ci.yml

name: CI

# Lint + test + audit on every branch push and pull request, except pushes to the
# `release` branch: release.yml runs the same checks there as a gate before publishing,
# so a candidate does not double-run them here. Tag pushes never match (branches: '**'
# matches branches, not tags), and release.yml's own pushes of `main` and the tag
# are made with the workflow token, which triggers no workflow at all.
#
# A build job runs alongside quality, so the two take as long as the longer one, and
# uploads the binaries as a GitHub Actions artifact (retention: 1 day). This lets you grab a
# build from any commit without waiting for a release. Like a release, every run builds the
# guest kernel and the UEFI firmware from its own commit, each in a job of its own beside the
# binaries', and embeds them.
#
# fleet-e2e then runs the fleet's end-to-end tests (tests/fleet-*.sh) against that
# build once quality has passed too: a hub and its nodes booted as microVMs on the runner's
# KVM.

on:
  push:
    branches:
      - '**'
      - '!release'
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  quality:
    uses: ./.github/workflows/quality.yml

  build:
    uses: ./.github/workflows/build.yml
    with:
      artifact-prefix: ci
      retention-days: 1

  # The scripts also run before every release, with the rest of tests/ (release.yml).
  fleet-e2e:
    needs: [quality, build]
    runs-on: ubuntu-26.04
    # Above the scripts' caps and cleanups combined (4 × (900 + 120 + 70)s), so the loop
    # always ends and reports. The mixed-version and update tests skip here without older or
    # newer binaries.
    timeout-minutes: 75
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download binary artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ci-binaries-${{ github.sha }}
          path: dist

      - name: Enable KVM for the runner user
        uses: ./.github/actions/enable-kvm

      # An artifact keeps no permission bits. Every script runs, each capped, and the job
      # fails if any did — or skipped for want of KVM or nesting (E2E_REQUIRE_KVM). The
      # cap's grace period lets a script's own teardown run; what a killed script still
      # leaves behind is stopped before the next one starts.
      - name: Run the fleet end-to-end tests against the built vk
        env:
          E2E_REQUIRE_KVM: 1
        run: |
          chmod +x dist/vk dist/vk-hub
          df -h /
          free -m
          failed=0
          for t in tests/fleet-*.sh; do
            echo "::group::$t"
            start=$SECONDS
            VK=dist/vk timeout -k 120 900 bash "$t" || { echo "::error::$t failed"; failed=1; }
            echo "$t: $((SECONDS - start))s"
            timeout -k 10 60 dist/vk stop --all || true
            pkill -f "^$PWD/dist/vk node run\$" || true
            echo "::endgroup::"
          done
          exit "$failed"

      # Clean up after cancellation or timeout bypasses the loop's cleanup.
      - name: Stop leftover VMs
        if: always()
        run: |
          [ -x dist/vk ] || exit 0
          dist/vk list || true
          pkill -f "^$PWD/dist/vk node run\$" || true
          dist/vk stop --all

      # Report disk and memory use by the fleet's VMs and images to help diagnose
      # otherwise opaque ENOSPC or OOM test failures.
      - name: Free space and memory after the tests
        if: always()
        run: |
          df -h /
          free -m