ci.yml

name: CI

on:
  pull_request:
    branches:
      - dev
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review
  push:
    branches:
      - dev
  schedule:
    - cron: "17 5 * * *"
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && format('full-{0}', github.run_id) || github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

env:
  PERFORMANCE_BASELINE_WINDOW: 10
  PERFORMANCE_BASELINE_MINIMUM_HISTORY: 10
  PERFORMANCE_REGRESSION_THRESHOLD: 50
  PERFORMANCE_REGRESSION_ABSOLUTE_TOLERANCE_MS: 10

jobs:
  quality:
    name: Lint, typing, and formatting
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      # Scheduled and manually dispatched full runs save no caches.
      - name: Check code quality
        uses: ./.github/actions/check-quality
        with:
          save-cache: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}

  aci-edge-sandboxes:
    name: aci-edge-sandboxes / ${{ matrix.os }}
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      # The release that the self-hosted runners provide, for `nvx.py test-agent-bundling`.
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Check aci_edge_sandboxes
        uses: ./.github/actions/check-aci-edge-sandboxes

  nvx-rs:
    name: nvx-rs / ${{ matrix.os }}
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Check nvx-rs
        uses: ./.github/actions/check-nvx-rs

  # The NVX CLI tests do not depend on the backend, so they run once per OS on
  # GitHub-hosted runners rather than in every hypervisor job. They read
  # OpenVMM's pinned CPU profiles from the submodule, so they follow its
  # checkout, which needs the deploy key that fork pull requests lack. The
  # microVM and platform jobs of each OS wait for its result.
  nvx-cli-linux:
    name: NVX CLI / Linux
    if: >-
      ${{
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        )
      }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Checkout OpenVMM
        uses: ./.github/actions/checkout-openvmm
        with:
          ssh-key: ${{ secrets.OPENVMM_DEPLOY_KEY }}

      # The release that the self-hosted runners provide.
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      # nvx.py runs nvx-rs for its sandbox command and for the egress and
      # artifact steps of its run command. A static musl build runs on every
      # self-hosted Linux runner, so the microVM jobs take this one, as they
      # take OpenVMM from its build jobs. It goes where `cargo build
      # --release` puts it, where nvx.py, and so the CLI tests, look for it,
      # and NVX_RS names it for the tests that run it directly.
      - name: Build nvx-rs
        shell: bash
        run: |
          set -euo pipefail
          toolchain=$(sed -n 's/^channel = "\([^"]*\)".*/\1/p' rust-toolchain.toml)
          test -n "${toolchain}"
          rustup toolchain install "${toolchain}" --profile minimal --no-self-update \
            --target x86_64-unknown-linux-musl
          cargo "+${toolchain}" build --release --locked --features cli \
            --manifest-path nvx-rs/Cargo.toml --target x86_64-unknown-linux-musl
          install -D -m 0755 nvx-rs/target/x86_64-unknown-linux-musl/release/nvx-rs \
            nvx-rs/target/release/nvx-rs
          echo "NVX_RS=${GITHUB_WORKSPACE}/nvx-rs/target/release/nvx-rs" >> "${GITHUB_ENV}"

      # Packages ship the build with its provenance, which binds it to the
      # nvx-rs sources, the pinned Rust release, the target, and the features.
      - name: Record nvx-rs provenance
        shell: bash
        run: >-
          python3 scripts/nvx.py record-nvx-rs-provenance
          --target x86_64-unknown-linux-musl

      - name: Validate NVX CLI
        uses: ./.github/actions/validate-nvx

      - name: Upload nvx-rs executable
        uses: actions/upload-artifact@v7
        with:
          name: nvx-rs-linux-musl-executable
          path: nvx-rs/target/release/nvx-rs
          if-no-files-found: error
          overwrite: true
          retention-days: 1

      - name: Upload nvx-rs provenance
        uses: actions/upload-artifact@v7
        with:
          name: nvx-rs-linux-musl-provenance
          path: build/nvx-rs.provenance.json
          if-no-files-found: error
          overwrite: true
          retention-days: 1

  nvx-cli-windows:
    name: NVX CLI / Windows
    if: >-
      ${{
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        )
      }}
    runs-on: windows-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Checkout OpenVMM
        uses: ./.github/actions/checkout-openvmm
        with:
          ssh-key: ${{ secrets.OPENVMM_DEPLOY_KEY }}

      # The release that the self-hosted runners provide.
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      # The curl shim test compiles the shim, and the next step builds nvx-rs,
      # with the release that rust-toolchain.toml pins, which rustup would
      # otherwise install with its default profile.
      - name: Install the pinned Rust release
        shell: powershell
        run: |
          $ErrorActionPreference = "Stop"
          $channel = Select-String -LiteralPath "rust-toolchain.toml" `
            -Pattern '^channel = "([^"]+)"' | Select-Object -First 1
          if ($null -eq $channel) {
            throw "rust-toolchain.toml does not pin a Rust release"
          }
          rustup toolchain install $channel.Matches[0].Groups[1].Value `
            --profile minimal --no-self-update
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      # As on Linux, for the microVM jobs and the CLI tests. The static C
      # runtime spares the self-hosted runners the Visual C++ redistributable.
      - name: Build nvx-rs
        shell: powershell
        env:
          RUSTFLAGS: -C target-feature=+crt-static
        run: |
          $ErrorActionPreference = "Stop"
          cargo build --release --locked --features cli --manifest-path nvx-rs/Cargo.toml
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          "NVX_RS=$env:GITHUB_WORKSPACE\nvx-rs\target\release\nvx-rs.exe" |
            Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Record nvx-rs provenance
        shell: powershell
        run: |
          python scripts\nvx.py record-nvx-rs-provenance --target x86_64-pc-windows-msvc
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Validate NVX CLI
        uses: ./.github/actions/validate-nvx

      - name: Upload nvx-rs executable
        uses: actions/upload-artifact@v7
        with:
          name: nvx-rs-windows-msvc-executable
          path: nvx-rs/target/release/nvx-rs.exe
          if-no-files-found: error
          overwrite: true
          retention-days: 1

      - name: Upload nvx-rs provenance
        uses: actions/upload-artifact@v7
        with:
          name: nvx-rs-windows-msvc-provenance
          path: build/nvx-rs.provenance.json
          if-no-files-found: error
          overwrite: true
          retention-days: 1

  openvmm-changes:
    name: Detect CI workload inputs
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      run-tests: ${{ steps.changes.outputs.run-tests }}
      run-workloads: ${{ steps.changes.outputs.run-workloads }}
      run-openvmm-unit-tests: ${{ steps.changes.outputs.run-openvmm-unit-tests }}
      run-openvmm-vmm-tests: ${{ steps.changes.outputs.run-openvmm-vmm-tests }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
          persist-credentials: false

      # `nvx.py classify-ci-changes` selects the suites for pushes and pull
      # requests; this script selects the full matrix for full-run events and
      # whenever it cannot classify changed files.
      - name: Detect relevant changes
        id: changes
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail

          outputs=(run-tests run-workloads run-openvmm-unit-tests run-openvmm-vmm-tests)

          run_everything() {
            for output in "${outputs[@]}"; do
              echo "${output}=true" >> "${GITHUB_OUTPUT}"
            done
            {
              echo "### Full matrix: run"
              echo "$1"
            } >> "${GITHUB_STEP_SUMMARY}"
          }

          if [[ "${EVENT_NAME}" == "schedule" ||
                "${EVENT_NAME}" == "workflow_dispatch" ]]; then
            run_everything "The ${EVENT_NAME} event runs the full matrix without change classification."
            exit 0
          fi

          if [[ -z "${BASE_SHA}" || "${BASE_SHA}" =~ ^0+$ ]]; then
            run_everything "The comparison base is unavailable, so the safe fallback is to run the full matrix."
            exit 0
          fi

          if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null ||
             ! git cat-file -e "${HEAD_SHA}^{commit}" 2>/dev/null; then
            run_everything "A comparison commit is unavailable, so the safe fallback is to run the full matrix."
            exit 0
          fi

          changed_files="${RUNNER_TEMP}/ci-changed-files"
          if ! git diff --name-only --no-renames -z "${BASE_SHA}" "${HEAD_SHA}" > "${changed_files}"; then
            run_everything "The changed files could not be determined, so the safe fallback is to run the full matrix."
            exit 0
          fi

          echo "Changes between \`${BASE_SHA}\` and \`${HEAD_SHA}\`:" >> "${GITHUB_STEP_SUMMARY}"
          classification="${RUNNER_TEMP}/ci-classification"
          if ! python3 scripts/nvx.py classify-ci-changes \
            --event-name "${EVENT_NAME}" \
            --changed-files "${changed_files}" --null \
            --summary "${GITHUB_STEP_SUMMARY}" > "${classification}"; then
            run_everything "The changes could not be classified, so the safe fallback is to run the full matrix."
            exit 0
          fi
          # A missing or malformed output would silently skip its suites.
          for output in "${outputs[@]}"; do
            if [[ "$(grep -Ecx "${output}=(true|false)" "${classification}")" != 1 ]]; then
              run_everything "The classification did not report \`${output}\`, so the safe fallback is to run the full matrix."
              exit 0
            fi
          done
          grep -Ex '[a-z-]+=(true|false)' "${classification}" >> "${GITHUB_OUTPUT}"

  artifacts:
    name: Build shared artifacts
    needs: [openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-workloads == 'true'
        )
      }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      # Full runs build the guest artifacts that miss the cache without saving
      # them.
      - name: Build guest artifacts
        id: guest-artifacts
        uses: ./.github/actions/build-guest-artifacts
        with:
          save-cache: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}

      - name: Upload guest artifacts
        uses: actions/upload-artifact@v7
        with:
          name: guest-artifacts
          path: |
            build/vmlinux
            build/vmlinux.config
            build/vmlinux.provenance.json
            build/initramfs.cpio.gz
            build/initramfs.cpio.gz.packages.json
            build/initramfs.provenance.json
            build/initramfs-ubuntu.cpio.gz
            build/initramfs-ubuntu.cpio.gz.packages.json
            build/initramfs-azurelinux.cpio.gz
            build/initramfs-azurelinux.cpio.gz.packages.json
            build/ubuntu-distro.erofs
            build/ubuntu-distro.erofs.manifest.json
            build/ubuntu-smoke-scratch.ext4
          if-no-files-found: error
          retention-days: 1

  # Beside the shared artifacts, so that a kernel rebuild doesn't delay the
  # jobs that don't use the debug kernel.
  debug-kernel:
    name: Build CI debug kernel
    needs: [openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-workloads == 'true'
        )
      }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Build the CI debug kernel
        uses: ./.github/actions/build-guest-artifacts
        with:
          debug-kernel: "true"
          guest-images: "false"
          save-cache: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}

      - name: Upload guest debug kernel
        uses: actions/upload-artifact@v7
        with:
          name: guest-debug-kernel
          path: |
            build/vmlinux-debug
            build/vmlinux-debug.config
            build/vmlinux-debug.provenance.json
          if-no-files-found: error
          retention-days: 1

  build-openvmm-linux-gnu:
    name: OpenVMM binary / Linux GNU
    needs: [openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-tests == 'true' ||
          needs.openvmm-changes.outputs.run-workloads == 'true'
        )
      }}
    uses: ./.github/workflows/build-openvmm-binary.yml
    with:
      display-name: Linux GNU
      runner: '["self-hosted", "linux", "kvm", "virtual-machine", "general"]'
      backend: kvm
      artifact: openvmm-linux-gnu
      binary: openvmm/target/release/openvmm
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  build-openvmm-linux-musl:
    name: OpenVMM binary / Linux musl
    needs: [openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-tests == 'true' ||
          needs.openvmm-changes.outputs.run-workloads == 'true'
        )
      }}
    uses: ./.github/workflows/build-openvmm-binary.yml
    with:
      display-name: Linux musl
      runner: '["self-hosted", "linux", "mshv", "virtual-machine", "general"]'
      backend: mshv
      artifact: openvmm-linux-musl
      binary: openvmm/target/release/openvmm
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  build-openvmm-windows-msvc:
    name: OpenVMM binary / Windows MSVC
    needs: [openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-tests == 'true' ||
          needs.openvmm-changes.outputs.run-workloads == 'true'
        )
      }}
    uses: ./.github/workflows/build-openvmm-binary.yml
    with:
      display-name: Windows MSVC
      runner: '["self-hosted", "windows", "whp", "virtual-machine", "general"]'
      backend: whp
      artifact: openvmm-windows-msvc
      binary: openvmm/target/release/openvmm.exe
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  openvmm-vmm-tests:
    name: OpenVMM vmm-tests / ${{ matrix.name }}
    needs: [artifacts, openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        needs.artifacts.result == 'success' &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-openvmm-vmm-tests == 'true'
        )
      }}
    runs-on: ${{ fromJSON(matrix.runner) }}
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Linux / KVM
            backend: kvm
            runner: '["self-hosted", "linux", "kvm", "virtual-machine", "general"]'
          - name: Linux / MSHV
            backend: mshv
            runner: '["self-hosted", "linux", "mshv", "virtual-machine", "general"]'
          - name: Windows / WHP
            backend: whp
            runner: '["self-hosted", "windows", "whp", "virtual-machine", "general"]'
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Validate runner
        uses: ./.github/actions/validate-runner
        with:
          backend: ${{ matrix.backend }}

      - name: Checkout OpenVMM
        id: openvmm
        uses: ./.github/actions/checkout-openvmm
        with:
          ssh-key: ${{ secrets.OPENVMM_DEPLOY_KEY }}

      - name: Set up retrying curl
        uses: ./.github/actions/setup-curl

      - name: Download guest artifacts
        uses: actions/download-artifact@v8
        with:
          name: guest-artifacts
          path: build

      - name: Prepare Windows cache tools
        if: runner.os == 'Windows'
        shell: powershell
        run: python scripts\nvx.py setup-cross-os-cache

      - name: Prepare Linux cache tools
        id: cache-tools-linux
        if: runner.os != 'Windows'
        shell: bash
        run: |
          set -euo pipefail
          cache_tools="${RUNNER_TEMP}/nvx-gzip-cache-tools"
          mkdir -p "${cache_tools}"
          ln -sf "$(command -v tar)" "${cache_tools}/tar"
          ln -sf "$(command -v gzip)" "${cache_tools}/gzip"
          echo "path=${cache_tools}" >> "${GITHUB_OUTPUT}"

      - name: Restore OpenVMM inputs on Linux
        id: restore-openvmm-inputs-linux
        if: runner.os != 'Windows'
        uses: actions/cache/restore@v5
        env:
          PATH: ${{ steps.cache-tools-linux.outputs.path }}
        with:
          path: |
            openvmm/flowey-persist/flowey_lib_common__download_gh_release
            openvmm/flowey-persist/flowey_lib_common__cache
          key: openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-vmm-tests-${{ steps.openvmm.outputs.sha }}
          restore-keys: |
            openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-

      - name: Restore OpenVMM inputs on Windows
        id: restore-openvmm-inputs-windows
        if: runner.os == 'Windows'
        uses: actions/cache/restore@v5
        with:
          path: |
            openvmm/flowey-persist/flowey_lib_common__download_gh_release
            openvmm/flowey-persist/flowey_lib_common__cache
          key: openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-vmm-tests-${{ steps.openvmm.outputs.sha }}
          restore-keys: |
            openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-

      - name: Restore shared Cargo cache on Linux
        id: restore-openvmm-cargo-linux
        if: runner.os != 'Windows'
        uses: actions/cache/restore@v5
        env:
          PATH: ${{ steps.cache-tools-linux.outputs.path }}
        with:
          path: |
            ${{ format('{0}/cargo-home/registry', runner.temp) }}
            ${{ format('{0}/cargo-home/git', runner.temp) }}
          key: openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-vmm-tests-${{ hashFiles('openvmm/Cargo.lock') }}
          restore-keys: |
            openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-

      - name: Restore shared Cargo cache on Windows
        id: restore-openvmm-cargo-windows
        if: runner.os == 'Windows'
        uses: actions/cache/restore@v5
        with:
          path: |
            ${{ format('{0}/cargo-home/registry', runner.temp) }}
            ${{ format('{0}/cargo-home/git', runner.temp) }}
          key: openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-vmm-tests-${{ hashFiles('openvmm/Cargo.lock') }}
          restore-keys: |
            openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-

      - name: Prepare sccache
        uses: ./.github/actions/sccache
        with:
          operation: start

      - name: Run OpenVMM tests on KVM
        if: matrix.backend == 'kvm'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 scripts/nvx.py test-openvmm --backend "${{ matrix.backend }}"

      - name: Run OpenVMM tests on MSHV
        if: matrix.backend == 'mshv'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 scripts/nvx.py test-openvmm --backend "${{ matrix.backend }}"

      - name: Run OpenVMM tests on Windows
        if: runner.os == 'Windows'
        shell: powershell
        env:
          GH_TOKEN: ${{ github.token }}
        run: python scripts\nvx.py test-openvmm --backend "${{ matrix.backend }}"

      - name: Upload OpenVMM test diagnostics
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: openvmm-vmm-tests-${{ runner.os }}-${{ matrix.backend }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.os == 'Windows' && format('{0}/{1}/test_results', runner.temp, matrix.backend) || 'openvmm/target/vmm_tests/test_results' }}
          if-no-files-found: warn
          retention-days: 7

      - name: Report sccache
        if: always()
        uses: ./.github/actions/sccache
        with:
          operation: stop

      - name: Save OpenVMM inputs on Linux
        if: >-
          success() &&
          github.event_name == 'push' &&
          github.ref == 'refs/heads/dev' &&
          runner.os != 'Windows' &&
          steps.restore-openvmm-inputs-linux.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        env:
          PATH: ${{ steps.cache-tools-linux.outputs.path }}
        with:
          path: |
            openvmm/flowey-persist/flowey_lib_common__download_gh_release
            openvmm/flowey-persist/flowey_lib_common__cache
          key: openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-vmm-tests-${{ steps.openvmm.outputs.sha }}

      - name: Save OpenVMM inputs on Windows
        if: >-
          success() &&
          github.event_name == 'push' &&
          github.ref == 'refs/heads/dev' &&
          runner.os == 'Windows' &&
          steps.restore-openvmm-inputs-windows.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        with:
          path: |
            openvmm/flowey-persist/flowey_lib_common__download_gh_release
            openvmm/flowey-persist/flowey_lib_common__cache
          key: openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-vmm-tests-${{ steps.openvmm.outputs.sha }}

      - name: Save shared Cargo cache on Linux
        if: >-
          success() &&
          github.event_name == 'push' &&
          github.ref == 'refs/heads/dev' &&
          runner.os != 'Windows' &&
          steps.restore-openvmm-cargo-linux.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        env:
          PATH: ${{ steps.cache-tools-linux.outputs.path }}
        with:
          path: |
            ${{ format('{0}/cargo-home/registry', runner.temp) }}
            ${{ format('{0}/cargo-home/git', runner.temp) }}
          key: openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-vmm-tests-${{ hashFiles('openvmm/Cargo.lock') }}

      - name: Save shared Cargo cache on Windows
        if: >-
          success() &&
          github.event_name == 'push' &&
          github.ref == 'refs/heads/dev' &&
          runner.os == 'Windows' &&
          steps.restore-openvmm-cargo-windows.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        with:
          path: |
            ${{ format('{0}/cargo-home/registry', runner.temp) }}
            ${{ format('{0}/cargo-home/git', runner.temp) }}
          key: openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-vmm-tests-${{ hashFiles('openvmm/Cargo.lock') }}

  openvmm-unit-tests:
    name: OpenVMM unit tests / ${{ matrix.name }}
    needs: [openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-openvmm-unit-tests == 'true'
        )
      }}
    runs-on: ${{ fromJSON(matrix.runner) }}
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        # The suites run once per OS: the tests that need /dev/kvm or
        # /dev/mshv are ignored, so the KVM and MSHV runners ran the same
        # tests.
        include:
          - name: Linux
            backend: mshv
            runner: '["self-hosted", "linux", "mshv", "virtual-machine", "general"]'
          - name: Windows
            backend: whp
            runner: '["self-hosted", "windows", "whp", "virtual-machine", "general"]'
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Validate runner
        uses: ./.github/actions/validate-runner
        with:
          backend: ${{ matrix.backend }}

      - name: Checkout OpenVMM
        id: openvmm
        uses: ./.github/actions/checkout-openvmm
        with:
          ssh-key: ${{ secrets.OPENVMM_DEPLOY_KEY }}

      - name: Set up retrying curl
        uses: ./.github/actions/setup-curl

      - name: Prepare Windows cache tools
        if: runner.os == 'Windows'
        shell: powershell
        run: python scripts\nvx.py setup-cross-os-cache

      - name: Prepare Linux cache tools
        id: cache-tools-linux
        if: runner.os != 'Windows'
        shell: bash
        run: |
          set -euo pipefail
          cache_tools="${RUNNER_TEMP}/nvx-gzip-cache-tools"
          mkdir -p "${cache_tools}"
          ln -sf "$(command -v tar)" "${cache_tools}/tar"
          ln -sf "$(command -v gzip)" "${cache_tools}/gzip"
          echo "path=${cache_tools}" >> "${GITHUB_OUTPUT}"

      - name: Restore OpenVMM inputs on Linux
        id: restore-openvmm-inputs-linux
        if: runner.os != 'Windows'
        uses: actions/cache/restore@v5
        env:
          PATH: ${{ steps.cache-tools-linux.outputs.path }}
        with:
          path: |
            openvmm/flowey-persist/flowey_lib_common__download_gh_release
            openvmm/flowey-persist/flowey_lib_common__cache
          key: openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-unit-tests-${{ steps.openvmm.outputs.sha }}
          restore-keys: |
            openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-

      - name: Restore OpenVMM inputs on Windows
        id: restore-openvmm-inputs-windows
        if: runner.os == 'Windows'
        uses: actions/cache/restore@v5
        with:
          path: |
            openvmm/flowey-persist/flowey_lib_common__download_gh_release
            openvmm/flowey-persist/flowey_lib_common__cache
          key: openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-unit-tests-${{ steps.openvmm.outputs.sha }}
          restore-keys: |
            openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-

      - name: Restore shared Cargo cache on Linux
        id: restore-openvmm-cargo-linux
        if: runner.os != 'Windows'
        uses: actions/cache/restore@v5
        env:
          PATH: ${{ steps.cache-tools-linux.outputs.path }}
        with:
          path: |
            ${{ format('{0}/cargo-home/registry', runner.temp) }}
            ${{ format('{0}/cargo-home/git', runner.temp) }}
          key: openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-unit-tests-${{ hashFiles('openvmm/Cargo.lock') }}
          restore-keys: |
            openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-

      - name: Restore shared Cargo cache on Windows
        id: restore-openvmm-cargo-windows
        if: runner.os == 'Windows'
        uses: actions/cache/restore@v5
        with:
          path: |
            ${{ format('{0}/cargo-home/registry', runner.temp) }}
            ${{ format('{0}/cargo-home/git', runner.temp) }}
          key: openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-unit-tests-${{ hashFiles('openvmm/Cargo.lock') }}
          restore-keys: |
            openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-

      - name: Prepare sccache
        uses: ./.github/actions/sccache
        with:
          operation: start

      - name: Run OpenVMM unit tests on Linux
        if: runner.os != 'Windows'
        shell: bash
        run: python3 scripts/nvx.py test-openvmm-unit

      - name: Run OpenVMM unit tests on Windows
        if: runner.os == 'Windows'
        shell: powershell
        run: python scripts\nvx.py test-openvmm-unit

      - name: Report sccache
        if: always()
        uses: ./.github/actions/sccache
        with:
          operation: stop

      - name: Save OpenVMM inputs on Linux
        if: >-
          success() &&
          github.event_name == 'push' &&
          github.ref == 'refs/heads/dev' &&
          runner.os != 'Windows' &&
          steps.restore-openvmm-inputs-linux.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        env:
          PATH: ${{ steps.cache-tools-linux.outputs.path }}
        with:
          path: |
            openvmm/flowey-persist/flowey_lib_common__download_gh_release
            openvmm/flowey-persist/flowey_lib_common__cache
          key: openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-unit-tests-${{ steps.openvmm.outputs.sha }}

      - name: Save OpenVMM inputs on Windows
        if: >-
          success() &&
          github.event_name == 'push' &&
          github.ref == 'refs/heads/dev' &&
          runner.os == 'Windows' &&
          steps.restore-openvmm-inputs-windows.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        with:
          path: |
            openvmm/flowey-persist/flowey_lib_common__download_gh_release
            openvmm/flowey-persist/flowey_lib_common__cache
          key: openvmm-inputs-v1-${{ runner.os }}-${{ runner.arch }}-unit-tests-${{ steps.openvmm.outputs.sha }}

      - name: Save shared Cargo cache on Linux
        if: >-
          success() &&
          github.event_name == 'push' &&
          github.ref == 'refs/heads/dev' &&
          runner.os != 'Windows' &&
          steps.restore-openvmm-cargo-linux.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        env:
          PATH: ${{ steps.cache-tools-linux.outputs.path }}
        with:
          path: |
            ${{ format('{0}/cargo-home/registry', runner.temp) }}
            ${{ format('{0}/cargo-home/git', runner.temp) }}
          key: openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-unit-tests-${{ hashFiles('openvmm/Cargo.lock') }}

      - name: Save shared Cargo cache on Windows
        if: >-
          success() &&
          github.event_name == 'push' &&
          github.ref == 'refs/heads/dev' &&
          runner.os == 'Windows' &&
          steps.restore-openvmm-cargo-windows.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        with:
          path: |
            ${{ format('{0}/cargo-home/registry', runner.temp) }}
            ${{ format('{0}/cargo-home/git', runner.temp) }}
          key: openvmm-cargo-v1-${{ runner.os }}-${{ runner.arch }}-unit-tests-${{ hashFiles('openvmm/Cargo.lock') }}

  nvx-microvm-tests-kvm:
    name: NVX microVM tests / Linux / KVM
    needs: [artifacts, build-openvmm-linux-gnu, nvx-cli-linux, openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        needs.artifacts.result == 'success' &&
        needs.build-openvmm-linux-gnu.result == 'success' &&
        needs.nvx-cli-linux.result == 'success' &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-tests == 'true'
        )
      }}
    uses: ./.github/workflows/run-nvx-microvm-tests.yml
    with:
      display-name: Linux / KVM
      runner: '["self-hosted", "linux", "kvm", "virtual-machine", "general"]'
      backend: kvm
      openvmm-artifact: openvmm-linux-gnu
      nvx-rs-artifact: nvx-rs-linux-musl
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  nvx-microvm-tests-mshv:
    name: NVX microVM tests / Linux / MSHV
    needs: [artifacts, build-openvmm-linux-gnu, nvx-cli-linux, openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        needs.artifacts.result == 'success' &&
        needs.build-openvmm-linux-gnu.result == 'success' &&
        needs.nvx-cli-linux.result == 'success' &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-tests == 'true'
        )
      }}
    uses: ./.github/workflows/run-nvx-microvm-tests.yml
    with:
      display-name: Linux / MSHV
      runner: '["self-hosted", "linux", "mshv", "virtual-machine", "general"]'
      backend: mshv
      openvmm-artifact: openvmm-linux-gnu
      nvx-rs-artifact: nvx-rs-linux-musl
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  nvx-microvm-tests-whp:
    name: NVX microVM tests / Windows / WHP
    needs: [artifacts, build-openvmm-windows-msvc, nvx-cli-windows, openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        needs.artifacts.result == 'success' &&
        needs.build-openvmm-windows-msvc.result == 'success' &&
        needs.nvx-cli-windows.result == 'success' &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-tests == 'true'
        )
      }}
    uses: ./.github/workflows/run-nvx-microvm-tests.yml
    with:
      display-name: Windows / WHP
      runner: '["self-hosted", "windows", "whp", "virtual-machine", "general"]'
      backend: whp
      openvmm-artifact: openvmm-windows-msvc
      nvx-rs-artifact: nvx-rs-windows-msvc
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  # Pull requests run the debug kernel on KVM only; dev pushes and full runs
  # run every backend.
  nvx-microvm-debug-kvm:
    name: NVX microVM tests / Linux / KVM / Debug kernel
    needs: [artifacts, debug-kernel, build-openvmm-linux-gnu, nvx-cli-linux, openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        needs.artifacts.result == 'success' &&
        needs.debug-kernel.result == 'success' &&
        needs.build-openvmm-linux-gnu.result == 'success' &&
        needs.nvx-cli-linux.result == 'success' &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-tests == 'true'
        )
      }}
    uses: ./.github/workflows/run-nvx-microvm-tests.yml
    with:
      display-name: Linux / KVM / Debug kernel
      runner: '["self-hosted", "linux", "kvm", "virtual-machine", "general"]'
      backend: kvm
      openvmm-artifact: openvmm-linux-gnu
      nvx-rs-artifact: nvx-rs-linux-musl
      debug-kernel: true
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  nvx-microvm-debug-mshv:
    name: NVX microVM tests / Linux / MSHV / Debug kernel
    needs: [artifacts, debug-kernel, build-openvmm-linux-gnu, nvx-cli-linux, openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        github.event_name != 'pull_request' &&
        needs.artifacts.result == 'success' &&
        needs.debug-kernel.result == 'success' &&
        needs.build-openvmm-linux-gnu.result == 'success' &&
        needs.nvx-cli-linux.result == 'success' &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-tests == 'true'
        )
      }}
    uses: ./.github/workflows/run-nvx-microvm-tests.yml
    with:
      display-name: Linux / MSHV / Debug kernel
      runner: '["self-hosted", "linux", "mshv", "virtual-machine", "general"]'
      backend: mshv
      openvmm-artifact: openvmm-linux-gnu
      nvx-rs-artifact: nvx-rs-linux-musl
      debug-kernel: true
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  nvx-microvm-debug-whp:
    name: NVX microVM tests / Windows / WHP / Debug kernel
    needs: [artifacts, debug-kernel, build-openvmm-windows-msvc, nvx-cli-windows, openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        github.event_name != 'pull_request' &&
        needs.artifacts.result == 'success' &&
        needs.debug-kernel.result == 'success' &&
        needs.build-openvmm-windows-msvc.result == 'success' &&
        needs.nvx-cli-windows.result == 'success' &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-tests == 'true'
        )
      }}
    uses: ./.github/workflows/run-nvx-microvm-tests.yml
    with:
      display-name: Windows / WHP / Debug kernel
      runner: '["self-hosted", "windows", "whp", "virtual-machine", "general"]'
      backend: whp
      openvmm-artifact: openvmm-windows-msvc
      nvx-rs-artifact: nvx-rs-windows-msvc
      debug-kernel: true
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  # The platform jobs measure the performance series that the regression gate
  # and the history compare. Each runs on the one runner of its backend's pool
  # that carries `benchmark` instead of `general`, so that no other job can
  # delay it and every workflow run measures its series on the same VM: the
  # pools mix CPU generations and VMs whose results differ by more than the
  # run-to-run noise (#383, #415).
  platform-kvm:
    name: Platform / Linux / KVM / Virtual machine
    needs: [artifacts, build-openvmm-linux-gnu, nvx-cli-linux, openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        needs.artifacts.result == 'success' &&
        needs.build-openvmm-linux-gnu.result == 'success' &&
        needs.nvx-cli-linux.result == 'success' &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-workloads == 'true'
        )
      }}
    uses: ./.github/workflows/run-platform.yml
    with:
      display-name: Linux / KVM / Virtual machine
      runner: '["self-hosted", "linux", "kvm", "virtual-machine", "benchmark"]'
      backend: kvm
      release-platform: linux-kvm
      benchmark-platform: linux-kvm-virtual-machine
      openvmm-artifact: openvmm-linux-gnu
      nvx-rs-artifact: nvx-rs-linux-musl
      teardown-mode: guest-exit
      benchmark-cpus: 0-7
      host-cpu-reserve: 0
      marker-timeout: 40
      package-release: true
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  platform-mshv:
    name: Platform / Linux / MSHV / Virtual machine
    needs: [artifacts, build-openvmm-linux-musl, nvx-cli-linux, openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        needs.artifacts.result == 'success' &&
        needs.build-openvmm-linux-musl.result == 'success' &&
        needs.nvx-cli-linux.result == 'success' &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-workloads == 'true'
        )
      }}
    uses: ./.github/workflows/run-platform.yml
    with:
      display-name: Linux / MSHV / Virtual machine
      runner: '["self-hosted", "linux", "mshv", "virtual-machine", "benchmark"]'
      backend: mshv
      release-platform: linux-mshv
      benchmark-platform: linux-mshv-virtual-machine
      openvmm-artifact: openvmm-linux-musl
      nvx-rs-artifact: nvx-rs-linux-musl
      teardown-mode: guest-exit
      benchmark-cpus: 0-7
      host-cpu-reserve: 0
      marker-timeout: 40
      package-release: true
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  platform-whp:
    name: Platform / Windows / WHP / Virtual machine
    needs: [artifacts, build-openvmm-windows-msvc, nvx-cli-windows, openvmm-changes]
    if: >-
      ${{
        always() &&
        !cancelled() &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.draft == false
        ) &&
        (
          github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository
        ) &&
        needs.artifacts.result == 'success' &&
        needs.build-openvmm-windows-msvc.result == 'success' &&
        needs.nvx-cli-windows.result == 'success' &&
        (
          needs.openvmm-changes.result != 'success' ||
          needs.openvmm-changes.outputs.run-workloads == 'true'
        )
      }}
    uses: ./.github/workflows/run-platform.yml
    with:
      display-name: Windows / WHP / Virtual machine
      runner: '["self-hosted", "windows", "whp", "virtual-machine", "benchmark"]'
      backend: whp
      release-platform: windows-whp
      benchmark-platform: windows-whp-virtual-machine
      openvmm-artifact: openvmm-windows-msvc
      nvx-rs-artifact: nvx-rs-windows-msvc
      teardown-mode: guest-exit
      benchmark-cpus: 0-7
      host-cpu-reserve: 0
      marker-timeout: 40
      package-release: true
    secrets:
      OPENVMM_DEPLOY_KEY: ${{ secrets.OPENVMM_DEPLOY_KEY }}

  release:
    name: Publish development release
    needs:
      - debug-kernel
      - quality
      - aci-edge-sandboxes
      - nvx-rs
      - nvx-cli-linux
      - nvx-cli-windows
      - openvmm-vmm-tests
      - openvmm-unit-tests
      - nvx-microvm-tests-kvm
      - nvx-microvm-tests-mshv
      - nvx-microvm-tests-whp
      - nvx-microvm-debug-kvm
      - nvx-microvm-debug-mshv
      - nvx-microvm-debug-whp
      - platform-kvm
      - platform-mshv
      - platform-whp
    if: >-
      ${{
        always() &&
        github.event_name == 'push' &&
        github.ref == 'refs/heads/dev' &&
        !cancelled() &&
        needs.debug-kernel.result == 'success' &&
        needs.quality.result == 'success' &&
        needs.aci-edge-sandboxes.result == 'success' &&
        needs.nvx-rs.result == 'success' &&
        needs.nvx-cli-linux.result == 'success' &&
        needs.nvx-cli-windows.result == 'success' &&
        (
          needs.openvmm-vmm-tests.result == 'success' ||
          needs.openvmm-vmm-tests.result == 'skipped'
        ) &&
        (
          needs.openvmm-unit-tests.result == 'success' ||
          needs.openvmm-unit-tests.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-tests-kvm.result == 'success' ||
          needs.nvx-microvm-tests-kvm.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-tests-mshv.result == 'success' ||
          needs.nvx-microvm-tests-mshv.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-tests-whp.result == 'success' ||
          needs.nvx-microvm-tests-whp.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-debug-kvm.result == 'success' ||
          needs.nvx-microvm-debug-kvm.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-debug-mshv.result == 'success' ||
          needs.nvx-microvm-debug-mshv.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-debug-whp.result == 'success' ||
          needs.nvx-microvm-debug-whp.result == 'skipped'
        ) &&
        needs.platform-kvm.result == 'success' &&
        needs.platform-mshv.result == 'success' &&
        needs.platform-whp.result == 'success'
      }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    permissions:
      actions: read
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Publish development release
        uses: ./.github/actions/publish-development-release

  performance-gate:
    name: Performance regression gate
    needs: [platform-kvm, platform-mshv, platform-whp]
    if: >-
      ${{
        github.event_name == 'pull_request' &&
        github.event.pull_request.draft == false &&
        !cancelled() &&
        needs.platform-kvm.result == 'success' &&
        needs.platform-mshv.result == 'success' &&
        needs.platform-whp.result == 'success'
      }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Gate on performance regressions
        uses: ./.github/actions/gate-performance
        with:
          base-ref: dev
          baseline-window: ${{ env.PERFORMANCE_BASELINE_WINDOW }}
          minimum-history: ${{ env.PERFORMANCE_BASELINE_MINIMUM_HISTORY }}
          regression-threshold: ${{ env.PERFORMANCE_REGRESSION_THRESHOLD }}
          absolute-tolerance-ms: ${{ env.PERFORMANCE_REGRESSION_ABSOLUTE_TOLERANCE_MS }}

  required-status-check:
    name: Required status check
    needs:
      - quality
      - aci-edge-sandboxes
      - nvx-rs
      - nvx-cli-linux
      - nvx-cli-windows
      - openvmm-changes
      - artifacts
      - debug-kernel
      - build-openvmm-linux-gnu
      - build-openvmm-linux-musl
      - build-openvmm-windows-msvc
      - openvmm-vmm-tests
      - openvmm-unit-tests
      - nvx-microvm-tests-kvm
      - nvx-microvm-tests-mshv
      - nvx-microvm-tests-whp
      - nvx-microvm-debug-kvm
      - nvx-microvm-debug-mshv
      - nvx-microvm-debug-whp
      - platform-kvm
      - platform-mshv
      - platform-whp
      - performance-gate
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Verify required jobs
        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
        shell: bash
        env:
          SAME_REPOSITORY: >-
            ${{
              github.event_name != 'pull_request' ||
              github.event.pull_request.head.repo.full_name == github.repository
            }}
          RUN_TESTS: ${{ needs.openvmm-changes.outputs.run-tests }}
          RUN_WORKLOADS: ${{ needs.openvmm-changes.outputs.run-workloads }}
          RUN_OPENVMM_UNIT_TESTS: ${{ needs.openvmm-changes.outputs.run-openvmm-unit-tests }}
          RUN_OPENVMM_VMM_TESTS: ${{ needs.openvmm-changes.outputs.run-openvmm-vmm-tests }}
          QUALITY_RESULT: ${{ needs.quality.result }}
          ACI_EDGE_SANDBOXES_RESULT: ${{ needs.aci-edge-sandboxes.result }}
          NVX_RS_RESULT: ${{ needs.nvx-rs.result }}
          NVX_CLI_LINUX_RESULT: ${{ needs.nvx-cli-linux.result }}
          NVX_CLI_WINDOWS_RESULT: ${{ needs.nvx-cli-windows.result }}
          CHANGES_RESULT: ${{ needs.openvmm-changes.result }}
          ARTIFACTS_RESULT: ${{ needs.artifacts.result }}
          DEBUG_KERNEL_RESULT: ${{ needs.debug-kernel.result }}
          BUILD_LINUX_GNU_RESULT: ${{ needs.build-openvmm-linux-gnu.result }}
          BUILD_LINUX_MUSL_RESULT: ${{ needs.build-openvmm-linux-musl.result }}
          BUILD_WINDOWS_MSVC_RESULT: ${{ needs.build-openvmm-windows-msvc.result }}
          VMM_TESTS_RESULT: ${{ needs.openvmm-vmm-tests.result }}
          UNIT_TESTS_RESULT: ${{ needs.openvmm-unit-tests.result }}
          MICROVM_KVM_RESULT: ${{ needs.nvx-microvm-tests-kvm.result }}
          MICROVM_MSHV_RESULT: ${{ needs.nvx-microvm-tests-mshv.result }}
          MICROVM_WHP_RESULT: ${{ needs.nvx-microvm-tests-whp.result }}
          MICROVM_DEBUG_KVM_RESULT: ${{ needs.nvx-microvm-debug-kvm.result }}
          MICROVM_DEBUG_MSHV_RESULT: ${{ needs.nvx-microvm-debug-mshv.result }}
          MICROVM_DEBUG_WHP_RESULT: ${{ needs.nvx-microvm-debug-whp.result }}
          PLATFORM_KVM_RESULT: ${{ needs.platform-kvm.result }}
          PLATFORM_MSHV_RESULT: ${{ needs.platform-mshv.result }}
          PLATFORM_WHP_RESULT: ${{ needs.platform-whp.result }}
          PERFORMANCE_GATE_RESULT: ${{ needs.performance-gate.result }}
        run: >-
          python3 scripts/nvx.py check-required-ci
          --event-name "${{ github.event_name }}"
          --same-repository "${SAME_REPOSITORY}"
          --run-tests "${RUN_TESTS}"
          --run-workloads "${RUN_WORKLOADS}"
          --run-openvmm-unit-tests "${RUN_OPENVMM_UNIT_TESTS}"
          --run-openvmm-vmm-tests "${RUN_OPENVMM_VMM_TESTS}"

  performance-persist:
    name: Persist performance baseline
    needs:
      - debug-kernel
      - nvx-cli-linux
      - nvx-cli-windows
      - openvmm-vmm-tests
      - openvmm-unit-tests
      - nvx-microvm-tests-kvm
      - nvx-microvm-tests-mshv
      - nvx-microvm-tests-whp
      - nvx-microvm-debug-kvm
      - nvx-microvm-debug-mshv
      - nvx-microvm-debug-whp
      - platform-kvm
      - platform-mshv
      - platform-whp
    if: >-
      ${{
        always() &&
        github.event_name == 'push' &&
        github.ref == 'refs/heads/dev' &&
        !cancelled() &&
        needs.debug-kernel.result == 'success' &&
        needs.nvx-cli-linux.result == 'success' &&
        needs.nvx-cli-windows.result == 'success' &&
        (
          needs.openvmm-vmm-tests.result == 'success' ||
          needs.openvmm-vmm-tests.result == 'skipped'
        ) &&
        (
          needs.openvmm-unit-tests.result == 'success' ||
          needs.openvmm-unit-tests.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-tests-kvm.result == 'success' ||
          needs.nvx-microvm-tests-kvm.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-tests-mshv.result == 'success' ||
          needs.nvx-microvm-tests-mshv.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-tests-whp.result == 'success' ||
          needs.nvx-microvm-tests-whp.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-debug-kvm.result == 'success' ||
          needs.nvx-microvm-debug-kvm.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-debug-mshv.result == 'success' ||
          needs.nvx-microvm-debug-mshv.result == 'skipped'
        ) &&
        (
          needs.nvx-microvm-debug-whp.result == 'success' ||
          needs.nvx-microvm-debug-whp.result == 'skipped'
        ) &&
        needs.platform-kvm.result == 'success' &&
        needs.platform-mshv.result == 'success' &&
        needs.platform-whp.result == 'success'
      }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout dev
        uses: actions/checkout@v5
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          ssh-key: ${{ secrets.PERFORMANCE_PERSIST_DEPLOY_KEY }}

      - name: Persist results on dev
        uses: ./.github/actions/persist-performance-results
        with:
          branch: dev