ci.yml

name: CI

on:
  schedule:
    - cron: "0 0 * * 0"
  pull_request:
  workflow_dispatch:
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  actions: read
  checks: write

jobs:
  checks:
    name: "Format and License Checks"
    runs-on: ubuntu-latest
    container: ghcr.io/microsoft/ccf/ci/default:build-25-07-2024

    steps:
      - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - name: Checkout repository
        uses: actions/checkout@v4
      - run: ./scripts/ci-checks.sh

  build_and_test:
    name: CI
    needs: checks
    strategy:
      matrix:
        platform:
          - name: virtual
            image: default
            nodes: [self-hosted, 1ES.Pool=gha-virtual-ccf-sub]
            options: --user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE -v /lib/modules:/lib/modules:ro
          - name: snp
            image: default
            nodes: [self-hosted, 1ES.Pool=gha-virtual-ccf-sub]
            options: --user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE -v /lib/modules:/lib/modules:ro
    runs-on: ${{ matrix.platform.nodes }}
    container:
      image: ghcr.io/microsoft/ccf/ci/${{ matrix.platform.image }}:build-25-07-2024
      options: ${{ matrix.platform.options }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: "Build Debug ${{ matrix.platform.name }}"
        run: |
          set -ex
          git config --global --add safe.directory /__w/CCF/CCF
          mkdir build
          cd build
          cmake -GNinja -DCOMPILE_TARGET=${{ matrix.platform.name }} -DCMAKE_BUILD_TYPE=Debug -DLVI_MITIGATIONS=OFF ..
          ninja
        shell: bash

      - name: "Platform SNP"
        run: |
          samples/scripts/snpinfo.sh
        shell: bash
        if: "${{ matrix.platform.name == 'snp' }}"

      - name: "Test ${{ matrix.platform.name }}"
        run: |
          set -ex
          cd build
          rm -rf /github/home/.cache
          mkdir -p /github/home/.cache
          export ASAN_SYMBOLIZER_PATH=$(realpath /usr/bin/llvm-symbolizer-15)
          # Unit tests
          ./tests.sh --output-on-failure -L unit -j$(nproc --all)
          # All other acceptably fast tests, mostly end-to-end
          ./tests.sh --timeout 360 --output-on-failure -LE "benchmark|protocolstest|suite|unit"
          # Partitions tests
          ./tests.sh --timeout 240 --output-on-failure -L partitions -C partitions
        shell: bash
        if: "${{ matrix.platform.name != 'snp' }}" # Needs 1ES Pool support

      - name: "Upload logs for ${{ matrix.platform.name }}"
        uses: actions/upload-artifact@v4
        with:
          name: logs-${{ matrix.platform.name }}
          path: |
            build/workspace/*/*.config.json
            build/workspace/*/out
            build/workspace/*/err
          if-no-files-found: ignore
        if: success() || failure()

  scan_build:
    name: "Scan build"
    runs-on: [self-hosted, 1ES.Pool=gha-virtual-ccf-sub]
    container:
      image: ghcr.io/microsoft/ccf/ci/default:build-25-07-2024

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: "Run scan"
        run: |
          set -x
          mkdir build
          cd build
          ../scripts/scan-build.sh

  long-asan:
    name: ASAN
    runs-on: [self-hosted, 1ES.Pool=gha-virtual-ccf-sub]
    container:
      image: ghcr.io/microsoft/ccf/ci/default:build-25-07-2024

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: "Install deps"
        run: |
          sudo apt-get -y update
          sudo apt install ansible -y
          cd getting_started/setup_vm
          ansible-playbook ccf-extended-testing.yml

      - name: "Build"
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          mkdir build
          cd build
          cmake -GNinja -DCOMPILE_TARGET=virtual -DCMAKE_BUILD_TYPE=Debug -DLONG_TESTS=ON -DLVI_MITIGATIONS=OFF -DSAN=ON ..
          ninja

      - name: "Test"
        run: |
          set +x
          cd build
          ./tests.sh --output-on-failure --timeout 1600 -LE "benchmark"

      - name: "Upload logs"
        if: success() || failure()
        uses: actions/upload-artifact@v4
        with:
          name: logs-asan
          path: |
            build/workspace/*/*.config.json
            build/workspace/*/out
            build/workspace/*/err
          if-no-files-found: ignore

  long-tsan:
    name: TSAN
    runs-on: [self-hosted, 1ES.Pool=gha-virtual-ccf-sub]
    container:
      image: ghcr.io/microsoft/ccf/ci/default:build-25-07-2024

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: "Build"
        run: |
          git config --global --add safe.directory /__w/CCF/CCF
          mkdir build
          cd build
          cmake -GNinja -DCOMPILE_TARGET=virtual -DCMAKE_BUILD_TYPE=Debug -DLONG_TESTS=ON -DLVI_MITIGATIONS=OFF -DTSAN=ON -DWORKER_THREADS=2 ..
          ninja

      - name: "Test"
        run: |
          set +x
          cd build
          ./tests.sh --output-on-failure --timeout 1600 -LE "benchmark"

      - name: "Upload logs"
        if: success() || failure()
        uses: actions/upload-artifact@v4
        with:
          name: logs-tsan
          path: |
            build/workspace/*/*.config.json
            build/workspace/*/out
            build/workspace/*/err
          if-no-files-found: ignore