qemu.yml

name: qemu

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

env:
  CARGO_TERM_COLOR: always
  # IGVM C wrapper might require a different Rust version than SVSM
  RUST_VERSION_IGVM: 1.84.1
  QEMU_REPO: https://github.com/coconut-svsm/qemu.git
  QEMU_REF: svsm-igvm
  IGVM_REPO: https://github.com/microsoft/igvm.git
  IGVM_REF: igvm-v0.3.4

permissions:
  contents: read

jobs:
  check:
    name: QEMU NOCC test-in-svsm
    runs-on: ubuntu-latest
    steps:

      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Query coconut-svsm/qemu repo
        run: |
          QEMU_SHA=$(git ls-remote "$QEMU_REPO" --exit-code "$QEMU_REF" | cut -f 1)
          echo "QEMU_SHA=${QEMU_SHA}" >> "$GITHUB_ENV"

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true
          fetch-depth: 1

      - name: Calculate SHA for qemu.yml
        run: |
          QEMU_YML_SHA=$(shasum .github/workflows/qemu.yml | awk '{print $1}')
          echo "QEMU_YML_SHA=${QEMU_YML_SHA}" >> "$GITHUB_ENV"

      - name: Get QEMU from cache
        id: qemu_cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: citests/qemu
          key: qemu-${{ env.QEMU_SHA }}--config-${{ env.QEMU_YML_SHA }}

      - if: ${{ steps.qemu_cache.outputs.cache-hit != 'true' }}
        name: Enable Ubuntu source repositories
        run: |
          sudo sed -i 's/^Types: deb/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources
          sudo apt-get update

      - if: ${{ steps.qemu_cache.outputs.cache-hit != 'true' }}
        name: Build QEMU
        run: |
          # Update & install dependencies
          sudo apt-get install --yes git curl libcunit1-dev
          # TODO: Find a minimal set of dependencies to install
          sudo apt-get build-dep --yes qemu

          OUT="$PWD/citests/qemu"
          mkdir -p "$OUT"

          # Set up a build directory outside the coconut-svsm checkout
          mkdir -p ../scratch
          pushd ../scratch

          # Build IGVM
          git clone "${{ env.IGVM_REPO }}" \
            --branch="${{ env.IGVM_REF }}" \
            --depth=1

          pushd igvm

          # Installing Rust toolchain and tools from within this workflow step in in the
          # igvm checkout directory to avoid interference of the coconut-svsm rust-toolchain.toml,
          # which might override versions and target settings.
          rustup toolchain install "${{ env.RUST_VERSION_IGVM }}" --target x86_64-unknown-linux-gnu --profile minimal

          # Currently needed for the C wrapper of IGVM
          cargo install cbindgen

          PREFIX="$OUT" make -C igvm_c
          PREFIX="$OUT" make -C igvm_c install
          popd

          # Build Qmeu
           git clone "${{ env.QEMU_REPO }}" \
            --branch="${{ env.QEMU_REF }}" \
            --depth=1

          pushd qemu
          PKG_CONFIG_PATH="$OUT/lib64/pkgconfig" ./configure \
            --target-list=x86_64-softmmu \
            --enable-igvm --extra-ldflags=-L"$OUT/lib64" \
            --extra-cflags=-I"$OUT/include" \
            --enable-tcg \
            --enable-kvm \
            --enable-slirp \
            --enable-strip \
            --enable-vhost-kernel \
            --static \
            --disable-docs \
            --disable-user \
            --without-default-features \
            --prefix="$OUT"
          make -j "$(nproc)" install
          popd

          popd

      ## TODO: We can replace the SVSM build step and download the IGVM file as an artifact
        # from the "Rust check" jobs instread to speed things up.

      - name: Install latest nightly
        run: rustup toolchain install nightly -t x86_64-unknown-none --profile minimal --force -c rustfmt

      - name: Install TPM 2.0 Reference Implementation build dependencies
        run: sudo apt install -y build-essential cmake pkg-config

      - name: Install netcat used by test-in-svsm for vsock tests
        run: sudo apt install -y ncat

      - name: Set up vhost-vsock permissions
        run: sudo chmod 666 /dev/vhost-vsock

      - name: Build test
        run: make bin/coconut-test-qemu.igvm

      ########################

      - name: Run test-in-svsm in QEMU
        run: |
          # Use the pull request number for the port and the cid to avoid conflicts if two (or more)
          # actions run in parallel. On push-to-main events the PR number is empty, default to 0.
          # 1024 is the first non reserved port, 10 is an arbitrary number that should be safe enough
          # to avoid conflicts.
          PR_NUM=${{ github.event.pull_request.number }}
          VSOCK_PORT=$(( ${PR_NUM:-0} + 1024 ))
          VSOCK_CID=$(( ${PR_NUM:-0} + 10 ))
          QEMU=./citests/qemu/bin/qemu-system-x86_64 scripts/test-in-svsm.sh \
            --vsock-port $VSOCK_PORT --vsock-cid $VSOCK_CID \
            --nocc --timeout 180 \
            </dev/null 2>&1

      - name: Dump host kernel messages on QEMU or test failure
        if: failure()
        run: sudo dmesg