name: wai-quantum-qpu

# The clients for quantum processing services: every client against a service
# that follows its provider's published contract (the fake parses the program
# in the provider's format, runs it on wai-quantum's simulator, and answers in
# the provider's result shape and bit order), certification through the
# fabric, the probe that catches a service with another bit order, and curl
# end to end against a local server. And the person's own providers: the
# open provider protocol against the reference provider over both
# transports (a local process and HTTP through curl), its conformance
# vectors, the reference's pinned counts, the registry with its credential
# in a file only its owner reads, the refusal of a run that is not free
# until it is confirmed, receipts that verify, and no credential in
# anything a run returns; and, on macOS, the keychain in a keychain file
# made for the test. No request leaves the runner, and nothing spends money.

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'wai/wai-quantum-qpu/**'
      - 'wai/wai-quantum/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-quantum-qpu.yml'
  schedule:
    - cron: '1 7 * * *'

jobs:
  # Does this pull request's own diff touch the paths below? This forge matches a
  # workflow's `paths:` against the push, so a merge of main into a branch fires the
  # workflow whatever the pull request changes; every job here waits on this answer.
  # A push to main, a schedule, or anything the script cannot determine answers
  # `true` (scripts/pr-touches-paths.py).
  relevant:
    name: does this change touch it
    runs-on: gate
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-quantum-qpu.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-quantum-qpu: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  clients:
    name: clients against their contracts (linux)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.99.1
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
          rustup toolchain install 1.99.1 --profile minimal --component clippy
          rustup default 1.99.1
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Tests
        shell: bash
        working-directory: wai/wai-quantum-qpu
        run: |
          set -euo pipefail
          command -v curl >/dev/null || { echo "::error::no curl: the transport test would pass over nothing"; exit 1; }
          # The credentials go to files here: CI has no keychain, and the
          # tests never touch one but the macOS leg's own.
          export WAI_QUANTUM_CREDENTIALS=file
          cargo test --locked 2>&1 | tee "$RUNNER_TEMP/test.log"
          # The library (110 here, the cloud-tasks client's, a job under a contract's,
          # the reference as an xx device and as a star, an energy-landscape job's, the
          # open protocol's counts of the shots a device kept, the result vectors'
          # accepted_shots, and the estimate vectors' unpriced form among them; the macOS
          # keychain's test makes 111 on macOS, run by the leg below), the clients
          # against their contracts (20, a processor of prx xx rz, a star's resonator
          # and a device that keeps fewer shots than asked among them), and the
          # providers end to end (12), each binary's count pinned.
          for n in 110 20 12; do
            grep -qE "^test result: ok\. $n passed; 0 failed" "$RUNNER_TEMP/test.log" || { echo "::error::a test binary did not pass all $n of its tests"; exit 1; }
          done
          for t in curl_carries_a_request_to_a_server_and_back every_operation_over_http every_operation_over_a_local_process \
                   the_reference_conforms_over_both_transports the_reference_gives_its_pinned_counts_on_every_platform \
                   a_run_that_is_not_free_is_refused_until_confirmed_and_carries_its_cost \
                   a_credential_reaches_the_provider_and_nothing_a_run_returns \
                   job::tests::a_recorded_job_outlives_what_sent_it_and_seals_as_a_run_would job::tests::running_out_of_patience_does_not_cancel_the_job \
                   job::tests::nothing_is_sent_that_could_not_be_recorded_first job::tests::a_job_that_may_have_been_sent_is_never_sent_again \
                   ledger::tests::a_handle_cannot_reach_outside_the_records \
                   cloud_tasks::tests::the_signature_is_the_published_example cloud_tasks::tests::a_processor_gets_a_verbatim_box_on_its_own_qubit_names \
                   cloud_tasks::tests::a_submission_names_the_persons_own_bucket_and_never_carries_their_secret \
                   job::tests::what_a_provider_states_of_its_counts_is_sealed_and_a_statement_out_of_form_is_refused \
                   job::tests::a_job_recorded_before_clients_stated_what_they_sent_says_no_one_stated_it \
                   every_built_in_kind_states_what_it_sent_and_its_receipt_keeps_every_rule \
                   cloud_tasks::tests::temporary_keys_send_their_token_and_sign_it cloud_tasks::tests::the_look_for_a_secret_reads_a_request_s_body \
                   cloud_tasks::tests::a_program_on_a_qubit_past_the_sixty_fourth_is_read_back cloud_tasks::tests::a_dotted_bucket_is_read_by_path_where_its_host_has_no_certificate \
                   registry::tests::a_named_credential_that_gives_nothing_is_an_error_saying_where_it_looked \
                   registry::tests::every_part_of_kept_keys_is_taken_out_of_a_message_whole_or_cut_short \
                   sampler_v2::tests::a_simulated_backend_is_not_silicon \
                   a_job_recorded_by_the_last_release_is_sealed_with_a_receipt_this_one_accepts \
                   a_receipt_names_the_device_s_qubits_as_the_program_was_sent_on_them \
                   cloud_tasks::tests::signing_gives_the_published_test_suite_s_signatures \
                   cloud_tasks::tests::a_client_that_did_not_submit_a_task_does_not_read_it_through_today_s_device \
                   cloud_tasks::tests::a_task_is_asked_after_in_the_region_its_id_names \
                   registry::tests::a_kind_this_build_does_not_know_is_kept_and_the_rest_is_read \
                   a_cloud_task_cancelled_while_it_waits_ends_cancelled \
                   cloud_tasks_round_trip_through_their_contract a_job_collected_later_is_read_through_the_qubits_it_was_sent_on \
                   job::tests::a_contract_is_weighed_before_anything_is_sent job::tests::a_cost_ceiling_holds_the_estimate_and_is_no_confirmation \
                   job::tests::every_provider_is_weighed_against_the_engine_s_own_methods job::tests::a_shadow_and_its_reasoning_outlive_what_sent_the_job \
                   job::tests::a_deadline_it_cannot_be_held_to_is_refused_and_one_that_leaves_no_time_says_so \
                   job::tests::a_job_past_its_deadline_is_cancelled_where_it_waits \
                   job::tests::a_provider_the_contract_does_not_allow_is_asked_nothing \
                   job::tests::the_word_for_a_routed_run_binds_the_provider_and_says_only_itself \
                   job::tests::a_job_past_its_deadline_ends_only_on_the_provider_s_word \
                   job::tests::a_reasoning_no_receipt_could_give_is_not_taken_up \
                   job::tests::a_word_confirms_one_run_and_binds_its_contract \
                   job::tests::an_open_provider_says_it_cannot_cancel_and_that_its_estimate_is_the_least \
                   a_built_in_kind_runs_under_a_contract_and_a_classical_method_shadows_it a_cost_estimated_at_the_least_it_can_come_to_meets_no_ceiling \
                   conformance::tests::the_reference_conforms_as_an_xx_device_and_as_a_star \
                   open_provider::tests::a_star_device_and_an_xx_device_are_read_from_their_descriptions \
                   open_provider::tests::an_angle_past_the_xx_basis_range_or_a_move_out_of_its_basis_is_refused \
                   cloud_tasks_drive_a_processor_of_prx_xx_and_rz_in_its_own_gates prx_circuits_route_through_a_star_s_resonator \
                   landscape::tests::a_free_landscape_job_runs_and_its_receipt_verifies landscape::tests::a_landscape_job_that_is_not_free_waits_for_its_confirmation \
                   landscape::tests::nothing_is_sent_or_sealed_that_does_not_hold conformance::tests::the_landscape_vectors_are_the_reference_s \
                   conformance::tests::landscape_jobs_conform_and_a_provider_that_departs_fails \
                   a_device_that_keeps_fewer_shots_than_asked_seals_how_many_it_kept \
                   open_provider::tests::the_counts_are_of_the_shots_the_device_says_it_kept \
                   conformance::tests::every_result_vector_reads_as_it_says \
                   conformance::tests::a_device_that_keeps_another_number_of_shots_conforms \
                   conformance::tests::every_estimate_vector_reads_as_it_says \
                   conformance::tests::a_provider_that_sets_no_price_states_its_counts_and_runs_only_with_the_spend_allowed \
                   the_schema_takes_exactly_the_estimate_forms_a_client_reads the_schema_takes_every_result_a_client_keeps; do
            grep -q "^test $t \.\.\. ok$" "$RUNNER_TEMP/test.log" || { echo "::error::$t did not run and pass"; exit 1; }
          done
      - name: Clippy
        shell: bash
        working-directory: wai/wai-quantum-qpu
        run: cargo clippy --locked --all-targets --no-deps -- -D warnings

  keychain:
    name: credentials in the keychain (macos)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: macos
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Put cargo on PATH
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      # The registry's tests, the keychain's among them: a credential kept,
      # read back, replaced and forgotten through the system tool, in a
      # keychain file the test makes and deletes (the runner's own keychain
      # is never touched).
      - name: The keychain test
        shell: bash
        working-directory: wai/wai-quantum-qpu
        run: |
          set -euo pipefail
          nice -n 10 cargo test --locked --lib registry:: 2>&1 | tee "$RUNNER_TEMP/keychain.log"
          grep -q '^test registry::tests::the_macos_keychain_keeps_reads_and_forgets_a_credential \.\.\. ok$' "$RUNNER_TEMP/keychain.log" || { echo "::error::the keychain test did not run and pass"; exit 1; }