cfg.json
      - name: configure AWS credentials (Secure tunneling)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CI_SECURE_TUNNEL }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      # Secure Tunneling has special requirements, so it uses a different Python file
      - name: run Secure Tunneling sample
        run: |
          python3 ${{ env.CI_UTILS_FOLDER }}/run_secure_tunnel_ci.py --sample_file "./aws-iot-device-sdk-cpp-v2/build/samples/secure_tunneling/secure_tunnel/secure-tunnel" --sample_region ${{ env.AWS_DEFAULT_REGION }}