ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

# Supersede in-flight runs for the same PR, so a rapid second push does not
# queue behind the run it already obsoletes. Pushes to main are never
# cancelled: every commit there keeps its own result.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.11.3
          args: --timeout=5m

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Download dependencies
        run: go mod download

      - name: Run tests
        env:
          GOEXPERIMENT: runtimesecret
        run: go test -v ./...

  build:
    name: Build
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goos: [linux, darwin]
        goarch: [amd64, arm64]
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Download dependencies
        run: go mod download

      - name: Build
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: 0
          GOEXPERIMENT: runtimesecret
        run: |
          go build ./...

  writers:
    name: Key writer builds
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Download dependencies
        run: go mod download

      - name: Build, vet and conflict-check every writer
        env:
          GOEXPERIMENT: runtimesecret
          CGO_ENABLED: 0
        run: |
          set -euo pipefail

          # "<build tag>:<space-separated supported GOOS values>"
          # Adding a writer means adding one line here. See KEYCONTROL.md.
          WRITERS=(
            "wireguard_netlink:linux darwin"
            "wireguard_mikrotik:linux darwin"
          )
          ALL_GOOS=(linux darwin)

          TAGS=()
          for entry in "${WRITERS[@]}" ; do TAGS+=("${entry%%:*}") ; done

          echo "::group::Build each writer for its supported platforms"
          for entry in "${WRITERS[@]}" ; do
            tag="${entry%%:*}"
            for goos in ${entry#*:} ; do
              for goarch in amd64 arm64 ; do
                echo "-> $tag $goos/$goarch"
                GOOS="$goos" GOARCH="$goarch" go build -tags "$tag" -o /dev/null .
              done
            done
          done
          echo "::endgroup::"

          echo "::group::Vet each writer"
          for entry in "${WRITERS[@]}" ; do
            tag="${entry%%:*}"
            first_goos="$(echo "${entry#*:}" | awk '{print $1}')"
            echo "-> $tag (GOOS=$first_goos)"
            GOOS="$first_goos" go vet -tags "$tag" ./...
          done
          echo "::endgroup::"

          echo "::group::Unsupported platforms must NOT build"
          for entry in "${WRITERS[@]}" ; do
            tag="${entry%%:*}"
            supported=" ${entry#*:} "
            for goos in "${ALL_GOOS[@]}" ; do
              case "$supported" in *" $goos "*) continue ;; esac
              if GOOS="$goos" GOARCH=arm64 go build -tags "$tag" -o /dev/null . 2>/dev/null ; then
                echo "::error::$tag built for $goos, which it does not support - its platform constraint has been lost"
                exit 1
              fi
              echo "-> $tag correctly refuses $goos"
            done
          done
          echo "::endgroup::"

          echo "::group::Two writer tags must never compile together"
          for ((i = 0; i < ${#TAGS[@]}; i++)) ; do
            for ((j = i + 1; j < ${#TAGS[@]}; j++)) ; do
              pair="${TAGS[i]} ${TAGS[j]}"
              if go build -tags "$pair" -o /dev/null . 2>/dev/null ; then
                echo "::error::tags '$pair' built; expected duplicate getKeyWriterService"
                exit 1
              fi
              echo "-> '$pair' correctly fails"
            done
          done
          echo "::endgroup::"

  integration-test:
    name: Integration Test with Containerlab
    runs-on: ubuntu-latest
    needs: [build, test]
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Built before the keys are generated, for two reasons: ci/setup-keys.sh
      # borrows the `wg` binary from this image instead of installing
      # wireguard-tools on the runner, and keeping the freshly generated keys
      # out of the build context stops them invalidating the COPY layer.
      - name: Build Arnika node image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ci/Dockerfile.node
          tags: arnika-node:ci
          load: true
          cache-from: type=gha,scope=arnika-node
          cache-to: type=gha,mode=max,scope=arnika-node

      - name: Build QKD simulator image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ci/Dockerfile.simulator
          tags: qkd-simulator:ci
          load: true
          cache-from: type=gha,scope=qkd-simulator
          cache-to: type=gha,mode=max,scope=qkd-simulator

      - name: Generate WireGuard keys
        run: |
          chmod +x ci/setup-keys.sh
          ./ci/setup-keys.sh

      - name: Install Containerlab
        run: |
          bash -c "$(curl -sL https://get.containerlab.dev)"

      - name: Deploy containerlab topology
        run: |
          sudo containerlab deploy -t ci/clab-ci.yaml

      - name: Start QKD simulator
        run: |
          docker exec clab-arnika-ci-test-qkd-simulator /usr/local/bin/qkd-simulator &
          sleep 5

      - name: Start node-a
        run: |
          docker exec clab-arnika-ci-test-node-a /bin/bash /etc/arnika/start.sh

      - name: Start node-b
        run: |
          docker exec clab-arnika-ci-test-node-b /bin/bash /etc/arnika/start.sh

      # ci/verify-keys.sh polls for convergence itself, so there is no separate
      # fixed wait here any more.
      - name: Verify key injection
        run: |
          chmod +x ci/verify-keys.sh
          ./ci/verify-keys.sh

      - name: Collect logs on failure
        if: failure()
        run: |
          echo "====== QKD Simulator Logs ======"
          docker logs clab-arnika-ci-test-qkd-simulator || true
          echo "====== Node-A Logs ======"
          docker exec clab-arnika-ci-test-node-a cat /tmp/arnika.log || true
          echo "====== Node-B Logs ======"
          docker exec clab-arnika-ci-test-node-b cat /tmp/arnika.log || true

      - name: Cleanup containerlab
        if: always()
        run: |
          sudo containerlab destroy -t ci/clab-ci.yaml --cleanup