ci-reproducibility #420
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # NOTE: This name appears in GitHub's Checks API and in workflow's status badge. | |
| name: ci-reproducibility | |
| # Trigger the workflow when: | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - stable/* | |
| # Or when a pull request event occurs for a pull request against one of the | |
| # matched branches and at least one modified file matches the configured paths. | |
| pull_request: | |
| branches: | |
| - main | |
| - stable/* | |
| paths: | |
| - .github/actions/** | |
| # Besides pushes on the branches above, also check every day at 00:00 UTC. | |
| schedule: | |
| - cron: "0 0 * * *" | |
| # Cancel in-progress jobs on same branch. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check-reproducible-build: | |
| # NOTE: This name appears in GitHub's Checks API. | |
| name: check-reproducibility | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Determine tag name | |
| id: determine-tag | |
| uses: ./.github/actions/determine-tag | |
| with: | |
| use_base_for_pr: yes | |
| - name: Build test binaries, 1. | |
| id: build-1 | |
| uses: ./.github/actions/hash-rust | |
| with: | |
| binaries: test-runtime-simple-consensus,test-runtime-simple-keyvalue | |
| image: ghcr.io/oasisprotocol/runtime-builder:${{ steps.determine-tag.outputs.tag }} | |
| - name: Build test binaries, 2. | |
| id: build-2 | |
| uses: ./.github/actions/hash-rust | |
| with: | |
| binaries: test-runtime-simple-consensus,test-runtime-simple-keyvalue | |
| image: ghcr.io/oasisprotocol/runtime-builder:${{ steps.determine-tag.outputs.tag }} | |
| - name: Check result is non-empty | |
| run: | | |
| [ "${{ steps.build-1.outputs.hashes }}" != "" ] | |
| - name: Check binary equality | |
| run: | | |
| [ "${{ steps.build-1.outputs.hashes }}" == "${{ steps.build-2.outputs.hashes }}" ] |