ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

# A newer push to a pull request supersedes the older run. Every push to
# main gets its own group, so a later push never cancels the
# pending run of an earlier one: each pushed commit can be a deploy candidate
# and needs its own full result. A pull request's newer commits do cancel its
# older runs.
concurrency:
  group: ci-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: never
  PYTHONDONTWRITEBYTECODE: 1

jobs:
  lint:
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.12'
      - name: Install stable Rust and rustfmt
        run: |
          rustup toolchain install stable --profile minimal --component rustfmt
          rustup default stable
      - run: cargo fmt --all --check
      - name: Check shell scripts
        run: |
          curl --fail --location --retry 3 https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.x86_64.tar.xz -o "$RUNNER_TEMP/shellcheck.tar.xz"
          tar -xJf "$RUNNER_TEMP/shellcheck.tar.xz" -C "$RUNNER_TEMP"
          "$RUNNER_TEMP/shellcheck-v0.11.0/shellcheck" --version
          "$RUNNER_TEMP/shellcheck-v0.11.0/shellcheck" -x script/*.sh
      # These suites use fixture signing and debugger functions, not the real
      # codesign, lldb or worker, so they need no Rust build or macOS runner.
      - name: Check offline flow rig contracts
        run: python3 -m unittest script.tests.flows_rig -v
      - name: Check Cargo path dependency boundary
        run: |
          python3 script/check-path-deps.py
          python3 -m unittest script.tests.check_path_deps -v
      - name: Check development executable names
        run: |
          python3 script/check-ckdev-names.py
          python3 -m unittest script.tests.check_ckdev_names -v
      - name: Check tracked local paths
        run: |
          python3 script/check-local-paths.py
          python3 -m unittest script.tests.check_local_paths -v
      - name: Check offline placement cards
        run: |
          /bin/sh -n script/stage.sh
          python3 -m unittest script.tests.stage_card -v
      - name: Check worker signing gate and core JSON features
        run: python3 -m unittest script.tests.sign_worker script.tests.codemode_manifest -v

  checks:
    if: github.event_name != 'schedule'
    # The worker confines itself on macOS (Seatbelt) and on Linux (seccomp and
    # Landlock), so every leg runs the worker packages. Their macOS-only probes
    # (codesign, privacy disclaim) are compiled only on macOS. The Linux
    # seccomp filter has a separate syscall table per architecture, so Linux
    # runs natively on both x86_64 and aarch64. The lint job handles build-free
    # checks.
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux
            os: ubuntu-latest
          - platform: linux-arm64
            os: ubuntu-24.04-arm
          - platform: macos
            os: macos-latest
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.12'
      - name: Install stable Rust and analysis components
        run: |
          rustup toolchain install stable --profile minimal --component rustfmt --component clippy
          rustup default stable
      - &install-nats
        name: Install pinned nats-server v2.15.0
        uses: ./.github/actions/install-nats-server
      - name: Record installed Rust version
        id: rust
        run: echo "version=$(rustc --version | cut -d ' ' -f 2)" >> "$GITHUB_OUTPUT"
      - name: Restore Cargo build cache
        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-checks-main-${{ github.run_id }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-checks-main-
            ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-checks-
            ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-
      - &restored-build-size
        name: Measure restored build folder
        shell: bash
        run: du -sk target 2>/dev/null || test ! -d target
      - run: cargo clippy --workspace --all-targets -- -D warnings
        if: matrix.platform == 'linux'
      - run: cargo clippy --workspace --all-targets --features basal-module/rig-kill-hook -- -D warnings
      - name: Test portable crates
        if: runner.os == 'Linux'
        run: cargo test --locked -p basal-proto -p basal-core -p basal-host
      # The module feature propagates to basal-host, so portable tests need both
      # modes as well. Enable it on the selected host crate without selecting the
      # worker-using module. The hook's Linux tests run on x86_64; aarch64
      # retains production-mode tests and hook-enabled clippy coverage.
      - name: Test portable crates with the rig kill hook
        if: matrix.platform == 'linux'
        run: cargo test --locked -p basal-proto -p basal-core -p basal-host --features basal-host/rig-kill-hook
      # A procfs mounted with hidepid hides the confined worker from its parent,
      # and the Linux startup tests then accept a weaker self-reported status.
      # GitHub's runners show every process, so require the exact parent-side
      # /proc/<pid>/status readback here; the variable has no effect on macOS.
      - name: Test confined worker packages
        env:
          BASAL_REQUIRE_VISIBLE_PROC: ${{ runner.os == 'Linux' && '1' || '' }}
        run: cargo test --locked -p basal-worker -p basal-module -p basal-testkit -p basal-rig
      - name: Test confined worker packages with the rig kill hook
        if: matrix.platform != 'linux-arm64'
        env:
          BASAL_REQUIRE_VISIBLE_PROC: ${{ runner.os == 'Linux' && '1' || '' }}
        run: cargo test --locked -p basal-worker -p basal-module -p basal-testkit -p basal-rig --features basal-module/rig-kill-hook
      - &final-build-size
        name: Measure final build folder
        shell: bash
        run: du -sk target
      # Cache entries are immutable. Only main publishes a new run-scoped entry;
      # PRs read the newest main prefix without consuming cache quota.
      - name: Save Cargo build cache
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-checks-main-${{ github.run_id }}

  # Native aarch64 evidence for the Linux seccomp allowlist. The filter has a
  # separate aarch64 syscall table, and only a native trace shows which calls
  # glibc and the release worker actually make there. The script fails when no
  # confined worker was traced or a panic/abort probe misbehaves; its reduced
  # traces are uploaded for review against
  # crates/basal-worker/sandbox/linux/syscall-admission.md.
  aarch64-syscall-trace:
    if: github.event_name != 'schedule'
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install stable Rust and strace
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable
          sudo apt-get update
          sudo apt-get install --yes --no-install-recommends strace
      - name: Trace the native release worker
        run: |
          rm -rf crates/basal-worker/sandbox/linux/traces/aarch64
          env -u BASAL_WORKER_BIN bash crates/basal-worker/sandbox/linux/trace-native.sh
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always()
        with:
          name: syscall-trace-aarch64
          path: crates/basal-worker/sandbox/linux/traces/aarch64
          if-no-files-found: error

  minimum-rust:
    if: github.event_name != 'schedule'
    # Builds every workspace target at the declared minimum Rust version. It
    # only compiles, so it needs no macOS: nothing here starts the flow
    # worker, whose sandbox exists on macOS.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install the declared minimum Rust
        run: rustup toolchain install 1.89.0 --profile minimal
      - name: Record installed Rust version
        id: rust
        run: echo "version=$(rustc +1.89.0 --version | cut -d ' ' -f 2)" >> "$GITHUB_OUTPUT"
      - name: Restore Cargo build cache
        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-minimum-main-${{ github.run_id }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-minimum-main-
            ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-minimum-
            ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-
      - *restored-build-size
      - name: Build every target with the declared minimum Rust
        run: |
          cargo +1.89.0 check --workspace --all-targets --locked
          cargo +1.89.0 check --workspace --all-targets --locked --features basal-module/rig-kill-hook
      - *final-build-size
      - name: Save Cargo build cache
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-minimum-main-${{ github.run_id }}

  # Each Windows image leaves a different set of loader and thread-pool handles
  # in the worker, so both must exercise the startup allowlist. Native suites
  # also exercise the launcher, worker probes and filesystem/Git guards. Two
  # package groups run in parallel per image; logs survive failed gates.
  windows-baseline:
    if: github.event_name != 'schedule'
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, windows-2022]
        suite: [launch-worker-host, module-core-testkit-rig]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 120
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - *install-nats
      - name: Install stable Rust
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable
          rustc --version
          cargo --version
      - name: Record installed Rust version
        id: rust
        run: echo "version=$(rustc --version | cut -d ' ' -f 2)" >> "$GITHUB_OUTPUT"
      - name: Restore Cargo build cache
        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-windows-baseline-${{ matrix.os }}-main-${{ github.run_id }}-${{ matrix.suite }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-windows-baseline-${{ matrix.os }}-main-
            ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-windows-baseline-${{ matrix.os }}-
      - *restored-build-size
      - name: Prepare the log directory
        run: mkdir -p "$RUNNER_TEMP/windows-baseline"
      # The Windows launcher's own tests start real confined children, so
      # they can only run here. The deviations feature adds the test-only
      # launch variants, one per confinement check. They run first and print
      # what the parent read back, so the log shows it even when the
      # workspace steps below fail.
      - name: Test the Windows launcher with its test variants
        if: matrix.suite == 'launch-worker-host'
        id: test-launch
        timeout-minutes: 20
        run: |
          cargo test -p basal-launch --locked -- --show-output 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-launch-production.log"
          cargo test -p basal-launch --features deviations --locked -- --show-output 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-launch.log"
      # The worker's tests on their own: its Windows startup checks, its image
      # and a real activation, each worker started through the launcher. The
      # plain build is the production worker, which must refuse the
      # launcher's request to skip a check. The deviations build is a test
      # worker that honours that request, for the three checks the parent
      # cannot break from outside.
      - name: Test the worker on its own
        if: matrix.suite == 'launch-worker-host'
        id: test-worker
        timeout-minutes: 30
        run: cargo test -p basal-worker --locked --no-fail-fast -- --show-output 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-worker.log"
      - name: Test the worker with its test variants
        if: matrix.suite == 'launch-worker-host'
        id: test-worker-deviations
        timeout-minutes: 30
        run: cargo test -p basal-worker --features deviations --locked --no-fail-fast -- --show-output 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-worker-deviations.log"
      # The module's tests: workers started, supervised and killed through
      # the launcher; worker deaths from a confinement fault (an invalid
      # handle or access violation) counted apart from other crashes; and
      # the store directory and database readable by their owner only.
      # basal-core's tests run with them: the module's store and runtime
      # are basal-core's.
      - name: Test the module and the core
        if: matrix.suite == 'module-core-testkit-rig'
        id: test-module
        timeout-minutes: 40
        run: cargo test -p basal-module -p basal-core --locked --no-fail-fast -- --show-output 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-module.log"
      - name: Test the shared test kit on its own
        if: matrix.suite == 'module-core-testkit-rig'
        id: test-testkit
        timeout-minutes: 30
        run: cargo test -p basal-testkit --locked --no-fail-fast 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-testkit.log"
      - name: Test the integration rig on its own
        if: matrix.suite == 'module-core-testkit-rig'
        id: test-rig
        timeout-minutes: 30
        run: cargo test -p basal-rig --locked --no-fail-fast 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-rig.log"
      - name: Check every workspace target
        if: matrix.suite == 'module-core-testkit-rig'
        id: check
        timeout-minutes: 40
        run: cargo check --workspace --all-targets --locked 2>&1 | tee "$RUNNER_TEMP/windows-baseline/check.log"
      - name: Check every workspace target, continuing past failed crates
        if: failure() && matrix.suite == 'module-core-testkit-rig' && steps.check.outcome == 'failure'
        timeout-minutes: 40
        run: cargo check --workspace --all-targets --locked --keep-going 2>&1 | tee "$RUNNER_TEMP/windows-baseline/check-keep-going.log"
      # The rest of the workspace: every package not already tested by its own
      # step above. Testing those again doubled the job's time, and on a slow
      # runner pushed this step past its limit.
      - name: Test the workspace
        if: matrix.suite == 'launch-worker-host'
        id: test
        timeout-minutes: 40
        run: cargo test --workspace --exclude basal-launch --exclude basal-worker --exclude basal-module --exclude basal-core --exclude basal-testkit --exclude basal-rig --locked 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test.log"
      - name: Test the workspace, continuing past failed tests
        if: failure() && matrix.suite == 'launch-worker-host' && steps.test.outcome == 'failure'
        timeout-minutes: 40
        run: cargo test --workspace --exclude basal-launch --exclude basal-worker --exclude basal-module --exclude basal-core --exclude basal-testkit --exclude basal-rig --locked --no-fail-fast 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-no-fail-fast.log"
      - *final-build-size
      - name: Save Cargo build cache
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('Cargo.lock') }}-${{ steps.rust.outputs.version }}-windows-baseline-${{ matrix.os }}-main-${{ github.run_id }}-${{ matrix.suite }}
      - name: Summarize the Windows gates
        if: always()
        run: |
          {
            echo "## Windows gates (${{ matrix.os }}, ${{ matrix.suite }}, $(rustc --version))"
            echo
            echo "- cargo check --workspace --all-targets --locked: ${{ steps.check.outcome }}"
            echo "- cargo test --workspace --locked: ${{ steps.test.outcome }}"
            echo "- cargo test -p basal-launch --features deviations --locked: ${{ steps.test-launch.outcome }}"
            echo "- cargo test -p basal-module -p basal-core --locked --no-fail-fast: ${{ steps.test-module.outcome }}"
            echo "- cargo test -p basal-worker --locked: ${{ steps.test-worker.outcome }}"
            echo "- cargo test -p basal-worker --features deviations --locked: ${{ steps.test-worker-deviations.outcome }}"
            echo "- cargo test -p basal-testkit --locked --no-fail-fast: ${{ steps.test-testkit.outcome }}"
            echo "- cargo test -p basal-rig --locked --no-fail-fast: ${{ steps.test-rig.outcome }}"
          } >> "$GITHUB_STEP_SUMMARY"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always()
        with:
          name: windows-baseline-logs-${{ matrix.os }}-${{ matrix.suite }}
          path: ${{ runner.temp }}/windows-baseline
          if-no-files-found: error