name: Verify Reproducible Builds

on:
  workflow_call:

env:
  IS_PUSH_TO_MAIN: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
  # The exact compiler modes to use for compiling and comparing hashes by retester.
  # Runs triggered by pushes to main exercise more modes.
  COMPILE_MODES: >-
    ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main')
    && 'Y M0 S+, Y M3 S+, Y Mz S+, NY M0 S+, NY M3 S+, NY Mz S+'
    || 'Y M0 S+, Y M3 S+, Y Mz S+, NY Mz S+' }}
  # The compiler modes allowed to run during e2e test execution by retester.
  # E.g. this can be updated to allow only `"Y, NY Mz S+"` (all Yul modes + newyork with -Oz and solc optimizer enabled).
  E2E_ALLOWED_MODES: "Y, NY"
  SOLC_VERSION: "0.8.35"

jobs:
  build-linux:
    uses: ./.github/workflows/reusable-build-linux.yml
    with:
      retention_days: 1

  build-macos:
    uses: ./.github/workflows/reusable-build-macos.yml
    with:
      retention_days: 1

  build-windows:
    uses: ./.github/workflows/reusable-build-windows.yml
    with:
      retention_days: 1

  build-matrix:
    runs-on: ubuntu-24.04
    outputs:
      entries: ${{ steps.matrix.outputs.entries }}
    steps:
      - name: Build Matrix
        id: matrix
        run: |
          entries='[
            {
              "platform": "linux-x86_64",
              "target": "x86_64-unknown-linux-musl",
              "runner": "ubuntu-24.04"
            },
            {
              "platform": "macos-arm64",
              "target": "universal-apple-darwin",
              "runner": "macos-15"
            },
            ${{ env.IS_PUSH_TO_MAIN == 'true' && '{
              "platform": "macos-x86_64",
              "target": "universal-apple-darwin",
              "runner": "macos-15-intel"
            },' || '' }}
            {
              "platform": "windows-x86_64",
              "target": "x86_64-pc-windows-msvc",
              "runner": "windows-2022"
            }
          ]'

          echo "Matrix:"
          jq . <<< "$entries"
          echo "entries=$(jq -c . <<< "$entries")" >> "$GITHUB_OUTPUT"

  compile-and-export-hashes-native:
    needs: [build-matrix, build-linux, build-macos, build-windows]
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.build-matrix.outputs.entries) }}
    runs-on: ${{ matrix.runner }}
    steps:
      # For some deeply nested contracts in `resolc-compiler-tests`, Windows
      # will generate a "Filename too long" error. This step enables long paths.
      - name: Enable Git Long Paths (Windows)
        if: ${{ runner.os == 'Windows' }}
        run: git config --system core.longpaths true

      - name: Checkout revive
        uses: actions/checkout@v6
        with:
          path: revive
          submodules: recursive

      - name: Download Binary
        uses: actions/download-artifact@v7
        with:
          name: resolc-${{ matrix.target }}
          path: resolc-bin

      - name: Make resolc Executable
        shell: bash
        run: chmod +x "resolc-bin/resolc-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}"

      - name: Compile Contracts
        id: compile
        uses: ./revive/revive-differential-tests/.github/actions/compile-contracts
        with:
          revive-differential-tests-path: revive/revive-differential-tests
          resolc-path: resolc-bin/resolc-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
          solc-version: ${{ env.SOLC_VERSION }}
          modes: ${{ env.COMPILE_MODES }}
          upload-artifact-name: compilation-report-${{ matrix.platform }}

      - name: Export Bytecode Hashes
        uses: ./revive/revive-differential-tests/.github/actions/export-bytecode-hashes
        with:
          revive-differential-tests-path: revive/revive-differential-tests
          report-path: ${{ steps.compile.outputs.report-path }}
          remove-prefix: ${{ steps.compile.outputs.contracts-source-prefix }}
          platform-label: ${{ matrix.platform }}
          upload-artifact-name: hashes-${{ matrix.platform }}

  compare-hashes:
    needs: compile-and-export-hashes-native
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout revive
        uses: actions/checkout@v6
        with:
          path: revive
          submodules: true

      - name: Compare Bytecode Hashes
        uses: ./revive/revive-differential-tests/.github/actions/compare-bytecode-hashes
        with:
          revive-differential-tests-path: revive/revive-differential-tests
          hash-artifact-names: >-
            hashes-linux-x86_64,
            hashes-macos-arm64,
            ${{ env.IS_PUSH_TO_MAIN == 'true' && 'hashes-macos-x86_64,' || '' }}
            hashes-windows-x86_64
          modes: ${{ env.COMPILE_MODES }}
          upload-artifact-name: hash-comparison-result

  run-e2e-tests:
    needs: build-linux
    runs-on: parity-large
    timeout-minutes: 60
    env:
      # Commit SHA that produced the polkadot-sdk crate pinned in Cargo.toml,
      # obtained from the crate's .cargo_vcs_info.json via:
      # curl -sL -A "user-agent" https://crates.io/api/v1/crates/polkadot-sdk/<VERSION>/download | tar xzO polkadot-sdk-<VERSION>/.cargo_vcs_info.json
      # Current version: 2604.2.0
      POLKADOT_SDK_REF: "54095b130013902aaaa33a69dbbf980144764afb"
      RUSTFLAGS: "-Awarnings"
    steps:
      - name: Checkout revive
        uses: actions/checkout@v6
        with:
          path: revive
          submodules: recursive

      - name: Download Binary
        uses: actions/download-artifact@v7
        with:
          name: resolc-x86_64-unknown-linux-musl
          path: ./resolc-bin

      - name: Make resolc Executable
        shell: bash
        run: chmod +x ./resolc-bin/resolc-x86_64-unknown-linux-musl

      - name: Checkout Polkadot SDK
        uses: actions/checkout@v6
        with:
          repository: paritytech/polkadot-sdk
          ref: ${{ env.POLKADOT_SDK_REF }}
          path: polkadot-sdk
          submodules: recursive

      - name: Install Dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential pkg-config libssl-dev protobuf-compiler llvm clang libclang-dev

      - name: Download forklift
        run: |
          curl -fsSLo forklift https://github.com/paritytech/forklift/releases/download/0.15.0/forklift_0.15.0_linux_amd64
          chmod +x forklift
          sudo mv forklift /usr/local/bin/

      - name: Configure forklift
        run: |
          mkdir -p .forklift
          cp polkadot-sdk/.forklift/config.toml .forklift/config.toml

      - name: Set Up Rust Toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: "1.91.0"
          target: "wasm32-unknown-unknown"
          components: "rust-src"
          rustflags: ""

      - name: Run Differential E2E Tests
        uses: ./revive/revive-differential-tests/.github/actions/run-differential-tests
        with:
          revive-differential-tests-path: revive/revive-differential-tests
          polkadot-sdk-path: ./polkadot-sdk
          cargo-command: "forklift cargo"
          platform: revive-dev-node-polkavm-resolc
          resolc-path: ./resolc-bin/resolc-x86_64-unknown-linux-musl
          solc-version: ${{ env.SOLC_VERSION }}
          allowed-modes: ${{ env.E2E_ALLOWED_MODES }}
          use-compilation-caches: false
          expectations-file-path: ./revive/.github/assets/revive-dev-node-polkavm-resolc.json
          # Use a sane value which is fast enough to make the tests run fast but not too
          # fast that it overwhelms the node.
          concurrency-number-of-concurrent-tasks: 1000

  # Sentinel job that depends on the jobs we want to allow completing (instead of
  # being canceled once the other job chains complete). Thus, run-e2e-tests
  # will always run even if compare-hashes finishes first, and vice versa.
  wait-for-jobs:
    if: ${{ always() }}
    needs: [compare-hashes, run-e2e-tests]
    runs-on: ubuntu-24.04
    steps:
      - name: Finish
        run: echo "All jobs finished"