build.yml

name: CI

on:
  push:
  pull_request_target:

permissions:
  actions: read
  contents: read
  packages: write

concurrency:
  group: |
    ${{ github.workflow }}-${{
      (vars.ALLOW_CONCURRENCY != '' && github.sha) ||
      (github.event_name == 'pull_request_target' && github.event.pull_request.number) ||
      (github.event_name == 'push' && github.ref)
    }}
  cancel-in-progress: ${{ github.ref_type != 'tag' }}

jobs:
  check-skip:
    name: Check skip conditions
    # Keep the bootstrap job cheap; RUNNER_CHECK_SKIP can point to a small Blacksmith ARM runner.
    runs-on: ${{ vars.RUNNER_CHECK_SKIP || 'ubuntu-24.04-arm' }}
    outputs:
      skip: ${{ steps.skip-check.outputs.skip }}
      runner-amd64: ${{ steps.select-runner.outputs.runner_amd64 }}
      runner-arm64: ${{ steps.select-runner.outputs.runner_arm64 }}
      use-blacksmith: ${{ steps.select-runner.outputs.use_blacksmith }}
      backlog-count: ${{ steps.select-runner.outputs.backlog_count }}
      decision-reason: ${{ steps.select-runner.outputs.decision_reason }}
      base-image-digest: ${{ steps.base-image.outputs.digest }}
    steps:
      - name: Check skip environment variables
        id: skip-check
        run: |
          if [[ "${{ github.event_name }}" == "push" && "${{ vars.SKIP_ON_PUSH }}" != "" ]]; then
            echo "Skipping build on push due to SKIP_ON_PUSH environment variable"
            echo "skip=true" >> $GITHUB_OUTPUT
          elif [[ "${{ github.event_name }}" == "pull_request_target" && "${{ vars.SKIP_ON_PR }}" != "" ]]; then
            echo "Skipping build on pull request due to SKIP_ON_PR environment variable"
            echo "skip=true" >> $GITHUB_OUTPUT
          else
            echo "skip=false" >> $GITHUB_OUTPUT
          fi

      - name: Checkout code
        if: ${{ steps.skip-check.outputs.skip == 'false' }}
        uses: actions/checkout@v6

      - name: Select runners
        id: select-runner
        if: ${{ steps.skip-check.outputs.skip == 'false' }}
        env:
          BACKLOG_THRESHOLD: "10"
          GH_TOKEN: ${{ github.token }}
          RUNNER_AMD64_VAR: ${{ vars.RUNNER_AMD64 }}
          RUNNER_ARM64_VAR: ${{ vars.RUNNER_ARM64 }}
        run: |
          python3 .github/workflows/select_dynamic_runner.py

      - name: Get base image digest
        id: base-image
        if: ${{ steps.skip-check.outputs.skip == 'false' }}
        run: |
          # Fetch the canonical manifest digest for ubuntu:noble so the
          # depends cache key changes when Canonical pushes base image
          # updates (which may bump compiler versions).
          # Falls back to "unknown" on failure so CI is not blocked.
          TOKEN="$(curl -fsSL --max-time 10 \
            'https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/ubuntu:pull' \
            | jq -r '.token')" || true
          if [ -n "$TOKEN" ] && [ "$TOKEN" != "null" ]; then
            DIGEST="$(curl -fsSL --max-time 10 \
              -H "Authorization: Bearer $TOKEN" \
              -H 'Accept: application/vnd.docker.distribution.manifest.list.v2+json' \
              'https://registry-1.docker.io/v2/library/ubuntu/manifests/noble' \
              -o /dev/null -D - | grep -i docker-content-digest | awk '{print $2}' | tr -d '\r' | sed 's/^sha256://')" || true
          fi
          echo "digest=${DIGEST:-unknown}" >> "$GITHUB_OUTPUT"

  cache-sources:
    name: Cache depends sources
    needs: [check-skip]
    if: ${{ needs.check-skip.outputs.skip == 'false' }}
    uses: ./.github/workflows/cache-depends-sources.yml
    with:
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}

  container:
    name: Build container
    needs: [check-skip]
    if: ${{ needs.check-skip.outputs.skip == 'false' }}
    uses: ./.github/workflows/build-container.yml
    with:
      context: ./contrib/containers/ci
      file: ./contrib/containers/ci/ci.Dockerfile
      name: dashcore-ci-runner
      runs-on-amd64: ${{ needs.check-skip.outputs['runner-amd64'] }}
      runs-on-arm64: ${{ needs.check-skip.outputs['runner-arm64'] }}

  container-slim:
    name: Build slim container
    needs: [check-skip]
    if: ${{ needs.check-skip.outputs.skip == 'false' }}
    uses: ./.github/workflows/build-container.yml
    with:
      context: ./contrib/containers/ci
      file: ./contrib/containers/ci/ci-slim.Dockerfile
      name: dashcore-ci-slim
      runs-on-amd64: ${{ needs.check-skip.outputs['runner-amd64'] }}
      runs-on-arm64: ${{ needs.check-skip.outputs['runner-arm64'] }}

  depends-aarch64-linux:
    name: aarch64-linux-gnu
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: ${{ vars.SKIP_ARM_LINUX == '' }}
    with:
      build-target: aarch64-linux
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  depends-linux64:
    name: x86_64-pc-linux-gnu
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: |
      vars.SKIP_LINUX64 == '' ||
      vars.SKIP_LINUX64_FUZZ == '' ||
      vars.SKIP_LINUX64_SQLITE == '' ||
      vars.SKIP_LINUX64_UBSAN == ''
    with:
      build-target: linux64
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  depends-linux64_multiprocess:
    name: linux64_multiprocess
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: |
      vars.SKIP_LINUX64_MULTIPROCESS == '' ||
      vars.SKIP_LINUX64_TSAN == ''
    with:
      build-target: linux64_multiprocess
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}

  depends-linux64_nowallet:
    name: x86_64-pc-linux-gnu_nowallet
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: ${{ vars.SKIP_LINUX64_NOWALLET == '' }}
    with:
      build-target: linux64_nowallet
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  depends-mac:
    name: x86_64-apple-darwin
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: ${{ vars.SKIP_MAC == '' }}
    with:
      build-target: mac
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  depends-win64:
    name: x86_64-w64-mingw32
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: ${{ vars.SKIP_WIN64 == '' }}
    with:
      build-target: win64
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  lint:
    name: Lint
    uses: ./.github/workflows/lint.yml
    needs: [check-skip, container-slim]
    with:
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  src-aarch64-linux:
    name: aarch64-linux-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-aarch64-linux]
    with:
      build-target: aarch64-linux
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-aarch64-linux.outputs.key }}
      depends-host: ${{ needs.depends-aarch64-linux.outputs.host }}
      depends-dep-opts: ${{ needs.depends-aarch64-linux.outputs.dep-opts }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  src-linux64:
    name: linux64-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64]
    if: ${{ vars.SKIP_LINUX64 == '' }}
    with:
      build-target: linux64
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64.outputs.key }}
      depends-host: ${{ needs.depends-linux64.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  src-linux64_fuzz:
    name: linux64_fuzz-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64]
    if: ${{ vars.SKIP_LINUX64_FUZZ == '' }}
    with:
      build-target: linux64_fuzz
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64.outputs.key }}
      depends-host: ${{ needs.depends-linux64.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  src-linux64_multiprocess:
    name: linux64_multiprocess-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64_multiprocess, lint]
    if: ${{ vars.SKIP_LINUX64_MULTIPROCESS == '' }}
    with:
      build-target: linux64_multiprocess
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64_multiprocess.outputs.key }}
      depends-host: ${{ needs.depends-linux64_multiprocess.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64_multiprocess.outputs.dep-opts }}
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}

  src-linux64_nowallet:
    name: linux64_nowallet-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64_nowallet]
    with:
      build-target: linux64_nowallet
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64_nowallet.outputs.key }}
      depends-host: ${{ needs.depends-linux64_nowallet.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64_nowallet.outputs.dep-opts }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  src-linux64_sqlite:
    name: linux64_sqlite-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64]
    if: ${{ vars.SKIP_LINUX64_SQLITE == '' }}
    with:
      build-target: linux64_sqlite
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64.outputs.key }}
      depends-host: ${{ needs.depends-linux64.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  src-linux64_tsan:
    name: linux64_tsan-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64_multiprocess]
    if: ${{ vars.SKIP_LINUX64_TSAN == '' }}
    with:
      build-target: linux64_tsan
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64_multiprocess.outputs.key }}
      depends-host: ${{ needs.depends-linux64_multiprocess.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64_multiprocess.outputs.dep-opts }}
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}

  src-linux64_ubsan:
    name: linux64_ubsan-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64]
    if: ${{ vars.SKIP_LINUX64_UBSAN == '' }}
    with:
      build-target: linux64_ubsan
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64.outputs.key }}
      depends-host: ${{ needs.depends-linux64.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  src-mac:
    name: mac-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-mac]
    with:
      build-target: mac
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-mac.outputs.key }}
      depends-host: ${{ needs.depends-mac.outputs.host }}
      depends-dep-opts: ${{ needs.depends-mac.outputs.dep-opts }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  src-win64:
    name: win64-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-win64]
    with:
      build-target: win64
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-win64.outputs.key }}
      depends-host: ${{ needs.depends-win64.outputs.host }}
      depends-dep-opts: ${{ needs.depends-win64.outputs.dep-opts }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  test-linux64:
    name: linux64-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64, lint]
    with:
      bundle-key: ${{ needs.src-linux64.outputs.key }}
      build-target: linux64
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  test-linux64_multiprocess:
    name: linux64_multiprocess-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64_multiprocess, lint]
    with:
      bundle-key: ${{ needs.src-linux64_multiprocess.outputs.key }}
      build-target: linux64_multiprocess
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}

  test-linux64_nowallet:
    name: linux64_nowallet-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64_nowallet, lint]
    with:
      bundle-key: ${{ needs.src-linux64_nowallet.outputs.key }}
      build-target: linux64_nowallet
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  test-linux64_sqlite:
    name: linux64_sqlite-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64_sqlite, lint]
    with:
      bundle-key: ${{ needs.src-linux64_sqlite.outputs.key }}
      build-target: linux64_sqlite
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  test-linux64_tsan:
    name: linux64_tsan-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64_tsan, lint]
    with:
      bundle-key: ${{ needs.src-linux64_tsan.outputs.key }}
      build-target: linux64_tsan
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}

  test-linux64_ubsan:
    name: linux64_ubsan-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64_ubsan, lint]
    with:
      bundle-key: ${{ needs.src-linux64_ubsan.outputs.key }}
      build-target: linux64_ubsan
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}