open-standards/.github/workflows/wai-quantum-qpu.yml

name: wai-quantum-qpu

# The clients for quantum processing services: every client against a service
# that follows its provider's published contract (the fake parses the program
# in the provider's format, runs it on wai-quantum's simulator, and answers in
# the provider's result shape and bit order), certification through the
# fabric, the probe that catches a service with another bit order, and curl
# end to end against a local server. And the person's own providers: the
# open provider protocol against the reference provider over both
# transports (a local process and HTTP through curl), its conformance
# vectors, the reference's pinned counts, the registry with its credential
# in a file only its owner reads, the refusal of a run that is not free
# until it is confirmed, receipts that verify, and no credential in
# anything a run returns; and, on macOS, the keychain in a keychain file
# made for the test. No request leaves the runner, and nothing spends money.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'wai/wai-quantum-qpu/**'
      - 'wai/wai-quantum/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-quantum-qpu.yml'
  schedule:
    - cron: '1 7 * * *'

jobs:
  # Does this pull request's own diff touch the paths below? This forge matches a
  # workflow's `paths:` against the push, so a merge of main into a branch fires the
  # workflow whatever the pull request changes; every job here waits on this answer.
  # A push to main, a schedule, or anything the script cannot determine answers
  # `true` (scripts/pr-touches-paths.py).
  relevant:
    name: does this change touch it
    runs-on: gate
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-quantum-qpu.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-quantum-qpu: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  clients:
    name: clients against their contracts (linux)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.99.1
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
          rustup toolchain install 1.99.1 --profile minimal --component clippy
          rustup default 1.99.1
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Tests
        shell: bash
        working-directory: wai/wai-quantum-qpu
        run: |
          set -euo pipefail
          command -v curl >/dev/null || { echo "::error::no curl: the transport test would pass over nothing"; exit 1; }
          # The credentials go to files here: CI has no keychain, and the
          # tests never touch one but the macOS leg's own.
          export WAI_QUANTUM_CREDENTIALS=file
          cargo test --locked 2>&1 | tee "$RUNNER_TEMP/test.log"
          # The library (81, the cloud-tasks client's 26 among them), the clients
          # against their contracts (15), and the providers end to end (12), each
          # binary's count pinned.
          for n in 81 15 12; do
            grep -qE "^test result: ok\. $n passed; 0 failed" "$RUNNER_TEMP/test.log" || { echo "::error::a test binary did not pass all $n of its tests"; exit 1; }
          done
          for t in curl_carries_a_request_to_a_server_and_back every_operation_over_http every_operation_over_a_local_process \
                   the_reference_conforms_over_both_transports the_reference_gives_its_pinned_counts_on_every_platform \
                   a_run_that_is_not_free_is_refused_until_confirmed_and_carries_its_cost \
                   a_credential_reaches_the_provider_and_nothing_a_run_returns \
                   job::tests::a_recorded_job_outlives_what_sent_it_and_seals_as_a_run_would job::tests::running_out_of_patience_does_not_cancel_the_job \
                   job::tests::nothing_is_sent_that_could_not_be_recorded_first job::tests::a_job_that_may_have_been_sent_is_never_sent_again \
                   ledger::tests::a_handle_cannot_reach_outside_the_records \
                   cloud_tasks::tests::the_signature_is_the_published_example cloud_tasks::tests::a_processor_gets_a_verbatim_box_on_its_own_qubit_names \
                   cloud_tasks::tests::a_submission_names_the_persons_own_bucket_and_never_carries_their_secret \
                   job::tests::what_a_provider_states_of_its_counts_is_sealed_and_a_statement_out_of_form_is_refused \
                   job::tests::a_job_recorded_before_clients_stated_what_they_sent_says_no_one_stated_it \
                   every_built_in_kind_states_what_it_sent_and_its_receipt_keeps_every_rule \
                   cloud_tasks::tests::temporary_keys_send_their_token_and_sign_it cloud_tasks::tests::the_look_for_a_secret_reads_a_request_s_body \
                   cloud_tasks::tests::a_program_on_a_qubit_past_the_sixty_fourth_is_read_back cloud_tasks::tests::a_dotted_bucket_is_read_by_path_where_its_host_has_no_certificate \
                   registry::tests::a_named_credential_that_gives_nothing_is_an_error_saying_where_it_looked \
                   registry::tests::every_part_of_kept_keys_is_taken_out_of_a_message_whole_or_cut_short \
                   sampler_v2::tests::a_simulated_backend_is_not_silicon \
                   a_job_recorded_by_the_last_release_is_sealed_with_a_receipt_this_one_accepts \
                   a_receipt_names_the_device_s_qubits_as_the_program_was_sent_on_them \
                   cloud_tasks::tests::signing_gives_the_published_test_suite_s_signatures \
                   cloud_tasks::tests::a_client_that_did_not_submit_a_task_does_not_read_it_through_today_s_device \
                   cloud_tasks::tests::a_task_is_asked_after_in_the_region_its_id_names \
                   registry::tests::a_kind_this_build_does_not_know_is_kept_and_the_rest_is_read \
                   a_cloud_task_cancelled_while_it_waits_ends_cancelled \
                   cloud_tasks_round_trip_through_their_contract a_job_collected_later_is_read_through_the_qubits_it_was_sent_on; do
            grep -q "^test $t \.\.\. ok$" "$RUNNER_TEMP/test.log" || { echo "::error::$t did not run and pass"; exit 1; }
          done
      - name: Clippy
        shell: bash
        working-directory: wai/wai-quantum-qpu
        run: cargo clippy --locked --all-targets --no-deps -- -D warnings

  keychain:
    name: credentials in the keychain (macos)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: macos
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Put cargo on PATH
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      # The registry's tests, the keychain's among them: a credential kept,
      # read back, replaced and forgotten through the system tool, in a
      # keychain file the test makes and deletes (the runner's own keychain
      # is never touched).
      - name: The keychain test
        shell: bash
        working-directory: wai/wai-quantum-qpu
        run: |
          set -euo pipefail
          nice -n 10 cargo test --locked --lib registry:: 2>&1 | tee "$RUNNER_TEMP/keychain.log"
          grep -q '^test registry::tests::the_macos_keychain_keeps_reads_and_forgets_a_credential \.\.\. ok$' "$RUNNER_TEMP/keychain.log" || { echo "::error::the keychain test did not run and pass"; exit 1; }