build.yml

name: build_and_test

on: [push, pull_request, workflow_dispatch]

env:
  CCACHE_DIR: ${{ github.workspace }}/.ccache"
jobs:
  build_and_test:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - name: generate deps cache key
        id: deps-cache-key
        run: |
          # Generate a hash based on all submodule SHAs
          DEPS_HASH=$(git submodule status | sha256sum | cut -d' ' -f1)
          echo "hash=$DEPS_HASH" >> $GITHUB_OUTPUT
      - name: cache deps build artifacts
        id: deps-cache
        uses: actions/cache@v4
        with:
          path: |
            deps/llvm-build
            deps/boringssl/build
            deps/libsodium/build
            deps/ekam/bin
            tmp/.deps
          key: deps-${{ runner.os }}-${{ steps.deps-cache-key.outputs.hash }}
      - name: setup python 3.10
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - name: install dependencies
        run: |
            export DEBIAN_FRONTEND=noninteractive
            echo "The build of boringssl requires golang."
            echo "The github runner seems to have some version of golang already; installing golang-go breaks."
            which go || (sudo apt-get update && sudo apt-get install golang-go)

            sudo apt-get update && sudo apt-get install -y --no-install-recommends \
                build-essential libcap-dev xz-utils zip unzip strace curl discount git python3 zlib1g-dev cmake ccache apparmor

            # Install OpenSSL 1.1 (required for Meteor/Node compatibility)
            # Ubuntu 24.04 only ships OpenSSL 3.x, so we need to install 1.1 from older release
            wget http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2_amd64.deb
            sudo dpkg -i libssl1.1_1.1.1f-1ubuntu2_amd64.deb
            rm libssl1.1_1.1.1f-1ubuntu2_amd64.deb

            # Ubuntu 24.04 restricts unprivileged user namespaces by default via AppArmor.
            # Sandstorm requires user namespaces for sandboxing, so grant that permission
            # to the binaries used by this CI run.
            cat > /tmp/sandstorm-ci-apparmor <<EOF
            profile sandstorm-ci-bin $GITHUB_WORKSPACE/bin/sandstorm flags=(unconfined) {
              userns,
            }

            profile spk-ci-bin $GITHUB_WORKSPACE/bin/spk flags=(unconfined) {
              userns,
            }

            profile sandstorm-ci-bundle $GITHUB_WORKSPACE/bundle/sandstorm flags=(unconfined) {
              userns,
            }

            profile sandstorm-ci-test $GITHUB_WORKSPACE/tests/tmp-sandstorm/sandstorm flags=(unconfined) {
              userns,
            }

            profile sandstorm-ci-test-latest $GITHUB_WORKSPACE/tests/tmp-sandstorm/latest/sandstorm flags=(unconfined) {
              userns,
            }

            profile sandstorm-ci-test-build $GITHUB_WORKSPACE/tests/tmp-sandstorm/sandstorm-*/sandstorm flags=(unconfined) {
              userns,
            }

            profile sandstorm-ci-test-custom-build $GITHUB_WORKSPACE/tests/tmp-sandstorm/sandstorm-custom.*/sandstorm flags=(unconfined) {
              userns,
            }
            EOF
            sudo mv /tmp/sandstorm-ci-apparmor /etc/apparmor.d/sandstorm-ci
            sudo apparmor_parser -r /etc/apparmor.d/sandstorm-ci
      - name: install meteor
        run: |
            curl https://install.meteor.com/ | sh
      - name: cache ccache files
        uses: actions/cache@v4
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ccache-${{ github.run_number }}
          restore-keys: ccache-
      - name: print and zero ccache stats
        run: |
            mkdir -p "$CCACHE_DIR"
            ccache -s
            ccache -z
      - name: make fast
        run: |
            set -x
            export CCACHE_COMPRESS="true"
            export CCACHE_COMPRESSLEVEL="6"
            export CCACHE_MAXSIZE="1G"
            #     export CCACHE_DEBUG=1
            export CCACHE_SLOPPINESS="time_macros"
            export PATH=/usr/lib/ccache:$CLANGDIR:$PATH
            # Use Python 3.10 for node-gyp (3.11+ removed 'rU' mode)
            export npm_config_python=$(which python)

            make \
              CC="$(which clang)" \
              CXX="$(which clang++)" \
              fast
      - name: print ccache stats
        run: |
            ccache -s
      #      # for debugging ccache misses
      #      find . -iname *ccache* | tar -czf ccache-debug.tar.gz -T /dev/stdin
      #- name: upload ccache debug tarball
      #  uses: actions/upload-artifact@v1
      #  with:
      #    name: ccache-debug.tar.gz
      #    path: ccache-debug.tar.gz
      - name: upload sandstorm tarball
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: sandstorm-0-fast.tar.xz
          path: sandstorm-0-fast.tar.xz
      - name: typecheck-ts
        run: make typecheck-ts
      - name: lint
        run: |
          # In addition to making sure the linting step doesn't flag any errors,
          # we also want to make sure the number of warnings doesn't increase.
          # We check for equality; if the number decreases, great! But then update
          # the constant below.
          make lint | tee lint.log
          num_problems=$(cat lint.log | grep ' problems (0 errors, ' | awk '{print $2}')
          [ "$num_problems" = 774 ]
      - name: setup java 11
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '11'
      - name: setup chrome
        uses: browser-actions/setup-chrome@v1
        with:
          chrome-version: 144
      - name: remove system chrome
        run: |
          sudo rm -f /usr/bin/google-chrome /usr/bin/google-chrome-stable
          sudo rm -rf /opt/google/chrome
      - name: test
        run: |
          set -o pipefail
          (make test |& tee testlog.txt; echo "Result: $?")
      - name: upload test log
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: testlog.txt
          path: testlog.txt
      - name: upload screenshots
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: screenshots
          path: tests/screenshots