ci-pr.yml

name: ci pr

# PR verification: format + build/test matrix.
# Main push uses ci-main.yml which adds publish/release/notify.

on:
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  checks: write

jobs:
  check-format:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install clang-format
        run: pip install clang-format==19.1.7

      - name: Check formatting
        run: bash scripts/dev/format.sh --check

  build:
    needs: [check-format]
    strategy:
      fail-fast: false
      matrix:
        # `key` is the lane id (ccache keys, option gating); `name` renders into
        # the status-check name. Renaming a lane branch protection requires stops
        # that check reporting — update the ruleset in the same change.
        include:
          - name: linux
            key: linux
            preset: default
            runner: ubuntu-22.04
          # arm64 is validated by the publish-side docker build (ci-main publish
          # arm64 entry); skipped here to avoid the ubuntu-runner ↔ bookworm-tarball
          # glog ABI mismatch. arm64 regressions surface at main-push time.
          - name: macos
            key: macos
            preset: default
            runner: macos-15
          # ASan on moqx's own TUs, over the uninstrumented prebuilt folly, for a
          # fast PR signal; sanitizers.yml builds the instrumented stack.
          # RelWithDebInfo: the prebuilt is NDEBUG and folly's kIsDebug is ABI.
          - name: asan (moqx TUs, prebuilt deps)
            key: asan
            preset: san
            extra_cmake: -DCMAKE_BUILD_TYPE=RelWithDebInfo
            # The san preset demands an instrumented moxygen; this lane knowingly
            # takes the uninstrumented one. Without it configure.sh refuses.
            uninstrumented_deps: true
            leak_check: true
            runner: [self-hosted, linode]
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.runner }}
    # Ceiling for the from-source fallback, not the normal runtime (~28 min).
    # Matched to sanitizers.yml, the only measured from-source budget we have.
    timeout-minutes: 180
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/setup-build
        with:
          ccache-key: ${{ matrix.key }}

      # The trilogy, not raw cmake: configure.sh picks the moxygen and build.sh
      # resolves a job count, where Ninja's own nproc + 2 default OOMs the
      # sanitizer lane. See BUILD.md#build.
      - name: Build
        env:
          GITHUB_TOKEN: ${{ github.token }}
          MOQX_ALLOW_UNINSTRUMENTED_DEPS: ${{ matrix.uninstrumented_deps && '1' || '' }}
        run: |
          scripts/configure.sh ${{ matrix.preset }} --moxygen prebuilt-with-fallback ${{ matrix.extra_cmake }}
          scripts/build.sh ${{ matrix.preset }}

      # test.sh, not raw ctest: it resolves the --parallel the suite needs (the
      # shell integration tests carry unique ports so they can share a run).
      - name: Test
        env:
          ASAN_OPTIONS: ${{ matrix.leak_check && 'detect_leaks=1:abort_on_error=1' || '' }}
        run: scripts/test.sh ${{ matrix.preset }} --output-junit test-results.xml

      # dorny/test-reporter writes a Check Run, which needs 'checks: write' on
      # GITHUB_TOKEN. Fork-PR tokens are read-only regardless of workflow perms,
      # so skip on cross-repo PRs. test-log output above still shows pass/fail.
      - name: Publish test results
        uses: dorny/test-reporter@v1.9.1
        if: ${{ (success() || failure()) && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
        with:
          name: "test (${{ matrix.name }})"
          path: build/${{ matrix.preset }}/test-results.xml
          reporter: java-junit
          fail-on-empty: ${{ job.status == 'success' && 'true' || 'false' }}
          # Only list failing tests in the Check Run summary. Listing all
          # passing tests too blows GitHub's 64 KiB output-body cap on large
          # suites; the per-suite pass/fail counts at the top still render.
          list-tests: failed

      - name: Note fork-PR reporter skip
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
        run: |
          echo "::notice::Publish test results skipped — fork-PR GITHUB_TOKEN lacks checks:write. Test-log output above is authoritative."

  conformance:
    needs: [check-format]
    strategy:
      fail-fast: false
      matrix:
        include:
          # mvfst — both transports for d14 and d16. d14+WT was unblocked by
          # facebookexperimental/moxygen#151 (Accept moq-00 in WT-Available-Protocols).
          # pico — raw QUIC for d14 and d16. WT cells deferred until pico
          # WT CONNECT (openmoq/moxygen#172 / PR #173) syncs in.
          - name: mvfst d14 Q
            versions: "14"
            transport: "Q"
            stack: "mvfst"
          - name: mvfst d14 WT
            versions: "14"
            transport: ""
            stack: "mvfst"
          - name: mvfst d16 Q
            versions: "16"
            transport: "Q"
            stack: "mvfst"
          - name: mvfst d16 WT
            versions: "16"
            transport: ""
            stack: "mvfst"
          - name: pico d14 Q
            versions: "14"
            transport: "Q"
            stack: "pico"
          - name: pico d16 Q
            versions: "16"
            transport: "Q"
            stack: "pico"
    name: conformance (${{ matrix.name }})
    runs-on: ubuntu-22.04
    # Ceiling for the from-source fallback; see the build job.
    timeout-minutes: 180
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/setup-build
        with:
          ccache-key: conformance

      # Tests off: this job only drives the moqx binary; the ~25 gtest
      # executables would link the heavy static stack for nothing.
      - name: Build
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          scripts/configure.sh default --moxygen prebuilt-with-fallback -DMOQX_BUILD_TESTS=OFF
          scripts/build.sh default

      - name: Run conformance tests
        run: bash test/test_conformance.sh ./build/default/moqx ${{ matrix.versions }} ${{ matrix.transport }} ${{ matrix.stack }}

  microbenchmark:
    needs: [check-format]
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux
            runner: ubuntu-22.04
          - name: macos
            # Pinned to the moxygen publish runner: releases ship
            # moxygen-macos-15-arm64.tar.gz and no macos-26 one, so macos-latest
            # 404s. Keep in lockstep with the build job above.
            runner: macos-15
    name: microbenchmark (${{ matrix.name }})
    runs-on: ${{ matrix.runner }}
    # Ceiling for the from-source fallback; see the build job.
    timeout-minutes: 180
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/setup-build
        with:
          ccache-key: microbench

      - name: Build microbenchmarks
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          scripts/configure.sh default --moxygen prebuilt-with-fallback \
            -DMOQX_BUILD_BENCHMARKS=ON -DMOQX_BUILD_TESTS=OFF
          scripts/build.sh default

      - name: Run microbenchmarks
        run: |
          ./build/default/benchmark/moqx_benchmark \
            --bm_json_verbose=microbench-results.json \
            | tee microbench-output.txt

      - name: Render summary
        if: always()
        run: |
          {
            echo "## Microbenchmark results — ${{ matrix.name }}"
            echo ""
            echo '```'
            cat microbench-output.txt
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload microbenchmark artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: microbench-results-${{ matrix.name }}
          path: |
            microbench-results.json
            microbench-output.txt