mlkem.yml

name: ML-KEM

on:
  push:
    branches: ["main", "dev"]
  pull_request:
    branches: ["main", "dev", "*"]
  workflow_dispatch:
  merge_group:

env:
  CARGO_TERM_COLOR: always

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    if: ${{ github.event_name != 'merge_group' }}
    strategy:
      fail-fast: false
      matrix:
        bits: [32, 64]
        os:
          - macos-13 # Intel mac
          - macos-latest # macos-14 m1
          - ubuntu-latest
          - windows-latest
        exclude:
          - bits: 32
            os: "macos-latest"
          - bits: 32
            os: "macos-13"

    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash
        working-directory: libcrux-ml-kem

    steps:
      - uses: actions/checkout@v4
      - uses: taiki-e/install-action@cargo-hack

      - name: Update dependencies
        run: cargo update

      - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
        if: ${{ matrix.bits == 64 }}

      - run: echo 'EXCLUDE_FEATURES=--exclude-features simd256' > $GITHUB_ENV
        if: ${{ matrix.os == 'macos-latest' }}

      - run: echo 'EXCLUDE_FEATURES=--exclude-features simd128' > $GITHUB_ENV
        if: ${{ matrix.os != 'macos-latest' }}

      - name: 🛠️ Setup Rust Nightly
        run: rustup toolchain install nightly

      - name: 🛠️ Setup Ubuntu x86
        if: ${{ matrix.bits == 32 &&  matrix.os == 'ubuntu-latest' }}
        run: |
          rustup target add i686-unknown-linux-gnu
          sudo apt-get update
          sudo apt-get install -y gcc-multilib g++-multilib

      - name: 🛠️ Setup Ubuntu x64
        if: ${{ matrix.bits == 64 &&  matrix.os == 'ubuntu-latest' }}
        run: |
          rustup target add aarch64-unknown-linux-gnu

      # Set up 32 bit systems

      - name: 🛠️ Config Windows x86
        run: echo "RUST_TARGET_FLAG=--target=i686-pc-windows-msvc" > $GITHUB_ENV
        if: ${{ matrix.bits == 32 && matrix.os == 'windows-latest' }}

      - name: 🛠️ Config Linux x86
        run: |
          echo "RUST_TARGET_FLAG=--target=i686-unknown-linux-gnu" > $GITHUB_ENV
        if: ${{ matrix.bits == 32 && matrix.os == 'ubuntu-latest' }}

      # Build ...

      - name: 🔨 Build
        run: |
          rustc --print=cfg
          cargo build --verbose $RUST_TARGET_FLAG --features pre-verification

      - name: 🔨 Build Release
        run: cargo build --verbose --release $RUST_TARGET_FLAG --features pre-verification

      - name: 🏃🏻 Asan MacOS
        if: ${{ matrix.os == 'macos-latest' }}
        run: RUSTDOCFLAGS=-Zsanitizer=address RUSTFLAGS=-Zsanitizer=address cargo +nightly test --release --target aarch64-apple-darwin --features pre-verification

      # - name: ⬆ Upload build
      #   uses: ./.github/actions/upload_artifacts
      #   with:
      #     name: build_${{ matrix.os }}_${{ matrix.bits }}

      # We get false positives here.
      # TODO: Figure out what is going on here
      # - name: 🏃🏻 Asan Linux
      #   if: ${{ matrix.bits == 64 && matrix.os == 'ubuntu-latest' }}
      #   run: RUSTDOCFLAGS=-Zsanitizer=address RUSTFLAGS=-Zsanitizer=address cargo +nightly test --release --target x86_64-unknown-linux-gnu

      # Test SHA3
      - name: 🏃🏻‍♀️ SHA3 Test
        working-directory: libcrux-sha3
        run: |
          cargo clean
          cargo test --verbose $RUST_TARGET_FLAG

      - name: 🏃🏻‍♀️ SHA3 Test Release
        working-directory: libcrux-sha3
        run: |
          cargo clean
          cargo test --release --verbose $RUST_TARGET_FLAG

      - name: 🏃🏻‍♀️ SHA3 Test Portable
        working-directory: libcrux-sha3
        run: |
          cargo clean
          LIBCRUX_DISABLE_SIMD128=1 LIBCRUX_DISABLE_SIMD256=1 cargo test --verbose $RUST_TARGET_FLAG

      - name: 🏃🏻‍♀️ SHA3 Test Portable Release
        working-directory: libcrux-sha3
        run: |
          cargo clean
          LIBCRUX_DISABLE_SIMD128=1 LIBCRUX_DISABLE_SIMD256=1 cargo test --verbose --release $RUST_TARGET_FLAG

      # Test ...

      - name: 🏃🏻‍♀️ Test
        run: |
          cargo clean
          cargo test --verbose $RUST_TARGET_FLAG --features pre-verification

      - name: 🏃🏻‍♀️ Test Release
        run: |
          cargo clean
          cargo test --verbose --release $RUST_TARGET_FLAG --features pre-verification

      - name: 🏃🏻‍♀️ Test Portable
        run: |
          cargo clean
          LIBCRUX_DISABLE_SIMD128=1 LIBCRUX_DISABLE_SIMD256=1 cargo test --verbose $RUST_TARGET_FLAG --features pre-verification

      - name: 🏃🏻‍♀️ Test Portable Release
        run: |
          cargo clean
          LIBCRUX_DISABLE_SIMD128=1 LIBCRUX_DISABLE_SIMD256=1 cargo test --verbose --release $RUST_TARGET_FLAG --features pre-verification

      - name: 🏃🏻‍♀️ Test Kyber
        run: |
          cargo clean
          cargo test --features kyber --verbose $RUST_TARGET_FLAG

      - name: 🏃🏻‍♀️ Cargo Check Features
        if: ${{ matrix.bits == 64 }}
        run: |
          cargo clean
          cargo hack check --feature-powerset $EXCLUDE_FEATURES --verbose --no-dev-deps $RUST_TARGET_FLAG

      - name: 🏃🏻‍♀️ Cargo Test Features
        if: ${{ matrix.bits == 64 }}
        run: |
          cargo clean
          cargo hack test --each-feature $EXCLUDE_FEATURES --verbose $RUST_TARGET_FLAG

  benchmarks:
    if: ${{ github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' }}
    strategy:
      fail-fast: true
      matrix:
        bits: [32, 64]
        os:
          - macos-13
          - macos-latest
          - ubuntu-latest
          - windows-latest
        exclude:
          # There's no such thing as 32-bit macOS
          - bits: 32
            os: "macos-latest"
          - bits: 32
            os: "macos-13"

    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash
        working-directory: libcrux-ml-kem

    steps:
      - uses: actions/checkout@v4

      - name: Update dependencies
        run: cargo update

      - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
        if: ${{ matrix.bits == 64 }}

      - name: 🛠️ Setup Ubuntu x86
        if: ${{ matrix.bits == 32 &&  matrix.os == 'ubuntu-latest' }}
        run: |
          rustup target add i686-unknown-linux-gnu
          sudo apt-get update
          sudo apt-get install -y gcc-multilib g++-multilib

      - name: 🛠️ Setup Ubuntu x64
        if: ${{ matrix.bits == 64 &&  matrix.os == 'ubuntu-latest' }}
        run: |
          rustup target add aarch64-unknown-linux-gnu

      - name: 🛠️ Setup macOS
        if: ${{  matrix.os == 'macos-latest' }}
        run: |
          rustup target add aarch64-apple-darwin

      # Set up 32 bit systems

      - name: 🛠️ Config Windows x86
        run: echo "RUST_TARGET_FLAG=--target=i686-pc-windows-msvc" > $GITHUB_ENV
        if: ${{ matrix.bits == 32 && matrix.os == 'windows-latest' }}

      - name: 🛠️ Config Linux x86
        run: |
          echo "RUST_TARGET_FLAG=--target=i686-unknown-linux-gnu" > $GITHUB_ENV
        if: ${{ matrix.bits == 32 && matrix.os == 'ubuntu-latest' }}

      # - name: 🔨 Build
      #   run: cargo build --benches

      # - name: ⬆ Upload build
      #   uses: ./.github/actions/upload_artifacts
      #   with:
      #     name: benchmarks_${{ matrix.os }}_${{ matrix.bits }}

      # Benchmarks ...

      - name: 🏃🏻‍♀️ Benchmarks
        run: cargo bench --verbose $RUST_TARGET_FLAG

      - name: 🏃🏻‍♀️ Benchmarks Portable
        run: |
          cargo clean
          LIBCRUX_DISABLE_SIMD128=1 LIBCRUX_DISABLE_SIMD256=1 cargo bench --verbose $RUST_TARGET_FLAG

  mq_status:
    if: |
      always() &&
      github.event_name ==  'workflow_dispatch' || github.event_name ==  'merge_group'
    needs: [benchmarks]
    runs-on: ubuntu-latest
    steps:
      - name: Successful
        if: ${{ !(contains(needs.*.result, 'failure')) }}
        run: exit 0
      - name: Failing
        if: ${{ contains(needs.*.result, 'failure') }}
        run: exit 1