sterile-build-and-test.yml

# This is a sterile build and test workflow that uses the `dev-env` container image
# to build and test the project in a sterile environment.
# Artifacts produced by this workflow are intended to be used for production.
name: Sterile build + test
on:
  push:
  workflow_dispatch:
    inputs:
      debug_enabled:
        type: boolean
        description: "Run with tmate enabled"
        required: false
        default: false

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  just: 1.36.0

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
  test:
    runs-on: "ubuntu-latest"
    strategy:
      fail-fast: false
      matrix:
        dpdk_sys:
          - main
        rust:
          - stable
          # - nightly
    steps:
      - name: login to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: "${{ github.actor }}"
          password: "${{ secrets.GITHUB_TOKEN }}"
      - name: install just
        uses: extractions/setup-just@v2
        with:
          just-version: ${{env.just}}
      - name: Checkout
        uses: actions/checkout@v4

      - name: dev/gnu sterile test
        run: |
          export GITHUB_STEP_SUMMARY
          just rust="${{matrix.rust}}" profile=dev target=x86_64-unknown-linux-gnu sterile test
          mkdir dev.gnu
          cp -a ./target/nextest dev.gnu
      - name: dev/musl sterile test
        run: |
          export GITHUB_STEP_SUMMARY
          just rust="${{matrix.rust}}" profile=dev target=x86_64-unknown-linux-musl sterile test
          mkdir dev.musl
          cp -a ./target/nextest dev.musl
      - name: release/gnu sterile test
        run: |
          export GITHUB_STEP_SUMMARY
          just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-gnu sterile test
          mkdir release.gnu
          cp -a ./target/nextest release.gnu
      - name: release/musl sterile test
        run: |
          export GITHUB_STEP_SUMMARY
          just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-musl sterile test
          mkdir release.musl
          cp -a ./target/nextest release.musl

      # NOTE: we don't even install rust till the sterile tests are done (lowers contamination risk)
      - name: install rust
        uses: dtolnay/rust-toolchain@stable
        if: ${{ always() }}
        with:
          toolchain: ${{ matrix.rust }}
          targets: x86_64-unknown-linux-gnu,x86_64-unknown-linux-musl

      - uses: cargo-bins/cargo-binstall@main
        if: ${{ always() }}

      - name: install openssl and libssl-dev (needed for markdown-test-report)
        if: ${{ always() }}
        run: |
          sudo apt-get update
          sudo apt-get --yes --no-install-recommends install \
            colorized-logs \
            libssl-dev \
            openssl \
            pkg-config

      - name: install markdown-test-report
        if: ${{ always() }}
        run: cargo binstall --no-confirm markdown-test-report

      - name: dev/gnu report
        run: |
          export GITHUB_STEP_SUMMARY
          export CARGO_TARGET_DIR=dev.gnu
          just rust="${{matrix.rust}}" profile=dev target=x86_64-unknown-linux-gnu report
        if: ${{ always() }}

      - name: dev/musl report
        run: |
          export GITHUB_STEP_SUMMARY
          export CARGO_TARGET_DIR=dev.musl
          just rust="${{matrix.rust}}" profile=dev target=x86_64-unknown-linux-musl report
        if: ${{ always() }}

      - name: release/gnu report
        run: |
          export GITHUB_STEP_SUMMARY
          export CARGO_TARGET_DIR=release.gnu
          just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-gnu report
        if: ${{ always() }}

      - name: release/musl report
        run: |
          export GITHUB_STEP_SUMMARY
          export CARGO_TARGET_DIR=release.musl
          just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-musl report
        if: ${{ always() }}

      - uses: actions/upload-artifact@v4
        if: ${{ always() }}
        with:
          name: 'rust-${{matrix.rust}}-test-results'
          path: target/nextest

      - name: Setup tmate session for debug
        if: ${{ failure() }}
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 30
        with:
          limit-access-to-actor: true

  push:
    runs-on: "ubuntu-latest"
    strategy:
      fail-fast: false
      matrix:
        dpdk_sys:
          - main
        rust:
          - stable
          # - nightly
    steps:
      - name: login to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: "${{ github.actor }}"
          password: "${{ secrets.GITHUB_TOKEN }}"
      - name: install just
        uses: extractions/setup-just@v2
        with:
          just-version: ${{env.just}}
      - name: Checkout
        uses: actions/checkout@v4

      - name: install rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.rust }}
          targets: x86_64-unknown-linux-gnu
      - uses: cargo-bins/cargo-binstall@main
      - name: install cargo-deny
        run: cargo binstall --no-confirm cargo-deny
      # we want to avoid pushing any container which fails our carg-deny checks
      - run: just cargo deny check
      - run: just rust="${{matrix.rust}}" profile=debug target=x86_64-unknown-linux-gnu push-container
      # - run: just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-gnu push-container
      - run: just rust="${{matrix.rust}}" profile=debug target=x86_64-unknown-linux-musl push-container
      # - run: just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-musl push-container

      - name: Setup tmate session for debug
        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 30
        with:
          limit-access-to-actor: true