ValidatePullRequest.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Validate Pull Request

on:
  pull_request:
    branches: [main, "release/**"]
  merge_group:

# Cancels old running job if a new one is triggered (e.g. by a push onto the same branch).
# This will cancel dependent jobs as well, such as dep_rust and dep_fuzzing
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true    

permissions:
  contents: write
  pull-requests: read

jobs:
  docs-pr:
    runs-on: ubuntu-latest
    outputs:
      docs-only: ${{ steps.docs-only.outputs.result }}
    steps:
      - uses: dorny/paths-filter@v3
        id: changes
        with:
          filters: |
            docs:
              - '**/*.md'
              - '**/*.txt'
            all:
              - '**/*'
      - uses: actions/github-script@v8
        id: docs-only
        with:
          script: |
            let docs_file_count = ${{steps.changes.outputs.docs_count}};
            let all_file_count = ${{steps.changes.outputs.all_count}};
            return all_file_count === docs_file_count;
          result-encoding: string

  # Update guest Cargo.lock files for Dependabot PRs.
  # Dependabot only updates the root Cargo.lock, leaving the guest crate
  # Cargo.lock files stale. This job updates them before code-checks runs
  # `cargo fetch --locked` so that the first CI run succeeds.
  update-guest-locks:
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    uses: ./.github/workflows/dep_update_guest_locks.yml
    secrets: inherit

  # Build guests once, upload as artifacts for other jobs to download
  build-guests:
    needs: [docs-pr, update-guest-locks]
    # Required because update-guest-locks is skipped on non-dependabot PRs,
    # and a skipped dependency transitively skips all downstream jobs.
    # See: https://github.com/actions/runner/issues/2205
    if: ${{ !cancelled() && !failure() }}
    strategy:
      fail-fast: true
      matrix:
        config: [debug, release]
    uses: ./.github/workflows/dep_build_guests.yml
    secrets: inherit
    with:
      docs_only: ${{ needs.docs-pr.outputs.docs-only }}
      config: ${{ matrix.config }}

  # Code checks (fmt, clippy, MSRV) - runs in parallel with build-guests
  code-checks:
    needs: [docs-pr, update-guest-locks]
    # Required because update-guest-locks is skipped on non-dependabot PRs,
    # and a skipped dependency transitively skips all downstream jobs.
    # See: https://github.com/actions/runner/issues/2205
    if: ${{ !cancelled() && !failure() }}
    uses: ./.github/workflows/dep_code_checks.yml
    secrets: inherit
    with:
      docs_only: ${{ needs.docs-pr.outputs.docs-only }}

  # Build and test - needs guest artifacts
  build-test:
    needs:
      - docs-pr
      - build-guests
    # Required because update-guest-locks is skipped on non-dependabot PRs,
    # and a skipped dependency transitively skips all downstream jobs.
    # See: https://github.com/actions/runner/issues/2205
    if: ${{ !cancelled() && !failure() }}
    strategy:
      fail-fast: true
      matrix:
        hypervisor: [hyperv, 'hyperv-ws2025', mshv3, kvm]
        cpu: [amd, intel]
        config: [debug, release]
    uses: ./.github/workflows/dep_build_test.yml
    secrets: inherit
    with: 
      docs_only: ${{ needs.docs-pr.outputs.docs-only }}
      hypervisor: ${{ matrix.hypervisor }}
      cpu: ${{ matrix.cpu }}
      config: ${{ matrix.config }}

  # Run examples - needs guest artifacts, runs in parallel with build-test
  run-examples:
    needs:
      - docs-pr
      - build-guests
    # Required because update-guest-locks is skipped on non-dependabot PRs,
    # and a skipped dependency transitively skips all downstream jobs.
    # See: https://github.com/actions/runner/issues/2205
    if: ${{ !cancelled() && !failure() }}
    strategy:
      fail-fast: true
      matrix:
        hypervisor: [hyperv, 'hyperv-ws2025', mshv3, kvm]
        cpu: [amd, intel]
        config: [debug, release]
    uses: ./.github/workflows/dep_run_examples.yml
    secrets: inherit
    with: 
      docs_only: ${{ needs.docs-pr.outputs.docs-only }}
      hypervisor: ${{ matrix.hypervisor }}
      cpu: ${{ matrix.cpu }}
      config: ${{ matrix.config }}

  # Run benchmarks - release only, needs guest artifacts, runs in parallel with build-test
  benchmarks:
    needs:
      - docs-pr
      - build-guests
    # Required because update-guest-locks is skipped on non-dependabot PRs,
    # and a skipped dependency transitively skips all downstream jobs.
    # See: https://github.com/actions/runner/issues/2205
    if: ${{ !cancelled() && !failure() }}
    strategy:
      fail-fast: true
      matrix:
        hypervisor: [hyperv, 'hyperv-ws2025', mshv3, kvm]
        cpu: [amd, intel]
    uses: ./.github/workflows/dep_benchmarks.yml
    secrets: inherit
    with: 
      docs_only: ${{ needs.docs-pr.outputs.docs-only }}
      hypervisor: ${{ matrix.hypervisor }}
      cpu: ${{ matrix.cpu }}

  fuzzing:
    needs:
      - docs-pr
      - build-guests
    # Required because update-guest-locks is skipped on non-dependabot PRs,
    # and a skipped dependency transitively skips all downstream jobs.
    # See: https://github.com/actions/runner/issues/2205
    if: ${{ !cancelled() && !failure() }}
    uses: ./.github/workflows/dep_fuzzing.yml
    with:
      targets: '["fuzz_host_print", "fuzz_guest_call", "fuzz_host_call", "fuzz_guest_estimate_trace_event", "fuzz_guest_trace"]' # Pass as a JSON array
      max_total_time: 300 # 5 minutes in seconds
      docs_only: ${{ needs.docs-pr.outputs.docs-only }}
    secrets: inherit

  spelling:
    name: spell check with typos
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - name: Spell Check Repo
      uses: crate-ci/typos@v1.44.0

  license-headers:
    name: check license headers
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - name: Check License Headers
      run: ./dev/check-license-headers.sh

  # Gate PR merges on this specific "join-job" which requires all other
  # jobs to run first.
  report-ci-status:
    needs:
      - docs-pr
      - update-guest-locks
      - build-guests
      - code-checks
      - build-test
      - run-examples
      - benchmarks
      - fuzzing
      - spelling
      - license-headers
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: calculate the correct exit status
        run: jq --exit-status 'all(.result == "success" or .result == "skipped")' <<< '${{ toJson(needs) }}'