posix.yml

# Copyright (c) 2022-present, IO Visor Project
# SPDX-License-Identifier: Apache-2.0
#
# Copyright (c) 2022-present, IO Visor Project
# SPDX-License-Identifier: Apache-2.0
# All rights reserved.
#
# This source code is licensed in accordance with the terms specified in
# the LICENSE file found in the root directory of this source tree.
#

name: Posix

permissions:
  contents: read
  security-events: write # Required by codeql task

on:
  workflow_call:
    inputs:
      arch:
        description: 'Architecture'
        required: true
        type: string

      platform:
        required: true
        type: string

      build_type:
        required: true
        type: string

      enable_sanitizers:
        required: false
        type: boolean

      enable_coverage:
        required: false
        type: boolean

      scan_build:
        required: false
        type: boolean

      upload_packages:
        required: false
        type: boolean

      build_codeql:
        required: false
        type: boolean

      disable_retpolines:
        required: false
        type: boolean

jobs:
  build:
    runs-on: ${{ inputs.platform }}

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
      with:
        egress-policy: audit

    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        submodules: 'recursive'

    - name: Initialize CodeQL
      if: inputs.build_codeql == true
      uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae
      with:
        languages: 'cpp'

    - name: Generate the cache key
      id: cache_key
      run: echo "VALUE=platform-${{ inputs.platform }}_arch=${{ inputs.arch }}_type-${{ inputs.build_type }}_sanitizers-${{ inputs.enable_sanitizers }}_coverage-${{ inputs.enable_coverage }}_scan_build-${{ inputs.scan_build }}_retpolines-${{ inputs.disable_retpolines }}" >> $GITHUB_OUTPUT

    - name: Update the cache (ccache)
      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
      with:
        path: ccache
        key: ${{ steps.cache_key.outputs.VALUE }}_ccache

    - name: Create the build folders
      run: |
        mkdir -p \
          ccache

    - name: Install system dependencies (Linux)
      if: inputs.platform == 'ubuntu-latest'
      run: |
        sudo apt-get update

        sudo apt-get install -y \
          ccache \
          ninja-build \
          cmake \
          lcov \
          libboost-dev \
          libboost-program-options-dev \
          libboost-filesystem-dev \
          libelf-dev

        if [[ "${{ inputs.scan_build }}" == "true" ]] ; then
          sudo apt-get install -y \
            clang-tools
        fi

        if [[ "${{ inputs.arch }}" == "arm64" ]] ; then
          sudo apt install -y \
            g++-aarch64-linux-gnu \
            gcc-aarch64-linux-gnu \
            qemu-user
        fi

    - name: Build/install libbpf From Source
      if: inputs.platform == 'ubuntu-latest'
      run: ./.github/scripts/build-libbpf.sh
      shell: bash

    - name: Install system dependencies (macOS)
      if: inputs.platform == 'macos-latest'
      run: |
        brew install \
          cmake \
          ninja \
          ccache \
          lcov \
          boost

    - name: Configure uBPF
      run: |
        export CCACHE_DIR="$(pwd)/ccache"

        if [[ "${{ inputs.scan_build }}" == "true" ]] ; then
          mkdir scan_build_report
          command_prefix="scan-build -o scan_build_report"
        fi

        if [[ "${{ inputs.arch }}" == "arm64" ]] ; then
          arch_flags="-DCMAKE_TOOLCHAIN_FILE=cmake/arm64.cmake"
        else
          arch_flags=""
        fi

        ${command_prefix} cmake \
          -G Ninja \
          -S . \
          -B build \
          -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} \
          -DUBPF_ENABLE_COVERAGE=${{ inputs.enable_coverage }} \
          -DUBPF_ENABLE_SANITIZERS=${{ inputs.enable_sanitizers }} \
          -DUBPF_DISABLE_RETPOLINES=${{ inputs.disable_retpolines }} \
          -DUBPF_ENABLE_TESTS=true \
          -DUBPF_ENABLE_INSTALL=true \
          ${arch_flags}

    - name: Build uBPF
      run: |
        export CCACHE_DIR="$(pwd)/ccache"

        if [[ "${{ inputs.scan_build }}" == "true" ]] ; then
          command_prefix="scan-build -o scan_build_report"
        fi

        ${command_prefix} cmake \
          --build build \
          -- -v

    - name: Upload scan-build report
      if: inputs.scan_build == true
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
      with:
        name: scan-build_report
        path: ${{github.workspace}}/scan_build_report
        retention-days: 5

    - name: Run the CTest suite
      run: |
        export CCACHE_DIR="$(pwd)/ccache"

        if [[ "${{ inputs.scan_build }}" == "true" ]] ; then
          command_prefix="scan-build -o scan_build_report"
        fi

        ${command_prefix} cmake \
          --build build \
          --target test

    - name: Rerun failed tests with more verbose output
      if: inputs.platform == 'ubuntu-latest' && failure()
      working-directory: ${{github.workspace}}/build
      run: |
        ctest --rerun-failed --output-on-failure

    - name: Generate code coverage report
      if: inputs.enable_coverage == true && inputs.platform == 'macos-latest'
      run: |
        mkdir -p coverage
        lcov --capture --directory build --include '${{env.GITHUB_WORKSPACE}}/*' --output-file coverage/lcov.info --ignore-errors inconsistent

    - name: Generate code coverage report
      if: inputs.enable_coverage == true && inputs.platform != 'macos-latest'
      run: |
        mkdir -p coverage
        lcov --capture --directory build --include '${{env.GITHUB_WORKSPACE}}/*' --output-file coverage/lcov.info

    - name: Coveralls Parallel
      if: inputs.enable_coverage == true
      uses: coverallsapp/github-action@cfd0633edbd2411b532b808ba7a8b5e04f76d2c8 # v2.3.4
      with:
        github-token: ${{ secrets.github_token }}
        flag-name: run-${{inputs.build_type}}-${{inputs.platform}}-${{inputs.arch}}
        parallel: true

    - name: Run the install target
      run: |
        mkdir install
        export DESTDIR=$(pwd)/install

        cmake \
          --build build \
          --target install

    - name: Generate the DEB package
      if: inputs.platform == 'ubuntu-latest'
      run: |
        cmake \
          -S . \
          -B build \
          -DUBPF_ENABLE_PACKAGE=true \
          -DCPACK_GENERATOR=DEB

        cmake \
          --build build \
          --target package

    - name: Generate the RPM package
      if: inputs.platform == 'ubuntu-latest'
      run: |
        cmake \
          -S . \
          -B build \
          -DUBPF_ENABLE_PACKAGE=true \
          -DCPACK_GENERATOR=RPM

        cmake \
          --build build \
          --target package

    - name: Generate the TGZ package
      run: |
        cmake \
          -S . \
          -B build \
          -DUBPF_ENABLE_PACKAGE=true \
          -DCPACK_GENERATOR=TGZ

        cmake \
          --build build \
          --target package

    - name: Locate the packages
      id: package_locations
      if: inputs.upload_packages == true
      run: |
        echo "REL_DEB_PACKAGE_PATH=$(ls build/*.deb)" >> $GITHUB_OUTPUT
        echo "REL_RPM_PACKAGE_PATH=$(ls build/*.rpm)" >> $GITHUB_OUTPUT
        echo "REL_TGZ_PACKAGE_PATH=$(ls build/*.tar.gz)" >> $GITHUB_OUTPUT

    - name: Upload the DEB package
      if: inputs.upload_packages == true && inputs.platform == 'ubuntu-latest'
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
      with:
        name: linux_deb_package
        path: ${{ steps.package_locations.outputs.REL_DEB_PACKAGE_PATH }}
        retention-days: 5

    - name: Upload the RPM package
      if: inputs.upload_packages == true && inputs.platform == 'ubuntu-latest'
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
      with:
        name: linux_rpm_package
        path: ${{ steps.package_locations.outputs.REL_RPM_PACKAGE_PATH }}
        retention-days: 5

    - name: Upload the Linux TGZ package
      if: inputs.upload_packages == true && inputs.platform == 'ubuntu-latest'
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
      with:
        name: linux_tgz_package
        path: ${{ steps.package_locations.outputs.REL_TGZ_PACKAGE_PATH }}
        retention-days: 5

    - name: Upload the macOS TGZ package
      if: inputs.upload_packages == true && inputs.platform == 'macos-latest'
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
      with:
        name: macos_tgz_package
        path: ${{ steps.package_locations.outputs.REL_TGZ_PACKAGE_PATH }}
        retention-days: 5

    - name: Perform CodeQL Analysis
      if: inputs.build_codeql == true
      uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae