ci-nix.yml

# This is a basic workflow to help you get started with Actions

name: "CI (nix)"

# Controls when the workflow will run
on:
  # Triggers the workflow on push or pull request events but only for the "main" branch and release tags
  push:
    branches: [ "main", "master", "devel", "releases/v*" ]
    tags:
      - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
  pull_request:
    branches: [ "main", "master", "devel", "releases/v*" ]
  merge_group:
    branches: [ "main", "master", "devel", "releases/v*" ]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  self-care:
    name: Flake self-check
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - name: Check Nix flake inputs
        uses: DeterminateSystems/flake-checker-action@v5
        with:
          fail-mode: true
          nixpkgs-keys: nixpkgs,nixpkgs-unstable

  lint:
    name: "Lint"
    runs-on: ubuntu-22.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - uses: cachix/install-nix-action@v23
        with:
          nix_path: nixpkgs=channel:nixos-22.05
      - uses: cachix/cachix-action@v12
        with:
          name: fedimint
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
        continue-on-error: true

      # caching ~/.cargo to avoid downloading all (especially git) deps in pre-commit's `cargo update --lock` check
      - name: Cache ~/.cargo
        uses: actions/cache@v3
        with:
          path: ~/.cargo
          key: ${{ runner.os }}-${{ hashFiles('Cargo.lock') }}

      # run the same check that git `pre-commit` hook would, just in case
      - name: Commit check
        run: nix develop --ignore-environment .#lint --command ./misc/git-hooks/pre-commit

      - name: Check udeps
        run: nix build -L .#nightly.test.workspaceCargoUdeps

  build:
    strategy:
      matrix:
        host:
          - linux
          - macos
        include:
          - host: linux
            runs-on: buildjet-8vcpu-ubuntu-2004
            build-in-pr: true
            timeout: 60
            run-tests: true
          - host: macos
            runs-on: macos-12
            build-in-pr: false
            # TODO: Too slow; see https://github.com/actions/runner-images/issues/1336
            timeout: 60
            run-tests: false

    name: "Build on ${{ matrix.host }}"
    runs-on: ${{ matrix.runs-on }}
    timeout-minutes: ${{ matrix.timeout }}

    steps:
      - uses: actions/checkout@v4
        if: github.event_name != 'pull_request' || matrix.build-in-pr

      - uses: cachix/install-nix-action@v23
        if: github.event_name != 'pull_request' || matrix.build-in-pr
        with:
          nix_path: nixpkgs=channel:nixos-22.05
      - uses: cachix/cachix-action@v12
        if: github.event_name != 'pull_request' || matrix.build-in-pr
        with:
          name: fedimint
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
        continue-on-error: true

      - name: Build workspace
        if: github.event_name != 'pull_request' || matrix.build-in-pr
        run: nix build -L .#ci.workspaceBuild

      - name: Clippy workspace
        if: github.event_name != 'pull_request' || matrix.build-in-pr
        run: nix build -L .#ci.workspaceClippy

      - name: Run cargo doc
        if: (github.event_name != 'pull_request' || matrix.build-in-pr) && (matrix.host != 'macos')
        run: nix build -L .#ci.workspaceDoc

      - name: Test docs
        if: (github.event_name != 'pull_request' || matrix.build-in-pr) && (matrix.host != 'macos')
        run: nix build -L .#ci.workspaceTestDoc

      - name: Tests
        if: (github.event_name != 'pull_request' || matrix.build-in-pr) && matrix.run-tests
        run: |
          nix build -L .#ci.ciTestAll --keep-failed

      - name: Wasm Tests
        if: (github.event_name != 'pull_request' || matrix.build-in-pr) && matrix.run-tests && (matrix.host != 'macos')
        run: nix build -L .#wasm32-unknown.ci.wasmTest --keep-failed

      - name: Prepare failed test build dirs
        if: always()
        run:  |
          set -x
          # delete source and target artifacts as it is huge and rather useless now
          sudo rm -Rf /tmp/nix-build-*/source || true
          # chown so actions/upload-artifact can access it
          sudo chown -R $USER /tmp/nix-build-* || true
          # delete unix sockets, as actions/upload-artifact can't handle them
          find /tmp/nix-build-* -type s -print0 | xargs -0 rm || true

      - name: Upload failed test build dirs
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: "fedimint-failed-test-logs-${{ github.run_number }}-${{ matrix.host}}"
          path: |
            /tmp/nix-build-*/
            !/tmp/nix-build-*/source/

  audit:
    if: github.repository == 'fedimint/fedimint'
    name: "Audit"
    runs-on: buildjet-2vcpu-ubuntu-2004
    timeout-minutes: 10
    # sometimes we can't fix these immediately, yet
    # we don't want to stop the world because of it
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - uses: cachix/install-nix-action@v23
        with:
          nix_path: nixpkgs=channel:nixos-22.05
      - uses: cachix/cachix-action@v12
        with:
          name: fedimint
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

      - name: Run cargo audit
        run: |
          nix flake lock --update-input advisory-db
          nix build -L .#ci.cargoAudit

      - name: Run cargo deny
        run: |
          nix build -L .#ci.cargoDeny

  cross:
    name: "Cross-compile on ${{ matrix.host }} to ${{ matrix.toolchain }}"

    strategy:
      matrix:
        host:
          - linux
          - macos
        toolchain:
          - aarch64-android
          - armv7-android
          - x86_64-android
          - wasm32-unknown
        include:
          - host: linux
            runs-on: ubuntu-22.04
            build-in-pr: true
            timeout: 20
          - host: macos
            runs-on: macos-12
            build-in-pr: false
            # TODO: Too slow; see https://github.com/actions/runner-images/issues/1336
            timeout: 60
        exclude:
            # there's not enough macos runners available for our CI, so test only the more important cross-compilation toolchains
            # if they work, rest probably works as well
          - host: macos
            toolchain: armv7-linux-androideabi
          - host: macos
            toolchain: x86_64-linux-android


    runs-on: ${{ matrix.runs-on }}
    timeout-minutes: ${{ matrix.timeout }}

    steps:
      - uses: actions/checkout@v4
        if: github.event_name != 'pull_request' || matrix.build-in-pr

      - uses: cachix/install-nix-action@v23
        if: github.event_name != 'pull_request' || matrix.build-in-pr
        with:
          nix_path: nixpkgs=channel:nixos-22.05

      - uses: cachix/cachix-action@v12
        if: github.event_name != 'pull_request' || matrix.build-in-pr
        with:
          name: fedimint
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
        continue-on-error: true

      - name: Build client packages for ${{ matrix.toolchain }}
        if: github.event_name != 'pull_request' || matrix.build-in-pr
        run: nix build -L .#${{ matrix.toolchain }}.ci.client-pkgs