basic.yml

name: Basic checks

permissions:
  contents: read

on: [workflow_call, workflow_dispatch]

jobs:
  workflowcheck:
    name: Check validity of GitHub workflows
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v4
      - name: Install actionlint
        run: |
          bash <(curl -sSL https://raw.githubusercontent.com/rhysd/actionlint/2ab3a12c7848f6c15faca9a92612ef4261d0e370/scripts/download-actionlint.bash)
          sudo mv ./actionlint /usr/local/bin/
      - name: Ensure GitHub actions are valid
        run: actionlint -shellcheck "" # run *without* shellcheck

  stylecheck:
    name: Check code formatting
    needs: [workflowcheck]
    runs-on: ubuntu-latest
    container: openquantumsafe/ci-ubuntu-latest:latest
    permissions:
      contents: read
      actions: write  # required to cancel the run on failure (fail-fast)
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v4
      - name: Ensure the build system can reach everything that ships
        run: python3 -m pytest --verbose tests/test_cmake_option_coverage.py tests/test_kats_json.py
      - name: Ensure code conventions are upheld
        run: python3 -m pytest --verbose tests/test_code_conventions.py
      - name: Check that doxygen can parse the documentation
        run: mkdir build && ./scripts/run_doxygen.sh $(which doxygen) ./docs/.Doxyfile ./build
      - name: Validate CBOM
        run: scripts/validate_cbom.sh
      - name: Cancel run on failure (fail-fast across jobs)
        if: failure()
        run: gh run cancel ${{ github.run_id }}
        env:
          GH_TOKEN: ${{ github.token }}

  markdownlint:
    name: Check Markdown documentation
    needs: [workflowcheck]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v4
      - name: Install rumdl
        run: |
          python3 -m pip install --user -r requirements-linter.txt
      - name: Ensure Markdown conventions are upheld
        run: ~/.local/bin/rumdl check --config .rumdl.toml --respect-gitignore --exclude "build,**/build" .

  upstreamcheck:
    name: Check default upstream code is properly integrated
    needs: [workflowcheck]
    runs-on: ubuntu-latest
    container: openquantumsafe/ci-ubuntu-latest:latest
    permissions:
      contents: read
      actions: write  # required to cancel the run on failure (fail-fast)
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v4
      - name: Configure
        run: |
          git config --global user.name "ciuser" && \
          git config --global user.email "ci@openquantumsafe.org" && \
          git config --global --add safe.directory "$PWD" && \
          echo "LIBOQS_DIR=$PWD" >> "$GITHUB_ENV"
      - name: Verify copy_from_upstream state after copy
        working-directory: "scripts/copy_from_upstream"
        run: |
          python3 copy_from_upstream.py -d copy && \
          git status --porcelain && \
          test -z "$(git status --porcelain)"
      - name: Cancel run on failure (fail-fast across jobs)
        if: failure()
        run: gh run cancel ${{ github.run_id }}
        env:
          GH_TOKEN: ${{ github.token }}

  buildcheck:
    name: Check that code passes a basic build
    needs: [workflowcheck]
    runs-on: ubuntu-latest
    container: openquantumsafe/ci-ubuntu-latest:latest
    env:
      KEM_NAME: ml_kem_768
      SIG_NAME: ml_dsa_65
    steps:
      - name: Create random build folder
        run: tmp_build=$(mktemp -d) && echo "RANDOM_BUILD_DIR=$tmp_build" >> $GITHUB_ENV
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v4
      - name: Configure
        run: |
          cmake \
            -B ${{ env.RANDOM_BUILD_DIR }} \
            -GNinja \
            -DOQS_STRICT_WARNINGS=ON \
            -DOQS_MINIMAL_BUILD="KEM_$KEM_NAME;SIG_$SIG_NAME" \
            --warn-uninitialized . > config.log 2>&1 && \
          cat config.log && \
          cmake -LA -N . && \
          ! (grep -i "uninitialized variable" config.log)
      - name: Build code
        run: ninja
        working-directory: ${{ env.RANDOM_BUILD_DIR }}
      - name: Build documentation
        run: ninja gen_docs
        working-directory: ${{ env.RANDOM_BUILD_DIR }}

  cppcheck:
    name: Check C++ linking with example program
    needs: [workflowcheck]
    runs-on: ubuntu-latest
    container: openquantumsafe/ci-ubuntu-latest:latest
    permissions:
      contents: read
      actions: write  # required to cancel the run on failure (fail-fast)
    env:
      SIG_NAME: ml_dsa_44
    steps:
      - name: Create random build folder
        run: tmp_build=$(mktemp -d) && echo "RANDOM_BUILD_DIR=$tmp_build" >> $GITHUB_ENV
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v4
      - name: Configure
        run: |
          cmake \
            -B ${{ env.RANDOM_BUILD_DIR }} \
            -GNinja \
            -DOQS_STRICT_WARNINGS=ON \
            -DOQS_MINIMAL_BUILD="SIG_$SIG_NAME" \
            --warn-uninitialized . > config.log 2>&1 && \
          cat config.log && \
          cmake -LA -N . && \
          ! (grep -i "uninitialized variable" config.log)
      - name: Build liboqs
        run: ninja
        working-directory: ${{ env.RANDOM_BUILD_DIR }}
      - name: Link with C++ program
        run: |
          g++ "$GITHUB_WORKSPACE"/cpp/sig_linking_test.cpp -g \
          -I./include -L./lib -loqs -lcrypto -std=c++11 -o example_sig && \
          ./example_sig
        working-directory: ${{ env.RANDOM_BUILD_DIR }}
      - name: Cancel run on failure (fail-fast across jobs)
        if: failure()
        run: gh run cancel ${{ github.run_id }}
        env:
          GH_TOKEN: ${{ github.token }}

  fuzzbuildcheck:
    name: Check that code passes a basic fuzzing build
    needs: [workflowcheck]
    runs-on: ubuntu-latest
    container: openquantumsafe/ci-ubuntu-latest:latest
    env:
      SIG_NAME: ml_dsa_44
      CC: clang
      CXX: clang++
      CFLAGS: -fsanitize=fuzzer-no-link,address
      LDFLAGS: -fsanitize=address
    steps:
      - name: Create random build folder
        run: tmp_build=$(mktemp -d) && echo "RANDOM_BUILD_DIR=$tmp_build" >> $GITHUB_ENV
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v4
      - name: Configure
        run: |
          cmake \
            -B ${{ env.RANDOM_BUILD_DIR }} \
            -GNinja \
            -DOQS_STRICT_WARNINGS=ON \
            -DOQS_BUILD_FUZZ_TESTS=ON \
            -DOQS_MINIMAL_BUILD="SIG_$SIG_NAME" \
            --warn-uninitialized . > config.log 2>&1 && \
          cat config.log && \
          cmake -LA -N . && \
          ! (grep -i "uninitialized variable" config.log)
      - name: Build code
        run: ninja fuzz_test_sig
        working-directory: ${{ env.RANDOM_BUILD_DIR }}

      - name: Short fuzz check (30s)
        run: ./tests/fuzz_test_sig -max_total_time=30
        working-directory: ${{ env.RANDOM_BUILD_DIR }}

  nixflakecheck:
    name: Check that Nix flake has correct syntax and can build
    needs: [workflowcheck]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v4
      - name: Check devShell
        run: nix develop --command echo
      - name: Check flake syntax
        run: nix flake check --no-build
      - name: Check that the flake builds (2 algs)
        # Uses the lightweight .#ci package (OQS_MINIMAL_BUILD, 1 KEM + 1
        # SIG = 2 algorithms) instead of the default (OQS_DIST_BUILD=ON, all ~330+
        # algorithms).
        run: nix build .#ci