check-vm.yml

name: CI VM
on:
  push:
    branches: ["main"]
    paths-ignore: ["*.md", "*.png", "*.svg", "LICENSE-*"]
  pull_request:
    branches: ["main"]
    paths-ignore: ["*.md", "*.png", "*.svg", "LICENSE-*"]
  merge_group:
  workflow_dispatch:
env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  RUST_LOG: trace

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  check-vm:
    strategy:
      fail-fast: false
      matrix:
        os: [freebsd, openbsd, netbsd, solaris]
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - id: nss-version
        run: echo "minimum=$(cat neqo-crypto/min_version.txt)" >> "$GITHUB_OUTPUT"

      - run: curl -o rustup.sh --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs

      - if: matrix.os == 'freebsd'
        uses: vmactions/freebsd-vm@debf37ca7b7fa40e19c542ef7ba30d6054a706a4
        with:
          usesh: true
          envs: "CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG GITHUB_ACTIONS"
          prepare: | # This executes as root
            set -e
            pkg install -y curl llvm nss pkgconf
          run: | # This executes as user
            NSS_MINOR_VERSION="$(pkg-config --modversion nss | cut -d. -f2)"
            NSS_MINIMUM_VERSION="$(echo ${{ steps.nss-version.outputs.minimum }} | cut -d. -f2)"
            if [ "$NSS_MINOR_VERSION" -lt "$NSS_MINIMUM_VERSION" ]; then
              # Only check on this OS if the system NSS is usable.
              # Exit with no error otherwise.
              echo "System NSS package too old (minorversion $NSS_MINOR_VERSION < $NSS_MINIMUM_VERSION); skipping checks"
              exit 0
            fi
            set -e
            sh rustup.sh --default-toolchain stable --profile minimal --component clippy llvm-tools -y
            . "$HOME/.cargo/env"
            cargo check --all-targets
            cargo clippy -- -D warnings
            cargo install cargo-llvm-cov --locked
            cargo llvm-cov test --no-fail-fast --lcov --output-path lcov.info
            cargo test --no-fail-fast --release
            rm -rf target # Don't sync this back to host

      - if: matrix.os == 'openbsd'
        uses: vmactions/openbsd-vm@0cfe06e734a0ea3a546fca7ebf200b984b94d58a
        with:
          usesh: true
          envs: "CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG GITHUB_ACTIONS"
          prepare: | # This executes as root
            set -e
            pkg_add rust rust-clippy llvm-16.0.6p30 nss pkgconf # rustup doesn't support OpenBSD at all
          run: | # This executes as user
            set -e
            export LIBCLANG_PATH=/usr/local/llvm16/lib
            cargo check --all-targets
            cargo clippy -- -D warnings
            # FIXME: No profiler support in openbsd currently, error is:
            # > error[E0463]: can't find crate for `profiler_builtins`
            # > = note: the compiler may have been built without the profiler runtime
            # export LLVM_COV=/usr/local/llvm16/bin/llvm-cov
            # export LLVM_PROFDATA=/usr/local/llvm16/bin/llvm-profdata
            # cargo install cargo-llvm-cov --locked
            # cargo llvm-cov test --no-fail-fast --lcov --output-path lcov.info
            cargo test --no-fail-fast # Remove this once profiler is supported
            cargo test --no-fail-fast --release
            rm -rf target # Don't sync this back to host

      - if: matrix.os == 'netbsd'
        uses: vmactions/netbsd-vm@7c9086fdb4cc1aa814cda6e305390c2b966551a9
        with:
          usesh: true
          envs: "CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG GITHUB_ACTIONS"
          prepare: | # This executes as root
            set -e
            /usr/sbin/pkg_add pkgin
            pkgin -y install curl clang nss pkgconf
          run: | # This executes as user
            set -e
            sh rustup.sh --default-toolchain stable --profile minimal --component clippy llvm-tools -y
            . "$HOME/.cargo/env"
            cargo check --all-targets
            cargo clippy -- -D warnings
            # FIXME: No profiler support in netbsd currently, error is:
            # > error[E0463]: can't find crate for `profiler_builtins`
            # > = note: the compiler may have been built without the profiler runtime
            # cargo install cargo-llvm-cov --locked
            # cargo llvm-cov test --no-fail-fast --lcov --output-path lcov.info
            cargo test --no-fail-fast # Remove this once profiler is supported
            cargo test --no-fail-fast --release
            rm -rf target # Don't sync this back to host

      - if: matrix.os == 'solaris'
        uses: vmactions/solaris-vm@a89b9438868c70db27e41625f0a5de6ff5e90809
        with:
          release: "11.4-gcc"
          usesh: true
          envs: "CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG GITHUB_ACTIONS"
          prepare: | # This executes as root
            set -e
            pkg install clang-libs nss pkg-config
          run: | # This executes as also as root on Solaris
            set -e
            source <(curl -s https://raw.githubusercontent.com/psumbera/solaris-rust/refs/heads/main/sh.rust-web-install) || true # This doesn't exit with zero on success
            export LIBCLANG_PATH="/usr/lib/amd64"
            cargo check --all-targets
            cargo clippy -- -D warnings
            # FIXME: No profiler support in openbsd currently, error is:
            # > error[E0463]: can't find crate for `profiler_builtins`
            # > = note: the compiler may have been built without the profiler runtime
            # cargo install cargo-llvm-cov --locked
            # cargo llvm-cov test --no-fail-fast --lcov --output-path lcov.info
            cargo test --no-fail-fast # Remove this once profiler is supported
            cargo test --no-fail-fast --release
            rm -rf target # Don't sync this back to host

      - uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v5.0.7
        with:
          files: lcov.info
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}
          verbose: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}