main.yml

# This is a basic workflow to help you get started with Actions

name: Component Build & Test CI

# Controls when the workflow will run
on:
  # Triggers the workflow on push or pull request events but only for the develop branch
  push:

  # Allows you to run this workflow manually from the Actions tab
  #workflow_dispatch:

env:
  OPENSUT_BASE_IMAGE_ID: ghcr.io/galoisinc/verse-opensut/opensut-base:latest

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  mps-build:
      runs-on: ubuntu-22.04
      needs: libgpiod
      steps:
        - name: Checkout repository
          uses: actions/checkout@v4
        - name: Checkout submodules
          run: |
              git submodule update --init src/pkvm_setup/libgpiod
        - name: Hash inputs
          id: hash
          run: |
              cache_key="$(bash src/pkvm_setup/package.sh cache_key mps)"
              echo "Cache key: $cache_key"
              echo "CACHE_KEY=$cache_key" >>$GITHUB_OUTPUT
              echo "CACHE_KEY=$cache_key" >>$GITHUB_ENV
        - name: Cache results
          id: cache
          uses: actions/cache@v3
          with:
              key: ${{ env.CACHE_KEY }}
              path: packages/${{ env.CACHE_KEY }}.tar.gz
        - if: ${{ steps.cache.outputs.cache-hit == 'true' }}
          name: "Unpack mps"
          run: |
              tar -xvf packages/${{ env.CACHE_KEY }}.tar.gz
        - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
          name: "Cache restore: libgpiod"
          uses: actions/cache/restore@v3
          with:
              key: ${{ needs.libgpiod.outputs.CACHE_KEY }}
              path: packages/${{ needs.libgpiod.outputs.CACHE_KEY }}.tar.gz
        - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
          name: Install aarch64 toolchain
          run: |
            sudo apt-get update
            sudo apt-get install -y {gcc,g++}-aarch64-linux-gnu
        - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
          name: Install verilator
          run: sudo apt-get install -y verilator
        - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
          name: Build MPS
          run: |
              bash src/pkvm_setup/package.sh full_build mps
        - name: Upload MPS binaries
          uses: actions/upload-artifact@v4
          with:
              name: mps-binaries
              path: components/mission_protection_system/src/mps.*
      outputs:
          CACHE_KEY: ${{ steps.hash.outputs.CACHE_KEY }}

  mps-test:
    runs-on: ubuntu-22.04
    needs: mps-build
    steps:
      - name: Checkout repository and submodules
        uses: actions/checkout@v4
      - name: Download MPS binaries
        uses: actions/download-artifact@v4
        with:
          name: mps-binaries
      - name: Display structure of downloaded files
        run: |
          chmod +x mps.*
          mv mps.* components/mission_protection_system/src/.
      - name: Install pip3
        run: |
          sudo apt-get update
          sudo apt-get install -y python3-pip
      - name: Test MPS
        run: |
          cd components/mission_protection_system/tests
          pip3 install -r requirements.txt
          MPS_DEBUG=1 QUICK=1 python3 ./run_all.py

  trusted-boot-build:
      runs-on: ubuntu-22.04
      steps:
        - name: Checkout repository and submodules
          uses: actions/checkout@v4
        - name: Install aarch64 toolchain
          run: |
            sudo apt-get update
            sudo apt-get install -y {gcc,g++}-aarch64-linux-gnu
        - name: Build trusted_boot
          run: |
            cd components/platform_crypto/shave_trusted_boot/
            make clean
            # Build, then check it created the correct output file.
            make
            [ -f trusted_boot ]
            make TARGET=aarch64
            [ -f trusted_boot.aarch64 ]

  vm_runner:
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v4
    - name: Hash inputs
      id: hash
      run: |
        cache_key="$(bash src/pkvm_setup/package.sh cache_key vm_runner)"
        echo "Cache key: $cache_key"
        echo "CACHE_KEY=$cache_key" >>$GITHUB_OUTPUT
        echo "CACHE_KEY=$cache_key" >>$GITHUB_ENV
    - name: Cache results
      id: cache
      uses: actions/cache@v3
      with:
        key: ${{ env.CACHE_KEY }}
        path: packages/${{ env.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Install aarch64 toolchain
      run: |
        sudo apt-get update
        sudo apt-get install -y gcc-aarch64-linux-gnu
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      uses: hecrj/setup-rust-action@v2
      with:
        rust-version: 1.74
        targets: aarch64-unknown-linux-gnu
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Build VM runner
      run: |
        bash src/pkvm_setup/package.sh full_build vm_runner
    outputs:
      CACHE_KEY: ${{ steps.hash.outputs.CACHE_KEY }}

  libgpiod:
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v4
    - name: Checkout submodules
      run: |
        git submodule update --init src/pkvm_setup/libgpiod
    - name: Hash inputs
      id: hash
      run: |
        cache_key="$(bash src/pkvm_setup/package.sh cache_key libgpiod)"
        echo "Cache key: $cache_key"
        echo "CACHE_KEY=$cache_key" >>$GITHUB_OUTPUT
        echo "CACHE_KEY=$cache_key" >>$GITHUB_ENV
    - name: Cache results
      id: cache
      uses: actions/cache@v3
      with:
        key: ${{ env.CACHE_KEY }}
        path: packages/${{ env.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Install dependency packages
      run: |
        sudo apt-get update
        sudo apt-get install -y \
          build-essential autoconf automake autoconf-archive \
          gcc-aarch64-linux-gnu
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Build libgpiod
      run: |
        bash src/pkvm_setup/package.sh full_build libgpiod
    outputs:
      CACHE_KEY: ${{ steps.hash.outputs.CACHE_KEY }}

  vhost_device:
    runs-on: ubuntu-22.04
    needs: libgpiod
    steps:
    - uses: actions/checkout@v4
    - name: Checkout submodules
      run: |
        git config --global url."https://galoisactions:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
        git submodule update --init src/pkvm_setup/libgpiod
        git submodule update --init src/pkvm_setup/vhost-device
    - name: Hash inputs
      id: hash
      run: |
        cache_key="$(bash src/pkvm_setup/package.sh cache_key vhost_device)"
        echo "Cache key: $cache_key"
        echo "CACHE_KEY=$cache_key" >>$GITHUB_OUTPUT
        echo "CACHE_KEY=$cache_key" >>$GITHUB_ENV
    - name: Cache results
      id: cache
      uses: actions/cache@v3
      with:
        key: ${{ env.CACHE_KEY }}
        path: packages/${{ env.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: libgpiod"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.libgpiod.outputs.CACHE_KEY }}
        path: packages/${{ needs.libgpiod.outputs.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Install dependency packages
      run: |
        sudo apt-get update
        sudo apt-get install -y \
          build-essential autoconf automake autoconf-archive \
          gcc-aarch64-linux-gnu
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      uses: hecrj/setup-rust-action@v2
      with:
        rust-version: 1.74
        targets: aarch64-unknown-linux-gnu
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Build vhost-device
      run: |
        # This must match the `rust-version` installed above.
        export RUSTUP_TOOLCHAIN=1.74
        bash src/pkvm_setup/package.sh full_build vhost_device
    outputs:
      CACHE_KEY: ${{ steps.hash.outputs.CACHE_KEY }}

  pkvm:
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v4
    - name: Checkout submodules
      run: |
        git submodule update --init src/pkvm_setup/linux-pkvm
    - name: Hash inputs
      id: hash
      run: |
        cache_key="$(bash src/pkvm_setup/package.sh cache_key pkvm)"
        echo "Cache key: $cache_key"
        echo "CACHE_KEY=$cache_key" >>$GITHUB_OUTPUT
        echo "CACHE_KEY=$cache_key" >>$GITHUB_ENV
    - name: Cache results
      id: cache
      uses: actions/cache@v3
      with:
        key: ${{ env.CACHE_KEY }}
        path: packages/${{ env.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Fetch from Artifactory
      run: |
        bash src/pkvm_setup/package.sh download pkvm \
          -u "${{ secrets.ARTIFACTORY_RDE_GENERIC_USERNAME }}:${{ secrets.ARTIFACTORY_RDE_GENERIC_ACCESS_TOKEN }}"
    outputs:
      CACHE_KEY: ${{ steps.hash.outputs.CACHE_KEY }}

  qemu:
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v4
    - name: Checkout submodules
      run: |
        git config --global url."https://galoisactions:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
        git submodule update --init src/pkvm_setup/qemu
    - name: Hash inputs
      id: hash
      run: |
        cache_key="$(bash src/pkvm_setup/package.sh cache_key qemu)"
        echo "Cache key: $cache_key"
        echo "CACHE_KEY=$cache_key" >>$GITHUB_OUTPUT
        echo "CACHE_KEY=$cache_key" >>$GITHUB_ENV
    - name: Cache results
      id: cache
      uses: actions/cache@v3
      with:
        key: ${{ env.CACHE_KEY }}
        path: packages/${{ env.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Fetch from Artifactory
      run: |
        bash src/pkvm_setup/package.sh download qemu \
          -u "${{ secrets.ARTIFACTORY_RDE_GENERIC_USERNAME }}:${{ secrets.ARTIFACTORY_RDE_GENERIC_ACCESS_TOKEN }}"
    outputs:
      CACHE_KEY: ${{ steps.hash.outputs.CACHE_KEY }}

  vm_image_base:
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v4
    - name: Hash inputs
      id: hash
      run: |
        cache_key="$(bash src/pkvm_setup/package.sh cache_key vm_image_base)"
        echo "Cache key: $cache_key"
        echo "CACHE_KEY=$cache_key" >>$GITHUB_OUTPUT
        echo "CACHE_KEY=$cache_key" >>$GITHUB_ENV
    - name: Cache results
      id: cache
      uses: actions/cache@v3
      with:
        key: ${{ env.CACHE_KEY }}
        path: packages/${{ env.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Fetch from Artifactory
      run: |
        bash src/pkvm_setup/package.sh download vm_image_base \
          -u "${{ secrets.ARTIFACTORY_RDE_GENERIC_USERNAME }}:${{ secrets.ARTIFACTORY_RDE_GENERIC_ACCESS_TOKEN }}"
    outputs:
      CACHE_KEY: ${{ steps.hash.outputs.CACHE_KEY }}

  vm_images:
    runs-on: ubuntu-22.04
    needs:
    - vm_runner
    - vhost_device
    - pkvm
    - qemu
    - vm_image_base
    steps:
    - uses: actions/checkout@v4
    - name: Checkout submodules
      run: |
        git config --global url."https://galoisactions:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
        git submodule update --init src/pkvm_setup/libgpiod
        git submodule update --init src/pkvm_setup/vhost-device
        git submodule update --init src/pkvm_setup/linux-pkvm
        git submodule update --init src/pkvm_setup/qemu
    - name: Hash inputs
      id: hash
      run: |
        cache_key="$(bash src/pkvm_setup/package.sh cache_key vm_images)"
        echo "Cache key: $cache_key"
        echo "CACHE_KEY=$cache_key" >>$GITHUB_OUTPUT
        echo "CACHE_KEY=$cache_key" >>$GITHUB_ENV
    - name: Cache results
      id: cache
      uses: actions/cache@v3
      with:
        key: ${{ env.CACHE_KEY }}
        path: packages/${{ env.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: vm_runner"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.vm_runner.outputs.CACHE_KEY }}
        path: packages/${{ needs.vm_runner.outputs.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: vhost_device"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.vhost_device.outputs.CACHE_KEY }}
        path: packages/${{ needs.vhost_device.outputs.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: pkvm"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.pkvm.outputs.CACHE_KEY }}
        path: packages/${{ needs.pkvm.outputs.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: qemu"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.qemu.outputs.CACHE_KEY }}
        path: packages/${{ needs.qemu.outputs.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: vm_image_base"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.vm_image_base.outputs.CACHE_KEY }}
        path: packages/${{ needs.vm_image_base.outputs.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Install dependency packages
      run: |
        sudo apt-get update
        sudo apt-get install -y qemu-system-arm qemu-utils
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: Build VM images
      run: |
        bash src/pkvm_setup/package.sh full_build vm_images
    outputs:
      CACHE_KEY: ${{ steps.hash.outputs.CACHE_KEY }}

  mps-test-vm:
    # Other jobs use Ubuntu 22.04, but that release has an old version of QEMU
    # (6.2) and doesn't support vhost-user-gpio devices.
    runs-on: ubuntu-24.04
    needs:
    - mps-build
    - vm_images
    - vhost_device
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
    - name: Download MPS binaries
      uses: actions/download-artifact@v4
      with:
        name: mps-binaries
    - name: Prepare MPS binaries for use
      run: |
        chmod +x mps.*
        mv mps.* components/mission_protection_system/src/.
    - name: "Cache restore: vm_images"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.vm_images.outputs.CACHE_KEY }}
        path: packages/${{ needs.vm_images.outputs.CACHE_KEY }}.tar.gz
    - name: "Cache restore: vhost_device"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.vhost_device.outputs.CACHE_KEY }}
        path: packages/${{ needs.vhost_device.outputs.CACHE_KEY }}.tar.gz
    - name: "Unpack vm_images"
      run: |
        tar -xvf packages/${{ needs.vm_images.outputs.CACHE_KEY }}.tar.gz
    - name: "Unpack vhost_device"
      run: |
        tar -xvf packages/${{ needs.vhost_device.outputs.CACHE_KEY }}.tar.gz
    - name: Install QEMU
      run: |
        sudo apt-get update
        sudo apt-get install -y qemu-system-arm
    - uses: hecrj/setup-rust-action@v2
      with:
        rust-version: 1.74
    - name: Run MPS tests
      run: RUST_LOG=trace MPS_DEBUG=1 python3 src/vm_runner/tests/mps/run_tests.py

  ardupilot:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Checkout submodules
        run: |
            git config --global url."https://galoisactions:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
            git submodule update --init components/autopilot/ardupilot
      - name: Hash inputs
        id: hash
        run: |
            cache_key="$(bash src/pkvm_setup/package.sh cache_key ardupilot)"
            echo "Cache key: $cache_key"
            echo "CACHE_KEY=$cache_key" >>$GITHUB_OUTPUT
            echo "CACHE_KEY=$cache_key" >>$GITHUB_ENV
      - name: Cache results
        id: cache
        uses: actions/cache@v3
        with:
            key: ${{ env.CACHE_KEY }}
            path: packages/${{ env.CACHE_KEY }}.tar.gz
      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
        name: Install dependencies
        run: |
          sudo apt-get update
          BUILD_ONLY=1 bash components/autopilot/ardupilot_install_deps.sh
      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
        name: Fetch additional submodules for build
        run: |
          bash components/autopilot/ardupilot_init_submodules.sh
      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
        name: Build ArduPilot
        run: |
            bash src/pkvm_setup/package.sh full_build ardupilot
    outputs:
        CACHE_KEY: ${{ steps.hash.outputs.CACHE_KEY }}

  jsbsim_proxy:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      # jsbsim_proxy is trivial to build, so we don't bother packaging or
      # caching it.
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt install build-essential
      - name: Build jsbsim_proxy
        run: |
            cd src/jsbsim_proxy
            make
            [ -f jsbsim_proxy ]

  opensut-base:
    runs-on: ubuntu-latest
    needs:
    - mps-build
    - vm_images
    - vm_runner
    - vhost_device
    - ardupilot
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
    - name: Cache results
      id: cache
      uses: actions/cache@v3
      with:
        key: ${{ env.CACHE_KEY }}
        path: packages/${{ env.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: vm_runner"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.vm_runner.outputs.CACHE_KEY }}
        path: packages/${{ needs.vm_runner.outputs.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: vhost_device"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.vhost_device.outputs.CACHE_KEY }}
        path: packages/${{ needs.vhost_device.outputs.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: pkvm"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.pkvm.outputs.CACHE_KEY }}
        path: packages/${{ needs.pkvm.outputs.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: qemu"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.qemu.outputs.CACHE_KEY }}
        path: packages/${{ needs.qemu.outputs.CACHE_KEY }}.tar.gz
    - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
      name: "Cache restore: vm_image_base"
      uses: actions/cache/restore@v3
      with:
        key: ${{ needs.vm_image_base.outputs.CACHE_KEY }}
        path: packages/${{ needs.vm_image_base.outputs.CACHE_KEY }}.tar.gz
    - name: Login to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.VERSE_OPENSUT_ACCESS_TOKEN }}
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Build and push
      uses: docker/build-push-action@v6
      with:
        platforms: linux/amd64
        tags: ${{env.OPENSUT_BASE_IMAGE_ID}}
        file: Dockerfile
        github-token: ${{ secrets.VERSE_OPENSUT_ACCESS_TOKEN }}
        push: true