Blake3.lean/.github/workflows/ci.yml at main · argumentcomputer/Blake3.lean · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: "CI"

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  lean-test:
    name: Lean Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
      - uses: leanprover/lean-action@50fcf42d2e460296f1a34b402e990d1b24f8b596 # v1.6.0
        with:
          build-args: "--wfail"
          test: true

  valgrind:
    needs: lean-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
      # Restore the `.lake` that lean-action saved in the lean-test job for
      # this commit, so the test binary is not rebuilt from scratch. Restore
      # only: lean-action below runs with its cache off to avoid a second save
      # under the same key.
      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ./.lake
          key: lake-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('lean-toolchain') }}-${{ hashFiles('lake-manifest.json') }}-${{ github.sha }}
          restore-keys: lake-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('lean-toolchain') }}-${{ hashFiles('lake-manifest.json') }}
      - uses: leanprover/lean-action@50fcf42d2e460296f1a34b402e990d1b24f8b596 # v1.6.0
        with:
          auto-config: false
          build: true
          build-args: "Blake3Test"
          use-github-cache: false
      - name: Install valgrind
        run: sudo apt-get update && sudo apt-get install -y valgrind
      - name: Run tests under valgrind
        run: |
          valgrind \
            --leak-check=full \
            --show-leak-kinds=definite,possible \
            --errors-for-leak-kinds=definite \
            --track-origins=yes \
            --error-exitcode=1 \
            .lake/build/bin/Blake3Test

  nix-test:
    name: Nix Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
        with:
          nix_path: nixpkgs=channel:nixos-unstable
          github_access_token: ${{ github.token }}
      - uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866 # v17
        with:
          name: argumentcomputer
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - run: nix build --print-build-logs --accept-flake-config
      # One step per check for separate logs; the store is shared across
      # steps, so nothing rebuilds.
      - run: nix build --print-build-logs --accept-flake-config .#checks.x86_64-linux.clippy
      - run: nix build --print-build-logs --accept-flake-config .#checks.x86_64-linux.blake3-test
      # Catch-all: near-free after the steps above; fails if a check is added
      # to the flake without a step here.
      - run: nix flake check --accept-flake-config

  lints:
    name: Lint workflows
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # actionlint, shellcheck over composite action scripts, pinact (actions
      # must be SHA-pinned with a matching version comment) and zizmor
      - uses: argumentcomputer/ci-workflows/.github/actions/lint-workflows@main