trailofbits-buttercup/.github/workflows/lint.yml

name: Lint

on:
  push:
    branches:
      - main
    # Always run full suite on main branch
  pull_request:
    paths:
      # Component-specific triggers
      - "common/**"
      - "orchestrator/**"
      - "fuzzer/**"
      - "fuzzer_runner/**"
      - "program-model/**"
      - "seed-gen/**"
      - "patcher/**"
      # Workflow changes
      - ".github/workflows/lint.yml"
      - ".github/workflows/tests.yml"
      # Global configuration that affects linting
      - "Makefile"
      - "protoc.sh"
      - "**/*.proto"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # Detect which components need linting based on changed files
  changes:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    outputs:
      common: ${{ steps.filter.outputs.common }}
      orchestrator: ${{ steps.filter.outputs.orchestrator }}
      fuzzer: ${{ steps.filter.outputs.fuzzer }}
      fuzzer_runner: ${{ steps.filter.outputs.fuzzer_runner }}
      program-model: ${{ steps.filter.outputs.program-model }}
      seed-gen: ${{ steps.filter.outputs.seed-gen }}
      patcher: ${{ steps.filter.outputs.patcher }}
      run-all: ${{ steps.filter.outputs.workflow || steps.filter.outputs.global }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
        id: filter
        with:
          filters: |
            common:
              - 'common/**'
            orchestrator:
              - 'orchestrator/**'
            fuzzer:
              - 'fuzzer/**'
            fuzzer_runner:
              - 'fuzzer_runner/**'
            program-model:
              - 'program-model/**'
            seed-gen:
              - 'seed-gen/**'
            patcher:
              - 'patcher/**'
            workflow:
              - '.github/workflows/lint.yml'
            global:
              - 'Makefile'
              - 'protoc.sh'
              - '**/*.proto'

  matrix-generator:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    needs: changes
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Generate matrix
        id: set-matrix
        env:
          RUN_ALL: ${{ needs.changes.outputs.run-all }}
          CHANGED_COMMON: ${{ needs.changes.outputs.common }}
          CHANGED_ORCHESTRATOR: ${{ needs.changes.outputs.orchestrator }}
          CHANGED_FUZZER: ${{ needs.changes.outputs.fuzzer }}
          CHANGED_FUZZER_RUNNER: ${{ needs.changes.outputs.fuzzer_runner }}
          CHANGED_PROGRAM_MODEL: ${{ needs.changes.outputs.program-model }}
          CHANGED_SEED_GEN: ${{ needs.changes.outputs.seed-gen }}
          CHANGED_PATCHER: ${{ needs.changes.outputs.patcher }}
        run: |
          components=()
          if [[ "$RUN_ALL" == "true" ]]; then
            components=("common" "orchestrator" "fuzzer" "fuzzer_runner" "program-model" "seed-gen" "patcher")
          else
            [[ "$CHANGED_COMMON" == "true" ]] && components+=("common")
            [[ "$CHANGED_ORCHESTRATOR" == "true" ]] && components+=("orchestrator")
            [[ "$CHANGED_FUZZER" == "true" ]] && components+=("fuzzer")
            [[ "$CHANGED_FUZZER_RUNNER" == "true" ]] && components+=("fuzzer_runner")
            [[ "$CHANGED_PROGRAM_MODEL" == "true" ]] && components+=("program-model")
            [[ "$CHANGED_SEED_GEN" == "true" ]] && components+=("seed-gen")
            [[ "$CHANGED_PATCHER" == "true" ]] && components+=("patcher")
          fi
          if [[ ${#components[@]} -eq 0 ]]; then
            echo 'matrix={"component":[]}' >> "$GITHUB_OUTPUT"
          else
            echo "matrix={\"component\":[$(printf '"%s",' "${components[@]}" | sed 's/,$//')]}" >> "$GITHUB_OUTPUT"
          fi

  lint:
    permissions:
      contents: read
    needs: [changes, matrix-generator]
    strategy:
      fail-fast: false # Continue running other components even if one fails
      matrix: ${{ fromJSON(needs.matrix-generator.outputs.matrix) }}

    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0

      - name: Setup uv cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
        with:
          path: |
            ~/.cache/uv
            ~/.local/share/uv
          key: ${{ runner.os }}-uv-${{ matrix.component }}-${{ hashFiles(format('{0}/uv.lock', matrix.component)) }}
          restore-keys: |
            ${{ runner.os }}-uv-${{ matrix.component }}-
            ${{ runner.os }}-uv-

      - name: Setup ${{ matrix.component }} component
        run: uv sync --all-extras
        working-directory: ${{ matrix.component }}

      - name: Run ruff on ${{ matrix.component }}
        run: |
          uv run ruff format --check --diff
          uv run ruff check --output-format=github
        working-directory: ${{ matrix.component }}

      - name: Run ty on ${{ matrix.component }}
        run: uv run ty check src/
        working-directory: ${{ matrix.component }}

  check-protobuf:
    permissions:
      contents: read
    needs: changes
    # Run if protobuf files changed or we need to run all
    if: needs.changes.outputs.run-all == 'true' || contains(github.event.head_commit.modified, '.proto') || contains(github.event.head_commit.modified, 'protoc.sh')
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
        with:
          enable-cache: true

      - name: Generate protobufs
        run: |
          # Generate fresh protobufs (must run from common venv for correct grpcio-tools)
          cd common && uv run ../protoc.sh

          # Check if any files were modified
          if ! git diff --quiet src/buttercup/common/datastructures; then
            echo "Error: Generated protobufs differ from committed files"
            exit 1
          fi