daily-validation.yml

---
name: Daily
permissions: read-all

on:
  # Run on user request
  workflow_dispatch:
    inputs:
      upload_sdl:
        description: 'Trigger SDL Upload'
        required: false
        default: false
        type: boolean
  # Run on schedule
  schedule:
    # daily at 9:00 UTC (2:00 MST)
    - cron: '0 9 * * *'

concurrency:
  # Cancel any existing jobs related to the target branch
  group: nightly-ci-${{ github.ref || github.run_id }}
  cancel-in-progress: true

jobs:

  lint:
    if: true
    uses: ./.github/workflows/lint.yml

  scorecard:
    if: true
    uses: ./.github/workflows/scorecard.yml

  hadolint:
    if: true
    uses: ./.github/workflows/hadolint.yml
    with:
      output_prefix: tools-

  trivy:
    if: true
    uses: ./.github/workflows/trivy.yml
    with:
      output_prefix: tools-

  ip-leak-scan:
    if: true
    name: IP Leak Scan
    uses: ./.github/workflows/ipldt.yml
    secrets: inherit
    with:
      output_prefix: tools-

  source-malware-scan:
    if: true
    uses: ./.github/workflows/mcafee.yml
    secrets: inherit
    with:
      output_prefix: tools-

  # This job configures variables that are useful for other jobs. Other jobs
  # that depend on this one can access the variables via
  # needs.setup-variables.outputs.<variable-name>
  setup-variables:
    if: true
    uses: ./.github/workflows/setup-variables.yml
    secrets: inherit

  linux-build:
    if: true
    needs: setup-variables
    uses: ./.github/workflows/cmake.yml
    with:
      os: linux
      build_type: release
      artifact_name: linux-release-build
      run_tests: false
      no_artifacts: false
      repository: ${{ vars.DISP_REPO }}
      ref: ${{ needs.setup-variables.outputs.lib_ref }}
    secrets:
      token: ${{ secrets.DISP_REPO_TOKEN }}

  windows-build:
    if: true
    needs: setup-variables
    uses: ./.github/workflows/cmake.yml
    with:
      os: windows
      build_type: release
      artifact_name: windows-release-build
      run_tests: false
      no_artifacts: false
      repository: ${{ vars.DISP_REPO }}
      ref: ${{ needs.setup-variables.outputs.lib_ref }}
    secrets:
      token: ${{ secrets.DISP_REPO_TOKEN }}

  coverity:
    if: true
    needs: [linux-build, windows-build]
    strategy:
      fail-fast: false
      matrix:
        os:
          - linux
          - windows
    uses: ./.github/workflows/coverity.yml
    secrets: inherit
    with:
      os: ${{ matrix.os }}
      output_prefix: tools-
      dependent_artifact: ${{ matrix.os }}-release-build
      extra_opts: --report

  linux-tools-build:
    if: true
    needs: [linux-build]
    uses: ./.github/workflows/cmake.yml
    with:
      os: linux
      build_type: release
      artifact_name: linux-tools-build
      run_tests: true
      no_artifacts: false
      dependent_artifact: linux-release-build

  windows-tools-build:
    if: true
    needs: [windows-build]
    uses: ./.github/workflows/cmake.yml
    with:
      os: windows
      build_type: release
      artifact_name: windows-tools-build
      run_tests: true
      no_artifacts: false
      dependent_artifact: windows-release-build

  windows-malware-scan:
    if: true
    needs: [windows-tools-build]
    uses: ./.github/workflows/mcafee.yml
    secrets: inherit
    with:
      artifact_name: windows-tools-build
      output_prefix: tools-

  linux-malware-scan:
    if: true
    needs: [linux-tools-build]
    uses: ./.github/workflows/mcafee.yml
    secrets: inherit
    with:
      artifact_name: linux-tools-build
      output_prefix: tools-

  windows-sscb:
    if: true
    needs: [windows-tools-build]
    uses: ./.github/workflows/sscb.yml
    with:
      os: windows
      artifact_name: windows-tools-build
      output_prefix: tools-

  linux-sscb:
    if: true
    needs: [linux-tools-build]
    uses: ./.github/workflows/sscb.yml
    with:
      os: linux
      artifact_name: linux-tools-build
      output_prefix: tools-

  bdba:
    if: true
    needs:
      - linux-tools-build
      - windows-tools-build
    uses: ./.github/workflows/bdba.yml
    with:
      output_prefix: tools-
      version: ${{ github.ref_name }}
      pattern: "*-tools-build"
    secrets: inherit

  sdl:
    if: ${{ github.event.inputs.upload_sdl == 'true' }}
    needs:
      - linux-build
      - windows-build
      - summary
      - setup-variables
    uses: ./.github/workflows/sdl.yml
    with:
      SUMMARY_ARTIFACT: tools-release-summary
      LABEL: ${{ needs.setup-variables.outputs.tools_version }}
      SDLE_PROJECT: ${{vars.SDLE_ID}}
      SDLE_USER: ${{vars.SDLE_API_USER}}
      output_prefix: tools-
    secrets:
      SDLE_API_KEY: ${{ secrets.SDLE_API_KEY }}

  windows-acceptance:
    if: true
    needs: [windows-build, windows-tools-build, setup-variables]
    strategy:
      fail-fast: true
      matrix:
        gpu:
          - gen12.5
        config:
          - release
        os:
          - windows
    uses: ./.github/workflows/acceptance.yml
    secrets: inherit
    with:
      os: ${{ matrix.os }}
      build_type: ${{ matrix.config }}
      lib_artifact: ${{ matrix.os }}-${{ matrix.config }}-build
      tools_artifact: windows-tools-build
      gpu: ${{ matrix.gpu }}
      distro_family: windows
      distro_version: 11
      test_ref: ${{ needs.setup-variables.outputs.test_ref }}

  linux-acceptance:
    if: true
    needs: [linux-build, linux-tools-build, setup-variables]
    strategy:
      fail-fast: true
      matrix:
        gpu:
          - gen12.5
        distro:
          - family: ubuntu
            version: 22.04
        config:
          - release
        os:
          - linux
    uses: ./.github/workflows/acceptance.yml
    secrets: inherit
    with:
      os: ${{ matrix.os }}
      build_type: ${{ matrix.config }}
      lib_artifact: ${{ matrix.os }}-${{ matrix.config }}-build
      tools_artifact: linux-tools-build
      gpu: ${{ matrix.gpu }}
      distro_family: ${{ matrix.distro.family }}
      distro_version: ${{ matrix.distro.version }}
      test_ref: ${{ needs.setup-variables.outputs.test_ref }}

  ref-build:
    if: true
    needs: [setup-variables, linux-build, windows-build]
    strategy:
      fail-fast: true
      matrix:
        os:
          - windows
          - linux
    uses: ./.github/workflows/cmake.yml
    with:
      os: ${{ matrix.os }}
      build_type: release
      artifact_name: ${{ matrix.os }}-ref-build
      run_tests: false
      no_artifacts: false
      ref: ${{ needs.setup-variables.outputs.last_release_ref }}
      dependent_artifact: ${{ matrix.os }}-release-build

  diff-report:
    if: true
    needs: [linux-tools-build, windows-tools-build, ref-build]
    strategy:
      fail-fast: false
      matrix:
        os: [windows, linux]
    uses: ./.github/workflows/diff.yml
    with:
      report_name: ${{ matrix.os }}-tools-diff-report
      left: ${{ matrix.os }}-ref-build
      right: ${{ matrix.os }}-tools-build

  distro-tests:
    if: true
    needs: [linux-build, linux-tools-build, setup-variables]
    strategy:
      fail-fast: true
      matrix:
        distro:
          - family: rhel
            version: 8.6
          - family: sles
            version: 15.4
        gpu:
          - gen12.5
        os:
          - linux
        config:
          - release
    uses: ./.github/workflows/acceptance.yml
    secrets: inherit
    with:
      os: ${{ matrix.os }}
      build_type: ${{ matrix.config }}
      lib_artifact: ${{ matrix.os }}-${{ matrix.config }}-build
      tools_artifact: linux-tools-build
      gpu: ${{ matrix.gpu }}
      distro_family: ${{ matrix.distro.family }}
      distro_version: ${{ matrix.distro.version }}
      test_ref: ${{ needs.setup-variables.outputs.test_ref }}

  experimental-off:
    if: '! github.event.pull_request.draft'
    needs: setup-variables
    uses: ./.github/workflows/cmake.yml
    strategy:
      fail-fast: false
      matrix:
        os:
          - windows
          - linux
    with:
      os: ${{ matrix.os }}
      build_type: release
      artifact_name: ${{ matrix.os }}-experimental-off-build
      run_tests: false
      no_artifacts: false
      configure_options: >-
        -DBUILD_EXPERIMENTAL=OFF
      repository: ${{ vars.DISP_REPO }}
      ref: ${{ needs.setup-variables.outputs.lib_ref }}
    secrets:
      token: ${{ secrets.DISP_REPO_TOKEN }}

  tools-experimental-off:
    if: '! github.event.pull_request.draft'
    needs: [experimental-off]
    uses: ./.github/workflows/cmake.yml
    strategy:
      fail-fast: false
      matrix:
        os:
          - windows
          - linux
    with:
      os: ${{ matrix.os }}
      build_type: release
      artifact_name: ${{ matrix.os }}-tools-experimental-off-build
      run_tests: false
      no_artifacts: true
      configure_options: >-
        -DBUILD_EXPERIMENTAL=OFF
      dependent_artifact: ${{ matrix.os }}-experimental-off-build

  summary:
    if: "always()"
    needs:
      - hadolint
      - trivy
      - ip-leak-scan
      - source-malware-scan
      - coverity
      - windows-malware-scan
      - linux-malware-scan
      - windows-sscb
      - linux-sscb
      - bdba
      - diff-report
      - windows-acceptance
      - linux-acceptance
      - distro-tests
      - tools-experimental-off
    uses: ./.github/workflows/summary.yml
    with:
      output_prefix: tools-