docker-reproducibility.yml

# SPDX-FileCopyrightText: 2026 Alexandre Gomes Gaigalas <alganet@gmail.com>
# SPDX-License-Identifier: ISC

name: Reproducibility check (temporary workflow)

on:
  pull_request:
    branches:
      - "main"

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-24.04
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v3
      - uses: ./.github/actions/downloads

      - name: Initialize report
        run: |
          echo "shell reproducibility report" > repro-report.txt
          echo "generated on $(date)" >> repro-report.txt
          echo >> repro-report.txt

      - name: Determine build targets
        run: |
          # convert newline-separated list to space-separated so build-arg works
          t=$(sh shvr.sh targets | tr '\n' ' ')
          echo "TARGETS=$t" >> $GITHUB_ENV

      - name: Build image (first pass)
        run: |
          docker buildx build --load --progress=plain -t repro:1 \
            --build-arg TARGETS="$TARGETS" .

      - name: Build image (second pass)
        run: |
          docker buildx build --load --progress=plain -t repro:2 \
            --build-arg TARGETS="$TARGETS" .

      - name: Extract filesystem snapshots
        run: |
          mkdir -p /tmp/opt1 /tmp/opt2
          docker create --name c1 repro:1 || true
          docker cp c1:/opt /tmp/opt1
          docker rm -f c1 || true
          docker create --name c2 repro:2 || true
          docker cp c2:/opt /tmp/opt2
          docker rm -f c2 || true

      - name: Compare binary checksums
        run: |
          echo "Image reproducibility report" >> repro-report.txt
          echo >> repro-report.txt
          for bin in $(find /tmp/opt1 -type f -executable); do
            rel=${bin#/tmp/opt1/}
            h1=$(sha256sum "$bin" | awk '{print $1}')
            if [ -f "/tmp/opt2/$rel" ]; then
              h2=$(sha256sum "/tmp/opt2/$rel" | awk '{print $1}')
            else
              h2="<missing>"
            fi
            if [ "$h1" = "$h2" ]; then
              echo "$rel: reproducible $h1" >> repro-report.txt
            else
              echo "$rel: NONREPRO $h1 $h2" >> repro-report.txt
            fi
          done
          echo >> repro-report.txt
          echo "Summary:" >> repro-report.txt
          grep -c "NONREPRO" repro-report.txt >> repro-report.txt || true

      - name: Upload artifact
        uses: actions/upload-artifact@v6
        with:
          name: reproducibility-report
          path: repro-report.txt