validation.yaml

name: Validation CI
on:
  pull_request:
  push:
    branches: [ master ]
  release:
    types: [ published ]
  schedule:
    # run every day at 0252, 0852, 1452, and 2052 UTC
    - cron: '52 1,7,13,19 * * *'
  workflow_dispatch:
env:
  TERM: xterm
jobs:
  changes:
    name: Check for file changes
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      ci: ${{ steps.filter.outputs.ci }}
      dependencies: ${{ steps.filter.outputs.dependencies }}
      dependencies-files: ${{ steps.filter.outputs.dependencies_files }}
      docker: ${{ steps.filter.outputs.docker }}
      docker-files: ${{ steps.filter.outputs.docker_files }}
      markdown: ${{ steps.filter.outputs.markdown }}
      helpers: ${{ steps.filter.outputs.helpers }}
      shell: ${{ steps.filter.outputs.shell }}
      spelling: ${{ steps.filter.outputs.spelling }}
      test: ${{ steps.filter.outputs.test }}
    steps:
    - uses: actions/checkout@v7
    - uses: dorny/paths-filter@v4
      id: filter
      with:
        filters: resources/config/paths-filter.yaml
        list-files: 'shell'

  dependencies-check:
    name: Check depencencies
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v7
      - name: Renovate
        uses: renovatebot/github-action@v46.3.12
        with:
          configurationFile: 'resources/config/renovate-config.json'
          token: ${{ secrets.RENOVATE_TOKEN }}
      - name: Dependency Review
        uses: actions/dependency-review-action@v5.0.0
        with:
          config-file: 'resources/config/dependency-review.yaml'
          base-ref: ${{ github.event.pull_request.base.sha || 'master' }}
          head-ref: ${{ github.event.pull_request.head.sha || github.ref }}

  shell-lint:
    name: Lint the shell code
    needs: changes
    if: >-
      ${{
        github.event.action == 'prerelease' ||
        github.event.action == 'published' ||
        needs.changes.outputs.ci == 'true' ||
        needs.changes.outputs.dependencies == 'true' ||
        needs.changes.outputs.docker == 'true' ||
        needs.changes.outputs.helpers == 'true' ||
        needs.changes.outputs.shell == 'true' ||
        needs.changes.outputs.test == 'true'
      }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Lint with shellcheck and shfmt
        uses: luizm/action-sh-checker@v0.10.0
        env:
          SHELLCHECK_OPTS: >-
            --enable add-default-case
            --enable avoid-nullary-conditions
            --enable check-unassigned-uppercase
            --enable deprecate-which
            --enable quote-safe-variables
            --enable require-variable-braces
          SHFMT_OPTS: >-
              --case-indent
              --func-next-line
              --indent 2
              --space-redirects

  yaml-lint:
    name: Lint the yaml code
    needs: changes
    if: >-
      ${{
        github.event.action == 'prerelease' ||
        github.event.action == 'published' ||
        needs.changes.outputs.ci == 'true' ||
        needs.changes.outputs.dependencies == 'true' ||
        needs.changes.outputs.docker == 'true' ||
        needs.changes.outputs.shell == 'true' ||
        needs.changes.outputs.test == 'true'
      }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Lint workflow files
        run: |
          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
          ./actionlint -color -verbose
        shell: bash

  dockerfile-lint:
    name: Lint the Dockerfile code
    needs: changes
    if: >-
      ${{
        github.event.action == 'prerelease' ||
        github.event.action == 'published' ||
        needs.changes.outputs.ci == 'true' ||
        needs.changes.outputs.dependencies == 'true' ||
        needs.changes.outputs.docker == 'true' ||
        needs.changes.outputs.shell == 'true'
      }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Lint Dockerfiles
        uses: luke142367/Docker-Lint-Action@v1.1.1
        with:
          target: docker/Dockerfile*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  markdown-checks:
    name: Check the documentation
    needs: changes
    if: >-
      ${{
        github.event.action == 'prerelease' ||
        github.event.action == 'published' ||
        needs.changes.outputs.ci == 'true' ||
        needs.changes.outputs.markdown == 'true'
      }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Lint the markdown
        uses: avto-dev/markdown-lint@v1
        with:
          config: 'resources/config/markdownlint.yaml'
          args: '*/*.md'
          ignore: './docs/pull_request_template.md'
      - name: Check spelling
        uses: rojopolis/spellcheck-github-actions@v0
        with:
          config_path: 'resources/config/spellcheck.yaml'
          output_file: 'spellcheck-output.txt'
      - uses: actions/upload-artifact@v7
        if: '!cancelled()'
        with:
          name: Spellcheck Output
          path: spellcheck-output.txt

  markdown-links:
    name: Check hyperlinks
    runs-on: ubuntu-latest
    # TODO: make this mandatory again with nodebuilder issue 2343
    continue-on-error: true
    steps:
      - uses: actions/checkout@v7
      - name: Run linkspector on markdown
        uses: umbrelladocs/action-linkspector@v1
        with:
          config_file: 'resources/config/linkspector.yaml'
          fail_on_error: true
          reporter: github-check

  conventional-commits:
    name: Check pull request title
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Validate pull request title as a conventional commit
        run: |
          PR_TITLE="$(jq --raw-output .pull_request.title "$GITHUB_EVENT_PATH")"
          PR_REGEX="^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([A-Za-z0-9\-]+\))?: .{1,}$"
          if [[ ${PR_TITLE} =~ ${PR_REGEX} ]]; then
            echo "Pull request title '${PR_TITLE}' is valid."
          else
            echo "Error: Pull request title does not follow Conventional Commits format."
            echo "Expected format: <type>(<scope>): <description>"
            echo "Actual title: ${PR_TITLE}"
            exit 1
          fi

  run-nodebuilder-baremetal:
    name: Test ${{ matrix.job-purpose }} on ${{ matrix.os-friendly-name }}
    needs: [changes, shell-lint, yaml-lint]
    if: >-
      ${{
        github.event.action == 'prerelease' ||
        github.event.action == 'published' ||
        needs.changes.outputs.ci == 'true' ||
        needs.changes.outputs.dependencies == 'true' ||
        needs.changes.outputs.shell == 'true' ||
        needs.changes.outputs.test == 'true'
      }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        # os: [ubuntu-latest, macos-latest, ubuntu-26.04, macos-15]
        os: [ubuntu-latest, macos-latest, macos-15]
        job-purpose: [package, source]
        include:
          - job-purpose: package
            additional-args: ''
          - job-purpose: source
            additional-args: '--compile'
          - os: ubuntu-latest
            os-friendly-name: Ubuntu 24 [x86_64]
            check-environment-command: cat /etc/os-release && lscpu && grep Mem /proc/meminfo
            remove-firefox-command: sudo apt-get remove --assume-yes firefox
            path-to-bitcoin-log: '/home/runner/.bitcoin/debug.log'
          - os: macos-latest
            os-friendly-name: macOS 26 [arm64]
            check-environment-command: sw_vers && sysctl machdep.cpu.core_count machdep.cpu.thread_count machdep.cpu.brand_string && memory_pressure -Q
            path-to-bitcoin-log: '/Users/runner/Library/Application Support/Bitcoin/debug.log'
          # - os: ubuntu-26.04
          #   os-friendly-name: Ubuntu 26 [x86_64]
          #   check-environment-command: cat /etc/os-release && lscpu && grep Mem /proc/meminfo
          #   remove-firefox-command: sudo apt-get remove --assume-yes firefox
          #   path-to-bitcoin-log: '/home/runner/.bitcoin/debug.log'
          - os: macos-15
            os-friendly-name: macOS 15 [arm64]
            check-environment-command: sw_vers && sysctl machdep.cpu.core_count machdep.cpu.thread_count machdep.cpu.brand_string && memory_pressure -Q
            path-to-bitcoin-log: '/Users/runner/Library/Application Support/Bitcoin/debug.log'
    steps:
      - uses: actions/checkout@v7
      - name: Check the current environment
        run: |
          uname -a
          ${{ matrix.check-environment-command }}
          df -h
          date -u
      - name: Remove the snap package
        if: matrix.remove-firefox-command != null
        run: ${{ matrix.remove-firefox-command }}
      - name: Test the console output ${{ matrix.additional-args }}
        id: test-nodebuilder
        run: /bin/sh -x ./test/test_nodebuilder --ref "${GITHUB_SHA}" ${{ matrix.additional-args }}
        timeout-minutes: 120
        continue-on-error: true
      - name: If test failed, debug nodebuilder ${{ matrix.additional-args }}
        if: steps.test-nodebuilder.outcome == 'failure'
        run: |
          CI_NODEBUILDER_URL="https://github.com/bitcoin-tools/nodebuilder/raw/${GITHUB_SHA}/nodebuilder"
          CI_NODEBUILDER_SCRIPT="$(basename "${CI_NODEBUILDER_URL}")"
          [ -n "$(ls /usr/local/bin/*bitcoin* 2> /dev/null)" ] &&
            rm /usr/local/bin/*bitcoin*
          wget --no-verbose --retry-connrefused "${CI_NODEBUILDER_URL}" &&
            chmod u+x "${CI_NODEBUILDER_SCRIPT}"
          sh -x "./${CI_NODEBUILDER_SCRIPT}" ${{ matrix.additional-args }}
        timeout-minutes: 120
      - name: Save Bitcoin Core log as artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.os }}-${{ matrix.job-purpose }}-bitcoin-debug.log
          path: ${{ matrix.path-to-bitcoin-log }}
      - name: If test failed, fail the job
        if: steps.test-nodebuilder.outcome == 'failure'
        run: printf '%s\n' "Review the step 'Test the console output' above." && exit 1

  run-nodebuilder-bsd-vm:
    name: Test source on ${{ matrix.vm-os-friendly-name }} [${{ matrix.vm-arch }}]
    needs: [changes, shell-lint, yaml-lint]
    if: >-
      ${{
        github.event.action == 'prerelease' ||
        github.event.action == 'published' ||
        needs.changes.outputs.ci == 'true' ||
        needs.changes.outputs.dependencies == 'true' ||
        needs.changes.outputs.shell == 'true' ||
        needs.changes.outputs.test == 'true'
      }}
    runs-on: ubuntu-latest
    env:
      FREEBSD_BITCOIN_LOG_PATH: /root/.bitcoin/debug.log
      NETBSD_BITCOIN_LOG_PATH: /root/.bitcoin/debug.log
      OPENBSD_BITCOIN_LOG_PATH: /home/bitcoin/.bitcoin/debug.log
    strategy:
      fail-fast: false
      max-parallel: 3
      matrix:
        vm-arch: [x86_64]
        vm-os: [freebsd, netbsd, openbsd]
        include:
          - { vm-os: freebsd, vm-os-friendly-name: FreeBSD }
          - { vm-os: netbsd, vm-os-friendly-name: NetBSD }
          - { vm-os: openbsd, vm-os-friendly-name: OpenBSD }
    steps:
      - uses: actions/checkout@v7
      - name: Test the FreeBSD console output
        if: ${{ matrix.vm-os == 'freebsd' }}
        uses: vmactions/freebsd-vm@v1
        timeout-minutes: 180
        with:
          arch: ${{ matrix.vm-arch }}
          envs: 'CI FREEBSD_BITCOIN_LOG_PATH'
          usesh: true
          run: |
            sh -x ./test/test_nodebuilder --ref "${GITHUB_SHA}"
            if [ "$?" -eq 0 ]; then
              echo "DEBUG HOME is ${HOME}"
              echo "DEBUG working directory is $(pwd)"
              echo "DEBUG listing /root/.bitcoin/debug.log"
              ls -l /root/.bitcoin/debug.log || true
              echo "DEBUG listing /home/runner/.bitcoin/debug.log"
              ls -l /home/runner/.bitcoin/debug.log || true
              echo "DEBUG listing /home/bitcoin/.bitcoin/debug.log"
              ls -l /home/runner/.bitcoin/debug.log || true
              [ -f "${FREEBSD_BITCOIN_LOG_PATH}" ] && cp "${FREEBSD_BITCOIN_LOG_PATH}" .
            else
              echo "${{ matrix.vm-os }} test failed with non-zero exit status." >&2
              echo "Running nodebuilder with xtrace enabled"
              sh -x ./nodebuilder
              [ -f "${FREEBSD_BITCOIN_LOG_PATH}" ] && cp "${FREEBSD_BITCOIN_LOG_PATH}" .
              exit 1
            fi
      - name: Test the NetBSD console output
        if: ${{ matrix.vm-os == 'netbsd' }}
        uses: vmactions/netbsd-vm@v1
        timeout-minutes: 180
        with:
          arch: ${{ matrix.vm-arch }}
          envs: 'CI NETBSD_BITCOIN_LOG_PATH'
          run: |
            sh -x ./test/test_nodebuilder --ref "${GITHUB_SHA}"
            if [ "$?" -eq 0 ]; then
              echo "DEBUG HOME is ${HOME}"
              echo "DEBUG working directory is $(pwd)"
              echo "DEBUG listing /root/.bitcoin/debug.log"
              ls -l /root/.bitcoin/debug.log || true
              echo "DEBUG listing /home/runner/.bitcoin/debug.log"
              ls -l /home/runner/.bitcoin/debug.log || true
              echo "DEBUG listing /home/bitcoin/.bitcoin/debug.log"
              ls -l /home/runner/.bitcoin/debug.log || true
              [ -f "${NETBSD_BITCOIN_LOG_PATH}" ] && cp "${NETBSD_BITCOIN_LOG_PATH}" .
            else
              echo "${{ matrix.vm-os }} test failed with non-zero exit status." >&2
              echo "Running nodebuilder with xtrace enabled"
              sh -x ./nodebuilder
              [ -f "${NETBSD_BITCOIN_LOG_PATH}" ] && cp "${NETBSD_BITCOIN_LOG_PATH}" .
              exit 1
            fi
      - name: Test the OpenBSD console output
        if: ${{ matrix.vm-os == 'openbsd' }}
        uses: vmactions/openbsd-vm@v1
        timeout-minutes: 180
        with:
          arch: ${{ matrix.vm-arch }}
          envs: 'CI OPENBSD_BITCOIN_LOG_PATH'
          usesh: true
          run: |
            sh -x ./test/test_nodebuilder --ref "${GITHUB_SHA}"
            if [ "$?" -eq 0 ]; then
              echo "DEBUG HOME is ${HOME}"
              echo "DEBUG working directory is $(pwd)"
              echo "DEBUG listing /root/.bitcoin/debug.log"
              ls -l /root/.bitcoin/debug.log || true
              echo "DEBUG listing /home/runner/.bitcoin/debug.log"
              ls -l /home/runner/.bitcoin/debug.log || true
              echo "DEBUG listing /home/bitcoin/.bitcoin/debug.log"
              ls -l /home/bitcoin/.bitcoin/debug.log || true
              [ -f "${OPENBSD_BITCOIN_LOG_PATH}" ] && cp "${OPENBSD_BITCOIN_LOG_PATH}" .
            else
              echo "${{ matrix.vm-os }} test failed with non-zero exit status." >&2
              echo "Running nodebuilder with xtrace enabled"
              sh -x ./nodebuilder
              [ -f "${OPENBSD_BITCOIN_LOG_PATH}" ] && cp "${OPENBSD_BITCOIN_LOG_PATH}" .
              exit 1
            fi
      - name: Save Bitcoin Core log as artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.vm-os }}-${{ matrix.vm-arch }}-source-bitcoin-debug.log
          path: /home/runner/work/nodebuilder/nodebuilder/debug.log

  run-nodebuilder-docker:
    name: Docker image for ${{ matrix.container }}
    needs: [changes, dockerfile-lint, shell-lint, yaml-lint]
    if: >-
      github.event.action != 'prerelease' &&
      github.event.action != 'published' &&
      (
        needs.changes.outputs.ci == 'true' ||
        needs.changes.outputs.dependencies == 'true' ||
        needs.changes.outputs.docker == 'true' ||
        needs.changes.outputs.shell == 'true'
      )
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      max-parallel: 8
      matrix:
        include:
          - { container: Gentoo, dockerfile: Dockerfile_gentoo }
          - { container: Alpine, dockerfile: Dockerfile_alpine }
          - { container: Amazon Linux, dockerfile: Dockerfile_amazonlinux }
          - { container: Arch, dockerfile: Dockerfile_archlinux }
          - { container: Debian, dockerfile: Dockerfile_debian }
          - { container: Fedora, dockerfile: Dockerfile_fedora }
          - { container: Kali, dockerfile: Dockerfile_kali }
          - { container: Manjaro, dockerfile: Dockerfile_manjarolinux }
          - { container: openSUSE, dockerfile: Dockerfile_opensuse }
          - { container: Oracle Linux, dockerfile: Dockerfile_oraclelinux }
          - { container: Red Hat Enterprise, dockerfile: Dockerfile_redhat-ubi9 }
          - { container: Rocky Linux, dockerfile: Dockerfile_rockylinux }
          - { container: SUSE Enterprise, dockerfile: Dockerfile_sles }
          - { container: Ubuntu, dockerfile: Dockerfile }
    steps:
      - uses: actions/checkout@v7
      - name: Check the current OS version
        run: grep 'VERSION\|ID' /etc/os-release && uname -a
      - name: Build the ${{ matrix.container }} docker image
        if: >-
          (
            needs.changes.outputs.ci == 'true' ||
            needs.changes.outputs.dependencies == 'true' ||
            contains(needs.changes.outputs.docker-files, matrix.dockerfile) ||
            needs.changes.outputs.shell == 'true'
          )
          &&
          (
            matrix.container != 'Gentoo' ||
            contains(needs.changes.outputs.dependencies-files, 'build_dependencies_emerge.txt') ||
            contains(needs.changes.outputs.dependencies-files, 'runtime_dependencies_emerge.txt') ||
            contains(needs.changes.outputs.docker-files, 'Dockerfile_gentoo') ||
            (
              github.event.action == '' &&
              github.event.before == '' &&
              github.event.inputs == null
            )
          )
        uses: docker/build-push-action@v7
        timeout-minutes: 300
        with:
          build-args: |
            CI=true
            NODEBUILDER_VERSION=${{ github.sha || github.head_ref || 'master' }}
          context: .
          file: docker/${{ matrix.dockerfile }}