build.yml

name: Build and Test

on:
  push:
    paths-ignore:
      - "README.md"
    branches:
      - main
    tags:
      - 'v*.*.*'
  pull_request:
  workflow_dispatch:


jobs:
  build:
    name: Build
    runs-on: ${{ matrix.runner }}
    env:
      VERSION: ${{ github.ref_name }}
      COMMIT: ${{ github.sha }}
      BINARY_NAME: ${{ matrix.os == 'windows' && 'shimmy.exe' || 'shimmy' }}
    strategy:
      matrix:
        include:
          - { runner: macos-latest, os: darwin, arch: amd64 }
          - { runner: macos-latest, os: darwin, arch: arm64 }
          - { runner: ubuntu-latest, os: linux, arch: amd64, env: CGO_ENABLED=0 }
          - { runner: ubuntu-latest, os: linux, arch: arm64, env: CGO_ENABLED=0 }
          - { runner: ubuntu-latest, os: windows, arch: amd64, env: CGO_ENABLED=0 }
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: ./go.mod

      - name: Install Dependencies
        run: go mod download

      - name: Run Build
        env:
          GOOS: ${{ matrix.os }}
          GOARCH: ${{ matrix.arch }}
        run: |
          ${{ matrix.env }} \
            make build

      - name: Upload binary
        uses: actions/upload-artifact@v4
        with:
          name: shimmy-${{ matrix.os }}-${{ matrix.arch }}
          path: ./bin/${{ env.BINARY_NAME }}

  # TODO: Test on windows
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: ./go.mod

      - name: Install Dependencies
        run: go mod download

      - name: Run Tests
        run: go test -json ./...

#      - name: Upload test results
#        uses: actions/upload-artifact@v4
#        with:
#          name: Go-results
#          path: TestResults.json

  test-sandbox:
    name: Sandbox Integration Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: ./go.mod

      - name: Install Dependencies
        run: go mod download

      - name: Install nsjail
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            autoconf bison flex g++ git \
            libprotobuf-dev libnl-route-3-dev \
            libtool pkg-config protobuf-compiler
          git clone --depth=1 https://github.com/google/nsjail.git /tmp/nsjail
          make -C /tmp/nsjail -j$(nproc)
          sudo install -m 0755 /tmp/nsjail/nsjail /usr/sbin/nsjail

      - name: Run sandbox integration tests
        run: sudo -E go test -v -run 'TestSandboxedWorker' ./internal/execution/worker/...

  build_docker:
    name: Build Docker Image
    runs-on: ubuntu-latest
    needs: [test, test-sandbox, build]
    concurrency:
      group: ${{ github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' || github.ref_name != github.event.repository.default_branch }}
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up QEMU
        if: github.ref_name == github.event.repository.default_branch || github.ref_type == 'tag'
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx (QEMU)
        uses: docker/setup-buildx-action@v3

      - name: Login to Github Packages
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          tags: |
            type=schedule
            type=ref,event=branch
            type=ref,event=tag
            type=ref,event=pr
            type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}
            type=edge,branch=main
          images: |
            ghcr.io/${{ github.repository }}

      - name: Build and push
        uses: docker/build-push-action@v4
        with:
          context: .
          push: ${{ !(github.event_name == 'push' && github.ref_type != 'tag' && github.ref_name != github.event.repository.default_branch) }}
          platforms: ${{ (github.ref_type == 'tag' || github.ref_name == github.event.repository.default_branch) && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
          provenance: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max,ignore-error=true
          build-args: |
            VERSION=${{ github.ref_name }}
            COMMIT=${{ github.sha }}

  build_base_images:
    name: Build Base Images
    runs-on: ubuntu-latest
    needs: build_docker
    if: github.event_name == 'push' && (github.ref_name == github.event.repository.default_branch || github.ref_type == 'tag')
    concurrency:
      group: ${{ github.ref }}
      cancel-in-progress: false
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Repository Dispatch
        env:
          GH_TOKEN: ${{ secrets.SHIMMY_DEPLOY_TOKEN }}
        run: |
          gh api repos/${{ github.repository_owner }}/evaluation-function-base/dispatches \
            --method POST \
            -f event_type=trigger-build