deploy.yml

# Copyright 2021, Proofcraft Pty Ltd
# Copyright 2026, UNSW
#
# SPDX-License-Identifier: BSD-2-Clause

# Deploy default.xml to microkit-manifest after successful runs.

name: Deploy

on:
  push:
    branches: [main]
    paths-ignore:
      - '**.md'

  # allow manual trigger
  workflow_dispatch:

  # allow explicit trigger from other repos when dependencies have changed
  repository_dispatch:
    types: [deps-update]

jobs:
  code:
    name: Freeze Code
    runs-on: ubuntu-latest
    outputs:
      xml: ${{ steps.repo.outputs.xml }}
    steps:
      - id: repo
        uses: seL4/ci-actions/repo-checkout@master
        with:
          manifest_repo: seL4/microkit-manifest
          manifest_branch: main
          manifest: main.xml

  # TODO: We want to add support for this but have yet to do so.
  # sim:
  #   name: Simulation
  #   needs: code
  #   runs-on: ubuntu-latest
  #   strategy:
  #     matrix:
  #       march: [aarch64, x86_64, riscv64]
  #       compiler: [gcc]
  #   steps:
  #     - uses: seL4/ci-actions/microkit-sim@master
  #       with:
  #         xml: ${{ needs.code.outputs.xml }}
  #         march: ${{ matrix.march }}
  #         compiler: ${{ matrix.compiler }}

  sdk-build:
    name: Build SDK (macOS, all targets)
    needs: code
    runs-on: [self-hosted, macos, ARM64]
    outputs:
      SDK_VERSION: ${{ steps.version.outputs.SDK_VERSION }}
    steps:
      - name: Clean build
        run: |
          rm -rf "$GITHUB_WORKSPACE"
          mkdir -p "$GITHUB_WORKSPACE"
      - name: Checkout code
        uses: seL4/ci-actions/repo-checkout@master
        with:
          xml: ${{ needs.code.outputs.xml }}
          # needed for reasons...
          manifest_repo: seL4/microkit-manifest
          manifest_branch: main
          manifest_depth: 0
          manifest: main.xml
      - name: Set version
        id: version
        run: ./ci/sdk_version.sh
        working-directory: ./microkit/
      - name: Get Nix dependencies
        run: nix develop -c bash -c 'echo Hello World'
        working-directory: ./microkit/
      - name: Build SDK
        run: nix develop --ignore-environment -c bash -c "python3 build_sdk.py --sel4=../seL4 --version ${{ env.SDK_VERSION }} --gcc-toolchain-prefix-x86_64 x86_64-elf --gcc-toolchain-prefix-riscv64 riscv64-none-elf --release-packaging"
        working-directory: ./microkit/
      - name: Upload SDK (macos-aarch64)
        uses: actions/upload-artifact@v7
        with:
          name: microkit-sdk-${{ env.SDK_VERSION }}-macos-aarch64
          path: microkit/release/microkit-sdk-${{ env.SDK_VERSION }}-macos-aarch64.tar.gz
      - name: Upload SDK (macos-x86-64)
        uses: actions/upload-artifact@v7
        with:
          name: microkit-sdk-${{ env.SDK_VERSION }}-macos-x86-64
          path: microkit/release/microkit-sdk-${{ env.SDK_VERSION }}-macos-x86-64.tar.gz
      - name: Upload SDK (linux-aarch64)
        uses: actions/upload-artifact@v7
        with:
          name: microkit-sdk-${{ env.SDK_VERSION }}-linux-aarch64
          path: microkit/release/microkit-sdk-${{ env.SDK_VERSION }}-linux-aarch64.tar.gz
      - name: Upload SDK (linux-x86-64)
        uses: actions/upload-artifact@v7
        with:
          name: microkit-sdk-${{ env.SDK_VERSION }}-linux-x86-64
          path: microkit/release/microkit-sdk-${{ env.SDK_VERSION }}-linux-x86-64.tar.gz

  # Not used for HW Run, just to confirm it builds on Linux outside of Nix.
  sdk-build-linux:
    name: Build SDK (Linux x86_64)
    runs-on: ubuntu-24.04
    needs: code
    steps:
      - name: Checkout code
        uses: seL4/ci-actions/repo-checkout@master
        with:
          xml: ${{ needs.code.outputs.xml }}
          # needed for reasons...
          manifest_repo: seL4/microkit-manifest
          manifest_branch: main
          manifest_depth: 0
          manifest: main.xml
      - name: Set version
        run: ./ci/sdk_version.sh
        working-directory: ./microkit/
      - name: Install SDK dependencies
        run: ./ci/install_ubuntu_deps.sh
        working-directory: ./microkit/
      - name: Build SDK (x86-64)
        run: ./pyenv/bin/python build_sdk.py --sel4=../seL4 --version ${{ env.SDK_VERSION }}-linux-x86-64 --tool-target-triple="x86_64-unknown-linux-musl"
        working-directory: ./microkit/

  the_matrix:
    name: Matrix
    needs: sdk-build
    runs-on: ubuntu-latest
    outputs:
      gh_matrix: ${{ steps.matrix.outputs.gh_matrix }}
      test_cases: ${{ steps.matrix.outputs.test_cases }}
    steps:
      - name: Checkout code
        uses: seL4/ci-actions/repo-checkout@master
        with:
          xml: ${{ needs.code.outputs.xml }}
          # needed for reasons...
          manifest_repo: seL4/microkit-manifest
          manifest_branch: main
          manifest: main.xml
      - id: matrix
        uses: seL4/ci-actions/microkit-hw-matrix@master
        env:
          # We don't actually care what this is set to, but for the files for
          # each platform it expects this path to exist, so we set it up.
          MICROKIT_SDK: /dummy-microkit-sdk-for-matrix

  hw-build:
    name: HW Test Builds
    if: ${{ github.repository_owner == 'seL4' }}
    runs-on: ubuntu-latest
    # FIXME: Add simulation support
    # needs: [sim, the_matrix, sdk-build]
    needs: [the_matrix, sdk-build]
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.the_matrix.outputs.gh_matrix) }}
    env:
      SDK_VERSION: ${{ needs.sdk-build.outputs.SDK_VERSION }}
    steps:
      - name: Checkout code
        uses: seL4/ci-actions/repo-checkout@master
        with:
          xml: ${{ needs.code.outputs.xml }}
          # needed for reasons...
          manifest_repo: seL4/microkit-manifest
          manifest_branch: main
          manifest: main.xml
      - name: Download microkit SDK
        uses: actions/download-artifact@v8
        with:
          name: microkit-sdk-${{ env.SDK_VERSION }}-linux-x86-64
      - name: Extract microkit SDK
        run: |
          tar xzf ./microkit-sdk-${{ env.SDK_VERSION }}-linux-x86-64.tar.gz
          export "MICROKIT_SDK=$(realpath ./microkit-sdk-${{ env.SDK_VERSION }}/)"
          echo "MICROKIT_SDK=${MICROKIT_SDK}" >> "${GITHUB_ENV}"
      - name: Install build dependencies
        run: ./ci/install_march_build_deps.sh ${{ matrix.march }}
        working-directory: ./microkit/
      - name: Build
        uses: seL4/ci-actions/microkit-hw-build@master
        with:
          board: ${{ matrix.board }}
        env:
          TEST_CASES: ${{ needs.the_matrix.outputs.test_cases }}
      - name: Upload test case builds
        uses: actions/upload-artifact@v7
        with:
          name: loader-img-${{ matrix.board }}
          path: '*.loader.img'

  hw-run:
    name: HW Run
    if: ${{ github.repository_owner == 'seL4' }}
    runs-on: ubuntu-latest
    needs: [the_matrix, hw-build, sdk-build]
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.the_matrix.outputs.gh_matrix) }}
    # do not run concurrently with other workflows, but do run concurrently in the build matrix
    concurrency: hw-run-${{ strategy.job-index }}
    env:
      SDK_VERSION: ${{ needs.sdk-build.outputs.SDK_VERSION }}
    steps:
      - name: Get machine queue
        uses: actions/checkout@v6
        with:
          repository: seL4/machine_queue
          path: machine_queue
      - name: Download test cases builds
        uses: actions/download-artifact@v8
        with:
          name: loader-img-${{ matrix.board }}
      - name: Download microkit SDK
        uses: actions/download-artifact@v8
        with:
          name: microkit-sdk-${{ env.SDK_VERSION }}-linux-x86-64
      - name: Extract microkit SDK
        run: |
          tar xzf ./microkit-sdk-${{ env.SDK_VERSION }}-linux-x86-64.tar.gz
          export "MICROKIT_SDK=$(realpath ./microkit-sdk-${{ env.SDK_VERSION }}/)"
          echo "MICROKIT_SDK=${MICROKIT_SDK}" >> "${GITHUB_ENV}"
      - name: Run
        uses: seL4/ci-actions/microkit-hw-run@master
        with:
          board: ${{ matrix.board }}
          index: ${{ strategy.job-index }}
        env:
          TEST_CASES: ${{ needs.the_matrix.outputs.test_cases }}
          HW_SSH: ${{ secrets.HW_SSH }}

  deploy:
    name: Deploy manifest
    if: ${{ github.repository_owner == 'seL4' }}
    runs-on: ubuntu-24.04
    needs: [code, hw-run, sdk-build-linux]
    steps:
    - name: Deploy
      uses: seL4/ci-actions/manifest-deploy@master
      with:
        xml: ${{ needs.code.outputs.xml }}
        manifest_repo: seL4/microkit-manifest
        manifest_branch: main
        manifest: main.xml
      env:
        GH_SSH: ${{ secrets.CI_SSH }}