name: wai media golden suite on RISC-V (emulated)

# WAI's golden suite for its integer-exact media paths (wai/byte-exact-conformance: the rANS
# coder, the integer syntheses, the JPEG AI symbol decode, integer video and its neural
# keyframe, the MLIC++-topology codec, the audio and splat codecs, the binary payloads and the
# staged residual layers), built for riscv64gc-unknown-linux-gnu and run on that instruction
# set: the same golden bytes wai-byte-equality.yml holds x86_64 and arm64 to, on a third one.
# One different byte fails the suite.
#
# There is no RISC-V runner, so the tests run under a user-mode emulator, as
# wai-quantum-vector.yml's rvv members do: Debian's static QEMU, pinned and fetched by the job
# and named as cargo's runner, never the host's binfmt handler (which some `linux` runners lack
# and others run at another version); the build in the cross-rs image for the target, pinned by
# digest. The emulated processor is the emulator's default for the target. Emulation inflates
# memory and time, and the `linux` hosts are shared: the container is capped at 6 GiB, the
# build runs at -j 6, and the emulated run has an hour (it took nine seconds on framework-128gb,
# 2026-11-10, its 112 tests passing). A RISC-V processor would run the same tests with no
# emulator.
#
# It runs on a change to what the suite decodes, the paths of wai-byte-equality.yml, in a pull
# request's own diff or in a push to main.

# A pull request's newer push supersedes its older run; a push to main takes a group of its own,
# its commit, so no later push cancels its run (scripts/check-workflow-concurrency.sh says why).
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'wai/byte-exact-conformance/**'
      # Every source the crate #[path]-includes, as in wai-byte-equality.yml.
      - 'wai/wai-rs/src/neural/int_synth.rs'
      - 'wai/wai-rs/src/neural/jpegai_mans.rs'
      - 'wai/wai-rs/src/int_synth.rs'
      - 'wai/wai-rs/src/int_entropy.rs'
      - 'wai/wai-rs/src/jpegai_mans.rs'
      - 'wai/wai-rs/src/rans.rs'
      - 'wai/wai-rs/src/int_video.rs'
      - 'wai/wai-rs/src/int_transform.rs'
      - 'wai/wai-rs/src/int_hyper_synth.rs'
      - 'wai/wai-rs/src/int_mlicpp.rs'
      - 'wai/wai-rs/src/int_audio.rs'
      - 'wai/wai-rs/src/int_splat.rs'
      - 'wai/wai-rs/src/int_payload/wire.rs'
      - 'wai/wai-rs/src/staged/predict.rs'
      - 'wai/wai-rs/src/staged/wir1.rs'
      - 'wai/wai-rs/src/staged/wir1_arith.rs'
      - 'wai/staged-conformance/**'
      - 'wai/wai-rs/src/int_kernels.rs'
      - 'wai/wai-rs/src/int_ops.rs'
      - 'wai/wai-ops/**'
      - 'wai/wai-rs/tests/vectors/int_video/**'
      - 'wai/wai-rs/tests/vectors/int_hyper/**'
      - 'wai/wai-rs/tests/vectors/int_mlicpp/**'
      - 'wai/wai-rs/tests/vectors/int_audio/**'
      - 'wai/wai-rs/tests/vectors/int_splat/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-media-riscv.yml'
  push:
    branches: [main]
    paths:
      - 'wai/byte-exact-conformance/**'
      # Every source the crate #[path]-includes, as in wai-byte-equality.yml.
      - 'wai/wai-rs/src/neural/int_synth.rs'
      - 'wai/wai-rs/src/neural/jpegai_mans.rs'
      - 'wai/wai-rs/src/int_synth.rs'
      - 'wai/wai-rs/src/int_entropy.rs'
      - 'wai/wai-rs/src/jpegai_mans.rs'
      - 'wai/wai-rs/src/rans.rs'
      - 'wai/wai-rs/src/int_video.rs'
      - 'wai/wai-rs/src/int_transform.rs'
      - 'wai/wai-rs/src/int_hyper_synth.rs'
      - 'wai/wai-rs/src/int_mlicpp.rs'
      - 'wai/wai-rs/src/int_audio.rs'
      - 'wai/wai-rs/src/int_splat.rs'
      - 'wai/wai-rs/src/int_payload/wire.rs'
      - 'wai/wai-rs/src/staged/predict.rs'
      - 'wai/wai-rs/src/staged/wir1.rs'
      - 'wai/wai-rs/src/staged/wir1_arith.rs'
      - 'wai/staged-conformance/**'
      - 'wai/wai-rs/src/int_kernels.rs'
      - 'wai/wai-rs/src/int_ops.rs'
      - 'wai/wai-ops/**'
      - 'wai/wai-rs/tests/vectors/int_video/**'
      - 'wai/wai-rs/tests/vectors/int_hyper/**'
      - 'wai/wai-rs/tests/vectors/int_mlicpp/**'
      - 'wai/wai-rs/tests/vectors/int_audio/**'
      - 'wai/wai-rs/tests/vectors/int_splat/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-media-riscv.yml'

jobs:
  # Does this pull request's own diff touch the paths below? This forge matches a
  # workflow's `paths:` against the push, so a merge of main into a branch fires the
  # workflow whatever the pull request changes; every job here waits on this answer.
  # A push to main, a schedule, or anything the script cannot determine answers
  # `true` (scripts/pr-touches-paths.py).
  relevant:
    name: does this change touch it
    runs-on: gate
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-media-riscv.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-media-riscv: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  golden:
    name: golden suite · riscv64 (emulated)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 90
    container:
      image: ghcr.io/cross-rs/riscv64gc-unknown-linux-gnu@sha256:67ee97dd4719390d299edfcf39f226360ccfb1539e08b078ec187d4848415794
      options: --memory=6g --memory-swap=6g
    env:
      # The emulator the test binaries run under: Debian's static QEMU, SHA-256 pinned, fetched
      # by the job and named as cargo's runner. Not the image's own (6.1), and not the host's
      # binfmt handler. (Not QEMU_*: qemu-user reads every QEMU_<option> variable as that
      # option.)
      USER_EMULATOR_VERSION: 10.0.13
      USER_EMULATOR_DEB: qemu-user_10.0.13+ds-0+deb13u1_amd64.deb
      USER_EMULATOR_SHA256: ca6ede739327a20ae5a3498230c8a3a9a072c586e131bc6bcc1201eb1725e336
      USER_EMULATOR_SHA1: dec1373851d29f91642c197f4a339d0d2ad25ed0
    steps:
      # The image has no Node for a checkout action: the forge's archive of the exact commit,
      # its embedded commit id checked.
      - name: Fetch the source
        shell: bash
        run: |
          set -euo pipefail
          want="${{ github.event.pull_request.head.sha || github.sha }}"
          rm -rf src src.tar.gz src.tar && mkdir src
          curl -sSf --max-time 600 -o src.tar.gz "http://100.64.224.0:3400/Transaction-Science/open-standards/archive/$want.tar.gz"
          gzip -dc src.tar.gz > src.tar
          got="$(git get-tar-commit-id < src.tar)"
          [ "$got" = "$want" ] || { echo "::error::the archive is of $got, not $want"; exit 1; }
          # -m: every file gets the time it was extracted, not its commit's, so cargo rebuilds
          # in the target directory kept between runs (see below).
          tar -xmf src.tar -C src --strip-components=1
          rm src.tar.gz src.tar
      - name: The golden suite, built for riscv64 and run under the emulator
        shell: bash
        working-directory: src/wai/byte-exact-conformance
        run: |
          set -euo pipefail
          target=riscv64gc-unknown-linux-gnu
          cache=/ci-cache/wai-media-riscv
          mkdir -p "$cache"
          exec 9>"$cache/.lock"
          flock 9
          # Every source file newer than every build in the cache, now that the lock is held:
          # another run may have built here while this one waited for it. (../.. is the tree.)
          find ../.. -type f -exec touch {} +
          export RUSTUP_HOME="$cache/rustup" CARGO_HOME="$cache/cargo" CARGO_TARGET_DIR="$cache/target"
          export PATH="$CARGO_HOME/bin:$PATH"
          if ! command -v rustup >/dev/null; then
            curl --proto '=https' --tlsv1.2 -sSf --max-time 300 https://sh.rustup.rs | sh -s -- -y --no-modify-path --profile minimal --default-toolchain none
          fi
          timeout 900 rustup toolchain install
          timeout 600 rustup target add "$target"
          # The emulator, fetched once per host into the cache (under the lock above), checked
          # against its pin.
          q="$cache/qemu-user-$USER_EMULATOR_VERSION"
          if [ ! -x "$q/qemu-riscv64" ]; then
            d="$cache/qemu-user-fetch"; rm -rf "$d" && mkdir "$d"
            curl -sSfL --max-time 600 -o "$d/$USER_EMULATOR_DEB" "https://deb.debian.org/debian/pool/main/q/qemu/$USER_EMULATOR_DEB" \
              || curl -sSfL --max-time 600 -o "$d/$USER_EMULATOR_DEB" "https://snapshot.debian.org/file/$USER_EMULATOR_SHA1"
            echo "$USER_EMULATOR_SHA256  $d/$USER_EMULATOR_DEB" | sha256sum -c -
            dpkg-deb --fsys-tarfile "$d/$USER_EMULATOR_DEB" | tar -x -C "$d" ./usr/bin/qemu-riscv64
            rm -rf "$q.tmp" && mkdir "$q.tmp" && mv "$d/usr/bin/qemu-riscv64" "$q.tmp/"
            rm -rf "$q" && mv "$q.tmp" "$q" && rm -rf "$d"
          fi
          runner="$q/qemu-riscv64 -L /usr/riscv64-linux-gnu"
          export CARGO_TARGET_RISCV64GC_UNKNOWN_LINUX_GNU_RUNNER="$runner"
          # Preflight: a trivial program, built for the target and run as cargo will run the
          # tests. An emulator that cannot run it fails the leg here, saying so.
          printf '%s\n' '#include <stdio.h>' '#include <sys/utsname.h>' \
            'int main(void) { struct utsname u; if (uname(&u) != 0) return 1; printf("%s\n", u.machine); return 0; }' > "$RUNNER_TEMP/probe.c"
          riscv64-linux-gnu-gcc -o "$RUNNER_TEMP/probe" "$RUNNER_TEMP/probe.c"
          got="$($runner "$RUNNER_TEMP/probe")" || { echo "::error::the emulator cannot run a program for $target: $runner"; exit 1; }
          [ "$got" = riscv64 ] || { echo "::error::the preflight program ran as $got, not riscv64"; exit 1; }
          echo "emulator: $("$q/qemu-riscv64" --version | head -1); a program for $target runs under it"
          # The build is native (cross-compiled); only the tests run emulated, within the hour.
          log="$RUNNER_TEMP/golden.log"
          nice -n 10 cargo test --locked --release -j 6 --target "$target" --no-run 2>&1 | tee "$log"
          # A build that compiled none of the suite would run a binary another commit left here.
          grep -qE '^ *Compiling wai-byte-exact-conformance v[0-9]' "$log" || { echo "::error::the build compiled no wai-byte-exact-conformance: its tests would run a binary already in the cache"; exit 1; }
          timeout 3600 nice -n 10 cargo test --locked --release -j 6 --target "$target" 2>&1 | tee -a "$log"
          # The suite's binary ran under the emulator, every test passing and none filtered out. (One
          # test of the included kernels is ignored on every leg: exhaustive over 2^32 roots, it is
          # run alone in release.)
          grep -qE "^ *Running unittests src/lib\.rs \(.*/$target/release/deps/wai_byte_exact_conformance-[0-9a-f]+\)" "$log" \
            || { echo "::error::the suite's binary for $target did not run"; exit 1; }
          ! grep -q '^test result: FAILED' "$log" || { echo "::error::a golden differs on $target"; exit 1; }
          grep -qE '^test result: ok\. [1-9][0-9]* passed; 0 failed; [0-9]+ ignored; 0 measured; 0 filtered out' "$log" \
            || { echo "::error::no test ran and passed"; exit 1; }
          grep -E '^test result: ' "$log"