name: wai-quantum-qpu

# The clients for quantum processing services: every client against a service
# that follows its provider's published contract (the fake parses the program
# in the provider's format, runs it on wai-quantum's simulator, and answers in
# the provider's result shape and bit order), certification through the
# fabric, the probe that catches a service with another bit order, and curl
# end to end against a local server. And the person's own providers: the
# open provider protocol against the reference provider over both
# transports (a local process and HTTP through curl), its conformance
# vectors, the reference's pinned counts, the registry with its credential
# in a file only its owner reads, the refusal of a run that is not free
# until it is confirmed, receipts that verify, and no credential in
# anything a run returns; and, on macOS, the keychain in a keychain file
# made for the test. No request leaves the runner, and nothing spends money.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'wai/wai-quantum-qpu/**'
      - 'wai/wai-quantum/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-quantum-qpu.yml'
  schedule:
    - cron: '1 7 * * *'

jobs:
  # Does this pull request's own diff touch the paths below? This forge matches a
  # workflow's `paths:` against the push, so a merge of main into a branch fires the
  # workflow whatever the pull request changes; every job here waits on this answer.
  # A push to main, a schedule, or anything the script cannot determine answers
  # `true` (scripts/pr-touches-paths.py).
  relevant:
    name: does this change touch it
    runs-on: gate
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-quantum-qpu.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-quantum-qpu: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  clients:
    name: clients against their contracts (linux)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.99.1
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
          rustup toolchain install 1.99.1 --profile minimal --component clippy
          rustup default 1.99.1
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Tests
        shell: bash
        working-directory: wai/wai-quantum-qpu
        run: |
          set -euo pipefail
          command -v curl >/dev/null || { echo "::error::no curl: the transport test would pass over nothing"; exit 1; }
          # The credentials go to files here: CI has no keychain, and the
          # tests never touch one but the macOS leg's own.
          export WAI_QUANTUM_CREDENTIALS=file
          cargo test --locked 2>&1 | tee "$RUNNER_TEMP/test.log"
          # The library (46), the clients against their contracts (8), and the
          # providers end to end (12), each binary's count pinned.
          for n in 46 8 12; do
            grep -qE "^test result: ok\. $n passed; 0 failed" "$RUNNER_TEMP/test.log" || { echo "::error::a test binary did not pass all $n of its tests"; exit 1; }
          done
          for t in curl_carries_a_request_to_a_server_and_back every_operation_over_http every_operation_over_a_local_process \
                   the_reference_conforms_over_both_transports the_reference_gives_its_pinned_counts_on_every_platform \
                   a_run_that_is_not_free_is_refused_until_confirmed_and_carries_its_cost \
                   a_credential_reaches_the_provider_and_nothing_a_run_returns \
                   job::tests::a_recorded_job_outlives_what_sent_it_and_seals_as_a_run_would job::tests::running_out_of_patience_does_not_cancel_the_job \
                   job::tests::nothing_is_sent_that_could_not_be_recorded_first job::tests::a_job_that_may_have_been_sent_is_never_sent_again \
                   ledger::tests::a_handle_cannot_reach_outside_the_records; do
            grep -q "^test $t \.\.\. ok$" "$RUNNER_TEMP/test.log" || { echo "::error::$t did not run and pass"; exit 1; }
          done
      - name: Clippy
        shell: bash
        working-directory: wai/wai-quantum-qpu
        run: cargo clippy --locked --all-targets --no-deps -- -D warnings

  keychain:
    name: credentials in the keychain (macos)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: macos
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Put cargo on PATH
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      # The registry's tests, the keychain's among them: a credential kept,
      # read back, replaced and forgotten through the system tool, in a
      # keychain file the test makes and deletes (the runner's own keychain
      # is never touched).
      - name: The keychain test
        shell: bash
        working-directory: wai/wai-quantum-qpu
        run: |
          set -euo pipefail
          nice -n 10 cargo test --locked --lib registry:: 2>&1 | tee "$RUNNER_TEMP/keychain.log"
          grep -q '^test registry::tests::the_macos_keychain_keeps_reads_and_forgets_a_credential \.\.\. ok$' "$RUNNER_TEMP/keychain.log" || { echo "::error::the keychain test did not run and pass"; exit 1; }