From e0fa69e0b9066ac9f7de56a9cfc88a4f5d469fe1 Mon Sep 17 00:00:00 2001
From: "origami74@gmail.com" <origami74@gmail.com>
Date: Wed, 25 Feb 2026 23:45:50 -0300
Subject: [PATCH] ci: add GitHub Actions workflow

Three-job pipeline:
- build: matrix over ubuntu/macos/windows, native cargo build per runner;
  macOS and Windows are continue-on-error (best-effort). Uploads Linux
  binary as artifact for downstream jobs.
- test: cargo test --all on ubuntu, gated on build succeeding.
- integration: parallel matrix of static-mesh, static-chain, and
  chaos-smoke-10; runs only when build + test both pass. Static jobs
  use docker compose + ping-test.sh; chaos job runs the stochastic
  simulation via chaos.sh.
---
 .github/workflows/ci.yml | 198 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 198 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..943e3a3
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,198 @@
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Job 1 – Build matrix
+#
+# Builds on Linux x86_64 and Linux aarch64.  macOS and Windows are in a
+# separate ci-compat.yml workflow so their failures don't mark this run red.
+# ─────────────────────────────────────────────────────────────────────────────
+jobs:
+  build:
+    name: Build (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+          - os: ubuntu-24.04-arm
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Cargo registry + build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Build
+        run: cargo build --release
+
+      # Upload the Linux binary so integration jobs can use it without rebuilding
+      - name: Upload Linux binary
+        if: matrix.os == 'ubuntu-latest'
+        uses: actions/upload-artifact@v4
+        with:
+          name: fips-linux
+          path: |
+            target/release/fips
+            target/release/fipsctl
+          retention-days: 1
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Job 2 – Unit tests
+#
+# Runs `cargo test` on Linux.  Gated on the build matrix completing so we
+# don't waste runner time if compilation is broken.
+# ─────────────────────────────────────────────────────────────────────────────
+  test:
+    name: Unit tests
+    runs-on: ubuntu-latest
+    needs: [build]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Cargo registry + build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Run unit tests
+        run: cargo test --all
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Job 3 – Integration tests (static mesh + chaos simulation)
+#
+# Runs only when both build and test succeed.  Each topology / scenario is a
+# separate matrix entry so they run in parallel.
+#
+# Static topologies  → build Docker images, start containers, ping-test
+# Chaos scenarios    → build sim image, run stochastic simulation
+# ─────────────────────────────────────────────────────────────────────────────
+  integration:
+    name: Integration (${{ matrix.suite }})
+    runs-on: ubuntu-latest
+    needs: [build, test]
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # ── Static mesh topologies ─────────────────────────────────────────
+          - suite: static-mesh
+            type: static
+            topology: mesh
+          - suite: static-chain
+            type: static
+            topology: chain
+          # ── Chaos / stochastic scenarios ───────────────────────────────────
+          - suite: chaos-smoke-10
+            type: chaos
+            scenario: smoke-10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # Fetch the pre-built Linux binary from job 1
+      - name: Download Linux binary
+        uses: actions/download-artifact@v4
+        with:
+          name: fips-linux
+          path: _bin
+
+      # ── Static topology ────────────────────────────────────────────────────
+      - name: Install binary (static)
+        if: matrix.type == 'static'
+        run: |
+          chmod +x _bin/fips _bin/fipsctl
+          cp _bin/fips    testing/static/fips
+          cp _bin/fipsctl testing/static/fipsctl
+
+      - name: Generate configs (static)
+        if: matrix.type == 'static'
+        run: bash testing/static/scripts/generate-configs.sh ${{ matrix.topology }}
+
+      - name: Build Docker images (static)
+        if: matrix.type == 'static'
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile ${{ matrix.topology }} build
+
+      - name: Start containers (static)
+        if: matrix.type == 'static'
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile ${{ matrix.topology }} up -d
+
+      - name: Run ping test (static)
+        if: matrix.type == 'static'
+        run: bash testing/static/scripts/ping-test.sh ${{ matrix.topology }}
+
+      - name: Collect logs on failure (static)
+        if: matrix.type == 'static' && failure()
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile ${{ matrix.topology }} logs --no-color
+
+      - name: Stop containers (static)
+        if: matrix.type == 'static' && always()
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile ${{ matrix.topology }} down --volumes --remove-orphans
+
+      # ── Chaos simulation ───────────────────────────────────────────────────
+      - name: Install Python deps (chaos)
+        if: matrix.type == 'chaos'
+        run: pip3 install --quiet pyyaml jinja2
+
+      - name: Install binary (chaos)
+        if: matrix.type == 'chaos'
+        run: |
+          chmod +x _bin/fips _bin/fipsctl
+          cp _bin/fips    testing/chaos/fips
+          cp _bin/fipsctl testing/chaos/fipsctl
+
+      - name: Build chaos Docker image
+        if: matrix.type == 'chaos'
+        run: docker build -t fips-chaos:latest testing/chaos
+
+      - name: Run chaos scenario
+        if: matrix.type == 'chaos'
+        run: bash testing/chaos/scripts/chaos.sh ${{ matrix.scenario }}
+
+      - name: Upload sim results on failure (chaos)
+        if: matrix.type == 'chaos' && failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: sim-results-${{ matrix.scenario }}
+          path: testing/chaos/sim-results/
+          retention-days: 7
\ No newline at end of file