check-linux.yml

name: Check Linux

# The full Linux suite (tests, goldens, integration exercises, clippy, Nix).
# It runs where it matters: Release's check and stable channels call it on the
# candidate commit and publish nothing until it passes, and anyone can run it
# by hand. Pull requests only compile (compile.yml).
on:
  workflow_call:
    inputs:
      sha:
        description: The commit to test
        required: true
        type: string
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    env:
      CARGO_BUILD_JOBS: "2"
      CARGO_PROFILE_DEV_DEBUG: "0"
      SOURCE_DATE_EPOCH: "0"
      BLA_VENDOR: OpenBLAS
      OPENSSL_NO_VENDOR: "1"
      CC: clang
      CXX: clang++
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ inputs.sha || github.sha }}
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
        with:
          toolchain: stable
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
        with:
          cache-on-failure: true
      - uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2
        with:
          tool: cargo-nextest
      - name: Install native libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y clang cmake pkg-config python3 libasound2-dev \
            libssl-dev libgtk-3-dev \
            libxkbcommon-x11-dev libx11-xcb-dev libfontconfig1-dev libfreetype-dev \
            libxcursor-dev libxi-dev libxrandr-dev libopenblas-dev libvulkan-dev \
            glslc libshaderc-dev xvfb xauth x11-xserver-utils \
            sway wl-clipboard wtype dbus-x11 jq mesa-vulkan-drivers \
            pulseaudio pulseaudio-utils libasound2-plugins xdotool
      - run: cargo fmt --all --check
      - run: cargo nextest run --locked --profile ci --bin hex
      - run: cargo nextest run --locked --profile ci -p scrawl-router
      - name: Upload renders that missed their goldens
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: golden-actual
          path: /tmp/rune-settings-*-actual.png
          if-no-files-found: ignore
      - name: Exercise X11 grabs on an isolated display
        run: |
          xvfb-run -a --server-args="-screen 0 1280x900x24 -noreset" sh -c '
            xmodmap -e "keycode 191 = F24"
            cargo nextest run --locked --profile ci --bin hex --run-ignored only --test-threads 1 linux_input::tests
          '
      - name: Exercise native Wayland paste into GTK
        run: |
          binary=$(cargo test --locked --bin hex --no-run --message-format=json |
            jq -r 'select(.reason == "compiler-artifact" and .profile.test == true and .target.name == "hex") | .executable // empty')
          app=$(cargo build --locked --bin hex --message-format=json |
            jq -r 'select(.reason == "compiler-artifact" and .target.name == "hex") | .executable // empty')
          scripts/test-wayland-paste.sh "$binary" "$app"
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ${{ runner.temp }}/hex-model-test/models
          key: linux-dictation-model-${{ hashFiles('src/transcription_models.rs') }}
      - name: Exercise capture, inference, and paste through a virtual microphone
        env:
          HEX_APPLICATION_SUPPORT_DIR: ${{ runner.temp }}/hex-model-test
        run: |
          target/debug/hex model install
          curl --fail --location --silent --show-error --max-time 60 \
            https://raw.githubusercontent.com/ggml-org/whisper.cpp/b0a11594aec50892a02cd8d129eee2dfe93a8bb8/samples/jfk.wav \
            --output "$RUNNER_TEMP/jfk.wav"
          printf '%s  %s\n' \
            59dfb9a4acb36fe2a2affc14bacbee2920ff435cb13cc314a08c13f66ba7860e \
            "$RUNNER_TEMP/jfk.wav" | sha256sum --check
          scripts/test-linux-dictation.sh target/debug/hex \
            "$HEX_APPLICATION_SUPPORT_DIR/models/parakeet-unified-en-0.6b-Q8_0.gguf" \
            "$RUNNER_TEMP/jfk.wav"
      - name: Exercise signed installer and tamper rejection
        run: scripts/test-install-linux-release.sh
      - name: Exercise service IPC and client-independent lifecycle
        run: python3 scripts/test-linux-service.py target/debug/hex
      - run: cargo clippy --locked --bin hex --tests -- -D warnings
      - run: cargo clippy --locked -p scrawl-router --all-targets -- -D warnings

  nix:
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ inputs.sha || github.sha }}
          persist-credentials: false
      - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31
      - uses: DeterminateSystems/magic-nix-cache-action@84c0677f58dcedf3b91f8223ce36a9ea5b3c84b7 # v15
        with:
          use-gha-cache: enabled
          use-flakehub: disabled
          diagnostic-endpoint: ""
      - run: nix flake check --all-systems --no-build
      - name: Check packaging configuration and session readiness
        run: |
          nix build --no-link \
            .#checks.x86_64-linux.shell-environment \
            .#checks.x86_64-linux.modules \
            .#checks.x86_64-linux.session-readiness
      - name: Build and test the installed Nix package
        run: |
          nix build --no-link --print-build-logs \
            .#checks.x86_64-linux.package