dev.yml

# The primary point of this workflow is to ensure that the developer experience is good.
# We take a very vanilla ubuntu image, install all necessary dependencies via "normal" means,
# and then run the build and test steps as described in the README.md file.

# The artifacts produced by these builds are not intended to be used for anything other than
# ensuring that the developer experience is good.

# Production artifacts are produced via nix builds (in another CI workflow).

name: "dev.yml"

on:
  pull_request: {}
  push:
    branches:
      - "main"
    tags:
      - "v*"
  merge_group:
    types: ["checks_requested"]
  workflow_dispatch:
    inputs:
      debug_enabled:
        type: "boolean"
        description: "Run with tmate enabled"
        required: false
        default: false
      debug_justfile:
        type: "boolean"
        description: "enable to see debug statements from just recipes"
        required: false
        default: false
      skip_vlab_tests:
        type: "boolean"
        description: "Skip VLAB tests (they run by default)"
        required: false
        default: false
      run_hlab_tests:
        type: "boolean"
        description: "Run hybrid HLAB tests"
        required: false
        default: false
      enable_release_tests:
        type: "boolean"
        description: "Enable release tests for VLAB/HLAB tests"
        required: false
        default: false

concurrency:
  group: "${{ github.workflow }}:${{ github.event.pull_request.number || github.event.after || github.event.merge_group && github.run_id }}"
  cancel-in-progress: true

permissions:
  contents: "read"
  packages: "write"
  id-token: "write"

jobs:
  check_changes:
    name: "Deduce required tests from code changes"
    permissions:
      contents: "read"
      pull-requests: "read"
    runs-on: "ubuntu-latest"
    outputs:
      devfiles: "${{ steps.changes.outputs.devfiles }}"
    steps:
      - name: "Checkout"
        if: "${{ !github.event.pull_request }}"
        uses: "actions/checkout@v6"
        with:
          persist-credentials: "false"
          fetch-depth: "0"
      - name: "Check code changes"
        uses: "dorny/paths-filter@v4"
        id: "changes"
        with:
          filters: |
            devfiles:
              - '!(README.md|LICENSE|NOTICE|.zed/**|.vscode/**|CLAUDE.md|.rules|development/**|testing.md|workspace-deps.svg|codebook.toml|.markdownlint.json|.gitattributes|.gitignore|.github/**)'
              - '.github/workflows/dev.yml'
              - '.github/actions/**'

  version:
    runs-on: lab

    permissions:
      contents: read

    outputs:
      version: "${{ steps.version-gen.outputs.version }}"
      ref: "${{ steps.version-gen.outputs.ref }}"

    steps:
      - &checkout
        name: Checkout repository
        uses: actions/checkout@v6
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Generate temp artifacts version
        id: version-gen
        env:
          commit_sha: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          echo "version=v0-${commit_sha::9}" >> "$GITHUB_OUTPUT"
          echo "ref=${commit_sha}" >> "$GITHUB_OUTPUT"

  check:
    if: >-
      ${{
        needs.check_changes.outputs.devfiles == 'true'
        || startsWith(github.event.ref, 'refs/tags/v')
        || github.event_name == 'workflow_dispatch'
      }}
    name: "check/${{ matrix.build.name }}/${{ matrix.features || 'default' }}"
    runs-on: "lab"
    needs:
      - check_changes
    permissions: &check-perms
      checks: "write"
      pull-requests: "write"
      contents: "read"
      packages: "write"
      id-token: "write"
    env: &check-env
      USER: "runner"
      JUST_VARS: >-
        docker_sock=/run/docker/docker.sock
        debug_justfile=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.debug_justfile || false }}
        profile=${{ matrix.build.profile }}
        sanitize=${{ matrix.build.sanitize }}
        instrument=${{ matrix.build.instrument }}
        features=${{ matrix.features }}
        oci_repo=ghcr.io
    strategy:
      fail-fast: false
      matrix:
        build: &default-build
          - &debug-build
            name: "debug"
            profile: "debug"
            sanitize: ""
            instrument: "none"
          - &release-build
            name: "release"
            profile: "release"
            sanitize: "" # TODO: enable cfi and safe-stack when possible
            instrument: "none"
    steps:
      - *checkout

      - &nix-setup
        uses: "./.github/actions/nix-setup"
        with:
          cachix_signing_key: "${{ secrets.CACHIX_SIGNING_KEY }}"
          cachix_auth_token: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - &check-dependencies
        name: "check-dependencies"
        uses: &just "./.github/actions/just"
        with:
          recipe: "check-dependencies"

      - name: "fmt"
        uses: *just
        with:
          recipe: "fmt"
          recipe_args: "--check"

      - name: "test"
        uses: *just
        with:
          recipe: "test"

      - name: "lint"
        uses: *just
        with:
          recipe: "lint"

      - name: "doctest"
        uses: *just
        with:
          recipe: "doctest"

      - &tmate
        name: "Setup tmate session for debug"
        if: "${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}"
        uses: "mxschmitt/action-tmate@v3"
        timeout-minutes: 60
        with:
          limit-access-to-actor: true

  build:
    if: >-
      ${{
        needs.check_changes.outputs.devfiles == 'true'
        || startsWith(github.event.ref, 'refs/tags/v')
        || github.event_name == 'workflow_dispatch'
      }}
    name: "${{matrix.nix-target}}/${{matrix.build.name}}"
    runs-on: lab
    needs:
      - check_changes
      - version
    permissions:
      checks: "write"
      pull-requests: "write"
      contents: "read"
      packages: "write"
      id-token: "write"
    env:
      USER: "runner"
      JUST_VARS: >-
        debug_justfile=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.debug_justfile || false }}
    strategy:
      fail-fast: false
      matrix:
        nix-target:
          - frr.dataplane
          - dataplane
          - validator
        build: *default-build
        exclude:
          - nix-target: validator
            build:
              name: "debug"
    steps:
      - *checkout
      - *nix-setup
      - *check-dependencies
      - name: "push container"
        env:
          VERSION: "${{ needs.version.outputs.version }}"
          PROFILE: "${{ matrix.build.profile }}"
          NIX_TARGET: "${{ matrix.nix-target }}"
          SANITIZE: "${{ matrix.build.sanitize }}"
          INSTRUMENT: "${{ matrix.build.instrument }}"
          DEBUG_JUSTFILE: "${{ github.event_name == 'workflow_dispatch' && github.event.inputs.debug_justfile || false }}"
        run: |
          nix-shell --run '
            set -euo pipefail;
            for v in "" "version=${VERSION}-${PROFILE}"; do
              if [ "${NIX_TARGET}" = "validator" ]; then
                platform="wasm32-wasip1"
              else
                platform="x86-64-v3"
              fi
              just \
                  docker_sock=/run/docker/docker.sock \
                  debug_justfile="${DEBUG_JUSTFILE}" \
                  profile="${PROFILE}" \
                  platform="${platform}" \
                  sanitize="${SANITIZE}" \
                  instrument="${INSTRUMENT}" \
                  oci_repo=ghcr.io \
                  $v \
                  push-container "${NIX_TARGET}"
            done
          '
      - *tmate

  sanitize:
    if: >-
      ${{
        needs.check_changes.outputs.devfiles == 'true'
        || startsWith(github.event.ref, 'refs/tags/v')
        || github.event_name == 'workflow_dispatch'
      }}
    name: "sanitize/${{ matrix.build.profile }}/${{ matrix.build.sanitize }}"
    runs-on: "lab"
    needs:
      - check_changes
      - check
    permissions: *check-perms
    env: *check-env
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        build:
          - name: "address"
            profile: "debug"
            sanitize: "address"
            instrument: "none"
          - name: "thread"
            profile: "fuzz"
            sanitize: "thread"
            instrument: "none"
    steps:
      - *checkout
      - *nix-setup
      - name: "test"
        uses: *just
        with:
          recipe: "test"
      - *tmate

  test_each:
    if: >-
      ${{
        needs.check_changes.outputs.devfiles == 'true'
        || startsWith(github.event.ref, 'refs/tags/v')
        || github.event_name == 'workflow_dispatch'
      }}
    name: "test_each"
    runs-on: "lab"
    needs:
      - check_changes
      - check
    permissions: *check-perms
    env: *check-env
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        build:
          - *debug-build
    steps:
      - *checkout
      - *nix-setup
      - name: "test-each"
        uses: *just
        with:
          recipe: "test-each"
      - *tmate

  features:
    if: >-
      ${{
        needs.check_changes.outputs.devfiles == 'true'
        || startsWith(github.event.ref, 'refs/tags/v')
        || github.event_name == 'workflow_dispatch'
      }}
    name: "features/${{ matrix.build.name }}/${{ matrix.features }}"
    runs-on: "lab"
    needs:
      - check_changes
      - check
    permissions: *check-perms
    env: *check-env
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        build:
          - *release-build
        features:
          - "shuttle"
    steps:
      - *checkout
      - *nix-setup
      - name: "test/${{ matrix.features }}"
        uses: *just
        with:
          recipe: "test"
      - *tmate

  vlab:
    if: "${{ needs.check_changes.outputs.devfiles == 'true' || (startsWith(github.event.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/v')) && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}"
    needs:
      - version
      - build
      - check_changes

    name: "${{ matrix.hybrid && 'h' || 'v' }}-${{ matrix.upgradefrom && 'up' || '' }}${{ matrix.upgradefrom }}${{ matrix.upgradefrom && '-' || '' }}${{ matrix.mesh && 'mesh-' || '' }}${{ matrix.gateway && 'gw-' || '' }}${{ matrix.includeonie && 'onie-' || '' }}${{ matrix.buildmode }}-${{ matrix.vpcmode }}"

    uses: githedgehog/fabricator/.github/workflows/run-vlab.yaml@master
    with:
      # ci:+hlab is required to enable hybrid lab tests on PR
      # ci:+vlab is required to enable virtual lab tests on PR
      # ci:-upgrade disables upgrade tests on PR
      # hlab is disabled for main and merge_queue till we have gateway tests for it
      skip: >-
        ${{
          github.event_name == 'pull_request'
          && (
            matrix.hybrid && !contains(github.event.pull_request.labels.*.name, 'ci:+hlab')
            || !matrix.hybrid && !contains(github.event.pull_request.labels.*.name, 'ci:+vlab')
            || matrix.upgradefrom != '' && contains(github.event.pull_request.labels.*.name, 'ci:-upgrade')
          )

          || github.event_name == 'workflow_dispatch'
          && (
            matrix.hybrid && inputs.run_hlab_tests != true
            || !matrix.hybrid && inputs.skip_vlab_tests == true
          )

          || (github.event_name == 'push' || github.event_name == 'merge_group')
          && matrix.hybrid
        }}
      fabricatorref: master
      prebuild: |
        just bump dataplane ${{ needs.version.outputs.version }}-release
        just bump frr ${{ needs.version.outputs.version }}-release
      fabricmode: ${{ matrix.fabricmode }}
      gateway: ${{ matrix.gateway }}
      includeonie: ${{ matrix.includeonie }}
      buildmode: ${{ matrix.buildmode }}
      vpcmode: ${{ matrix.vpcmode }}
      releasetest: ${{ contains(github.event.pull_request.labels.*.name, 'ci:+release') || inputs.enable_release_tests == true }}
      hybrid: ${{ matrix.hybrid }}
      upgradefrom: ${{ matrix.upgradefrom }}

    strategy:
      fail-fast: false
      matrix:
        fabricmode:
          - spine-leaf
        gateway:
          - true
        includeonie:
          - false
        buildmode:
          - iso
        vpcmode:
          - l2vni
        hybrid:
          - false
        upgradefrom:
          - ""
          - "26.01"
        include:
          # gateway l3vni
          - fabricmode: spine-leaf
            gateway: true
            includeonie: false
            buildmode: iso
            vpcmode: l3vni
            hybrid: false
            upgradefrom: ""

          # hlab gateway l2vni
          - fabricmode: spine-leaf
            gateway: true
            includeonie: false
            buildmode: iso
            vpcmode: l2vni
            hybrid: true
            upgradefrom: ""

  summary:
    name: "Summary"
    runs-on: "ubuntu-latest"
    needs:
      - check
      - sanitize
      - features
      - build
      - vlab
      - test_each
    # Run always so this job can aggregate results even when one of its
    # dependencies failed or was skipped.
    #
    # Skipped dependency jobs are handled explicitly by the step-level
    # conditions below, so a skipped "build" or "check" job does not cause
    # "summary" itself to be skipped.
    if: ${{ always() }}
    steps:
      - name: "Flag any check matrix failures"
        if: ${{ needs.check.result != 'success' && needs.check.result != 'skipped' }}
        run: |
          echo '::error:: Some check job(s) failed'
          exit 1
      - name: "Flag any features matrix failures"
        if: ${{ needs.features.result != 'success' && needs.features.result != 'skipped' }}
        run: |
          echo '::error:: Some features job(s) failed'
          exit 1
      - name: "Flag any test_each matrix failures"
        if: ${{ needs.test_each.result != 'success' && needs.test_each.result != 'skipped' }}
        run: |
          echo '::error:: Some test_each job(s) failed'
          exit 1
      - name: "Flag any sanitize matrix failures"
        if: ${{ needs.sanitize.result != 'success' && needs.sanitize.result != 'skipped' }}
        run: |
          echo '::error:: Some sanitize job(s) failed'
          exit 1
      - name: "Flag any build matrix failures"
        if: ${{ needs.build.result != 'success' && needs.build.result != 'skipped' }}
        run: |
          echo '::error:: Some build job(s) failed'
          exit 1
      - name: "Flag any vlab matrix failures"
        if: ${{ needs.vlab.result != 'success' && needs.vlab.result != 'skipped' }}
        run: |
          echo '::error:: Some vlab job(s) failed'
          exit 1

  publish:
    runs-on: lab
    if: startsWith(github.event.ref, 'refs/tags/v') && github.event_name == 'push'
    needs:
      - build
      - sanitize
      - vlab

    permissions:
      packages: write
      contents: read

    env:
      USER: "runner"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      # used to run go fmt after patching dp/frr versions in the fabricator
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version: stable
          cache: false

      - name: Login to ghcr.io
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: "Install nix"
        uses: cachix/install-nix-action@v31
        with:
          github_access_token: ${{ secrets.GITHUB_TOKEN }}
          nix_path: nixpkgs=channel:nixpkgs-unstable

      - uses: "cachix/cachix-action@v17"
        with:
          name: "hedgehog"
          # prettier-ignore
          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
          # prettier-ignore
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

      - name: "push containers"
        run: |
          nix-shell --run "
            set -euo pipefail;
            just \
              docker_sock=/run/docker/docker.sock \
              oci_repo=ghcr.io \
              version=${{ github.ref_name }} \
              push
          "

      # Bump dataplane in the fabricator repository

      - name: Checkout fabricator repository
        uses: actions/checkout@v6
        with:
          repository: githedgehog/fabricator
          path: fab-repo
          persist-credentials: false

      - name: Bump dataplane+frr in fabricator
        working-directory: fab-repo
        run: |
          sed -i "s/^\tDataplaneVersion.*/\tDataplaneVersion=meta.Version(\"${{ github.ref_name }}\")/" pkg/fab/versions.go
          sed -i "s/^\tFRRVersion.*/\tFRRVersion=meta.Version(\"${{ github.ref_name }}\")/" pkg/fab/versions.go
          go fmt pkg/fab/versions.go

      - name: Generate token for the fabricator repository
        uses: actions/create-github-app-token@v3
        id: fab-app-token
        with:
          app-id: ${{ secrets.FAB_APP_ID }}
          private-key: ${{ secrets.FAB_PRIVATE_KEY }}
          repositories: |
            fabricator

      - name: Create Pull Request for fabricator
        uses: peter-evans/create-pull-request@v8
        id: fab-pr
        with:
          token: ${{ steps.fab-app-token.outputs.token }}
          path: fab-repo
          branch: pr/auto/dataplane-bump
          commit-message: |
            bump: dataplane/frr to ${{ github.ref_name }}

            This is an automated commit created by GitHub Actions workflow,
            in the dataplane repository.
          signoff: true
          title: "bump: dataplane/frr to ${{ github.ref_name }}"
          body: |
            This is an automated Pull Request created by GitHub Actions workflow,
            in the dataplane repository.