nist-validation.yml

name: NIST Scientific Validation

on:
  workflow_dispatch:  # Only run manually for NIST reference comparison

env:
  PROTOC_VERSION: '28.3'

jobs:
  validate:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: '1.25.4'

    - name: Cache NIST reference repository and binaries
      uses: actions/cache@v4
      with:
        path: |
          build/90b-validation/ref
          build/90b-validation/bin
        key: nist-validation-${{ runner.os }}-${{ hashFiles('tools/run_90b_validation.sh') }}
        restore-keys: |
          nist-validation-${{ runner.os }}-

    - name: Cache protoc
      id: cache-protoc
      uses: actions/cache@v4
      with:
        path: ${{ runner.temp }}/protoc
        key: protoc-${{ env.PROTOC_VERSION }}-${{ runner.os }}-${{ runner.arch }}

    - name: Install protoc
      if: steps.cache-protoc.outputs.cache-hit != 'true'
      run: |
        wget -q "https://github.com/protocolbuffers/protobuf/releases/download/v${{ env.PROTOC_VERSION }}/protoc-${{ env.PROTOC_VERSION }}-linux-x86_64.zip"
        unzip -q protoc-${{ env.PROTOC_VERSION }}-linux-x86_64.zip -d "${{ runner.temp }}/protoc"

    - name: Add protoc to PATH
      run: echo "${{ runner.temp }}/protoc/bin" >> "$GITHUB_PATH"

    - name: Install C++ Dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y \
          g++ \
          make \
          libbz2-dev \
          libdivsufsort-dev \
          libjsoncpp-dev \
          libmpfr-dev \
          libgmp-dev \
          libssl-dev

    - name: Build NIST C++ Library
      run: make build-nist

    - name: Download Go dependencies
      run: go mod download

    - name: Install Go protobuf tools
      run: |
        go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
        go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest

    - name: Run NIST Validation
      id: validation
      run: |
        set -euo pipefail
        ARTIFACT_DIR="${GITHUB_WORKSPACE}/validation-artifacts"
        mkdir -p "${ARTIFACT_DIR}"
        STATUS="passed"

        if ! ./tools/run_90b_validation.sh 2>&1 | tee "${ARTIFACT_DIR}/validation_output.txt"; then
          STATUS="failed"
        fi

        find build/90b-validation -maxdepth 1 -type f \
          \( -name 'ref_*.json' -o -name 'go_*.json' \) \
          -exec cp {} "${ARTIFACT_DIR}/" \;

        echo "validation_status=${STATUS}" >> "${GITHUB_OUTPUT}"

        if [ "${STATUS}" != "passed" ]; then
          exit 1
        fi

    - name: Generate Validation Report
      if: always()
      run: |
        ARTIFACT_DIR="${GITHUB_WORKSPACE}/validation-artifacts"
        mkdir -p "${ARTIFACT_DIR}"
        REPORT="${ARTIFACT_DIR}/validation_report.md"
        STATUS="${{ steps.validation.outputs.validation_status }}"
        if [ -z "${STATUS}" ]; then
          STATUS="failed"
        fi

        echo "# NIST SP 800-90B Scientific Validation Results" > "${REPORT}"
        echo "" >> "${REPORT}"
        echo "## Test Status: ${STATUS}" >> "${REPORT}"
        echo "" >> "${REPORT}"

        if [ "${STATUS}" = "passed" ]; then
          echo "### Validation Successful" >> "${REPORT}"
          echo "" >> "${REPORT}"
          echo "The Go/CGO wrapper produced min-entropy estimates matching the NIST SP 800-90B C++ reference implementation within the configured floating-point tolerance." >> "${REPORT}"
        else
          echo "### Validation Failed" >> "${REPORT}"
          echo "" >> "${REPORT}"
          echo "One or more estimator comparisons failed or the validation workflow did not complete successfully." >> "${REPORT}"
        fi

        echo "" >> "${REPORT}"
        echo "### Artifact Contents" >> "${REPORT}"
        echo "" >> "${REPORT}"
        echo "- \`validation_output.txt\`: complete validation console output" >> "${REPORT}"
        echo "- \`ref_*.json\`: outputs generated by the NIST SP 800-90B C++ reference implementation" >> "${REPORT}"
        echo "- \`go_*.json\`: outputs generated by the Go/CGO service implementation" >> "${REPORT}"
        echo "" >> "${REPORT}"
        echo "### Test Details" >> "${REPORT}"
        echo "" >> "${REPORT}"
        echo '```' >> "${REPORT}"
        if [ -f "${ARTIFACT_DIR}/validation_output.txt" ]; then
          cat "${ARTIFACT_DIR}/validation_output.txt" >> "${REPORT}"
        else
          echo "No validation output available" >> "${REPORT}"
        fi
        echo '```' >> "${REPORT}"

        cat "${REPORT}" >> "$GITHUB_STEP_SUMMARY"

    - name: Upload Validation Artifacts
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: validation-results
        path: |
          validation-artifacts/**
        retention-days: 30
        if-no-files-found: warn