ci.yaml

name: CI
on: [pull_request, merge_group]
permissions:
  contents: read
  pull-requests: read
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.event_name }}
  cancel-in-progress: true
jobs:
  preflight:
    name: preflight
    runs-on: ubuntu-latest
    outputs:
      full: ${{ steps.classify.outputs.full }}
      rust: ${{ steps.changes.outputs.rust }}
      cargo: ${{ steps.changes.outputs.cargo }}
      openapi: ${{ steps.changes.outputs.openapi }}
      dockerfile: ${{ steps.changes.outputs.dockerfile }}
      shell: ${{ steps.changes.outputs.shell }}
      ci: ${{ steps.changes.outputs.ci }}
      docs: ${{ steps.changes.outputs.docs }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - id: changes
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        with:
          filters: |
            rust:
              - '**/*.rs'
              - 'build.rs'
              - '**/Cargo.toml'
              - '**/Cargo.lock'
              - 'rust-toolchain.toml'
            cargo:
              - '**/Cargo.toml'
              - '**/Cargo.lock'
            openapi:
              - 'vmm/src/api/openapi/**'
            dockerfile:
              - 'resources/Dockerfile'
            shell:
              - '**/*.sh'
              - 'scripts/**'
            ci:
              - '.github/workflows/**'
            docs:
              - 'docs/**'
              - '**/*.md'
              - '.github/ISSUE_TEMPLATE/**'
              - 'LICENSES/**'
              - 'CODEOWNERS'
      - id: classify
        name: Classify changes
        run: |
          set -eufo pipefail
          full=false
          if [[ "${{ steps.changes.outputs.rust }}" == "true" \
             || "${{ steps.changes.outputs.dockerfile }}" == "true" \
             || "${{ steps.changes.outputs.shell }}" == "true" \
             || "${{ steps.changes.outputs.ci }}" == "true" ]]; then
            full=true
          fi
          echo "full=$full" >> "$GITHUB_OUTPUT"
          echo "full=$full"
  dco:
    name: dco
    needs: [preflight]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Python 3.x
        uses: actions/setup-python@v6
        with:
          python-version: '3.x'
      - name: Check DCO
        if: github.event_name == 'pull_request'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -eufo pipefail
          pip3 install -U dco-check
          dco-check -e "49699333+dependabot[bot]@users.noreply.github.com"
  gitlint:
    name: gitlint
    needs: [preflight]
    # PR-only: gitlint needs GITHUB_BASE_REF, unset on merge_group.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          # PR head, not the merge ref, so gitlint sees the PR's commits.
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
      - name: Set up Python 3.10
        uses: actions/setup-python@v6
        with:
          python-version: "3.10"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --upgrade gitlint
      - name: Lint git commit messages
        run: |
          gitlint --commits "origin/$GITHUB_BASE_REF.."
  taplo:
    name: taplo
    needs: [preflight]
    if: needs.preflight.outputs.cargo == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Code checkout
        uses: actions/checkout@v6
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Install build dependencies
        run: sudo apt-get update && sudo apt-get -yqq install build-essential libssl-dev
      - name: Install taplo
        run: cargo install taplo-cli --locked
      - name: Check formatting
        run: taplo fmt --check
  audit:
    name: audit
    needs: [preflight]
    if: needs.preflight.outputs.cargo == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions-rust-lang/audit@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
  shlint:
    name: shlint
    needs: [preflight]
    if: needs.preflight.outputs.shell == 'true' || needs.preflight.outputs.ci == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Run the shell script checkers
        uses: luizm/action-sh-checker@883217215b11c1fabbf00eb1a9a041f62d74c744 # v0.10.0
        env:
          SHFMT_OPTS: -i 4 -d
          SHELLCHECK_OPTS: -x --source-path scripts
  hadolint:
    name: hadolint
    needs: [preflight]
    if: needs.preflight.outputs.dockerfile == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
      - name: Lint Dockerfile
        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: ./resources/Dockerfile
          format: tty
          no-fail: false
          verbose: true
          failure-threshold: info
  reuse:
    name: reuse
    needs: [preflight]
    if: needs.preflight.outputs.full == 'true' || needs.preflight.outputs.cargo == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: REUSE Compliance Check
        uses: fsfe/reuse-action@v6
  formatting:
    name: formatting
    needs: [preflight]
    if: needs.preflight.outputs.full == 'true'
    runs-on: ubuntu-latest
    strategy:
      matrix:
        rust: [nightly]
        target:
          - x86_64-unknown-linux-gnu
          - aarch64-unknown-linux-musl
    env:
      RUSTFLAGS: -D warnings
    steps:
      - name: Code checkout
        uses: actions/checkout@v6
      - name: Install Rust toolchain (${{ matrix.rust }})
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          components: rustfmt
      - name: Formatting (rustfmt)
        run: cargo fmt --all -- --check
      - name: Formatting (fuzz) (rustfmt)
        run: cargo fmt --all --manifest-path fuzz/Cargo.toml -- --check
  package-consistency:
    name: package-consistency
    needs: [preflight]
    if: needs.preflight.outputs.full == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Code checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Install dependencies
        run: sudo apt install -y python3
      - name: Install Rust toolchain stable
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
      - name: Check Rust VMM Package Consistency of root Workspace
        run: python3 scripts/package-consistency-check.py github.com/rust-vmm
      - name: Check Rust VMM Package Consistency of fuzz Workspace
        run: |
          set -eufo pipefail
          pushd fuzz
          python3 ../scripts/package-consistency-check.py github.com/rust-vmm
          popd
  fuzz-build:
    name: fuzz-build
    needs: [preflight]
    if: needs.preflight.outputs.full == 'true'
    runs-on: ubuntu-latest
    strategy:
      matrix:
        rust: [nightly]
        target: [x86_64-unknown-linux-gnu]
    env:
      RUSTFLAGS: -D warnings
    steps:
      - name: Code checkout
        uses: actions/checkout@v6
      - name: Install Rust toolchain (${{ matrix.rust }})
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
      - name: Install Cargo fuzz
        run: cargo install cargo-fuzz
      - name: Fuzz Build
        run: cargo fuzz build
      - name: Fuzz Check
        run: cargo fuzz check
  openapi:
    name: openapi
    needs: [preflight]
    if: needs.preflight.outputs.openapi == 'true'
    runs-on: ubuntu-latest
    container: openapitools/openapi-generator-cli
    steps:
      - uses: actions/checkout@v6
      - name: Validate OpenAPI
        run: |
          /usr/local/bin/docker-entrypoint.sh validate -i vmm/src/api/openapi/cloud-hypervisor.yaml
  typos:
    name: typos
    needs: [preflight]
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: crate-ci/typos@5374cbf686e897b15713110e233094e2874de7ef # v1.46.1
  quality:
    name: quality
    needs: [preflight]
    if: needs.preflight.outputs.full == 'true'
    runs-on: ubuntu-latest
    # Beta clippy is non-blocking; continue-on-error below keeps the
    # aggregated needs.quality.result green when only beta fails.
    continue-on-error: ${{ matrix.experimental }}
    strategy:
      fail-fast: false
      matrix:
        rust:
          - stable
        target:
          - x86_64-unknown-linux-gnu
        include:
          - rust: stable
            experimental: false
    steps:
      - name: Code checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Install Rust toolchain (${{ matrix.rust }})
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          override: true
          components: clippy
      - name: Bisectability Check (default features)
        if: ${{ github.event_name == 'pull_request' && matrix.target == 'x86_64-unknown-linux-gnu' }}
        run: |
          set -eufo pipefail
          commits=$(git rev-list origin/${{ github.base_ref }}..${{ github.sha }})
          for commit in $commits; do git checkout $commit; cargo check --tests --examples --all --target=${{ matrix.target }}; done
          git checkout ${{ github.sha }}
      - name: Clippy (kvm)
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --no-default-features --tests --examples --features "kvm" -- -D warnings
      - name: Clippy (mshv)
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --no-default-features --tests --examples --features "mshv" -- -D warnings
      - name: Clippy (mshv + kvm)
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --no-default-features --tests --examples --features "mshv,kvm" -- -D warnings
      - name: Clippy (default features)
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --tests --examples -- -D warnings
      - name: Clippy (default features + guest_debug)
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --tests --examples --features "guest_debug" -- -D warnings
      - name: Clippy (default features + pvmemcontrol)
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --tests --examples --features "pvmemcontrol" -- -D warnings
      - name: Clippy (default features + tracing)
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --tests --examples --features "tracing" -- -D warnings
      - name: Clippy (default features + fw_cfg)
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --target=${{ matrix.target }} --locked --all --all-targets --tests --examples --features "fw_cfg" -- -D warnings
      - name: Clippy (default features + ivshmem)
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --tests --examples --features "ivshmem" -- -D warnings
      - name: Clippy (sev_snp)
        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --no-default-features --tests --examples --features "sev_snp" -- -D warnings
      - name: Clippy (igvm)
        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --no-default-features --tests --examples --features "igvm" -- -D warnings
      - name: Clippy (kvm + tdx)
        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --no-default-features --tests --examples --features "tdx,kvm" -- -D warnings
      - name: Clippy (kvm + igvm + sev_snp + fw_cfg)
        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          cross-version: 3e0957637b49b1bbced23ad909170650c5b70635
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --no-default-features --tests --examples --features "kvm,igvm,sev_snp,fw_cfg" -- -D warnings
      - name: Clippy (default features + sev_snp + igvm + fw_cfg)
        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: clippy
          cross-version: 3e0957637b49b1bbced23ad909170650c5b70635
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
          args: --locked --all --all-targets --tests --examples --features "sev_snp,igvm,fw_cfg" -- -D warnings
      - name: Check build did not modify any files
        run: test -z "$(git status --porcelain)"
  build:
    name: build
    needs: [preflight]
    if: needs.preflight.outputs.full == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        rust:
          - stable
        target:
          - x86_64-unknown-linux-gnu
    steps:
      - name: Code checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Install musl-gcc
        run: sudo apt install -y musl-tools
      - name: Install Rust toolchain (${{ matrix.rust }})
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.target }}
      - name: Build (default features)
        run: cargo build --locked --bin cloud-hypervisor
      - name: Build (kvm)
        run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "kvm"
      - name: Build (default features + tdx)
        run: cargo build --locked --bin cloud-hypervisor --features "tdx"
      - name: Build (default features + dbus_api)
        run: cargo build --locked --bin cloud-hypervisor --features "dbus_api"
      - name: Build (default features + guest_debug)
        run: cargo build --locked --bin cloud-hypervisor --features "guest_debug"
      - name: Build (default features + pvmemcontrol)
        run: cargo build --locked --bin cloud-hypervisor --features "pvmemcontrol"
      - name: Build (default features + fw_cfg)
        run: cargo build --locked --bin cloud-hypervisor --features "fw_cfg"
      - name: Build (default features + ivshmem)
        run: cargo build --locked --bin cloud-hypervisor --features "ivshmem"
      - name: Build (mshv)
        run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "mshv"
      - name: Build (sev_snp)
        run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "sev_snp"
      - name: Build (kvm + igvm + sev_snp + fw_cfg)
        run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "kvm,igvm,sev_snp,fw_cfg"
      - name: Build (igvm)
        run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "igvm"
      - name: Build (mshv + kvm)
        run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "mshv,kvm"
      - name: Release Build (default features)
        run: cargo build --locked --all --release --target=${{ matrix.target }}
      - name: Check build did not modify any files
        run: test -z "$(git status --porcelain)"
  integration-x86-64-pr:
    name: integration-x86-64-pr
    needs: [preflight, dco, quality, build]
    if: >-
      needs.preflight.outputs.full == 'true' && needs.dco.result == 'success' && needs.quality.result == 'success' && needs.build.result == 'success'
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - name: Code checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Run unit tests
        run: scripts/dev_cli.sh tests --unit --libc gnu

  # The single required-status check. Branch protection requires this one job.
  all-green:
    name: all-green
    needs:
      - audit
      - build
      - dco
      - formatting
      - fuzz-build
      - gitlint
      - hadolint
      - integration-x86-64-pr
      - openapi
      - package-consistency
      - preflight
      - quality
      - reuse
      - shlint
      - taplo
      - typos
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Verify all dependencies succeeded or were skipped
        env:
          NEEDS_JSON: ${{ toJson(needs) }}
        run: |
          set -eufo pipefail
          echo "$NEEDS_JSON" | jq .
          # success or skipped = pass; failure or cancelled = red.
          echo "$NEEDS_JSON" | jq -e '
            to_entries
            | map(select(.value.result != "success" and .value.result != "skipped"))
            | length == 0
          ' >/dev/null