ci.yaml

name: CI

# Run CI when a commit lands on the main branch and when a PR for main is
# opened.
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  REGISTRY: ghcr.io

permissions:
  checks: write
  contents: read
  id-token: write
  packages: write
  pages: write
  pull-requests: write

jobs:
  create-images:
    timeout-minutes: 15
    strategy:
      matrix:
        host:
          - { name: ubuntu-24.04, arch: x64 }
          - { name: 4-core-ubuntu-arm, arch: arm64 }
        distribution:
          - { name: fedora, version: "41" }
          - { name: fedora, version: "40" }
          - { name: fedora, version: "39" }
          - { name: ubuntu, version: "24.10" }
          - { name: ubuntu, version: "24.04" }
    runs-on: [ "${{ matrix.host.name }}" ]
    name: "Image: ${{ matrix.distribution.name }} ${{ matrix.distribution.version }} (${{ matrix.host.arch}})"
    steps:
      - name: Checkout bpfilter
        uses: actions/checkout@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Log to GHCR
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      # Build the container images and use the existing images as cache
      - name: Build and push container image
        uses: docker/build-push-action@v4
        with:
          file: .github/${{ matrix.distribution.name }}-${{ matrix.distribution.version }}.Dockerfile
          push: ${{ github.ref == 'refs/heads/main' && 'true' || 'false' }}
          tags: ghcr.io/facebook/bpfilter:${{ matrix.distribution.name }}-${{ matrix.distribution.version }}-${{ matrix.host.arch}}
          cache-from: type=gha,scope=${{ matrix.distribution.name }}-${{ matrix.distribution.version }}-${{ matrix.host.arch}}
          cache-to: type=gha,mode=max,scope=${{ matrix.distribution.name }}-${{ matrix.distribution.version }}-${{ matrix.host.arch}}

  build:
    needs: create-images
    timeout-minutes: 5
    strategy:
      matrix:
        host:
          - { name: ubuntu-24.04, arch: x64 }
          - { name: 4-core-ubuntu-arm, arch: arm64 }
        distribution:
          - { name: fedora, version: "41" }
          - { name: fedora, version: "40" }
          - { name: fedora, version: "39" }
          - { name: ubuntu, version: "24.10" }
          - { name: ubuntu, version: "24.04" }
    runs-on: [ "${{ matrix.host.name }}" ]
    container: ghcr.io/facebook/bpfilter:${{ matrix.distribution.name }}-${{ matrix.distribution.version }}-${{ matrix.host.arch}}
    name: "Build: ${{ matrix.distribution.name }} ${{ matrix.distribution.version }} (${{ matrix.host.arch}})"
    steps:
      - name: Checkout bpfilter
        uses: actions/checkout@v2
      - name: Configure the build
        run: cmake -S $GITHUB_WORKSPACE -B $GITHUB_WORKSPACE/build -DNO_BENCHMARKS=1
      - name: Build all
        run: make -C $GITHUB_WORKSPACE/build -j `nproc`

  check:
    needs: create-images
    timeout-minutes: 5
    runs-on: [ "ubuntu-24.04" ]
    container: ghcr.io/facebook/bpfilter:fedora-41-x64
    name: "Check"
    steps:
      - name: Checkout bpfilter
        uses: actions/checkout@v2
      - name: Configure the build
        run: cmake -S $GITHUB_WORKSPACE -B $GITHUB_WORKSPACE/build
      - name: Build
        run: make -C $GITHUB_WORKSPACE/build -j `nproc` check

  test:
    needs: create-images
    timeout-minutes: 5
    strategy:
      matrix:
        host:
          - { name: ubuntu-24.04, arch: x64 }
          - { name: 4-core-ubuntu-arm, arch: arm64 }
    runs-on: [ "${{ matrix.host.name }}" ]
    container:
      image: ghcr.io/facebook/bpfilter:fedora-41-${{ matrix.host.arch }}
      options: --privileged
    name: "Test: ${{ matrix.host.arch }}"
    steps:
      - name: Checkout bpfilter
        uses: actions/checkout@v2
      - name: Restore the cached test results
        uses: actions/cache/restore@v4
        with:
          path: build/output/tests
          key: tests-results
      - name: Configure the build
        run: cmake -S $GITHUB_WORKSPACE -B $GITHUB_WORKSPACE/build
      - name: Run unit tests
        run: make -C $GITHUB_WORKSPACE/build -j `nproc` test
      - name: Run end-to-end tests
        run: make -C $GITHUB_WORKSPACE/build -j `nproc` e2e
      - name: Cache the test results
        uses: actions/cache/save@v4
        if: matrix.host.arch == 'x64' && github.ref == 'refs/heads/main'
        with:
          path: build/output/tests
          key: tests-results

  benchmark:
    needs: create-images
    timeout-minutes: 5
    strategy:
      matrix:
        host:
          - { name: ubuntu-24.04, arch: x64 }
          - { name: 4-core-ubuntu-arm, arch: arm64 }
    runs-on: [ "${{ matrix.host.name }}" ]
    container:
      image: ghcr.io/facebook/bpfilter:fedora-41-${{ matrix.host.arch }}
      options: --privileged
    name: "Benchmark: ${{ matrix.host.arch }}"
    steps:
      - name: Checkout bpfilter
        uses: actions/checkout@v2
      - name: Ensure we can read the Git repository
        run: git config --global --add safe.directory $GITHUB_WORKSPACE
      - name: Configure the build
        run: cmake -S $GITHUB_WORKSPACE -B $GITHUB_WORKSPACE/build -DWITH_BENCHMARK=on
      - name: Restore the cached benchmark results
        uses: actions/cache/restore@v4
        with:
          path: build/output/benchmarks
          key: benchmarks-results
      - name: Build
        run: make -C $GITHUB_WORKSPACE/build -j `nproc` benchmark
      - name: Cache the benchmark results
        uses: actions/cache/save@v4
        if: matrix.host.arch == 'x64' && github.ref == 'refs/heads/main'
        with:
          path: build/output/benchmarks
          key: benchmarks-results

  doc:
    needs: [ test, benchmark ]
    timeout-minutes: 5
    runs-on: [ "ubuntu-24.04" ]
    container: ghcr.io/facebook/bpfilter:fedora-41-x64
    name: "Documentation"
    steps:
      - name: Checkout bpfilter
        uses: actions/checkout@v2
      - name: Configure the build
        run: cmake -S $GITHUB_WORKSPACE -B $GITHUB_WORKSPACE/build
      - name: Restore the cached tests results
        uses: actions/cache@v4
        with:
          path: build/output/tests
          key: tests-results
      - name: Restore the cached benchmarks results
        uses: actions/cache@v4
        with:
          path: build/output/benchmarks
          key: benchmarks-results
      - name: Build
        run: make -C $GITHUB_WORKSPACE/build -j `nproc` doc
      - name: Fix permissions
        if: github.ref == 'refs/heads/main'
        run: |
          chmod -c -R +rX "$GITHUB_WORKSPACE/build/doc/html" | while read line; do
            echo "::warning title=Invalid file permissions automatically fixed::$line"
          done
      - name: Upload artifact
        uses: actions/upload-pages-artifact@v3
        if: github.ref == 'refs/heads/main'
        with:
          path: build/doc/html
      - name: Deploy to GitHub Pages
        uses: actions/deploy-pages@v4
        if: github.ref == 'refs/heads/main'