name: TKM

on: [push, pull_request]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CCACHE_DIR: ${{ github.workspace }}/.ccache
  CCACHE_CONTAINER: /root/.ccache
  CCACHE_COMPILERCHECK: content
  CCACHE_COMPRESS: true
  CCACHE_MAXSIZE: 100M
  EVICT_CCACHE_AGE: 1200s

jobs:
  pre-check:
    runs-on: ubuntu-latest
    outputs:
      should_skip: ${{ steps.skip-check.outputs.should_skip }}
    steps:
      - id: skip-check
        uses: fkirc/skip-duplicate-actions@master
        with:
          concurrent_skipping: 'same_content_newer'

  tkm:
    needs: pre-check
    if: ${{ needs.pre-check.outputs.should_skip != 'true' }}
    runs-on: ubuntu-latest
    permissions:
      actions: write
    env:
      TEST: tkm
    steps:
      - uses: actions/checkout@v6
      - uses: actions/cache/restore@v5
        id: cache-restore
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ccache-tkm
      - name: Build Docker Image
        run: docker build -t strongswan-tkm -f testing/tkm/Dockerfile testing
      - name: Run Tests in Container
        run: |
          docker run \
            --cap-add net_admin \
            -v ${{ github.workspace }}:/strongswan \
            -v ${{ env.CCACHE_DIR }}:${{ env.CCACHE_CONTAINER }} \
            -e CCACHE_DIR=${{ env.CCACHE_CONTAINER }} \
            -e CCACHE_COMPILERCHECK \
            -e CCACHE_COMPRESS \
            -e CCACHE_MAXSIZE \
            -e EVICT_CCACHE_AGE \
            strongswan-tkm \
            bash -c "ccache -z; \
            echo '### build charon-tkm'; \
            autoreconf -i /strongswan || exit 1; \
            CFLAGS=\"-g -O2 -Wall -Wno-format -Wno-format-security -Wno-pointer-sign -Werror\" \
            /strongswan/configure --disable-defaults --enable-silent-rules \
              --enable-ikev2 --enable-kernel-netlink --enable-pem --enable-pkcs1 \
              --enable-random --enable-sha1 --enable-socket-default --enable-swanctl \
              --enable-tkm --enable-x509 || exit 1; \
            make -j || exit 1; \
            \
            echo '### run tests without TKM first'; \
            make -j check TESTS_RUNNERS=tkm || exit 1; \
            \
            echo '### generate TKM config'; \
            /usr/local/share/tkm/generate-config.sh; \
            echo '### start TKM in the background'; \
            tkm_keymanager -c tkm.conf -k key.der -r ca.der:1 >/tmp/tkm.log & \
            \
            echo '### run the tests against TKM and get TKM log'; \
            make -j check TESTS_RUNNERS=tkm TESTS_TKM=1 || exit 1; \
            cat /tmp/tkm.log; \
            ccache -sv; \
            ccache --evict-older-than $EVICT_CCACHE_AGE; \
            ccache -sv; \
            "
      # delete old cache entry as we currently can't update it any other way
      - env:
          GH_TOKEN: ${{ github.token }}
        if: github.event_name == 'push' && steps.cache-restore.outputs.cache-hit
        continue-on-error: true
        run: gh cache delete -r ${{ github.ref }} ${{ steps.cache-restore.outputs.cache-primary-key }}
      - if: github.event_name == 'push'
        uses: actions/cache/save@v5
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ${{ steps.cache-restore.outputs.cache-primary-key }}