guix-build.yml

name: Guix Build

permissions: {}

on:
  pull_request_target: # zizmor: ignore[dangerous-triggers] runs only when a maintainer applies the 'guix-build' label
    types: [labeled]
  push:
  schedule:
    # Run weekly at 3 AM UTC on Sunday on the default branch
    - cron: '0 3 * * 0'

jobs:
  build-image:
    permissions:
      packages: write
    runs-on: ubuntu-24.04-arm
    if: |
      (github.event_name == 'push' && (startsWith(github.ref, 'refs/tags/') || vars.RUN_GUIX_ON_ALL_PUSH == 'true')) ||
      contains(github.event.pull_request.labels.*.name, 'guix-build') ||
      github.event_name == 'schedule'
    outputs:
      image: ghcr.io/${{ steps.prepare.outputs.repo-name }}/dashcore-guix-builder@${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true
          persist-credentials: false
          path: dash
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Commit variables
        id: prepare
        env:
          TRUSTED: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
        run: |
          echo "hash=$(sha256sum ./dash/contrib/containers/guix/Dockerfile | cut -d ' ' -f1)" >> $GITHUB_OUTPUT
          echo "host_user_id=$(id -u)" >> $GITHUB_OUTPUT
          echo "host_group_id=$(id -g)" >> $GITHUB_OUTPUT
          BRANCH_NAME=$(echo "${GITHUB_REF##*/}" | tr '[:upper:]' '[:lower:]')
          REPO_NAME=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          IMAGE="ghcr.io/${REPO_NAME}/dashcore-guix-builder"
          # Only trusted events may write tags that other runs read
          if [[ "$TRUSTED" == "true" ]]; then
            echo "tags=${IMAGE}:${BRANCH_NAME},${IMAGE}:latest,${IMAGE}:trusted-latest" >> "$GITHUB_OUTPUT"
          else
            echo "tags=${IMAGE}:untrusted" >> "$GITHUB_OUTPUT"
          fi
          echo "repo-name=${REPO_NAME}" >> $GITHUB_OUTPUT

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Docker image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ${{ github.workspace }}/dash
          build-args: |
            USER_ID=${{ steps.prepare.outputs.host_user_id }}
            GROUP_ID=${{ steps.prepare.outputs.host_group_id }}
          build-contexts: |
            docker_root=${{ github.workspace }}/dash/contrib/containers/guix
          file: ./dash/contrib/containers/guix/Dockerfile
          push: true
          tags: ${{ steps.prepare.outputs.tags }}
          cache-from: type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo-name }}/dashcore-guix-builder:trusted-latest
          cache-to: type=inline,mode=max

  build:
    needs: build-image
    # runs-on: [ "self-hosted", "linux", "x64", "ubuntu-core" ]
    runs-on: ubuntu-24.04-arm
    permissions:
      packages: read
      id-token: write
      attestations: write
    strategy:
      matrix:
        build_target: [x86_64-linux-gnu, aarch64-linux-gnu, riscv64-linux-gnu, powerpc64-linux-gnu, x86_64-w64-mingw32, x86_64-apple-darwin, arm64-apple-darwin]

    timeout-minutes: 480
    steps:
      - name: Disable apparmor user namespace restrictions
        run: |
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true
          persist-credentials: false
          path: dash
          fetch-depth: 0

      # Attested tag builds must not restore caches that labelled
      # pull_request_target runs can write
      - name: Cache depends sources
        if: github.ref_type != 'tag'
        uses: actions/cache@v5
        with:
          path: dash/depends/sources
          key: depends-sources-${{ hashFiles('dash/depends/packages/*') }}
          restore-keys: |
            depends-sources-

      - name: Cache Guix and depends
        id: guix-cache-restore
        if: github.ref_type != 'tag'
        uses: actions/cache@v5
        with:
          path: |
            ${{ github.workspace }}/.cache
            ${{ github.workspace }}/dash/depends/built
            ${{ github.workspace }}/dash/depends/work
            /gnu/store
          key: ${{ runner.os }}-guix-${{ matrix.build_target }}-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-guix-${{ matrix.build_target }}
            ${{ runner.os }}-guix-

      - name: Create .cache folder if missing
        if: steps.guix-cache-restore.outputs.cache-hit != 'true'
        run: mkdir -p .cache

      - name: Run Guix build
        timeout-minutes: 480
        env:
          IMAGE: ${{ needs.build-image.outputs.image }}
          BUILD_TARGET: ${{ matrix.build_target }}
        run: |
          docker run --privileged -d --rm -t \
            --name guix-daemon \
            -v "${GITHUB_WORKSPACE}/dash:/src/dash" \
            -v "${GITHUB_WORKSPACE}/.cache:/home/ubuntu/.cache" \
            -w /src/dash \
            "${IMAGE}" && \
          docker exec -e HOSTS="${BUILD_TARGET}" guix-daemon bash -c '/usr/local/bin/guix-start /src/dash'

      - name: Ensure build passes
        run: |
          if [[ $? != 0 ]]; then
            echo "Guix build failed!"
            exit 1
          fi

      - name: Compute SHA256 checksums
        continue-on-error: true # It will complain on depending on only some hosts
        env:
          HOSTS: ${{ matrix.build_target }}
        run: |
          ./dash/contrib/containers/guix/scripts/guix-check "${GITHUB_WORKSPACE}/dash"

      - name: Upload build artifacts
        uses: actions/upload-artifact@v6
        with:
          name: guix-artifacts-${{ matrix.build_target }}
          path: |
            ${{ github.workspace }}/dash/guix-build*/output/${{ matrix.build_target }}/
          compression-level: 0

      - name: Attest build provenance
        uses: actions/attest@v4
        with:
          subject-path: ${{ github.workspace }}/dash/guix-build*/output/${{ matrix.build_target }}/*

      - name: Upload SHA256SUMS fragment
        uses: actions/upload-artifact@v6
        with:
          name: guix-sha256sums-${{ matrix.build_target }}
          path: ${{ github.workspace }}/dash/guix-build*/output/${{ matrix.build_target }}/SHA256SUMS.part
          if-no-files-found: error

  # Publish the release's guix.sigs-format noncodesigned.SHA256SUMS with a
  # keyless (Sigstore) attestation tying it to this workflow and tag
  attest:
    needs: build
    if: github.repository == 'dashpay/dash' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-24.04
    permissions:
      id-token: write
      attestations: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false
          path: dash

      - name: Download SHA256SUMS fragments
        uses: actions/download-artifact@v8
        with:
          pattern: guix-sha256sums-*
          path: ${{ runner.temp }}/fragments
          merge-multiple: true

      - name: Create SHA256SUMS
        working-directory: dash
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          mkdir "${RUNNER_TEMP}/guix.sigs"
          # Only finds the outputs of a build versioned exactly after the tag
          env FORCE_VERSION="${VERSION}" \
              OUTDIR_BASE="${RUNNER_TEMP}/fragments/guix-build-${VERSION}/output" \
              GUIX_SIGS_REPO="${RUNNER_TEMP}/guix.sigs" SIGNER=dashcore-ci NO_SIGN=1 \
            ./contrib/guix/guix-attest

      - name: Attest SHA256SUMS
        uses: actions/attest@v4
        with:
          subject-path: ${{ runner.temp }}/guix.sigs/*/*/noncodesigned.SHA256SUMS

      - name: Upload SHA256SUMS
        uses: actions/upload-artifact@v6
        with:
          name: guix-sigs-${{ github.ref_name }}
          path: ${{ runner.temp }}/guix.sigs/