1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
name: Randomness battery (PractRand)
# Streams the AES-CTR generator into PractRand to a bounded volume. Runs on
# every push/PR and is individually runnable. The deep (multi-seed + dieharder,
# to 256GB+) battery lives in heavy-assurance.yml.
on:
workflow_dispatch:
push:
branches:
pull_request:
permissions:
contents: read
concurrency:
group: randomness-${{ github.ref }}
cancel-in-progress: true
jobs:
randomness-battery:
name: randomness battery (PractRand)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable as of 2026-06-11
with:
toolchain: stable
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Build PractRand
run: |
set -euo pipefail
git clone --depth 1 https://github.com/MartyMacGyver/PractRand.git /tmp/practrand
cd /tmp/practrand
g++ -std=c++14 -O2 -Iinclude -pthread -c src/*.cpp src/RNGs/*.cpp src/RNGs/other/*.cpp
g++ -std=c++14 -O2 -Iinclude -pthread *.o tools/RNG_test.cpp -o RNG_test
# Stream the AES-CTR generator into PractRand to a bounded volume (deeper
# runs are manual; see docs/randomness-testing.md). --error-exitcode is not
# a PractRand flag, so fail the job if any FAIL/suspicious appears.
- name: Run PractRand over the AES-CTR generator (to 4 GiB)
run: |
set -euo pipefail
cargo run --release --example rng_dump \
| /tmp/practrand/RNG_test stdin64 -tlmin 1MB -tlmax 4GB | tee practrand.log
if grep -Eiq 'FAIL|suspicious' practrand.log; then
echo "PractRand reported FAIL/suspicious" >&2
exit 1
fi