ci.yml

# Build, vet, format-check and test both Go modules.
#
# Linux exercises the firecracker provider's code (and all the
# platform-independent logic); macOS exercises the vz provider, which is
# cgo + Apple Virtualization.framework and only compiles on Darwin. Neither
# job boots a real VM — the end-to-end boot tests are gated behind
# TEST_GUEST_BOOT (see internal/e2e) and need /dev/kvm.
name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  linux:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: gofmt
        run: |
          unformatted=$(gofmt -l $(find . -name '*.go' -not -path './third_party/*'))
          if [ -n "$unformatted" ]; then
            echo "::error::these files are not gofmt-clean:"; echo "$unformatted"; exit 1
          fi

      - name: root module — build / vet / test
        run: |
          go build ./...
          go vet ./...
          go test ./...

      - name: machine module — build / vet / test
        working-directory: machine
        run: |
          go build ./...
          go vet ./...
          go test ./...

      # The release path, which the tests above can't reach: a plain checkout
      # embeds no guest binaries, so the prebuilt tests skip themselves. Run
      # the generator, then assert a sandbox can be prepared with no Go
      # toolchain — the whole point of shipping them prebuilt.
      - name: prebuilt guest binaries — generate + use without a toolchain
        run: |
          make guestbin
          go test ./internal/guestbuild/ -run 'TestBuildUsesPrebuilt|TestPrebuiltRejectsStaleSources' -v

      # Cross-build both release artifacts, so a tag can't be the first time we
      # discover the Linux release doesn't compile.
      - name: cross-build linux release artifacts
        run: |
          for arch in amd64 arm64; do
            make clean-guestbin
            make guestbin GUEST_ARCH="$arch"
            CGO_ENABLED=0 GOOS=linux GOARCH="$arch" \
              go build -trimpath -o "/tmp/clawk-linux-$arch" ./cmd/clawk
            ls -l "/tmp/clawk-linux-$arch"
          done

  macos:
    runs-on: macos-14 # Apple Silicon — required for the vz provider
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      # make build codesigns the binary ad-hoc with the entitlements
      # Virtualization.framework requires.
      - name: root module — build (vz) / vet / test
        run: |
          make build
          go vet ./...
          go test ./...

      - name: machine module — vet / test
        working-directory: machine
        run: |
          go vet ./...
          go test ./...