Nilix/.github/workflows/ci.yml at main · Zero-kernel/Nilix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true
defaults:
  run:
    shell: bash
env:
  CARGO_TERM_COLOR: always

jobs:
  quality:
    name: Quality / lint and harness tests
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: '3.12'
      - run: python3 -m pip install -r requirements-ci.txt
      - run: bash scripts/ci/entrypoint.sh quality
      - name: Check Actions definitions
        if: always()
        run: |
          GOBIN="$PWD/target/ci-tools" go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
          target/ci-tools/actionlint -shellcheck=
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: ci-quality
          path: target/ci/quality/
          if-no-files-found: error

  style:
    name: Quality / rustfmt and Clippy
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-kernel
      - run: make fmt-check
      - run: make clippy

  hosted:
    name: Hosted / ${{ matrix.profile }}
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        profile: [debug, release]
    env:
      HOSTED_TEST_PROFILE: ${{ matrix.profile }}
      CARGO_TARGET_DIR: hosted-subcrate-target
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-kernel
        with:
          cache-key: hosted-${{ matrix.profile }}
      - run: bash scripts/ci/entrypoint.sh hosted
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: ci-hosted-${{ matrix.profile }}
          path: target/ci/hosted/
          if-no-files-found: error

  tools:
    name: Hosted / fuzz tools and executor
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-kernel
        with:
          cache-key: host-tools
      - run: bash scripts/ci/entrypoint.sh tools
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: ci-tools
          path: target/ci/tools/
          if-no-files-found: error

  build:
    name: Kernel / build and usercopy
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-kernel
      - run: bash scripts/ci/entrypoint.sh build
      - uses: actions/upload-artifact@v7
        with:
          name: normal-boot-image
          path: esp/
          if-no-files-found: error
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: ci-build
          path: target/ci/build/
          if-no-files-found: error

  runtime:
    name: QEMU / boot and SMP
    needs: build
    runs-on: ubuntu-24.04
    # Three sequential 15-minute observation windows plus setup/reporting and
    # one bounded retry for a transient guest failure.
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-kernel
        with:
          qemu: 'true'
      - uses: actions/download-artifact@v8
        with:
          name: normal-boot-image
          path: esp
      - run: bash scripts/ci/entrypoint.sh runtime
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: ci-runtime
          path: target/ci/runtime/
          if-no-files-found: error

  qemu:
    name: QEMU / ${{ matrix.group }}
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        # `mitigation` is disabled until BSP-TIMER-1 is fixed. The four-CPU proof
        # requires timer_interrupt_stub on CPU 0, but the BSP tick comes from the
        # 8254 PIT, which the kernel never programs; it measured one BSP timer
        # interrupt per 35-44 on an AP and the gate passed only via the retry.
        # See docs/review/nextplan/bsp-timer-tick-rate-2026-09-15.md. Run it
        # locally with `bash scripts/ci/entrypoint.sh mitigation` or
        # `make test-security-mitigations`; restore this leg once fixed.
        group: [musl, iommu, qemu-fuzz]
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-kernel
        with:
          qemu: 'true'
          cache-key: qemu-${{ matrix.group }}
      - run: bash scripts/ci/entrypoint.sh "$CI_GROUP"
        env:
          CI_GROUP: ${{ matrix.group }}
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: ci-${{ matrix.group }}
          path: target/ci/${{ matrix.group }}/
          if-no-files-found: error

  result:
    name: CI result
    needs: [quality, style, hosted, tools, build, runtime, qemu]
    if: always()
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - run: python3 scripts/ci/ci_report.py --aggregate
        env:
          CI_JOB_RESULTS: ${{ toJSON(needs) }}