static.yml

name: static checks

on:
  workflow_dispatch:
  push:
    branches:
      - main
  pull_request:

jobs:
  flake-check:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup_nix
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: nix flake check
        run: |
          nix -L flake check

  generate:
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      contents: write
    env:
      SET: base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
          token: ${{ !github.event.pull_request.head.repo.fork && secrets.NUNKI_CI_COMMIT_PUSH_PR || github.token }}
          persist-credentials: true
      - uses: ./.github/actions/setup_nix
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Run code generations & tidying
        run: |
          nix run ".#${SET}.scripts.generate"
      - name: Check for modifications, commit changes on renovate PRs
        uses: ./.github/actions/pushdiff
        with:
          error: Generated code needs to be updated, check the GitHub run summary for the diff.
          suggested-fix: Run \`nix run ".#${SET}.scripts.generate"\` to run code generation.
          renovate-commit-msg: "fixup: update generated code"

  govulncheck:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
    env:
      SET: base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: true
      - uses: ./.github/actions/setup_nix
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Run govulncheck
        run: |
          nix run ".#${SET}.scripts.govulncheck"

  golangci-lint:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        goos: [linux, darwin]
    env:
      SET: base
      GOOS: ${{ matrix.goos }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup_nix
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Run golangci-lint
        run: |
          nix run ".#${SET}.scripts.golangci-lint"

  go-licenses:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
    env:
      SET: base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup_nix
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Run go-licenses
        run: |
          nix run ".#${SET}.scripts.go-licenses-check"

  sdk-wasm-compat:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup_nix
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Compile SDK for Wasm
        env:
          GOOS: js
          GOARCH: wasm
        run: |
          cat <<EOF > ./main.go
          package main
          import _ "github.com/edgelesssys/contrast/sdk"
          func main() {}
          EOF
          go build -tags contrast_unstable_api -o main.wasm ./main.go
      - name: Check Wasm code size
        run: |
          if [ "$(stat -c%s main.wasm)" -gt 25000000 ]; then
            echo "Compiled SDK exceeds size limit of 25MB"
            exit 1
          fi

  cli-build:
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      contents: read
    env:
      SET: base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup_nix
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Build CLI
        run: |
          nix build ".#${SET}.contrast.cli"

  darwin-cli-build:
    needs: cli-build
    runs-on: macos-latest
    timeout-minutes: 60
    permissions:
      contents: read
    env:
      SET: base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup_nix
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Build darwin formatter
        run: |
          nix build .#formatter.aarch64-darwin
      - name: Build darwin CLI
        run: |
          nix build ".#${SET}.contrast.cli"

  sev-snp-measure-consistency:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    env:
      SET: base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup_nix
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Run sev-snp-measure-consistency
        run: |
          nix run ".#${SET}.scripts.sev-snp-measure-consistency"