svsm/.github/workflows/manual-verify.yml at main · stefano-garzarella/svsm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: Verification

# Run this workflow when manually triggered or when a PR with
# 'verification' label is created/updated
on:
  workflow_dispatch:
  pull_request:
    types: [opened, synchronize, reopened, labeled]

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: read

jobs:
  check:
    name: Verification Check
    runs-on: ubuntu-latest
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event.action == 'labeled' && github.event.label.name == 'verification') ||
      (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'verification'))
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive

      - name: Calculate Verus cache key
        run: |
          VERUS_SCRIPT_SHA=$(shasum scripts/vinstall.sh | awk '{print $1}')
          echo "VERUS_SCRIPT_SHA=${VERUS_SCRIPT_SHA}" >> "$GITHUB_ENV"
          VERIFY_YML_SHA=$(shasum .github/workflows/manual-verify.yml | awk '{print $1}')
          echo "VERIFY_YML_SHA=${VERIFY_YML_SHA}" >> "$GITHUB_ENV"

      - name: Get Verus toolchain from cache
        id: verus_cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cargo/bin/verus
            ~/.cargo/bin/rust_verify
            ~/.cargo/bin/z3
            ~/.cargo/bin/cargo-verus
            ~/.cargo/bin/verus-root
            ~/.cargo/bin/verusfmt
          key: verus-${{ env.VERUS_SCRIPT_SHA }}--config-${{ env.VERIFY_YML_SHA }}

      # vinstall.sh checks `verus --version` and exits early if the
      # correct version is already installed (restored from cache above).
      - name: Install verus toolchains
        run: ./scripts/vinstall.sh

      - name: Format spec/proof code
        run: |
          verusfmt --check `find ./ -name *.verus.rs` --verus-only

      - name: Verify svsm with verus
        run: cargo verify
        working-directory: kernel

      - name: Verify extra proof libs with verus
        run: cargo verify
        working-directory: verification/verify_proof