ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

env:
  # Increment to bust Go module cache when needed.
  GO_CACHE_VERSION: v4

jobs:
  test-linux:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install build deps
        run: sudo apt-get update && sudo apt-get install -y libfuse-dev libfuse3-dev libseccomp-dev pkg-config

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Cache Go modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-

      - name: Free disk space
        run: |
          echo "=== Disk space before cleanup ==="
          df -h /tmp /home/runner
          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/powershell
          echo "=== Disk space after cleanup ==="
          df -h /tmp /home/runner

      - name: go test
        run: |
          mkdir -p "$GOTMPDIR"
          go test -p 2 ./...
        env:
          GOTMPDIR: ${{ runner.temp }}/go-tmp

      - name: smoke
        run: make smoke

      - name: macOS bundle assemble smoke test
        run: scripts/test-assemble-macos-bundle.sh

  test-macos:
    runs-on: macos-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Cache Go modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
            ~/Library/Caches/go-build
          key: ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-

      # nofuse matches how macOS is actually shipped (Makefile build-macos-go
      # and release.yml both pass it). macOS uses the Endpoint Security
      # Framework for file monitoring, never FUSE -- detect_darwin.go hardcodes
      # checkAvailable() to false -- so the macFUSE/FUSE-T install this job used
      # to do bought nothing but minutes.
      - name: go build
        run: CGO_ENABLED=1 go build -tags nofuse ./...

      - name: go test (all packages)
        run: CGO_ENABLED=1 go test -tags nofuse ./...

      # Compile the Swift system extension. Without this the entire sysext --
      # ESFClient, SessionPolicyCache, PolicySocketClient -- is built for the
      # first time at release, so a Swift break reaches main undetected.
      # Unsigned: CI has no certificates, and signing is exercised by the
      # release workflow.
      - name: xcodebuild (Swift sysext, unsigned)
        run: |
          xcodebuild \
            -project macos/AgentMon/agentmon.xcodeproj \
            -scheme agentmon \
            -configuration Release \
            -derivedDataPath build/DerivedData \
            CODE_SIGN_IDENTITY="" \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGNING_ALLOWED=NO \
            -quiet

      # The Swift side has no test target. This runs the one piece of it that
      # is pure logic worth pinning -- CIDR matching, whose failure mode is a
      # network rule that silently matches nothing.
      - name: Swift CIDR matcher
        run: scripts/test-swift-cidr.sh

      # File rules must decide in policy order, as the Go engine does.
      - name: Swift file rule order
        run: scripts/test-swift-file-rules.sh

      # A session process must not be able to change the daemon's directory.
      - name: Swift control directory guard
        run: scripts/test-swift-control-dir.sh

      # The extension must drop sessions the daemon no longer has, or every
      # file open on the machine stays on the slow path.
      - name: Swift session sync
        run: scripts/test-swift-session-sync.sh

      # The approval dialog's parser, launch URL, socket path and wire format,
      # checked against the JSON the Go policy socket tests pin.
      - name: Swift approval dialog client
        run: scripts/test-swift-approval-client.sh

      # The extension must decide file and network cases as the Go engine
      # does. TestPolicyParity_GoEngine runs the same table through Go.
      - name: Swift policy parity
        run: scripts/test-swift-policy-parity.sh

      # codesign rejects entitlements that plutil accepts, and the xcodebuild
      # step above signs nothing.
      - name: Entitlements files sign
        run: scripts/test-entitlements-sign.sh

  build-matrix:
    needs: [test-linux, test-macos]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      matrix:
        # darwin/amd64 is excluded: agentmon ships arm64-only macOS builds, and
        # a build target nothing releases is a target nobody notices breaking.
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: arm64
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Cache Go modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-${{ matrix.goos }}-${{ matrix.goarch }}-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-${{ matrix.goos }}-${{ matrix.goarch }}-

      - name: Install build deps (linux only)
        if: matrix.goos == 'linux'
        run: sudo apt-get update && sudo apt-get install -y libfuse-dev libfuse3-dev libseccomp-dev pkg-config

      - name: Cross-compile (build only)
        run: |
          if [ "${{ matrix.goos }}" = "linux" ]; then
            if [ "${{ matrix.goarch }}" = "arm64" ]; then
              export CGO_ENABLED=0
            else
              export CGO_ENABLED=1
            fi
          else
            export CGO_ENABLED=0
          fi
          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} CGO_ENABLED=$CGO_ENABLED go build ./...

  build-linux-arm64-cgo:
    # Pinned. This job installs amd64 and arm64 builds of the same
    # libraries side by side, and multiarch needs matching versions. On
    # ubuntu-latest (26.04 by 2026-10-28) the image ships newer amd64 builds
    # than the arm64 ports archive, and apt can only satisfy the install by
    # downgrading 38 packages.
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install build deps
        run: |
          # Ubuntu hosts arm64 packages on ports.ubuntu.com, not
          # archive.ubuntu.com. Without restricting the default sources
          # to amd64 and adding a ports source for arm64, `apt-get
          # update` after `dpkg --add-architecture arm64` 404s on every
          # arm64 Packages file.
          #
          # The suite comes from the host. It was hardcoded to noble, and
          # when ubuntu-latest moved past 24.04 the arm64 packages came
          # from an older release than the amd64 ones: libseccomp-dev
          # 2.5.5 for arm64 against 2.6.0 for amd64, which apt cannot
          # install side by side.
          . /etc/os-release
          sudo sed -i '/^Types: deb$/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
          sudo tee /etc/apt/sources.list.d/arm64-ports.sources >/dev/null <<EOF
          Types: deb
          URIs: http://ports.ubuntu.com/ubuntu-ports
          Suites: ${VERSION_CODENAME} ${VERSION_CODENAME}-updates ${VERSION_CODENAME}-security
          Components: main universe restricted multiverse
          Architectures: arm64
          Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
          EOF
          sudo dpkg --add-architecture arm64
          sudo apt-get update
          sudo apt-get install -y libfuse-dev libfuse3-dev pkg-config gcc-aarch64-linux-gnu libseccomp-dev libseccomp-dev:arm64

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Cache Go modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-linux-arm64-cgo-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-linux-arm64-cgo-

      - name: Cross-compile (arm64 CGO)
        run: go build ./...
        env:
          GOOS: linux
          GOARCH: arm64
          CGO_ENABLED: "1"
          CC: aarch64-linux-gnu-gcc
          PKG_CONFIG_LIBDIR: /usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig

  integration:
    needs: [test-linux]
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install build deps
        run: |
          sudo apt-get update && sudo apt-get install -y libseccomp-dev pkg-config fuse3
          sudo modprobe fuse
          # Ensure /dev/fuse exists and is accessible
          if [ ! -e /dev/fuse ]; then
            sudo mknod /dev/fuse -m 0666 c 10 229
          fi
          sudo chmod 666 /dev/fuse

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Cache Go modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-integration-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-integration-

      - name: Run integration tests (docker)
        env:
          DOCKER_HOST: unix:///var/run/docker.sock
          TESTCONTAINERS_RYUK_CONTAINER_PRIVILEGED: true
        run: go test -v -tags=integration ./internal/integration/...

      - name: Run API integration tests
        run: go test -v -tags=integration ./internal/api/... ./internal/proxy/...

  fargate-e2e:
    if: >-
      github.event_name == 'push' &&
      github.ref == 'refs/heads/main' &&
      vars.AWS_ECS_CLUSTER != ''
    needs: [test-linux, integration]
    continue-on-error: true
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Cache Go modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-fargate-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ env.GO_CACHE_VERSION }}-${{ runner.os }}-go-fargate-

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-region: ${{ vars.AWS_REGION || 'us-east-1' }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Login to Amazon ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7

      - name: Build and push agentmon test image
        env:
          ECR_REGISTRY: ${{ steps.ecr-login.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -f Dockerfile.ptrace-test -t $ECR_REGISTRY/agentmon-test:$IMAGE_TAG .
          docker push $ECR_REGISTRY/agentmon-test:$IMAGE_TAG

      - name: Build seccomp probe
        run: mkdir -p build && GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o build/seccomp-probe ./cmd/seccomp-probe/

      - name: Build and push workload test image
        env:
          ECR_REGISTRY: ${{ steps.ecr-login.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -f Dockerfile.fargate-workload -t $ECR_REGISTRY/agentmon-fargate-workload:$IMAGE_TAG .
          docker push $ECR_REGISTRY/agentmon-fargate-workload:$IMAGE_TAG

      - name: Run Fargate E2E tests
        env:
          AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
          AWS_ECS_CLUSTER: ${{ vars.AWS_ECS_CLUSTER }}
          AWS_ECS_SUBNET: ${{ vars.AWS_ECS_SUBNET }}
          AWS_ECS_SECURITY_GROUP: ${{ vars.AWS_ECS_SECURITY_GROUP }}
          AWS_ECS_EXECUTION_ROLE_ARN: ${{ vars.AWS_ECS_EXECUTION_ROLE_ARN }}
          AGENTMON_TEST_IMAGE: ${{ steps.ecr-login.outputs.registry }}/agentmon-test:${{ github.sha }}
          WORKLOAD_TEST_IMAGE: ${{ steps.ecr-login.outputs.registry }}/agentmon-fargate-workload:${{ github.sha }}
        run: go test -v -tags=fargate -timeout 5m ./internal/integration/fargate/...