ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  rust:
    name: Rust (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606  # v1.15.4
        with:
          toolchain: nightly, 1.94
          components: rustfmt, clippy
          rustflags: ""

      - name: Install just
        run: cargo install --locked just

      - name: Format check
        run: just fmt-check-rust

      - name: Lint
        run: just lint-rust

      - name: Tests
        run: just test-rust

  wasm-sandbox:
    name: WASM Sandbox (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606  # v1.15.4
        with:
          components: clippy
          rustflags: ""

      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0

      - name: Install Python
        run: uv python install 3.12

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
        with:
          node-version: "latest"
          cache: npm
          cache-dependency-path: src/wasm_sandbox/guests/javascript/package-lock.json

      - name: Install just
        run: cargo install --locked just

      - name: Install clang (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y clang

      - name: Install LLVM (Windows)
        if: runner.os == 'Windows'
        run: choco install llvm -y

      - name: Enable KVM
        if: runner.os == 'Linux' && !env.ACT
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
          sudo chmod 666 /dev/kvm

      - name: Build
        run: just wasm build

      - name: Lint
        run: just wasm lint

      - name: Integration tests
        run: just wasm test

      - name: Run examples
        run: just wasm examples

      # Python SDK checks go here so we don't rebuild everything from scratch on another job
      # Build JS sandbox first — the Python hyperlight-js backend shares the root
      # workspace target/ and needs hyperlight-js-runtime to be compiled.
      - name: Build JS sandbox
        run: just js build

      - name: Python SDK Format check
        run: just python fmt-check

      - name: Python SDK Lint
        run: just python lint

      - name: Python SDK Build
        run: just python build

      - name: Python SDK examples
        run: just python examples

      - name: Python SDK Tests
        run: just python python-test

      - name: Python SDK Fuzz
        run: just fuzz 30

      # this is too flaky in github actions to run on PRs
      # copilot fails to repsond in a timely fashion
      # - name: Run Python SDK integration examples
      #   env:
      #     COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_TOKEN }}
      #   run: just integration-examples

      # run last becuase it runs in build mode and messes with maturin
      - name: Python SDK Benchmark
        run: just benchmark

  python-wheelhouse:
    name: Python SDK wheelhouse test  (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606  # v1.15.4
        with:
          cache-key: release
          rustflags: ""

      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0

      - name: Install Python
        run: uv python install 3.12

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
        with:
          node-version: "latest"
          cache: npm
          cache-dependency-path: src/wasm_sandbox/guests/javascript/package-lock.json

      - name: Install just
        run: cargo install --locked just

      - name: Install clang (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y clang

      - name: Install LLVM (Windows)
        if: runner.os == 'Windows'
        run: choco install llvm -y

      - name: Enable KVM
        if: runner.os == 'Linux' && !env.ACT
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
          sudo chmod 666 /dev/kvm

      - name: Build release wheels and run wheelhouse test
        run: just python-wheelhouse-test

  javascript-sandbox:
    name: JS Sandbox (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606  # v1.15.4
        with:
          components: clippy
          rustflags: ""

      - name: Install just
        run: cargo install --locked just

      - name: Install clang (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y clang

      - name: Install LLVM (Windows)
        if: runner.os == 'Windows'
        run: choco install llvm -y

      - name: Enable KVM
        if: runner.os == 'Linux' && !env.ACT
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
          sudo chmod 666 /dev/kvm

      - name: Compile WIT world
        run: just wasm guest-compile-wit

      - name: Build
        run: just js build

      - name: Lint
        run: just js lint

      - name: Tests
        run: just js test

      - name: Run examples
        run: just js examples

  nanvix-sandbox:
    name: Nanvix Sandbox · build
    runs-on: ubuntu-latest #current linux only
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606  # v1.15.4
        with:
          toolchain: nightly
          rustflags: ""

      - name: Install just
        run: cargo install --locked just

      - name: Build
        run: just nanvix build

      # NOTE: nanvix examples are skipped until hyperlight-nanvix updates to
      # the new nanvix registry API (qjs/python3 are now separate packages).
      # See: https://github.com/hyperlight-dev/hyperlight-nanvix
      # - name: Run examples
      #   run: just nanvix examples