open-standards/.github/workflows/wai-quantum-sme.yml

name: wai-quantum matrix-extension member

# The fabric's matrix-extension member: the gate's fixed-point arithmetic in the
# processor's streaming vector mode (SME), 64-bit lanes, certified bit-exact
# against the CPU reference's pinned corpus digests.
#
# - sme-emulated (the container runner): the member's device tests for aarch64
#   Linux, run under a user-mode emulator the job fetches and runs itself
#   (Debian's static QEMU, pinned, which emulates SME), never the host's binfmt
#   handler; the job declares the emulator, and every certificate says it was
#   earned there, never on silicon.
# - sme-absent (the macOS runner, whose processor has no SME): the same build
#   finds no member and says why.
#
# Silicon: a processor with SME runs the same tests with the declaration
# `cpu-matrix-sme` and no emulator.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'wai/wai-quantum/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-quantum-sme.yml'
  schedule:
    - cron: '14 8 * * *'

jobs:
  # Does this pull request's own diff touch the paths below? This forge matches a
  # workflow's `paths:` against the push, so a merge of main into a branch fires the
  # workflow whatever the pull request changes; every job here waits on this answer.
  # A push to main, a schedule, or anything the script cannot determine answers
  # `true` (scripts/pr-touches-paths.py).
  relevant:
    name: does this change touch it
    runs-on: linux
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-quantum-sme.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-quantum-sme: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  sme-emulated:
    name: member · matrix extension, emulated (aarch64 Linux)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 90
    container:
      image: ghcr.io/cross-rs/aarch64-unknown-linux-gnu@sha256:7f8308a8734d9fcd2ebbe9a3e4bdea74af293f0799d80c3cc341e340cda49a4c
      options: --memory=6g --memory-swap=6g
    env:
      WAI_QUANTUM_SME_EXPECT: cpu-matrix-sme
      # The emulator every aarch64 test binary runs under, which the certificates
      # name: Debian's static QEMU, SHA-256 pinned, fetched by the job and named as
      # cargo's runner. Not the image's own (5.1), and not the host's binfmt
      # handler, which some `linux` runners lack and others run at another
      # version. (Not QEMU_*: qemu-user reads every QEMU_<option> variable as that
      # option.)
      WAI_QUANTUM_SME_EMULATOR: qemu-user 10.0.13 (Debian's static build, run by the job)
      USER_EMULATOR_VERSION: 10.0.13
      USER_EMULATOR_DEB: qemu-user_10.0.13+ds-0+deb13u1_amd64.deb
      USER_EMULATOR_SHA256: ca6ede739327a20ae5a3498230c8a3a9a072c586e131bc6bcc1201eb1725e336
      USER_EMULATOR_SHA1: dec1373851d29f91642c197f4a339d0d2ad25ed0
    steps:
      # The image has no Node for a checkout action: the forge's archive of the
      # exact commit, its embedded commit id checked.
      - name: Fetch the source
        shell: bash
        run: |
          set -euo pipefail
          want="${{ github.event.pull_request.head.sha || github.sha }}"
          rm -rf src src.tar.gz src.tar && mkdir src
          curl -sSf -o src.tar.gz "http://100.64.224.0:3400/Transaction-Science/open-standards/archive/$want.tar.gz"
          gzip -dc src.tar.gz > src.tar
          got="$(git get-tar-commit-id < src.tar)"
          [ "$got" = "$want" ] || { echo "::error::the archive is of $got, not $want"; exit 1; }
          # -m: every file gets the time it was extracted, not its commit's. The build
          # reuses a target directory kept between runs, and cargo takes a crate as
          # built when no source file is newer than its last build: with the commit's
          # times, an older commit ran the binary another commit had built there.
          tar -xmf src.tar -C src --strip-components=1
          rm src.tar.gz src.tar
      - name: The member's device tests under the emulator
        shell: bash
        working-directory: src/wai/wai-quantum
        run: |
          set -euo pipefail
          cache=/ci-cache/wai-quantum-sme
          mkdir -p "$cache"
          exec 9>"$cache/.lock"
          flock 9
          # Every source file newer than every build in the cache, now that the lock is
          # held: another run may have built here while this one waited for it, after
          # this one's extraction. (../.. is the extracted tree.)
          find ../.. -type f -exec touch {} +
          export RUSTUP_HOME="$cache/rustup" CARGO_HOME="$cache/cargo" CARGO_TARGET_DIR="$cache/target"
          export PATH="$CARGO_HOME/bin:$PATH"
          if ! command -v rustup >/dev/null; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --profile minimal --default-toolchain none
          fi
          rustup toolchain install
          rustup target add aarch64-unknown-linux-gnu
          # The emulator, fetched once per host into the cache (under the lock above)
          # and checked against its pin, then named as cargo's runner, so this leg
          # passes or fails the same on every `linux` runner.
          q="$cache/qemu-user-$USER_EMULATOR_VERSION"
          if [ ! -x "$q/qemu-aarch64" ]; then
            d="$cache/qemu-user-fetch"; rm -rf "$d" && mkdir "$d"
            curl -sSfL -o "$d/$USER_EMULATOR_DEB" "https://deb.debian.org/debian/pool/main/q/qemu/$USER_EMULATOR_DEB" \
              || curl -sSfL -o "$d/$USER_EMULATOR_DEB" "https://snapshot.debian.org/file/$USER_EMULATOR_SHA1"
            echo "$USER_EMULATOR_SHA256  $d/$USER_EMULATOR_DEB" | sha256sum -c -
            dpkg-deb --fsys-tarfile "$d/$USER_EMULATOR_DEB" | tar -x -C "$d" ./usr/bin/qemu-aarch64
            rm -rf "$q.tmp" && mkdir "$q.tmp" && mv "$d/usr/bin/qemu-aarch64" "$q.tmp/"
            rm -rf "$q" && mv "$q.tmp" "$q" && rm -rf "$d"
          fi
          runner="$q/qemu-aarch64 -L /usr/aarch64-linux-gnu"
          export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUNNER="$runner"
          # Preflight: a trivial program, built for the target and run as cargo will run
          # the tests. An emulator that cannot run it fails the leg here, saying so,
          # rather than as a test that never ran.
          cat > "$RUNNER_TEMP/probe.c" <<'EOF'
          #include <stdio.h>
          #include <sys/utsname.h>
          int main(void) { struct utsname u; if (uname(&u) != 0) return 1; printf("%s\n", u.machine); return 0; }
          EOF
          aarch64-linux-gnu-gcc -o "$RUNNER_TEMP/probe" "$RUNNER_TEMP/probe.c"
          got="$($runner "$RUNNER_TEMP/probe")" || { echo "::error::the emulator cannot run an aarch64 program: $runner"; exit 1; }
          [ "$got" = aarch64 ] || { echo "::error::the preflight program ran as $got, not aarch64"; exit 1; }
          echo "emulator: $("$q/qemu-aarch64" --version | head -1); an aarch64 program runs under it"
          report="$(mktemp)"
          WAI_QUANTUM_SME_REPORT="$report" cargo test --locked --release -j 6 --target aarch64-unknown-linux-gnu --features quantum_fabric_sme --test sme_member -- --test-threads=1 2>&1 | tee "$cache/device.log"
          # The first build after the refresh compiles wai-quantum; one that compiled
          # none ran a binary another commit left in the cache.
          grep -qE '^ *Compiling wai-quantum v[0-9]' "$cache/device.log" || { echo "::error::the build compiled no wai-quantum: its tests ran a binary already in the cache"; exit 1; }
          grep -qE '^test result: ok\. 9 passed; 0 failed' "$cache/device.log" || { echo "::error::not every device test ran and passed"; exit 1; }
          cat "$report"
          key="$WAI_QUANTUM_SME_EXPECT"
          grep -qx "sme devices: as declared ($key)" "$report" || { echo "::error::the member found is not the declared one"; exit 1; }
          grep -q "^sme member: key=$key .*emulator:qemu-user" "$report" || { echo "::error::the member does not say it ran under the emulator"; exit 1; }
          n="$(grep -c "^sme certified: key=$key .* parity=bit-exact " "$report")"
          [ "$n" = 4 ] || { echo "::error::$n of 4 certificates were earned"; exit 1; }
          grep -qx "sme mutants: key=$key killed 3 of 3" "$report" || { echo "::error::a kernel mutant survived"; exit 1; }

  sme-absent:
    name: member · matrix extension absent (macos)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    # The Mac Studio's M3 Ultra has no matrix extension; the fleet's M4 Max and M5 Max
    # do, and this member refuses a host that has one. It runs on the Studio by its label.
    runs-on: macos-m3-ultra
    timeout-minutes: 60
    env:
      WAI_QUANTUM_SME_EXPECT: none
    steps:
      - uses: actions/checkout@v5
      # launchd's PATH omits cargo on the macOS host runner.
      - name: Put cargo on PATH
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: No matrix extension here, and the member says so
        shell: bash
        working-directory: wai/wai-quantum
        run: |
          set -euo pipefail
          [ "$(sysctl -n hw.optional.arm.FEAT_SME 2>/dev/null || echo 0)" = 0 ] || { echo "::error::this runner has SME; declare it and run the silicon tests"; exit 1; }
          report="$RUNNER_TEMP/sme-report.txt"; : > "$report"
          WAI_QUANTUM_SME_REPORT="$report" nice -n 10 cargo test --locked --features quantum_fabric_sme --test sme_member -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/device.log"
          grep -qE '^test result: ok\. 9 passed; 0 failed' "$RUNNER_TEMP/device.log" || { echo "::error::not every device test ran and passed"; exit 1; }
          grep -qx 'sme devices: as declared (none)' "$report" || { echo "::error::the absent case was not established"; exit 1; }