ci.yml

# SPDX-License-Identifier: Apache-2.0

name: CI
on:
  push:
    branches: ["*"]
  pull_request:
    branches: ["main"]
jobs:
  build_kat:
    strategy:
      fail-fast: false
      matrix:
        include:
        - system: macos-latest
          expect_arch: arm64
        - system: pqcp-arm64
          expect_arch: aarch64
        - system: ubuntu-latest
          cross_prefix: aarch64-none-linux-gnu-
          expect_arch: x86_64
    name: build_kat (${{ matrix.system }})
    runs-on: ${{ matrix.system }}
    steps:
      - uses: actions/checkout@v4
      - name: Setup nix
        uses: ./.github/actions/setup-nix
        with:
          script: |
            ARCH=$(uname -m)
            cat >> $GITHUB_STEP_SUMMARY <<-EOF
              ## Setup
              Architecture: $ARCH
              - $(uname -a)
              - $(nix --version)
              - $(astyle --version)
              - $(${{ matrix.cross_prefix }}gcc --version | grep -m1 "")
              - $(bash --version | grep -m1 "")
            EOF

            if [[ "$ARCH" != ${{ matrix.expect_arch }} ]]; then
              echo ":x: Expecting to run on ${{ matrix.expect_arch }}, but instead running on $ARCH" >> $GITHUB_STEP_SUMMARY
              exit 1
            fi
      - name: Run functional tests
        id: func_test
        shell: nix develop .#ci -c bash -e {0}
        run: |
          tests func
      - name: Run KAT tests
        id: kat_test
        if: |
          success()
          || steps.func_test.conclusion == 'failure'
        shell: nix develop .#ci -c bash -e {0}
        run: |
          tests kat
      - name: Run Nistkat tests
        id: nistkat_test
        if: |
          success()
          || steps.func_test.conclusion == 'failure'
          || steps.kat_test.conclusion == 'failure'
        shell: nix develop .#ci -c bash -e {0}
        run: |
          tests nistkat
  lint:
    strategy:
      matrix:
        system: [ubuntu-latest]
    runs-on: ${{ matrix.system }}
    steps:
      - uses: actions/checkout@v4
      - name: Setup nix
        uses: ./.github/actions/setup-nix
        with:
          script: |
            cat >> $GITHUB_STEP_SUMMARY << EOF
              ## Setup
              Architecture: $(uname -m)
              - $(uname -a)
              - $(nix --version)
              - $(astyle --version)
              - $(${{ matrix.cross_prefix }}gcc --version | grep -m1 "")
              - $(bash --version | grep -m1 "")
            EOF
      - name: Lint
        shell: nix develop .#ci -c bash -e {0}
        run: |
          echo "## Lint & Checks" >> $GITHUB_STEP_SUMMARY
          lint
  cbmc:
    strategy:
      matrix:
        system: [macos-latest]
    runs-on: ${{ matrix.system }}
    steps:
      - uses: actions/checkout@v4
      - name: Setup nix
        uses: ./.github/actions/setup-nix
        with:
          script: |
            cat >> $GITHUB_STEP_SUMMARY << EOF
              ## Setup
              Architecture: $(uname -m)
              - $(nix --version)
              - $(cbmc --version)
              - litani Version $(litani --version)
              - Cadical Version $(cadical --version)
              - $(${{ matrix.cross_prefix }}gcc --version | grep -m1 "")
              - $(bash --version | grep -m1 "")
            EOF
      - name: Run CBMC proofs
        shell: nix develop .#ci -c bash -e {0}
        run: |
          cd cbmc/proofs;
          KYBER_K=2 ./run-cbmc-proofs.py --summarize;
          KYBER_K=3 ./run-cbmc-proofs.py --summarize;
          KYBER_K=4 ./run-cbmc-proofs.py --summarize;