rustd-resolved 0.2.1

name: Replacement upstream TEST-75 proof
run-name: Replacement upstream TEST-75 proof ${{ inputs.source_sha || github.sha }}

on:
  workflow_dispatch:
    inputs:
      source_sha:
        description: Full Git commit to prove; blank selects the dispatch ref
        required: false
        type: string

permissions:
  contents: read
  statuses: write

jobs:
  test75:
    runs-on: ubuntu-24.04
    timeout-minutes: 210
    steps:
      - name: Check out exact source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          ref: ${{ inputs.source_sha || github.sha }}
          fetch-depth: 1

      - name: Verify exact source identity
        shell: bash
        env:
          REQUESTED_SHA: ${{ inputs.source_sha || github.sha }}
        run: |
          set -euo pipefail
          [[ $REQUESTED_SHA =~ ^[0-9a-f]{40}$ ]]
          test "$(git rev-parse HEAD)" = "$REQUESTED_SHA"

      - name: Install candidate and upstream test dependencies
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install --yes --no-install-recommends \
            build-essential \
            btrfs-progs \
            cryptsetup-bin \
            dbus \
            debian-archive-keyring \
            debootstrap \
            dosfstools \
            gfortran \
            git \
            gperf \
            libacl1-dev \
            libaudit-dev \
            libblkid-dev \
            libcap-dev \
            libcryptsetup-dev \
            libcurl4-openssl-dev \
            libgcrypt20-dev \
            liblz4-dev \
            libmount-dev \
            libpam0g-dev \
            libseccomp-dev \
            libselinux1-dev \
            libssl-dev \
            liburing-dev \
            libzstd-dev \
            meson \
            mtools \
            ninja-build \
            ovmf \
            pkg-config \
            python3-jinja2 \
            python3-lxml \
            python3-pefile \
            python3-pyelftools \
            qemu-system-x86 \
            qemu-utils \
            squashfs-tools \
            systemd-boot-efi
          git clone --filter=blob:none --no-checkout \
            https://github.com/systemd/mkosi.git "$RUNNER_TEMP/mkosi"
          git -C "$RUNNER_TEMP/mkosi" fetch --depth 1 origin \
            60ed8c964f8d98aa4b325f381c4b3bc6de91a0b7
          git -C "$RUNNER_TEMP/mkosi" checkout --detach \
            60ed8c964f8d98aa4b325f381c4b3bc6de91a0b7
          echo "$RUNNER_TEMP/mkosi/bin" >> "$GITHUB_PATH"
          rustup toolchain install 1.74.0 --profile minimal --component rustfmt,clippy
          rustup default 1.74.0
          rustc --version --verbose
          cargo --version --verbose

      - name: Verify pinned baseline
        run: bash scripts/verify-upstream-resolved-baseline.sh

      - name: Build release candidate
        run: bash scripts/build-reproducible-release.sh

      - name: Run unmodified pinned TEST-75-RESOLVED
        id: suite
        shell: bash
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$PATH"
          bash scripts/run-upstream-test-75.sh \
            --binary target/reproducible-release/systemd-resolved \
            --client target/reproducible-release/resolvectl \
            --nss-module target/reproducible-release/libnss_resolve.so.2 \
            --output target/upstream-test-75

      - name: Write bound upstream proof
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p proof
          cp target/upstream-test-75/TEST-75-RESOLVED.log proof/
          cp target/upstream-test-75/evidence.json proof/
          python3 scripts/write-replacement-proof.py \
            --gate upstream-test-75 \
            --result pass \
            --output proof/upstream-test-75.json \
            --artifact proof/TEST-75-RESOLVED.log \
            --artifact proof/evidence.json \
            --metadata suite=TEST-75-RESOLVED \
            --metadata unmodified-recorded-files=true \
            --summary 'Pinned upstream TEST-75-RESOLVED passed with the candidate daemon, client, and NSS module.'

      - name: Upload bound upstream proof
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: replacement-upstream-test-75-proof-${{ inputs.source_sha || github.sha }}
          path: proof
          if-no-files-found: error
          retention-days: 30

      - name: Upload upstream failure evidence
        if: ${{ failure() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: replacement-upstream-test-75-failure-${{ inputs.source_sha || github.sha }}
          path: target/upstream-test-75
          if-no-files-found: ignore
          retention-days: 14

  report:
    name: Publish upstream TEST-75 status
    if: ${{ always() }}
    needs:
      - test75
    runs-on: ubuntu-24.04
    steps:
      - name: Publish exact-source status
        env:
          GH_TOKEN: ${{ github.token }}
          SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
          RESULT: ${{ needs.test75.result }}
        run: |
          set -euo pipefail
          state=failure
          if [[ "$RESULT" == success ]]; then
            state=success
          fi
          payload=$(printf '{"state":"%s","context":"replacement/upstream-test-75","description":"Upstream TEST-75 proof %s","target_url":"%s"}' "$state" "$state" "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}")
          curl --fail-with-body --silent --show-error -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer $GH_TOKEN" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/statuses/${SOURCE_SHA}" \
            --data "$payload" >/dev/null