ci-pr.yml

name: ci pr

# PR verification: format + build/test matrix.
# Main push uses ci-main.yml which adds publish/release/notify.

on:
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  checks: write

jobs:
  check-format:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install clang-format
        run: pip install clang-format==19.1.7

      - name: Check formatting
        run: bash scripts/format.sh --check

  build:
    needs: [check-format]
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux
            preset: default
            build_dir: build
            runner: ubuntu-22.04
          # arm64 is validated by the publish-side docker build (ci-main publish
          # arm64 entry); skipped here to avoid the ubuntu-runner ↔ bookworm-tarball
          # glog ABI mismatch. arm64 regressions surface at main-push time.
          - name: macos
            preset: default
            build_dir: build
            runner: macos-15
          - name: asan debug
            preset: san
            build_dir: build-san
            runner: [self-hosted, linode]
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install system dependencies
        run: |
          if [[ "$(uname)" == "Darwin" ]]; then
            deps/moxygen/standalone/install-system-deps.sh
            brew install coreutils
            echo "/opt/homebrew/opt/coreutils/libexec/gnubin" >> "$GITHUB_PATH"
          else
            sudo deps/moxygen/standalone/install-system-deps.sh
          fi

      - name: Setup dependencies
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MOQX_PLATFORM: ${{ matrix.platform || '' }}
        run: |
          # Three-mode setup resolution:
          # 1. .moxygen-release file (release branches): use pinned tag.
          # 2. Submodule SHA reachable from moxygen main: tarball mode via
          #    snapshot-latest. Robust to drift between moxygen merges and
          #    moqx's daily moxygen-sync.
          # 3. Submodule SHA NOT reachable from main (dev iterating against
          #    an unreleased moxygen feature branch): source build. Slow
          #    but supports cross-repo iteration without requiring a
          #    published moxygen tarball.
          if [ -f .moxygen-release ]; then
            export MOQX_MOXYGEN_RELEASE_TAG=$(cat .moxygen-release | tr -d '[:space:]')
            echo "==> Pinned moxygen tag: $MOQX_MOXYGEN_RELEASE_TAG"
            bash scripts/build.sh setup --no-fallback
          else
            SUB_SHA=$(git -C deps/moxygen rev-parse HEAD)
            AHEAD=$(gh api "repos/openmoq/moxygen/compare/main...$SUB_SHA" --jq .ahead_by 2>/dev/null || echo "1")
            if [ "$AHEAD" = "0" ]; then
              echo "==> moxygen submodule $SUB_SHA on main → snapshot tarball"
              bash scripts/build.sh setup --use-latest --no-fallback
            else
              echo "==> moxygen submodule $SUB_SHA $AHEAD commits diverged from main → source build"
              bash scripts/build.sh setup
            fi
          fi

      - name: Build
        run: bash scripts/build.sh --profile ${{ matrix.preset }} --build-dir ${{ matrix.build_dir }}

      - name: Test
        env:
          ASAN_OPTIONS: ${{ matrix.name == 'asan debug' && 'detect_leaks=1:abort_on_error=1' || '' }}
        run: bash scripts/build.sh test --build-dir ${{ matrix.build_dir }} -- --output-junit test-results.xml

      # dorny/test-reporter writes a Check Run, which needs 'checks: write' on
      # GITHUB_TOKEN. Fork-PR tokens are read-only regardless of workflow perms,
      # so skip on cross-repo PRs. test-log output above still shows pass/fail.
      - name: Publish test results
        uses: dorny/test-reporter@v1.9.1
        if: ${{ (success() || failure()) && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
        with:
          name: "test (${{ matrix.name }})"
          path: ${{ matrix.build_dir }}/test-results.xml
          reporter: java-junit
          fail-on-empty: ${{ job.status == 'success' && 'true' || 'false' }}
          # Only list failing tests in the Check Run summary. Listing all
          # passing tests too blows GitHub's 64 KiB output-body cap on large
          # suites; the per-suite pass/fail counts at the top still render.
          list-tests: failed

      - name: Note fork-PR reporter skip
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
        run: |
          echo "::notice::Publish test results skipped — fork-PR GITHUB_TOKEN lacks checks:write. Test-log output above is authoritative."

  conformance:
    needs: [check-format]
    strategy:
      fail-fast: false
      matrix:
        include:
          # mvfst — both transports for d14 and d16. d14+WT was unblocked by
          # facebookexperimental/moxygen#151 (Accept moq-00 in WT-Available-Protocols).
          # pico — raw QUIC for d14 and d16. WT cells deferred until pico
          # WT CONNECT (openmoq/moxygen#172 / PR #173) syncs in.
          - name: mvfst d14 Q
            versions: "14"
            transport: "Q"
            stack: "mvfst"
          - name: mvfst d14 WT
            versions: "14"
            transport: ""
            stack: "mvfst"
          - name: mvfst d16 Q
            versions: "16"
            transport: "Q"
            stack: "mvfst"
          - name: mvfst d16 WT
            versions: "16"
            transport: ""
            stack: "mvfst"
          - name: pico d14 Q
            versions: "14"
            transport: "Q"
            stack: "pico"
          - name: pico d16 Q
            versions: "16"
            transport: "Q"
            stack: "pico"
    name: conformance (${{ matrix.name }})
    runs-on: ubuntu-22.04
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.OMOQ_APP_ID }}
          private-key: ${{ secrets.OMOQ_APP_PRIV_KEY }}

      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install system dependencies
        run: sudo deps/moxygen/standalone/install-system-deps.sh

      - name: Setup dependencies
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          # Three-mode setup resolution (matches build job).
          if [ -f .moxygen-release ]; then
            export MOQX_MOXYGEN_RELEASE_TAG=$(cat .moxygen-release | tr -d '[:space:]')
            echo "==> Pinned moxygen tag: $MOQX_MOXYGEN_RELEASE_TAG"
            bash scripts/build.sh setup --no-fallback
          else
            SUB_SHA=$(git -C deps/moxygen rev-parse HEAD)
            AHEAD=$(gh api "repos/openmoq/moxygen/compare/main...$SUB_SHA" --jq .ahead_by 2>/dev/null || echo "1")
            if [ "$AHEAD" = "0" ]; then
              echo "==> moxygen submodule $SUB_SHA on main → snapshot tarball"
              bash scripts/build.sh setup --use-latest --no-fallback
            else
              echo "==> moxygen submodule $SUB_SHA $AHEAD commits diverged from main → source build"
              bash scripts/build.sh setup
            fi
          fi

      - name: Build
        run: bash scripts/build.sh

      - name: Run conformance tests
        run: bash test/test_conformance.sh ./build/moqx ${{ matrix.versions }} ${{ matrix.transport }} ${{ matrix.stack }}

  microbenchmark:
    needs: [check-format]
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux
            runner: ubuntu-22.04
          - name: macos
            # Pinned to match the moxygen publish runner: snapshot-latest ships
            # moxygen-macos-15-arm64.tar.gz, and this job downloads it with
            # --no-fallback. macos-latest now resolves to macOS 26 (gradual
            # rollout), which requests a macos-26 tarball that 404s. Keep in
            # lockstep with the build job above (also macos-15).
            runner: macos-15
    name: microbenchmark (${{ matrix.name }})
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.OMOQ_APP_ID }}
          private-key: ${{ secrets.OMOQ_APP_PRIV_KEY }}

      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install system dependencies
        run: |
          if [[ "$(uname)" == "Darwin" ]]; then
            deps/moxygen/standalone/install-system-deps.sh
          else
            sudo deps/moxygen/standalone/install-system-deps.sh
          fi

      - name: Setup dependencies
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          # Three-mode setup resolution (mirrors the build/conformance jobs):
          # 1. .moxygen-release file (release branches): use pinned tag.
          # 2. Submodule SHA reachable from moxygen main: snapshot tarball
          #    (avoids a slow from-source dep build when moxygen has advanced
          #    past the local pin — the common case under the daily sync).
          # 3. Submodule SHA diverged from main: source build.
          if [ -f .moxygen-release ]; then
            export MOQX_MOXYGEN_RELEASE_TAG=$(cat .moxygen-release | tr -d '[:space:]')
            echo "==> Pinned moxygen tag: $MOQX_MOXYGEN_RELEASE_TAG"
            bash scripts/build.sh setup --no-fallback
          else
            SUB_SHA=$(git -C deps/moxygen rev-parse HEAD)
            AHEAD=$(gh api "repos/openmoq/moxygen/compare/main...$SUB_SHA" --jq .ahead_by 2>/dev/null || echo "1")
            if [ "$AHEAD" = "0" ]; then
              echo "==> moxygen submodule $SUB_SHA on main → snapshot tarball"
              bash scripts/build.sh setup --use-latest --no-fallback
            else
              echo "==> moxygen submodule $SUB_SHA $AHEAD commits diverged from main → source build"
              bash scripts/build.sh setup
            fi
          fi

      - name: Build microbenchmarks
        run: bash scripts/build.sh --benchmark

      - name: Run microbenchmarks
        run: |
          ./build/benchmark/moqx_benchmark \
            --bm_json_verbose=microbench-results.json \
            | tee microbench-output.txt

      - name: Render summary
        if: always()
        run: |
          {
            echo "## Microbenchmark results — ${{ matrix.name }}"
            echo ""
            echo '```'
            cat microbench-output.txt
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload microbenchmark artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: microbench-results-${{ matrix.name }}
          path: |
            microbench-results.json
            microbench-output.txt