main.yml

name: CI

on:
  merge_group:
  pull_request:
    branches: [main, "release-*"]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

# this is needed to gain access via OIDC to the S3 bucket for caching
permissions:
  id-token: write
  contents: read

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  RISC0_TOOLCHAIN_VERSION: v2024-04-22.0

defaults:
  run:
    # This ensures `-eo pipefail`, which is important for catching errors
    shell: bash

jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      browser: ${{ steps.filter.outputs.browser }}
      check-external: ${{ steps.filter.outputs.check-external }}
      check-semver: ${{ steps.filter.outputs.check-semver }}
      check-template: ${{ steps.filter.outputs.check-template }}
      crates-validator: ${{ steps.filter.outputs.crates-validator }}
      doc: ${{ steps.filter.outputs.doc }}
      examples: ${{ steps.filter.outputs.examples }}
      risc0: ${{ steps.filter.outputs.risc0 }}
      test: ${{ steps.filter.outputs.test }}
      test-crates: ${{ steps.filter.outputs.test-crates }}
      web: ${{ steps.filter.outputs.web }}
    steps:
      - uses: actions/checkout@v4
      - uses: risc0/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
        id: filter
        with:
          filters: |
            base: &base
              - .github/actions/**
              - .github/workflows/main.yml
              - Cargo.toml
              - rust-toolchain.toml
              - Cargo.lock
            browser:
              - *base
              - examples/browser-verify/**
              - risc0/**
              - xtask/**
            check-external:
              - *base
              - external/**
              - risc0/**
            check-semver:
              - *base
              - risc0/**
            check-template:
              - *base
              - risc0/**
              - templates/**
            crates-validator:
              - *base
              - tools/crates-validator/**
            doc:
              - *base
              - bonsai/sdk/**
              - risc0/**
            examples:
              - *base
              - examples/**
              - risc0/**
            risc0:
              - *base
              - risc0/**
            test:
              - *base
              - bonsai/sdk/**
              - compact_proof/**
              - external/**
              - risc0/**
            test-crates:
              - *base
              - risc0/**
            web:
              - web/**

  # see: https://github.com/orgs/community/discussions/26822
  main-status-check:
    if: always()
    needs:
      - browser
      - check
      - check-external
      - check-template
      - clippy
      - crates-validator
      - doc
      - docs-rs
      - examples
      - docker
      - test
      # - test-crates
      - web
    runs-on: ubuntu-latest
    steps:
      - name: Check all job status
        # see https://docs.github.com/en/actions/reference/context-and-expression-syntax-for-github-actions#needs-context
        # see https://stackoverflow.com/a/67532120/4907315
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
        run: exit 1

  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # Full history is required by license-check.py
          fetch-depth: 0
      - uses: ./.github/actions/rustup
      - name: Install cargo-sort
        uses: risc0/cargo-install@9f6037ed331dcf7da101461a20656273fa72abf0
        with:
          crate: cargo-sort
          version: "1.0"
      - name: Install cargo-rdme
        uses: risc0/cargo-install@9f6037ed331dcf7da101461a20656273fa72abf0
        with:
          crate: cargo-rdme
          version: "1.4.3"
      - uses: actions/setup-node@v4
        with:
          node-version: 18
      - run: cargo fmt --all --check
      - run: cargo fmt --all --check --manifest-path benchmarks/Cargo.toml
      - run: cargo fmt --all --check --manifest-path examples/Cargo.toml
      - run: cargo fmt --all --check --manifest-path tools/crates-validator/Cargo.toml
      - run: cargo sort --workspace --check
      - run: cargo sort --workspace --check benchmarks
      - run: cargo sort --workspace --check examples
      - run: cargo sort --workspace --check tools/crates-validator
      - name: cargo rdme in bonsai/sdk
        run: cargo rdme -c
        working-directory: bonsai/sdk
      - name: cargo rdme in risc0/zkvm
        run: cargo rdme -c
        working-directory: risc0/zkvm
      - name: cargo rdme in risc0/groth16
        run: cargo rdme -c
        working-directory: risc0/groth16
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - run: python license-check.py
      - name: check for "D0 NOT MERGE" comments
        run: |
          [ "$(grep -re 'DO[_ ]\?NOT[_ ]\?MERGE' $(git ls-tree --full-tree --name-only -r HEAD) | tee /dev/fd/2 | wc -l)" -eq "0" ]
      - name: Compare circom hashes to golden values
        run: bash ./.github/scripts/circom_stable.sh

  clippy:
    if: needs.changes.outputs.risc0 == 'true'
    needs: changes
    runs-on: [self-hosted, prod, "${{ matrix.os }}"]
    strategy:
      fail-fast: false
      matrix:
        os: [Linux, macOS]
        feature: [default]
        device: [cpu]
        include:
          - os: Linux
            feature: cuda
          - os: macOS
            feature: metal
    env:
      FEATURE: ${{ matrix.feature }}
    steps:
      - uses: actions/checkout@v4
      - if: matrix.feature == 'cuda'
        uses: ./.github/actions/cuda
      - uses: ./.github/actions/rustup
      - uses: ./.github/actions/sccache
        with:
          key: ${{ matrix.os }}-${{ matrix.feature }}
      - run: python3 -u clippy.py -F $FEATURE

  test:
    if: needs.changes.outputs.test == 'true'
    needs: changes
    runs-on: [self-hosted, prod, "${{ matrix.os }}", "${{ matrix.device }}"]
    strategy:
      fail-fast: false
      matrix:
        os: [Linux, macOS]
        feature: [default]
        device: [cpu]
        include:
          - os: Linux
            feature: cuda
            device: nvidia_rtx_a5000
          - os: macOS
            feature: metal
            device: apple_m2_pro
    env:
      FEATURE: ${{ matrix.feature }}
      RISC0_BUILD_LOCKED: 1
      RUST_BACKTRACE: full
    steps:
      - uses: actions/checkout@v4
      - if: matrix.feature == 'cuda'
        uses: ./.github/actions/cuda
      - uses: ./.github/actions/rustup
      - uses: ./.github/actions/sccache
        with:
          key: ${{ matrix.os }}-${{ matrix.feature }}
      - run: cargo run --bin cargo-risczero --no-default-features -- risczero install --version $RISC0_TOOLCHAIN_VERSION
      - name: build workspace
        run: cargo test -F $FEATURE -F prove --workspace --timings --no-run --exclude doc-test
      - name: test workspace
        run: cargo test -F $FEATURE -F prove --workspace --timings --exclude doc-test
      - uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-${{ matrix.os }}-${{ matrix.device }}
          path: target/cargo-timings/
          retention-days: 5
      - name: build risc0-r0vm
        run: cargo test -p risc0-r0vm -F $FEATURE -F disable-dev-mode --no-run
      - name: build risc0-zkvm tests without the prove feature
        run: cargo test -p risc0-zkvm -F $FEATURE --no-run
      - name: test risc0-r0vm
        run: cargo test -p risc0-r0vm -F $FEATURE -F disable-dev-mode
      - run: cargo test -p cargo-risczero -F experimental
        if: matrix.device == 'cpu'
      - run: cargo run -F $FEATURE -- fibonacci
        working-directory: benchmarks
      - run: cargo run -F $FEATURE -F prove --example datasheet -- --json tmp/datasheet.json lift
      - run: cargo check -F $FEATURE --benches --workspace --exclude doc-test
      - run: cargo check -p risc0-build
        if: matrix.device == 'cpu'
      - run: cargo check -p risc0-circuit-rv32im -F $FEATURE
      - run: cargo check -p risc0-core
        if: matrix.device == 'cpu'
      - run: cargo check -p risc0-sys -F $FEATURE
      - run: cargo check -p risc0-zkp -F $FEATURE
      - run: cargo check -p risc0-zkvm -F $FEATURE
      - run: sccache --show-stats

  examples:
    if: needs.changes.outputs.examples == 'true'
    needs: changes
    runs-on: [self-hosted, prod, "${{ matrix.os }}", "${{ matrix.device }}"]
    strategy:
      fail-fast: false
      matrix:
        os: [Linux, macOS]
        feature: [default]
        device: [cpu]
        include:
          - os: Linux
            feature: cuda
            device: nvidia_rtx_a5000
          - os: macOS
            feature: metal
            device: apple_m2_pro
    env:
      FEATURE: ${{ matrix.feature }}
      RISC0_BUILD_LOCKED: 1
      RISC0_EXECUTOR: ipc
      RISC0_PROVER: ipc
      RISC0_SERVER_PATH: ${{ github.workspace }}/target/release/r0vm
      RUST_BACKTRACE: full
    steps:
      - uses: actions/checkout@v4
      - if: matrix.feature == 'cuda'
        uses: ./.github/actions/cuda
      - uses: ./.github/actions/rustup
      - uses: ./.github/actions/sccache
        with:
          key: ${{ matrix.os }}-${{ matrix.feature }}
      - run: cargo run --bin cargo-risczero --no-default-features -- risczero install --version $RISC0_TOOLCHAIN_VERSION
      - run: cargo build --release -p risc0-r0vm -F $FEATURE
      - name: build
        run: cargo test --locked -F $FEATURE --no-run
        working-directory: examples
      - name: test
        run: RISC0_DEV_MODE=1 cargo test --locked -F $FEATURE
        working-directory: examples
      - run: cargo run --locked -F $FEATURE
        env:
          RISC0_PPROF_OUT: ${{ github.workspace }}/fibonacci.pb
        working-directory: examples/profiling
      - run: sccache --show-stats

  # test-crates:
  #   if: needs.changes.outputs.test-crates == 'true'
  #   needs: changes
  #   runs-on: [self-hosted, prod, Linux, cpu]
  #   strategy:
  #     fail-fast: false
  #   steps:
  #     - uses: actions/checkout@v4
  #       with:
  #         path: 'risc0'
  #     - uses: actions/checkout@v4
  #       with:
  #         repository: risc0/RustCrypto-crypto-bigint
  #         path: 'RustCrypto-crypto-bigint'
  #     - uses: ./risc0/.github/actions/rustup
  #     - uses: ./risc0/.github/actions/sccache
  #       with:
  #         key: Linux-default
  #     - name: Install risczero toolchain
  #       run: |
  #         cargo run --bin cargo-risczero --no-default-features -- risczero install --version $RISC0_TOOLCHAIN_VERSION
  #         cargo install --force --path risc0/cargo-risczero -F experimental
  #       working-directory: risc0
  #     - name: run cargo risczero test
  #       working-directory: ${{ github.workspace }}/RustCrypto-crypto-bigint
  #       run: cargo risczero test
  #     - run: sccache --show-stats

  doc:
    if: needs.changes.outputs.doc == 'true'
    needs: changes
    runs-on: [self-hosted, prod, macOS, cpu]
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/rustup
      - uses: ./.github/actions/sccache
        with:
          key: macOS-default
      - run: cargo run --bin cargo-risczero --no-default-features -- risczero install --version $RISC0_TOOLCHAIN_VERSION
      - run: cargo doc --no-deps --exclude=risc0-zkvm-methods --workspace
      - run: sccache --show-stats

  # Run as a separate job because we need to install a different set of tools.
  # In particular, it uses nightly Rust and _does not_ install cargo risczero.
  docs-rs:
    if: needs.changes.outputs.doc == 'true'
    needs: changes
    runs-on: [self-hosted, prod, macOS, cpu]
    env:
      RUSTDOCFLAGS: "--cfg docsrs -D warnings"
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/rustup
        with:
          # Building with docs.rs config requires the nightly toolchain.
          toolchain: nightly
      - uses: ./.github/actions/sccache
        with:
          key: macOS-nightly
      - run: cargo +nightly doc -p risc0-zkvm -Fclient,prove,getrandom,std --no-deps
      - run: cargo +nightly doc -p risc0-zkp -Fprove,std --no-deps
      - run: cargo +nightly doc -p cargo-risczero -Fdocker,r0vm --no-deps
      - run: cargo +nightly doc -p risc0-binfmt -p risc0-core -p risc0-groth16 -p risc0-zkvm-platform --all-features  --no-deps
      - run: sccache --show-stats

  check-external:
    if: needs.changes.outputs.check-external == 'true'
    needs: changes
    runs-on: [self-hosted, prod, macOS, cpu]
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/rustup
      - uses: ./.github/actions/sccache
        with:
          key: macOS-default
      - run: cargo check
        working-directory: external/substrate
      - run: sccache --show-stats

  check-semver:
    if: needs.changes.outputs.check-semver == 'true'
    needs: changes
    runs-on: [self-hosted, prod, cpu, "${{ matrix.os }}"]
    strategy:
      fail-fast: false
      matrix:
        os: [Linux, macOS]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: ./.github/actions/rustup
      - uses: ./.github/actions/sccache
        with:
          key: ${{ matrix.os }}-default
      - name: Install cargo-semver-checks
        uses: risc0/cargo-install@9f6037ed331dcf7da101461a20656273fa72abf0
        with:
          crate: cargo-semver-checks
          version: "0.31.0"
      - name: run cargo semverchecks on ${{ github.event.pull_request.base.sha }}
        # There seems to be a bug in cargo-semver-checks that can't locate the platform crate...
        # All other excluded crates aren't published and therefore do not need this check
        run: |
          cargo semver-checks --default-features --baseline-rev ${{ github.event.pull_request.base.sha }} \
            --exclude risc0-zkvm-platform \
            --exclude doc-test \
            --exclude fibonacci-methods \
            --exclude risc0-zkvm-receipts \
            --exclude risc0-zkvm-methods
      - run: sccache --show-stats

  check-template:
    if: needs.changes.outputs.check-template == 'true'
    needs: changes
    runs-on: [self-hosted, prod, cpu, "${{ matrix.os }}"]
    strategy:
      fail-fast: false
      matrix:
        os: [Linux, macOS]
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/rustup
      - uses: ./.github/actions/sccache
        with:
          key: ${{ matrix.os }}-default
      - run: cargo install --force --path risc0/cargo-risczero
      - run: cargo risczero install --version $RISC0_TOOLCHAIN_VERSION
      - run: |
          cargo risczero new \
            --path $(pwd) \
            --dest ${{ runner.temp }} \
            --guest-name test_method \
            template-test
        shell: bash
      - run: cargo run --release --manifest-path ${{ runner.temp }}/template-test/Cargo.toml
      - run: ${{ runner.temp }}/template-test/target/release/host
      - run: sccache --show-stats

  crates-validator:
    if: needs.changes.outputs.crates-validator == 'true'
    needs: changes
    runs-on: [self-hosted, prod, macOS, cpu]
    env:
      RISC0_BUILD_LOCKED: 1
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/rustup
      - uses: ./.github/actions/sccache
        with:
          key: macOS-default
      - run: cargo test
        working-directory: tools/crates-validator
      - run: sccache --show-stats

  browser:
    if: needs.changes.outputs.browser == 'true'
    needs: changes
    runs-on: [self-hosted, prod, Linux, cpu]
    env:
      RISC0_BUILD_LOCKED: 1
    steps:
      - uses: actions/checkout@v4
      - uses: browser-actions/setup-firefox@v1
      - run: firefox --version
      - uses: ./.github/actions/rustup
      - uses: actions/setup-node@v4
        with:
          node-version: 18
      - uses: ./.github/actions/sccache
        with:
          key: Linux-default
      - run: cargo run --bin cargo-risczero --no-default-features -- risczero install --version $RISC0_TOOLCHAIN_VERSION
      - run: cargo xtask install
      - run: cargo xtask gen-receipt
      - run: |
          npm install
          npm test -- --firefox
        working-directory: examples/browser-verify
      - run: sccache --show-stats

  docker:
    if: needs.changes.outputs.test == 'true'
    needs: changes
    runs-on: [self-hosted, prod, Linux, cpu, docker]
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true
      - run: git lfs pull
      - uses: ./.github/actions/rustup
      - uses: ./.github/actions/sccache
        with:
          key: Linux-default
      - run: cargo run --bin cargo-risczero --no-default-features -- risczero install --version $RISC0_TOOLCHAIN_VERSION
      - run: cargo test -p risc0-build -F docker
      - run: cargo test -p risc0-groth16 -F prove --release
      - run: cargo test -p risc0-zkvm -F docker -F prove -- docker
        env:
          RISC0_USE_DOCKER: "1"
      - run: sccache --show-stats

  web:
    if: needs.changes.outputs.web == 'true'
    needs: changes
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v1
      - run: bun install
        working-directory: web
      - run: bun run ci
        working-directory: web
      - run: bun run typecheck
        working-directory: web
      - run: bun run test
        working-directory: web