image_rs_build.yml

name: image-rs build
on:
  push:
    branches:
      - 'main'
    paths:
      - 'image-rs/**'
      - '.github/workflows/image_rs_build.yml'
      - 'Cargo.toml'
      - 'Cargo.lock'
  pull_request:
    paths:
      - 'image-rs/**'
      - '.github/workflows/image_rs_build.yml'
      - 'Cargo.toml'
      - 'Cargo.lock'
  create:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    if: github.event_name != 'push'
    name: Check
    defaults:
      run:
        working-directory: ./image-rs
    strategy:
      fail-fast: false
      matrix:
        rust:
          - 1.76.0
          - stable
        instance:
          - ubuntu-24.04
          - s390x
    runs-on: ${{ matrix.instance }}
    steps:
      - name: Code checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Install Rust toolchain (${{ matrix.rust }})
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: ${{ matrix.rust }}
          override: true
          components: rustfmt, clippy

      - name: Install nettle-sys building dependence
        run: |
          sudo apt install -y clang llvm pkg-config nettle-dev protobuf-compiler libprotobuf-dev

      - uses: ./.github/actions/install-intel-dcap
        with:
          ubuntu-version: noble
        if: matrix.instance == 'ubuntu-24.04'

      - name: Install TPM dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libtss2-dev
        if: matrix.instance == 'ubuntu-24.04'

      - name: Install dm-verity dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libdevmapper-dev
        if: matrix.instance == 'ubuntu-24.04'

      - name: Install cross-compliation support dependencies
        run: |
          sudo apt install -y gcc-powerpc64le-linux-gnu
          rustup target add powerpc64le-unknown-linux-gnu
        if: matrix.instance == 'ubuntu-24.04'

      - name: Run cargo fmt check
        uses: actions-rs/cargo@v1
        with:
          command: fmt
          args: -p image-rs -- --check

      - name: Run rust lint check (all platforms)
        run: |
          cargo clippy -p image-rs --all-targets --features=default -- -D warnings
          cargo clippy -p image-rs --all-targets --features=kata-cc-rustls-tls --no-default-features -- -D warnings
          cargo clippy -p image-rs --all-targets --features=kata-cc-native-tls --no-default-features -- -D warnings
          cargo clippy -p image-rs --all-targets --features=kata-cc-native-tls,signature-simple-xrss --no-default-features -- -D warnings

      - name: Run rust lint check (x86_64 only)
        run: |
            cargo clippy -p image-rs --all-targets --features=enclave-cc-cckbc-native-tls --no-default-features -- -D warnings
            cargo clippy -p image-rs --all-targets --features=kata-cc-native-tls,nydus --no-default-features -- -D warnings
        if: matrix.instance == 'ubuntu-24.04'

      - name: Run cargo build
        uses: actions-rs/cargo@v1
        with:
          command: build
          args: -p image-rs --features default

      - name: Run cargo build, cross-compiling for powerpc64le
        run: |
          sudo -E PATH=$PATH -s RUSTFLAGS=" -C linker=powerpc64le-linux-gnu-gcc" cargo build --target powerpc64le-unknown-linux-gnu -p image-rs --features default
        if: matrix.instance == 'ubuntu-24.04'

      - name: Run cargo test - default
        run: |
          sudo -E PATH=$PATH -s cargo test -p image-rs --features default

      - name: Run cargo test - kata-cc (rust-tls version) with keywrap-grpc + keywrap-jwe
        run: |
          sudo -E PATH=$PATH -s cargo test -p image-rs --no-default-features --features=encryption-ring,keywrap-grpc,snapshot-overlayfs,signature-cosign-rustls,signature-simple,kbs,oci-client/rustls-tls,keywrap-jwe

      - name: Run cargo test - kata-cc (native-tls version) with keywrap-grpc + keywrap-jwe
        run: |
          sudo -E PATH=$PATH -s cargo test -p image-rs --no-default-features --features=encryption-openssl,keywrap-grpc,snapshot-overlayfs,signature-cosign-native,signature-simple,kbs,oci-client/native-tls,keywrap-jwe

      - name: Run cargo test - kata-cc (rust-tls version) with keywrap-ttrpc (default) + keywrap-jwe
        run: |
          sudo -E PATH=$PATH -s cargo test -p image-rs --no-default-features --features=kata-cc-rustls-tls,keywrap-jwe

      - name: Run cargo test - kata-cc (native-tls version) with keywrap-ttrpc (default) + keywrap-jwe
        run: |
          sudo -E PATH=$PATH -s cargo test -p image-rs --no-default-features --features=kata-cc-native-tls,keywrap-jwe
      
      - name: Clean test cache
        run: |
          sudo -E PATH=$PATH -s cargo clean

      - name: Run cargo test - kata-cc (native-tls version) with keywrap-ttrpc (default) + keywrap-jwe and with signatures from XRSS registry extension
        env:
          AUTH_PASSWORD: ${{ secrets.SH_ICR_API_KEY }}
        run: |
          sudo -E PATH=$PATH -s cargo test -p image-rs --no-default-features --features=kata-cc-native-tls,keywrap-jwe,signature-simple-xrss

      - name: Run cargo test - kata-cc (native-tls version) with keywrap-ttrpc (default) + keywrap-jwe + nydus
        run: |
          sudo -E PATH=$PATH -s cargo test -p image-rs --no-default-features --features=kata-cc-native-tls,keywrap-jwe,nydus
        if: matrix.instance == 'ubuntu-24.04'