open-standards/.github/workflows/wai-ops.yml

name: wai-ops integer operators

# The integer operator set (wai/extensions/integer-operators.md), checked on every
# fabric leg the corpus has today. Every leg recomputes every vector file of
# wai/ops-conformance/ from its inputs and requires the committed bytes:
#
#   - Linux x86_64, Linux arm64 and macOS arm64, natively, debug and release: the
#     unit tests, the goldens (every committed parameter set lowered, loaded and
#     decoded through the interpreter to its committed output digest), the step-8
#     test and the doc tests, each in the default build and with the `uncertified`
#     switch, and `wai-ops vectors verify`, which also re-lowers every set and
#     regenerates the whole corpus;
#   - WASI (wasm32-wasip2) under wasmtime, a 32-bit target: the same unit tests,
#     goldens and step-8 test in both builds, and the same `vectors verify`;
#   - a browser's engine (wasm32-unknown-unknown) under Node: the recomputation of
#     every vector file;
#   - the independent checker, tools/wai_ops_check.py: Python standard library only,
#     sharing no code with wai-ops, rewrites every vector file and every lowered graph.
#
# There is no Windows leg: the Windows runner has been offline since 2026-08-28.

# One run per branch at a time. A push supersedes the run before it.
#
# There is one `macos` runner and it is the dev Mac, so every macOS job in this repo
# queues on it; only the newest commit's verdict is wanted, so older runs are
# cancelled. `cancel-in-progress: true` also applies to `main`, which advances by
# merge commits whose tree contains the commits before them.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'wai/wai-ops/**'
      - 'wai/ops-conformance/**'
      - 'wai/tools/wai_ops_*.py'
      # The text the checker is held to.
      - 'wai/extensions/integer-operators.md'
      # Every committed parameter set the corpus lowers, and the digests the goldens
      # compare against (neural-conformance/sha256.json among them).
      - 'wai/neural-conformance/**'
      - 'wai/wai-rs/tests/vectors/int_hyper/**'
      - 'wai/wai-rs/tests/vectors/int_audio/**'
      - 'wai/wai-rs/tests/vectors/int_splat/**'
      - 'wai/wai-rs/tests/vectors/int_mlicpp/**'
      - 'wai/wai-rs/tests/vectors/int_world/**'
      - 'wai/wai-rs/tests/vectors/int_world2/**'
      - '.github/workflows/wai-ops.yml'
  push:
    branches:
      - main
    paths:
      - 'wai/wai-ops/**'
      - 'wai/ops-conformance/**'
      - 'wai/tools/wai_ops_*.py'
      - 'wai/extensions/integer-operators.md'
      - 'wai/neural-conformance/**'
      - 'wai/wai-rs/tests/vectors/int_hyper/**'
      - 'wai/wai-rs/tests/vectors/int_audio/**'
      - 'wai/wai-rs/tests/vectors/int_splat/**'
      - 'wai/wai-rs/tests/vectors/int_mlicpp/**'
      - 'wai/wai-rs/tests/vectors/int_world/**'
      - 'wai/wai-rs/tests/vectors/int_world2/**'
      - '.github/workflows/wai-ops.yml'

jobs:
  native:
    name: ${{ matrix.label }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: linux,       label: linux-x86_64 }
          - { os: linux-arm64, label: linux-aarch64 }
          - { os: macos,       label: macos-arm64 }
    steps:
      - uses: actions/checkout@v4

      # The docker images ship no Rust; the macOS host has it, but launchd's PATH omits
      # ~/.cargo/bin.
      - name: Install Rust 1.98.0
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      # Without the `uncertified` switch, load step 8 refuses every graph: the default
      # build is what a decoder would link before the certifier exists. Its tests show
      # that, and the doc tests that a graph runs only once loaded.
      - name: Unit, step-8 and doc tests, default build
        working-directory: wai/wai-ops
        shell: bash
        run: cargo test --locked

      - name: Unit tests and goldens, debug
        working-directory: wai/wai-ops
        shell: bash
        run: cargo test --locked --features uncertified

      - name: Unit tests and goldens, release
        working-directory: wai/wai-ops
        shell: bash
        run: cargo test --locked --release --features uncertified

      - name: Every vector file recomputed, every set re-lowered, the corpus regenerated
        working-directory: wai/wai-ops
        shell: bash
        run: cargo run --locked --release --features uncertified --bin wai-ops -- vectors verify ..

  wasip2:
    name: wasm32-wasip2 (wasmtime)
    runs-on: linux
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust 1.98.0 with the wasm32-wasip2 target
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0
          rustup target add wasm32-wasip2
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Install wasmtime 38.0.3
        shell: bash
        run: |
          set -euo pipefail
          v=38.0.3
          curl --proto '=https' --tlsv1.2 -sSfL -o "$RUNNER_TEMP/wasmtime.tar.xz" \
            "https://github.com/bytecodealliance/wasmtime/releases/download/v$v/wasmtime-v$v-x86_64-linux.tar.xz"
          tar -C "$RUNNER_TEMP" -xf "$RUNNER_TEMP/wasmtime.tar.xz"
          echo "$RUNNER_TEMP/wasmtime-v$v-x86_64-linux" >> "$GITHUB_PATH"

      # The tests read committed files through CARGO_MANIFEST_DIR/.., so the wai
      # directory is preopened at its own absolute path.
      - name: Unit and step-8 tests, default build, under WASI
        working-directory: wai/wai-ops
        shell: bash
        run: |
          set -euo pipefail
          W=$(cd .. && pwd)
          CARGO_TARGET_WASM32_WASIP2_RUNNER="wasmtime run --dir $W::$W" \
            cargo test --locked --release --target wasm32-wasip2

      - name: Unit tests, goldens and step-8 test, under WASI
        working-directory: wai/wai-ops
        shell: bash
        run: |
          set -euo pipefail
          W=$(cd .. && pwd)
          CARGO_TARGET_WASM32_WASIP2_RUNNER="wasmtime run --dir $W::$W" \
            cargo test --locked --release --features uncertified --target wasm32-wasip2

      - name: Build the tool for wasm32-wasip2
        working-directory: wai/wai-ops
        shell: bash
        run: cargo build --locked --release --features uncertified --target wasm32-wasip2 --bin wai-ops

      - name: Every vector file recomputed, every set re-lowered, the corpus regenerated, under WASI
        working-directory: wai
        shell: bash
        run: |
          set -euo pipefail
          wasmtime --version
          wasmtime run --dir .::/wai wai-ops/target/wasm32-wasip2/release/wai-ops.wasm vectors verify /wai

  node:
    name: wasm32 under Node
    runs-on: linux
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust 1.98.0 with the wasm32 target
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0
          rustup target add wasm32-unknown-unknown
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Build the recomputation for wasm32-unknown-unknown
        working-directory: wai/wai-ops/node
        shell: bash
        run: cargo build --locked --release --target wasm32-unknown-unknown

      - name: Every vector file recomputed under Node
        working-directory: wai/wai-ops/node
        shell: bash
        run: node verify.mjs target/wasm32-unknown-unknown/release/wai_ops_node.wasm ../../ops-conformance

  checker:
    name: independent checker (Python)
    runs-on: linux
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      # Standard library only, so it needs nothing installed.
      - name: wai_ops_check.py rewrites every vector file and every lowered graph
        working-directory: wai
        shell: bash
        run: python3 -I tools/wai_ops_check.py ops-conformance

      - name: Every workflow declares a concurrency group
        shell: bash
        run: bash scripts/check-workflow-concurrency.sh