ci.yaml

# Copyright (c) Microsoft Corporation.
# SPDX-License-Identifier: Apache-2.0

name: CI

on:
  push:
    branches:
      # Main is validated before merge by pull_request and merge_group. Push
      # runs on main exist to seed the Actions caches that pull requests
      # restore: caches written by pull_request or merge_group runs are scoped
      # to that ref and are not readable by other pull requests, so those runs
      # only restore, and caches are saved only from push events.
      - main
      # Keep push validation for supported release branches.
      - release-*
  pull_request:
    branches:
      - main
      - release-*
  merge_group:
    types:
      - checks_requested
  workflow_dispatch:

# Cancel in-progress runs for the same branch/PR to avoid wasted runner time.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  REGISTRY: ghcr.io/${{ github.repository_owner }}
  CNI_PLUGINS_VERSION: v1.9.1

jobs:
  # ---------- Frontend ----------
  frontend:
    name: Build Frontend
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Build frontend
        run: npm ci --prefer-offline --no-audit && npm run build
        working-directory: frontend

      - name: Upload frontend dist
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: frontend-dist
          path: frontend/dist/
          retention-days: 1

  # ---------- Lint ----------
  lint:
    name: Lint
    needs: [frontend]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download frontend dist
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: frontend-dist
          path: internal/net/html/dist

      - name: Set up Go
        id: setup-go
        uses: ./.github/actions/setup-go-cached
        with:
          profile: lint
          extra-build-paths: ~/.cache/golangci-lint

      - name: Compute Go tools cache key
        id: tools-key
        run: |
          # Hash only the pinned versions that install-tools uses, so unrelated
          # Makefile edits do not invalidate the cache.
          hash="$(grep -E '^(GOFUMPT|GOLANGCI_LINT|PROTOC_GEN_GO|PROTOC_GEN_GO_GRPC|CONTROLLER_GEN|ACTIONLINT)_VERSION ' Makefile | sha256sum | cut -c1-16)"
          echo "key=go-tools-${RUNNER_OS}-${RUNNER_ARCH}-${{ steps.setup-go.outputs.go-version }}-${hash}" >> "$GITHUB_OUTPUT"
          echo "dir=$(go env GOPATH)/bin" >> "$GITHUB_OUTPUT"

      - name: Restore Go tools
        id: tools-cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ steps.tools-key.outputs.dir }}
          key: ${{ steps.tools-key.outputs.key }}

      - name: Install tools
        if: steps.tools-cache.outputs.cache-hit != 'true'
        run: make install-tools

      - name: Save Go tools
        if: github.event_name == 'push' && steps.tools-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ steps.tools-key.outputs.dir }}
          key: ${{ steps.tools-key.outputs.key }}

      - name: Lint
        run: make lint

      - name: Save Go caches
        if: success() && github.event_name == 'push'
        uses: ./.github/actions/setup-go-cached
        with:
          phase: save
          profile: lint
          # Must match the restore call: actions/cache versions entries by
          # their path list, so a different list could not be restored.
          extra-build-paths: ~/.cache/golangci-lint
          save-build-cache: "true"
          save-mod-cache: "false"

  # ---------- Test ----------
  test:
    name: Test
    needs: [frontend]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download frontend dist
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: frontend-dist
          path: internal/net/html/dist

      - name: Set up Go
        id: setup-go
        uses: ./.github/actions/setup-go-cached
        with:
          profile: race

      - name: Verify go.mod tidy
        run: |
          make gomod
          if [ -n "$(git diff --name-only go.mod go.sum)" ]; then
            echo "::error::go.mod or go.sum is not tidy. Run 'make gomod' and commit the changes."
            git diff go.mod go.sum
            exit 1
          fi

      - name: Test
        run: make test

      - name: Summarize tests
        if: always() && hashFiles('tmp/go-test.json') != ''
        run: go run ./hack/cmd/test-summary tmp/go-test.json >> "$GITHUB_STEP_SUMMARY"

      - name: Upload coverage
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: coverage
          path: coverage.out
          retention-days: 7
          if-no-files-found: ignore

      - name: Save Go caches
        if: success() && github.event_name == 'push'
        uses: ./.github/actions/setup-go-cached
        with:
          phase: save
          profile: race
          save-build-cache: "true"
          save-mod-cache: "false"

  # ---------- Racer Rust workspace ----------
  # Lint, the two workspace feature sets, and the production gates run as
  # separate jobs so they build and test concurrently. Lint runs no tests, so
  # formatting and Clippy failures report within minutes.
  racer-rust-lint:
    name: Racer Rust Lint (${{ matrix.features }})
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    # The two workspace Clippy passes resolve different feature sets, so most
    # crates recompile between them. Running them as parallel legs halves wall
    # time with identical lint coverage. Non-Clippy checks run in one leg only.
    strategy:
      fail-fast: false
      matrix:
        features: [default, all-features]
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/bin/racer-cargo
      # Make the pinned toolchain active so rust-cache keys on its rustc -vV.
      RUSTUP_TOOLCHAIN: 1.96.0
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up pinned Rust
        run: timeout --signal=TERM --kill-after=10s 300s rustup toolchain install 1.96.0 --profile minimal --component rustfmt,clippy

      # Saved only on push so pull requests reuse base-branch entries without
      # writing their own. rust-cache keeps dependency artifacts only.
      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          workspaces: cmd/racer -> ../../bin/racer-cargo
          shared-key: racer-lint-${{ matrix.features }}
          save-if: ${{ github.event_name == 'push' }}

      - name: Check Rust formatting
        if: matrix.features == 'default'
        run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 fmt --manifest-path cmd/racer/Cargo.toml --all --check

      - name: Strict workspace Clippy (default features)
        if: matrix.features == 'default'
        run: timeout --signal=TERM --kill-after=10s 1200s cargo +1.96.0 clippy --locked --manifest-path cmd/racer/Cargo.toml --workspace --all-targets -- -D warnings

      - name: Strict workspace Clippy (all features)
        if: matrix.features == 'all-features'
        run: timeout --signal=TERM --kill-after=10s 1200s cargo +1.96.0 clippy --locked --manifest-path cmd/racer/Cargo.toml --workspace --all-targets --all-features -- -D warnings

      - name: Enforce Racer dependency purity
        if: matrix.features == 'default'
        run: timeout --signal=TERM --kill-after=10s 300s python3 hack/scripts/racer-purity-graph.py --manifest-path cmd/racer/Cargo.toml --strict

      # Allocator simulation is explicit test support (Slab::simulate_in), not a
      # cargo feature. Clippy also type-checks every allocator target.
      - name: Strict allocator Clippy
        if: matrix.features == 'default'
        run: |
          timeout --signal=TERM --kill-after=10s 600s cargo +1.96.0 clippy --locked --manifest-path cmd/racer/Cargo.toml -p page-alloc --all-targets --no-default-features -- -D warnings

  # Fan-in under the original check name so branch protection that requires
  # "Racer Rust Lint" keeps gating on both matrix legs.
  racer-rust-lint-result:
    name: Racer Rust Lint
    if: always()
    needs: racer-rust-lint
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Require every lint leg to pass
        env:
          RESULT: ${{ needs.racer-rust-lint.result }}
        run: test "$RESULT" = success

  # ---------- racer-object Rust sidecar ----------
  # Standalone crate (not a member of the cmd/racer workspace) with its own
  # lock file, so it gets its own target directory and cache key.
  racer-object-rust:
    name: racer-object Rust
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/bin/racer-object-cargo
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up pinned Rust
        run: timeout --signal=TERM --kill-after=10s 300s rustup toolchain install 1.96.0 --profile minimal --component rustfmt,clippy

      - name: Cache Cargo dependencies and artifacts
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            bin/racer-object-cargo
          key: racer-object-${{ runner.os }}-${{ runner.arch }}-1.96.0-${{ hashFiles('cmd/racer-object/Cargo.lock', 'cmd/racer-object/Cargo.toml') }}-${{ github.sha }}
          restore-keys: |
            racer-object-${{ runner.os }}-${{ runner.arch }}-1.96.0-${{ hashFiles('cmd/racer-object/Cargo.lock', 'cmd/racer-object/Cargo.toml') }}-

      - name: Check Rust formatting
        run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 fmt --manifest-path cmd/racer-object/Cargo.toml --all --check

      - name: Clippy
        run: timeout --signal=TERM --kill-after=10s 600s cargo +1.96.0 clippy --locked --manifest-path cmd/racer-object/Cargo.toml --all-targets -- -D warnings

      - name: Test
        run: timeout --signal=TERM --kill-after=10s 600s cargo +1.96.0 test --locked --manifest-path cmd/racer-object/Cargo.toml

  racer-rust:
    name: Racer Rust Workspace (${{ matrix.suite }})
    # Library real-I/O tests need a VM rather than a seccomp-restricted container.
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          - suite: default features
            key: default
            features: ""
          - suite: all features
            key: all-features
            features: --all-features
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/bin/racer-cargo
      # Make the pinned toolchain active so rust-cache keys on its rustc -vV.
      RUSTUP_TOOLCHAIN: 1.96.0
      RUST_TEST_THREADS: "4"
      FEATURES: ${{ matrix.features }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up pinned Rust
        run: timeout --signal=TERM --kill-after=10s 300s rustup toolchain install 1.96.0 --profile minimal

      - name: Enable io_uring
        run: timeout --signal=TERM --kill-after=10s 300s sudo sysctl -w kernel.io_uring_disabled=0

      # Saved only on push so pull requests reuse base-branch entries without
      # writing their own. rust-cache keeps dependency artifacts only.
      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          workspaces: cmd/racer -> ../../bin/racer-cargo
          shared-key: racer-workspace-${{ matrix.key }}
          save-if: ${{ github.event_name == 'push' }}

      - name: Check
        run: timeout --signal=TERM --kill-after=10s 1200s cargo +1.96.0 check --locked --manifest-path cmd/racer/Cargo.toml --workspace --all-targets $FEATURES

      # Compile test binaries separately: a cold build of the dataplane test
      # targets takes far longer than running any single step's tests.
      - name: Build tests
        run: timeout --signal=TERM --kill-after=10s 1800s cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml --workspace $FEATURES --no-run

      - name: Test
        run: timeout --signal=TERM --kill-after=10s 1500s cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml --workspace $FEATURES

      # The fuzz crate is a standalone workspace with its own lock, so the
      # workspace steps above never build it. Compile every target and check
      # that the committed seeds still decode and match their encoders.
      - name: Check fuzz targets
        if: matrix.key == 'default'
        run: timeout --signal=TERM --kill-after=10s 900s cargo +1.96.0 check --locked --manifest-path cmd/racer/fuzz/Cargo.toml --bins

      - name: Fuzz seed corpora
        if: matrix.key == 'default'
        env:
          RUSTC_BOOTSTRAP: "1"
        run: timeout --signal=TERM --kill-after=10s 900s cargo +1.96.0 test --locked --manifest-path cmd/racer/fuzz/Cargo.toml --test seeds

  racer-rust-gates:
    name: Racer Rust Production Gates
    # Real io_uring and direct I/O need a VM rather than a seccomp-restricted container.
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/bin/racer-cargo
      # Make the pinned toolchain active so rust-cache keys on its rustc -vV.
      RUSTUP_TOOLCHAIN: 1.96.0
      RUST_TEST_THREADS: "4"
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up pinned Rust
        run: timeout --signal=TERM --kill-after=10s 300s rustup toolchain install 1.96.0 --profile minimal

      - name: Enable io_uring
        run: timeout --signal=TERM --kill-after=10s 300s sudo sysctl -w kernel.io_uring_disabled=0

      # Saved only on push so pull requests reuse base-branch entries without
      # writing their own. rust-cache keeps dependency artifacts only.
      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          workspaces: cmd/racer -> ../../bin/racer-cargo
          shared-key: racer-gates
          save-if: ${{ github.event_name == 'push' }}

      - name: Racer I/O real io_uring
        env:
          RUNTIME_REQUIRE_IO_URING: "1"
        run: timeout --signal=TERM --kill-after=10s 900s cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml -p racer-io

      # Real-I/O allocator tests and simulated allocator tests share one run;
      # simulation is selected per slab through Slab::simulate_in.
      - name: Allocator real I/O and simulation
        env:
          PAGE_ALLOC_REQUIRE_REAL_IO: "1"
        run: timeout --signal=TERM --kill-after=10s 900s cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml -p page-alloc --no-default-features

  racer-verbs:
    name: Racer Verbs (${{ matrix.configuration }})
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - configuration: no-default-features
            features: ""
            native: false
          - configuration: simulation
            features: simulation
            native: false
          - configuration: native
            features: native
            native: true
          - configuration: native-and-simulation
            features: native,simulation
            native: true
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/bin/racer-verbs-cargo
      # Make the pinned toolchain active so rust-cache keys on its rustc -vV.
      RUSTUP_TOOLCHAIN: 1.96.0
      CARGO_BUILD_JOBS: "2"
      RUST_TEST_THREADS: "1"
      VERBS_FEATURES: ${{ matrix.features }}
      LD_LIBRARY_PATH: ${{ github.workspace }}/bin/racer-verbs-native
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up pinned Rust
        run: timeout --signal=TERM --kill-after=10s 300s rustup toolchain install 1.96.0 --profile minimal --component rustfmt,clippy

      # Matrix entries differ only in workspace-crate features, and rust-cache
      # prunes workspace crates, so one entry saves for all of them.
      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          workspaces: cmd/racer -> ../../bin/racer-verbs-cargo
          shared-key: racer-verbs
          save-if: ${{ github.event_name == 'push' && matrix.configuration == 'native-and-simulation' }}

      - name: Use the archive.ubuntu.com apt mirror
        if: matrix.native
        # Ubuntu runner sources share this list; bypass the stalled Azure mirror.
        run: printf '%s\n' 'https://archive.ubuntu.com/ubuntu/' | timeout --signal=TERM --kill-after=10s 300s sudo tee /etc/apt/apt-mirrors.txt > /dev/null

      - name: Install native adapter build dependencies
        if: matrix.native
        uses: ./.github/actions/apt-install-cached
        with:
          packages: build-essential pkg-config libibverbs-dev librdmacm-dev
          cache-name: racer-verbs-native
          timeout-seconds: "300"

      # Rust loads the adapter dynamically, so Cargo cannot compile-check its C ABI.
      - name: Compile native C adapter (not hardware validation)
        if: matrix.native
        run: timeout --signal=TERM --kill-after=10s 300s sh images/racer/build-native.sh cmd/racer/verbs/native/verbs.c bin/racer-verbs-native/librdma_verbs.so.1

      - name: Require native adapter ABI and symbols (no hardware)
        if: matrix.native
        run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml -p rdma-verbs --no-default-features --features "$VERBS_FEATURES" --lib ffi::tests::required_native_adapter_loads_abi_and_symbols -- --exact --ignored

      - name: Test C discovery and open cleanup faults (no hardware)
        if: matrix.native
        run: |
          timeout --signal=TERM --kill-after=10s 300s sh images/racer/build-native.sh cmd/racer/verbs/native/discovery_faults.c bin/racer-verbs-faults/librdma_verbs.so.1
          timeout --signal=TERM --kill-after=10s 300s env LD_LIBRARY_PATH="$GITHUB_WORKSPACE/bin/racer-verbs-faults" cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml -p rdma-verbs --no-default-features --features "$VERBS_FEATURES" --lib ffi::discovery_fault_tests::internal_close_failures_keep_admission_and_adapter -- --exact --ignored
          timeout --signal=TERM --kill-after=10s 300s env LD_LIBRARY_PATH="$GITHUB_WORKSPACE/bin/racer-verbs-faults" cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml -p rdma-verbs --no-default-features --features "$VERBS_FEATURES" --lib ffi::discovery_fault_tests::open_cleanup_failures_keep_admission_and_adapter -- --exact --ignored
          timeout --signal=TERM --kill-after=10s 300s env LD_LIBRARY_PATH="$GITHUB_WORKSPACE/bin/racer-verbs-faults" cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml -p rdma-verbs --no-default-features --features "$VERBS_FEATURES" --lib ffi::discovery_fault_tests::bind_is_signaled_and_fenced -- --exact --ignored
          timeout --signal=TERM --kill-after=10s 300s env LD_LIBRARY_PATH="$GITHUB_WORKSPACE/bin/racer-verbs-faults" cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml -p rdma-verbs --no-default-features --features "$VERBS_FEATURES" --lib ffi::discovery_fault_tests::wrappers_translate_verbs_results -- --exact --ignored

      - name: Check verbs formatting
        run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 fmt --manifest-path cmd/racer/Cargo.toml -p rdma-verbs --check

      - name: Check verbs feature configuration
        run: |
          features=()
          if [ -n "$VERBS_FEATURES" ]; then features=(--features "$VERBS_FEATURES"); fi
          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 check --locked --manifest-path cmd/racer/Cargo.toml -p rdma-verbs --all-targets --no-default-features "${features[@]}"

      - name: Strict verbs Clippy
        run: |
          features=()
          if [ -n "$VERBS_FEATURES" ]; then features=(--features "$VERBS_FEATURES"); fi
          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 clippy --locked --manifest-path cmd/racer/Cargo.toml -p rdma-verbs --all-targets --no-default-features "${features[@]}" -- -D warnings

      # Explicit zero-port and active-provider tests remain ignored. A hosted
      # runner does not establish RDMA hardware or DMA/fencing correctness.
      - name: Test verbs without requiring RDMA hardware
        run: |
          features=()
          if [ -n "$VERBS_FEATURES" ]; then features=(--features "$VERBS_FEATURES"); fi
          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml -p rdma-verbs --no-default-features "${features[@]}"

  racer-gpu:
    name: Racer GPU (${{ matrix.configuration }})
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - configuration: no-default-features
            features: ""
            native: false
          - configuration: simulation
            features: simulation
            native: false
          # native compiles the decrypt kernels with nvcc; native-and-simulation
          # keeps covering the build without them.
          - configuration: native
            features: native
            native: true
            kernels: true
          - configuration: native-and-simulation
            features: native,simulation
            native: true
            kernels: false
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/bin/racer-gpu-cargo
      # Make the pinned toolchain active so rust-cache keys on its rustc -vV.
      RUSTUP_TOOLCHAIN: 1.96.0
      CARGO_BUILD_JOBS: "2"
      GPU_FEATURES: ${{ matrix.features }}
      LD_LIBRARY_PATH: ${{ github.workspace }}/bin/racer-gpu-native
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up pinned Rust
        run: timeout --signal=TERM --kill-after=10s 300s rustup toolchain install 1.96.0 --profile minimal --component rustfmt,clippy

      # Matrix entries differ only in workspace-crate features, and rust-cache
      # prunes workspace crates, so one entry saves for all of them.
      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          workspaces: cmd/racer -> ../../bin/racer-gpu-cargo
          shared-key: racer-gpu
          save-if: ${{ github.event_name == 'push' && matrix.configuration == 'native-and-simulation' }}

      # Hosted runners have no GPU. nvcc (same package as the dataplane image)
      # compiles the decrypt kernels to PTX so they at least build; running
      # them needs .github/workflows/racer-gpu.yaml on a GPU runner. Kernel
      # math is covered by the C-core tests below and the kernel emulation step.
      - name: Add CUDA apt repository
        if: matrix.kernels
        run: |
          timeout --signal=TERM --kill-after=10s 120s curl -fsSL -o "$RUNNER_TEMP/cuda-keyring.deb" \
            https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/cuda-keyring_1.1-1_all.deb
          timeout --signal=TERM --kill-after=10s 120s sudo dpkg -i "$RUNNER_TEMP/cuda-keyring.deb"

      - name: Install nvcc
        if: matrix.kernels
        uses: ./.github/actions/apt-install-cached
        with:
          packages: cuda-nvcc-12-9
          cache-name: racer-gpu-nvcc

      - name: Add nvcc to PATH
        if: matrix.kernels
        run: echo /usr/local/cuda/bin >> "$GITHUB_PATH"

      - name: Compile CUDA shim with kernels (not hardware validation)
        if: matrix.kernels
        run: RACER_GPU_REQUIRE_PTX=1 timeout --signal=TERM --kill-after=10s 300s sh images/racer/build-native-cuda.sh cmd/racer/gpu/native bin/racer-gpu-native/libracer_gpu_cuda.so.1

      - name: Compile CUDA shim without kernels (not hardware validation)
        if: matrix.native && !matrix.kernels
        run: timeout --signal=TERM --kill-after=10s 300s sh images/racer/build-native-cuda.sh cmd/racer/gpu/native bin/racer-gpu-native/libracer_gpu_cuda.so.1

      - name: Require CUDA shim ABI and symbols (no hardware)
        if: matrix.native
        run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml -p racer-gpu --no-default-features --features "$GPU_FEATURES" --lib ffi::tests::required_native_shim_loads_abi_and_symbols -- --exact --ignored

      - name: Run decrypt kernels on the CPU (kernel emulation)
        if: matrix.native
        run: timeout --signal=TERM --kill-after=10s 300s sh cmd/racer/gpu/native/run-kernel-emulation.sh bin/racer-gpu-emulation

      - name: Check GPU formatting
        run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 fmt --manifest-path cmd/racer/Cargo.toml -p racer-gpu --check

      - name: Strict GPU Clippy
        run: |
          features=()
          if [ -n "$GPU_FEATURES" ]; then features=(--features "$GPU_FEATURES"); fi
          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 clippy --locked --manifest-path cmd/racer/Cargo.toml -p racer-gpu --all-targets --no-default-features "${features[@]}" -- -D warnings

      # Includes the C AES-GCM/CRC core check against racer-crypto (16 MiB pages).
      - name: Test GPU crate without requiring GPU hardware
        run: |
          features=()
          if [ -n "$GPU_FEATURES" ]; then features=(--features "$GPU_FEATURES"); fi
          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer/Cargo.toml -p racer-gpu --no-default-features "${features[@]}"

  racer-io-miri:
    name: Runtime Miri (${{ matrix.group }})
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        group: [spsc, mailbox, offload, scheduler, memory, rt-memory]
    env:
      # Make the pinned nightly active so rust-cache keys on its rustc -vV.
      RUSTUP_TOOLCHAIN: nightly-2025-11-21
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install pinned Miri
        run: timeout --signal=TERM --kill-after=10s 300s rustup toolchain install nightly-2025-11-21 --profile minimal --component miri,rust-src

      # Every group builds the same dependencies and Miri sysroot, so one group
      # saves for all of them. ~/.cache/miri is the Linux default MIRI_SYSROOT.
      - name: Cache Cargo dependencies and Miri sysroot
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          workspaces: cmd/racer -> ../../tmp/racer-io-miri-target
          shared-key: racer-io-miri
          cache-directories: ~/.cache/miri
          save-if: ${{ github.event_name == 'push' && matrix.group == 'spsc' }}

      - name: Prepare Miri sysroot
        run: timeout --signal=TERM --kill-after=10s 300s cargo +nightly-2025-11-21 miri setup

      - name: Validate exact pure runtime test group
        run: timeout --signal=TERM --kill-after=10s 1200s python3 hack/scripts/racer-io-miri.py ${{ matrix.group }}
  racer-envtest:
    name: Racer API Server Integration Tests
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # The envtest suite runs with -race, so reuse the race build cache that
      # the Test job saves.
      - name: Set up Go
        id: setup-go
        uses: ./.github/actions/setup-go-cached
        with:
          profile: race

      - name: Compute envtest cache key
        id: envtest-key
        run: |
          hash="$(grep -E '^(SETUP_ENVTEST|ENVTEST_K8S)_VERSION ' Makefile | sha256sum | cut -c1-16)"
          echo "key=envtest-${RUNNER_OS}-${RUNNER_ARCH}-${{ steps.setup-go.outputs.go-version }}-${hash}" >> "$GITHUB_OUTPUT"

      - name: Restore envtest binaries
        id: envtest-cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            bin/setup-envtest-*
            bin/envtest
          key: ${{ steps.envtest-key.outputs.key }}

      - name: Provision envtest and run Racer API-server race tests
        run: timeout --signal=TERM --kill-after=10s 300s make racer-envtest-ci

      - name: Save envtest binaries
        if: github.event_name == 'push' && steps.envtest-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            bin/setup-envtest-*
            bin/envtest
          key: ${{ steps.envtest-key.outputs.key }}

  racer-python:
    name: Racer Python Client
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Run Python client and vLLM plugin tests
        run: timeout --signal=TERM --kill-after=10s 540s make racer-python-test

  # ---------- Orca Integration Tests ----------
  # Spins up Garage and Azurite via testcontainers-go and runs the
  # orca in-process integration suite (internal/orca/inttest). Docker
  # is preinstalled on GitHub-hosted Ubuntu runners; no extra services:
  # block is required.
  orca-inttest:
    name: Orca Integration Tests
    needs: [frontend]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download frontend dist
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: frontend-dist
          path: internal/net/html/dist

      - name: Set up Go
        id: setup-go
        uses: ./.github/actions/setup-go-cached
        with:
          profile: race

      - name: Run orca-inttest
        run: make orca-inttest

  # ---------- Build ----------
  build:
    name: Build
    needs: [frontend]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download frontend dist
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: frontend-dist
          path: internal/net/html/dist

      - name: Set up Go
        id: setup-go
        uses: ./.github/actions/setup-go-cached
        with:
          profile: build

      - name: Build
        run: make build

      - name: Save Go caches
        if: success() && github.event_name == 'push'
        uses: ./.github/actions/setup-go-cached
        with:
          phase: save
          profile: build
          save-build-cache: "true"
          save-mod-cache: "true"

  # ---------- Vulnerability Check ----------
  govulncheck:
    name: Vulnerability Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Go
        id: setup-go
        uses: ./.github/actions/setup-go-cached
        with:
          profile: build

      - name: Vulnerability check
        run: make vulncheck

  # ---------- Verify Generated Files ----------
  verify-generated:
    name: Verify Generated Files
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Go
        id: setup-go
        uses: ./.github/actions/setup-go-cached
        with:
          profile: build

      - name: Compute Go tools cache key
        id: tools-key
        run: |
          # Hash only the pinned versions that install-tools uses, so unrelated
          # Makefile edits do not invalidate the cache.
          hash="$(grep -E '^(GOFUMPT|GOLANGCI_LINT|PROTOC_GEN_GO|PROTOC_GEN_GO_GRPC|CONTROLLER_GEN|ACTIONLINT)_VERSION ' Makefile | sha256sum | cut -c1-16)"
          echo "key=go-tools-${RUNNER_OS}-${RUNNER_ARCH}-${{ steps.setup-go.outputs.go-version }}-${hash}" >> "$GITHUB_OUTPUT"
          echo "dir=$(go env GOPATH)/bin" >> "$GITHUB_OUTPUT"

      - name: Restore Go tools
        id: tools-cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ steps.tools-key.outputs.dir }}
          key: ${{ steps.tools-key.outputs.key }}

      - name: Install tools
        if: steps.tools-cache.outputs.cache-hit != 'true'
        run: make install-tools

      - name: Install clang/llvm for bpf2go
        # Same package list and cache name as the other BPF job, so both share
        # one cache entry.
        uses: ./.github/actions/apt-install-cached
        with:
          packages: clang-18 llvm-18 libbpf-dev
          cache-name: bpf-clang

      - name: Verify BPF CO-RE pin artifacts
        run: make net-ebpf-verify

      - name: Regenerate
        run: make generate

      - name: Check for drift
        run: |
          if ! git diff --exit-code; then
            echo "::error::Generated files are out of date. Run 'make generate' and commit the results."
            exit 1
          fi

  # ---------- Verify BPF binary reproducibility ----------
  #
  # Recompiles bpf/unbounded_encap.c via bpf2go using the pinned clang
  # version (bpf/clang-version) and diffs the result against the
  # committed internal/net/ebpf/unboundedencap_bpfel.{go,o}. Catches any
  # PR that edits the BPF source (or its CO-RE inputs in bpf/vmlinux.h)
  # without re-running `make generate` and committing the updated
  # bindings.
  #
  # Reproducibility relies on every build path using the same clang
  # binary: contributors invoke clang-18 via `make generate`, this CI
  # job installs the same package. Bump the pin by updating
  # bpf/clang-version and the references it documents.
  verify-bpf-binary:
    name: Verify BPF Binary
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Go
        id: setup-go
        uses: ./.github/actions/setup-go-cached
        with:
          profile: build

      - name: Verify pinned clang version
        run: |
          pinned="$(grep -v '^#' bpf/clang-version | grep -v '^$' | head -n1)"
          if [ "$pinned" != "clang-18" ]; then
            echo "::error::bpf/clang-version pins '$pinned' but this CI job installs clang-18."
            echo "::error::Update the apt-install-cached packages in .github/workflows/ci.yaml (verify-generated and verify-bpf-binary jobs) to match."
            exit 1
          fi

      - name: Install pinned clang for bpf2go
        # Same package list and cache name as the other BPF job, so both share
        # one cache entry.
        uses: ./.github/actions/apt-install-cached
        with:
          packages: clang-18 llvm-18 libbpf-dev
          cache-name: bpf-clang

      - name: Recompile BPF bindings via bpf2go
        run: go generate ./internal/net/ebpf/...

      - name: Check for drift in bpf2go output
        run: |
          if ! git diff --exit-code -- internal/net/ebpf/ bpf/; then
            echo "::error::Committed BPF bindings are out of date."
            echo "::error::Run 'make generate' locally (with $(grep -v '^#' bpf/clang-version | grep -v '^$' | head -n1) installed) and commit the updated"
            echo "::error::internal/net/ebpf/unboundedencap_bpfel.{go,o}."
            exit 1
          fi

  # ---------- Verify licenses ----------
  license-check:
    name: License Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Check repository license declarations
        run: make license-check

  # ---------- Verify NOTICE ----------
  notice-check:
    name: NOTICE Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install frontend deps
        run: npm ci --prefer-offline --no-audit
        working-directory: frontend

      - name: Set up Go
        id: setup-go
        uses: ./.github/actions/setup-go-cached
        with:
          profile: build

      - name: Restore Cargo registry
        id: cargo-registry
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
          key: cargo-registry-${{ runner.os }}-${{ hashFiles('cmd/racer/Cargo.lock') }}
          restore-keys: |
            cargo-registry-${{ runner.os }}-

      - name: Provision locked Cargo sources for NOTICE
        run: |
          timeout --signal=TERM --kill-after=10s 300s rustup toolchain install 1.96.0 --profile minimal
          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 fetch --locked --manifest-path cmd/racer/Cargo.toml
          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 fetch --locked --manifest-path cmd/racer-object/Cargo.toml

      - name: Save Cargo registry
        if: github.event_name == 'push' && steps.cargo-registry.outputs.cache-hit != 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
          key: ${{ steps.cargo-registry.outputs.cache-primary-key }}

      - name: Verify NOTICE
        run: timeout --signal=TERM --kill-after=10s 300s make notice-check

  # ---------- Build Container Images ----------
  build-images:
    name: Build Images (${{ matrix.arch }})
    needs: [frontend]
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: true
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-latest
            platform: linux/amd64
          - arch: arm64
            runner: ubuntu-24.04-arm
            platform: linux/arm64
    steps:
      - name: Normalize container registry
        run: echo "REGISTRY=${REGISTRY,,}" >> "$GITHUB_ENV"

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Download frontend dist
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: frontend-dist
          path: internal/net/html/dist

      - name: Cache CNI plugins
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: resources
          key: cni-plugins-${{ matrix.arch }}-${{ env.CNI_PLUGINS_VERSION }}

      - name: Download CNI plugins
        run: |
          mkdir -p resources
          file="resources/cni-plugins-linux-${{ matrix.arch }}-${CNI_PLUGINS_VERSION}.tgz"
          if [ ! -s "$file" ]; then
            curl -fsSL "https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGINS_VERSION}/cni-plugins-linux-${{ matrix.arch }}-${CNI_PLUGINS_VERSION}.tgz" -o "$file"
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4

      - name: Compute Go version for Docker
        id: goversion
        run: echo "go_version=$(awk '/^go /{split($2,v,"."); print v[1]"."v[2]}' go.mod)" >> "$GITHUB_OUTPUT"

      # Caches are exported only on push (main and release branches) so PR
      # and merge-queue runs restore without churning the shared 10 GB
      # Actions cache. An empty cache-to disables the export. The net
      # controller and node builds use separate scopes because each export
      # replaces the scope's cache index.
      - name: Build controller image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        with:
          context: .
          file: images/net/Containerfile
          target: controller
          platforms: ${{ matrix.platform }}
          build-args: |
            GO_VERSION=${{ steps.goversion.outputs.go_version }}
            CNI_PLUGINS_VERSION=${{ env.CNI_PLUGINS_VERSION }}
            GIT_COMMIT=${{ github.sha }}
          tags: ${{ env.REGISTRY }}/unbounded-net-controller:ci-${{ matrix.arch }}
          cache-from: type=gha,scope=net-controller-${{ matrix.arch }}
          cache-to: ${{ github.event_name == 'push' && format('type=gha,mode=max,scope=net-controller-{0}', matrix.arch) || '' }}
          outputs: type=oci,dest=${{ runner.temp }}/net-controller.oci.tar,oci-mediatypes=true
          provenance: false

      - name: Build node image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        with:
          context: .
          file: images/net/Containerfile
          target: node
          platforms: ${{ matrix.platform }}
          build-args: |
            GO_VERSION=${{ steps.goversion.outputs.go_version }}
            CNI_PLUGINS_VERSION=${{ env.CNI_PLUGINS_VERSION }}
            GIT_COMMIT=${{ github.sha }}
          tags: ${{ env.REGISTRY }}/unbounded-net-node:ci-${{ matrix.arch }}
          cache-from: type=gha,scope=net-node-${{ matrix.arch }}
          cache-to: ${{ github.event_name == 'push' && format('type=gha,mode=max,scope=net-node-{0}', matrix.arch) || '' }}
          outputs: type=oci,dest=${{ runner.temp }}/net-node.oci.tar,oci-mediatypes=true
          provenance: false

      - name: Build racer-loadgen image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        timeout-minutes: 5
        with:
          context: .
          file: images/racer-loadgen/Containerfile
          platforms: ${{ matrix.platform }}
          load: true
          push: false
          tags: racer-loadgen:ci
          cache-from: type=gha,scope=racer-loadgen-${{ matrix.arch }}
          cache-to: ${{ github.event_name == 'push' && format('type=gha,mode=max,scope=racer-loadgen-{0}', matrix.arch) || '' }}
          provenance: false

      - name: Smoke-test racer-loadgen entrypoint
        run: timeout --signal=TERM --kill-after=10s 300s docker run --rm --network=none racer-loadgen:ci --help

      # A cold Cargo release build (LTO, one codegen unit) is slow; the gha
      # cache keeps warm builds short.
      - name: Build racer-object image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        timeout-minutes: 15
        with:
          context: .
          file: images/racer-object/Containerfile
          platforms: ${{ matrix.platform }}
          load: true
          push: false
          tags: racer-object:ci
          cache-from: type=gha,scope=racer-object-${{ matrix.arch }}
          cache-to: ${{ github.event_name == 'push' && format('type=gha,mode=max,scope=racer-object-{0}', matrix.arch) || '' }}
          provenance: false

      - name: Smoke-test racer-object entrypoint
        run: timeout --signal=TERM --kill-after=10s 300s docker run --rm --network=none racer-object:ci --help

      - name: Verify OCI image layouts
        run: |
          set -euo pipefail

          validate_layout() {
            local name="$1"
            local archive="${RUNNER_TEMP}/net-${name}.oci.tar"
            local index
            index="$(tar -xOf "$archive" index.json)"

            jq -e '
              .schemaVersion == 2 and
              .mediaType == "application/vnd.oci.image.index.v1+json" and
              (.manifests | length > 0) and
              all(.manifests[]; .mediaType == "application/vnd.oci.image.manifest.v1+json")
            ' <<<"$index"

            while IFS= read -r digest; do
              local algorithm="${digest%%:*}"
              local encoded="${digest#*:}"
              local manifest="blobs/$algorithm/$encoded"
              tar -xOf "$archive" "$manifest" | jq -e '
                .mediaType == "application/vnd.oci.image.manifest.v1+json" and
                .config.mediaType == "application/vnd.oci.image.config.v1+json" and
                all(.layers[];
                  .mediaType | test("^application/vnd\\.oci\\.image\\.layer\\.v1\\.tar(\\+(gzip|zstd))?$"))
              '
            done < <(jq -r '.manifests[].digest' <<<"$index")
          }

          validate_layout controller
          validate_layout node

  # ---------- Cross-Platform Images ----------
  # release.yaml publishes some images for platforms that no other PR job
  # builds. Images whose Containerfile picks packages or downloads per
  # architecture can break on one platform only, as the v0.19.0 racer image
  # did on arm64 when its CUDA apt repo had no nvcc 12.9 package for sbsa.
  # Build those images here for the platforms PR CI does not otherwise cover.
  # Nothing is pushed.
  cross-platform-images:
    name: Build Cross-Platform Image (${{ matrix.name }}, ${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: racer
            file: images/racer/Containerfile
            arch: arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build ${{ matrix.name }} image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: ${{ matrix.file }}
          platforms: linux/${{ matrix.arch }}
          push: false
          provenance: false
          cache-from: type=gha,scope=cross-platform-${{ matrix.name }}-${{ matrix.arch }}
          cache-to: ${{ github.event_name == 'push' && format('type=gha,mode=max,scope=cross-platform-{0}-{1}', matrix.name, matrix.arch) || '' }}