name: WAI HTTP delivery

# extensions/http-delivery.md: two jobs beside the corpus checks in wai-conformance.yml.
#
# falsify — the HTTP corpus tool and its independent verifier must catch defects. Each
#   patch in wai/http-conformance/falsify/ breaks one function of wai-rs (the content
#   hash's domain, the root flag, the left-subtree rule, the chunk counter, the component
#   digest check, the Content-Range and content-coding checks, ASCII-only numbers, the
#   union, layers' place in it and their dispatch, the wai prefix's case, duplicate
#   capabilities, a record beside a fallback, the trailing-byte rule, the missing-digest
#   plan, the class merge, the base-only threshold, refused refinement responses, stale
#   bytes after a mismatch, an unanswered base, the selection digest test, the component
#   conformance that withholds an envelope's refinements; and on the
#   playlist side adjacency, rendering, bandwidths, durations, the classical master, the
#   playlist receipt and its chain, listed cids, and the adaptation policies); it
#   is applied to a fresh worktree, the build must succeed, and `wai_http_vectors verify`
#   must fail naming the cases on the patch's first line. Then each `http_verify.py
#   --mutate` must fail, and the differential: wai-rs writes random envelopes' covered
#   prefixes and head proofs, the Python verifier accepts every one, and refuses exactly
#   the ten it changes one chaining-value byte in.
#
# cache-conformance — the cache rules (§9). wai/cache-conformance/run.sh stages the
#   corpus's objects behind the reference origin (`wai http origin`) and runs driver.py
#   against the origin, which must pass every MUST test, and against four negative-control
#   proxies, which must each fail the tests their defect reaches. Labelled caches run only
#   where the environment provides them (/opt/wai-cache); this repository holds none, and
#   the job summary says when none ran. The reports are uploaded as an artifact.
#
# No workflow_dispatch: it does not start runs on this forge. A weekly schedule keeps the
# jobs exercised between changes.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
    paths:
      - 'wai/wai-rs/src/http_binding/**'
      - 'wai/wai-rs/src/container.rs'
      - 'wai/wai-rs/src/jwp_hash.rs'
      - 'wai/wai-rs/src/bin/wai.rs'
      - 'wai/wai-rs/src/bin/wai_http_vectors.rs'
      - 'wai/wai-rs/src/bin/wai_cli/http.rs'
      - 'wai/wai-rs/src/bin/wai_cli/http_vectors.rs'
      - 'wai/wai-rs/src/bin/wai_cli/http_vectors_playlists.rs'
      - 'wai/wai-rs/src/bin/wai_cli/http_playlists.rs'
      # The playlists render through hls_render and are sealed by wai_video_manifest.
      - 'wai/wai-rs/src/hls_render.rs'
      - 'wai/wai-rs/src/wai_video_manifest.rs'
      # Playlist receipts verify Ed25519 through the shared strict rule, in Rust and Python.
      - 'wai/wai-rs/src/sig.rs'
      - 'wai/claim-conformance/_ed25519.py'
      - 'wai/wai-rs/Cargo.toml'
      - 'wai/http-conformance/**'
      - 'wai/cache-conformance/**'
      - 'wai/claim-conformance/_blake3.py'
      # http_verify.py reads staged_verify.py (and through it int_payload_verify.py), and
      # the corpus carries the staged ladder's base and layers.
      - 'wai/staged-conformance/staged_verify.py'
      # staged_verify.py's component rules (SPEC §7.1) read the capability registry.
      - 'wai/registry/capabilities.json'
      - 'wai/staged-conformance/cases/audio_flac_rate_ladder/**'
      - 'wai/int-payload-conformance/int_payload_verify.py'
      - 'wai/registry/**'
      - '.github/workflows/wai-http.yml'
  pull_request:
    paths:
      - 'wai/wai-rs/src/http_binding/**'
      - 'wai/wai-rs/src/container.rs'
      - 'wai/wai-rs/src/jwp_hash.rs'
      - 'wai/wai-rs/src/bin/wai.rs'
      - 'wai/wai-rs/src/bin/wai_http_vectors.rs'
      - 'wai/wai-rs/src/bin/wai_cli/http.rs'
      - 'wai/wai-rs/src/bin/wai_cli/http_vectors.rs'
      - 'wai/wai-rs/src/bin/wai_cli/http_vectors_playlists.rs'
      - 'wai/wai-rs/src/bin/wai_cli/http_playlists.rs'
      # The playlists render through hls_render and are sealed by wai_video_manifest.
      - 'wai/wai-rs/src/hls_render.rs'
      - 'wai/wai-rs/src/wai_video_manifest.rs'
      # Playlist receipts verify Ed25519 through the shared strict rule, in Rust and Python.
      - 'wai/wai-rs/src/sig.rs'
      - 'wai/claim-conformance/_ed25519.py'
      - 'wai/wai-rs/Cargo.toml'
      - 'wai/http-conformance/**'
      - 'wai/cache-conformance/**'
      - 'wai/claim-conformance/_blake3.py'
      # http_verify.py reads staged_verify.py (and through it int_payload_verify.py), and
      # the corpus carries the staged ladder's base and layers.
      - 'wai/staged-conformance/staged_verify.py'
      # staged_verify.py's component rules (SPEC §7.1) read the capability registry.
      - 'wai/registry/capabilities.json'
      - 'wai/staged-conformance/cases/audio_flac_rate_ladder/**'
      - 'wai/int-payload-conformance/int_payload_verify.py'
      - 'wai/registry/**'
      - '.github/workflows/wai-http.yml'
  schedule:
    - cron: '17 4 * * 1'

jobs:
  falsify:
    name: HTTP corpus · falsification and differential
    runs-on: linux
    steps:
      - uses: actions/checkout@v5

      - name: Install Rust 1.98.0
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      # One target directory for every patched build, so only the wai crate rebuilds.
      - name: Every patch is caught; every mutation is caught; the differential holds
        shell: bash
        env:
          CARGO_TARGET_DIR: ${{ runner.temp }}/falsify-target
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          bash wai/http-conformance/falsify/run.sh "$RUNNER_TEMP/falsify"

  cache-conformance:
    name: cache rules · controls and labelled caches
    runs-on: linux
    steps:
      - uses: actions/checkout@v5

      - name: Install Rust 1.98.0
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Build the reference origin
        working-directory: wai/wai-rs
        shell: bash
        run: cargo build --release --no-default-features --features http --bin wai

      # The verdict: run.sh exits non-zero when the origin fails a MUST test, a control is
      # not caught, or a labelled cache fails one.
      - name: The origin passes, the controls are caught, labelled caches report
        shell: bash
        run: WAI="$GITHUB_WORKSPACE/wai/wai-rs/target/release/wai" bash wai/cache-conformance/run.sh "$RUNNER_TEMP/cache"

      # The evidence in the log, whatever becomes of the upload: each report's path and
      # SHA-256, and the summary.
      - name: The reports, in the log
        if: always()
        shell: bash
        run: |
          cd "$RUNNER_TEMP/cache/reports" 2>/dev/null || { echo "no reports were written"; exit 0; }
          for f in *; do printf '%s  %s\n' "$(sha256sum "$f" | cut -d' ' -f1)" "$RUNNER_TEMP/cache/reports/$f"; done
          cat summary.md 2>/dev/null || true

      # An upload this forge cannot take must not decide the job: the verdict is the step
      # above it.
      - name: Upload the reports
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@v3
        with:
          name: cache-conformance-reports
          path: ${{ runner.temp }}/cache/reports