lint-bpf-checks.yaml

name: BPF Checks

# Any change in triggers needs to be reflected in the concurrency group.
on:
  pull_request: {}
  push:
    branches:
      - v1.14
      - ft/v1.14/**

permissions: read-all

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }}
  cancel-in-progress: true

jobs:
  check_changes:
    name: Deduce required tests from code changes
    runs-on: ubuntu-latest
    outputs:
      bpf-tree: ${{ steps.changes.outputs.bpf-tree }}
      coccinelle: ${{ steps.changes.outputs.coccinelle }}
      bpf-tests-runner: ${{ steps.changes.outputs.bpf-tests-runner }}
      workflow-description: ${{ steps.changes.outputs.workflow-description }}
    steps:
      - name: Checkout code
        if: ${{ !github.event.pull_request }}
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          persist-credentials: false
      - name: Check code changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          # For `push` events, compare against the `ref` base branch
          # For `pull_request` events, this is ignored and will compare against the pull request base branch
          base: ${{ github.ref }}
          filters: |
            bpf-tree:
              - 'bpf/**'
            coccinelle:
              - 'contrib/coccinelle/**'
            bpf-tests-runner:
              - 'test/bpf_tests/**'
              - 'pkg/bpf/**'
            workflow-description:
              - '.github/workflows/lint-bpf-checks.yaml'

  checkpatch:
    name: Check Patch
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Run checkpatch.pl
        run: |
          make -C bpf checkpatch || (echo "Run 'make -C bpf checkpatch' locally to investigate reports"; exit 1)

  # Runs only if code under bpf/ or contrib/coccinnelle/ is changed.
  coccicheck:
    needs: check_changes
    if: ${{ needs.check_changes.outputs.bpf-tree == 'true' || needs.check_changes.outputs.coccinelle == 'true' || needs.check_changes.outputs.workflow-description == 'true' }}
    name: Run coccicheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          persist-credentials: false
      - name: Run coccicheck 
        uses: docker://cilium/coccicheck:2.4@sha256:24abe3fbb8e829fa41a68a3b76cb4df84fd5a87a7d1d6254c1c1fe5effb5bd1b
        with:
          entrypoint: ./contrib/coccinelle/check-cocci.sh
        # Note: Setting COCCINELLE_HOME can be removed, here and in the
        # messages in the .cocci files, next time we upgrade coccinelle.
        # The issue was fixed, after v1.1.1 that we're using, in
        # https://gitlab.inria.fr/coccinelle/coccinelle/-/commit/540888ff426e.
        env:
          COCCINELLE_HOME: /usr/local/lib/coccinelle

  set_clang_dir:
    name: Set clang directory
    runs-on: ubuntu-latest
    outputs:
      clang_dir: ${{ steps.set_dir.outputs.clang_dir }}
    steps:
    - name: Set directory
      id: set_dir
      run: echo "clang_dir=$HOME/.clang" >> $GITHUB_OUTPUT

  # Runs only if code under bpf/ is changed.
  build_all:
    needs: [check_changes, set_clang_dir]
    if: ${{ needs.check_changes.outputs.bpf-tree == 'true' || needs.check_changes.outputs.workflow-description == 'true' }}
    name: Build Datapath
    runs-on: ubuntu-22.04
    steps:
      - name: Install Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          # renovate: datasource=golang-version depName=go
          go-version: 1.21.9
      - name: Cache LLVM and Clang
        id: cache-llvm
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ${{ needs.set_clang_dir.outputs.clang_dir }}
          key: llvm-10.0
      - name: Install LLVM and Clang prerequisites
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends libtinfo5
      - name: Install LLVM and Clang
        uses: KyleMayes/install-llvm-action@8b37482c5a2997a3ab5dbf6561f8109e2eaa7d3b # v2.0.2
        with:
          version: "10.0"
          directory: ${{ needs.set_clang_dir.outputs.clang_dir }}
          cached: ${{ steps.cache-llvm.outputs.cache-hit }}
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Build all BPF datapath permutations
        env:
          V: 0
        run: |
          make --quiet -C bpf build_all || (echo "Run 'make -C bpf build_all' locally to investigate build breakages"; exit 1)

  bpf_tests:
    needs: [check_changes, set_clang_dir]
    if: ${{ needs.check_changes.outputs.bpf-tree == 'true' || needs.check_changes.outputs.bpf-tests-runner == 'true' || needs.check_changes.outputs.workflow-description == 'true' }}
    name: BPF unit/integration Tests
    runs-on: ubuntu-22.04
    steps:
      - name: Install Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          # renovate: datasource=golang-version depName=go
          go-version: 1.21.9
      - name: Cache LLVM and Clang
        id: cache-llvm
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ${{ needs.set_clang_dir.outputs.clang_dir }}
          key: llvm-10.0
      - name: Install LLVM and Clang prerequisites
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends libtinfo5
      - name: Install LLVM and Clang
        uses: KyleMayes/install-llvm-action@8b37482c5a2997a3ab5dbf6561f8109e2eaa7d3b # v2.0.2
        with:
          version: "10.0"
          directory: ${{ needs.set_clang_dir.outputs.clang_dir }}
          cached: ${{ steps.cache-llvm.outputs.cache-hit }}
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Run BPF tests with code coverage reporting
        env:
          # Disable coverage report for these test cases since they are hitting
          # https://github.com/cilium/coverbee/issues/7
          NOCOVER_PATTERN: "inter_cluster_snat_clusterip.*|l4lb_ipip_health_check_host.o|nodeport_geneve_dsr_*|session_affinity_test.o|tc_egressgw_redirect.o|tc_egressgw_snat.o|tc_nodeport_lb4_dsr_backend.o|tc_nodeport_lb4_dsr_lb.o|tc_nodeport_lb4_nat_backend.o|tc_nodeport_lb4_nat_lb.o|tc_nodeport_lb6_dsr_backend.o|tc_nodeport_lb6_dsr_lb.o|xdp_egressgw_reply.o|xdp_nodeport_lb4_dsr_lb.o|xdp_nodeport_lb4_nat_backend.o|xdp_nodeport_lb4_nat_lb.o|xdp_nodeport_lb4_test.o|xdp_nodeport_lb6_dsr_lb.o|bpf_nat_tests.o|tc_nodeport_l3_dev.o"
        run: |
          make -C test run_bpf_tests COVER=1 NOCOVER="$NOCOVER_PATTERN" || (echo "Run 'make -C test run_bpf_tests COVER=1 NOCOVER=\"$NOCOVER_PATTERN\"' locally to investigate failures"; exit 1)
      - name: Archive code coverage results
        uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2
        with:
          name: bpf-code-coverage-report
          path: bpf-coverage.html