verify.yml

name: Verify

# The checks that cost a second operating system or a real build toolchain.
# They answer questions the CI workflow cannot, and they take long enough that
# running them on every push would make the quick answer arrive no sooner than
# the slow one, so they run when a change lands on main and when asked for.
#
# The Semantic-mode suite is deliberately not among them. It runs in the CI
# workflow with the rest of the tests, because a check performed only here is
# one nobody is keeping: it goes unnoticed until a release, and by then what
# broke it is many changes back.
on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"

jobs:
  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Linux is covered on every change by the CI workflow. These two are
        # the ones that catch what a single platform cannot: path spelling,
        # separators, and the native shells.
        os: [macos-latest, windows-latest]
    steps:
      # An audit is over the bytes of the tree it is given, so the tree has to
      # be the one that was measured. This repository declares its line
      # endings, but a labelled corpus is reconstructed from a pinned commit,
      # and a commit older than that declaration is extracted under whatever
      # this platform does by default. A multi-line string literal then holds
      # different bytes, which is enough to move a finding that sat on the size
      # floor — and the suite reports that as a regression. Extraction and
      # checkout both keep the recorded bytes instead.
      - name: Take the sources as they were committed
        if: runner.os == 'Windows'
        run: git config --global core.autocrlf false
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      # The same prerequisite the CI suite states: the Semantic tests are part
      # of the suite, and they ask a real libclang about real translation
      # units. Both platforms ship one with their developer tools; naming it
      # keeps the suite from quietly measuring less on one of them.
      - name: Locate libclang (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          "LIBCLANG_PATH=$env:ProgramFiles\LLVM\bin" >> $env:GITHUB_ENV
          "$env:ProgramFiles\LLVM\bin" >> $env:GITHUB_PATH
      # Named, because the default shell is the platform's own and one of
      # these platforms answers a shell script by doing nothing at all and
      # reporting success. The suite then measures an empty corpus.
      - name: Materialize the labelled corpora
        shell: bash
        run: corpus/scripts/materialize-labeled.sh
      # Every test binary runs, rather than stopping at the first one that
      # fails. A fault that only shows on one platform is rarely alone, and
      # stopping at the first means meeting the next a full round trip later.
      - name: Test
        run: cargo test --workspace --all-targets --all-features --no-fail-fast

  # Artifact inspection is an optional layer: the clone engine is complete
  # without it, and a tree with nothing built in it is the case that matters.
  # Building real binaries on three operating systems to check that layer is
  # worth doing when it changes or before a release, not on the way to every
  # merge — so these three run when asked for rather than on a push.
  artifact-fixtures:
    name: Artifact fixture end-to-end
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      # The fixture programs are compiled in a scratch directory outside the
      # checkout, where rust-toolchain.toml does not apply. The target has to
      # be added to the toolchain this job pins, which is what the fixtures are
      # built with there — adding it from inside the repository would install
      # it against the toolchain the file selects instead, and leave the one
      # doing the compiling without it.
      - uses: dtolnay/rust-toolchain@1.95.0
        with:
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@v2
      - name: Build and analyse real WASM and ELF fixtures
        run: make verify-artifact-fixtures

  macho-artifact-fixtures:
    name: Mach-O artifact fixture end-to-end
    if: github.event_name == 'workflow_dispatch'
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build and analyse real Mach-O and dSYM fixtures
        run: make verify-macho-artifact-fixtures

  pe-artifact-fixtures:
    name: PE/PDB artifact fixture end-to-end
    if: github.event_name == 'workflow_dispatch'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build and analyse real PE/PDB fixtures
        shell: pwsh
        run: .\scripts\verify-pe-artifact-fixtures.ps1

  coverage:
    name: coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov
      - name: Install Clang and libclang
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends clang libclang-dev libc++-dev libc++abi-dev
      # The labelled precision tests refuse to pass on an empty measurement,
      # so coverage over the suite needs the same sources the suite does.
      - name: Materialize the labelled corpora
        run: corpus/scripts/materialize-labeled.sh
      - name: Collect coverage
        run: cargo llvm-cov --all-features --lcov --output-path lcov.info
      - name: Upload to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: lcov.info
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}