AkurAI-VPN / .github/workflows/ci.yml

Latest change 967859a8fd3fd7cd6a106b71cda93af4daa5efc9 - ci: runtime smoke test — run the node on real macOS/Windows, assert the utun/Wintun device comes up by Claude Code

name: ci

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  # The cryptographic + transport + protocol core is pure-std and must build AND
  # pass its tests on every desktop OS — this is the cross-platform foundation a
  # macOS/Windows client is built on.
  portable-core:
    name: portable core (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: build core crates
        run: cargo build -p akurai-crypto -p akurai-transport -p akurai-common -p akurai-dns
      - name: test core crates
        run: cargo test -p akurai-crypto -p akurai-transport -p akurai-common -p akurai-dns

  # Full workspace (incl. control plane + relay + Linux node) on Linux.
  linux-full:
    name: linux full workspace
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - run: cargo fmt --all --check
      - run: cargo clippy --workspace --all-targets
      - run: cargo build --workspace
      - run: cargo test --workspace

  # Desktop node — builds the client daemon on macOS + Windows on real runners.
  # macOS has a real utun data plane; Windows compiles (Wintun data plane pending).
  # This is now a hard gate: a regression in the cross-platform build fails CI.
  desktop-node:
    name: desktop node (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: build node (release)
        run: cargo build --release -p akurai-node
      # Publish the built client so it can be downloaded and runtime-tested on
      # real Mac/Windows hardware (CI runners can't create a TUN/utun to test it).
      - name: upload client binary
        uses: actions/upload-artifact@v4
        with:
          name: akurai-node-${{ matrix.os }}
          path: |
            target/release/akurai-node
            target/release/akurai-node.exe
          if-no-files-found: warn

  # Runtime smoke test: actually RUN the client on real macOS/Windows and confirm
  # it brings the platform data-plane device UP ("tunnel up" only prints after the
  # utun/Wintun create + interface setup succeed). This runtime-verifies the FFI
  # device-create path — the part most likely to compile yet fail at runtime.
  runtime-smoke:
    name: runtime smoke (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: build node (release)
        run: cargo build --release -p akurai-node
      - name: macOS — bring up utun and assert tunnel up
        if: runner.os == 'macOS'
        run: |
          BIN=./target/release/akurai-node
          "$BIN" install --home /tmp/akv
          echo "100.88.0.2 $(cat /tmp/akv/config/identity.pub) peer" > /tmp/akv/config/peers
          sudo "$BIN" tunnel --home /tmp/akv --overlay-ip 100.88.0.3 \
            --relay 127.0.0.1:51820 --peers /tmp/akv/config/peers > smoke.log 2>&1 &
          PID=$!
          sleep 6
          sudo kill "$PID" 2>/dev/null || true
          echo "--- node output ---"; cat smoke.log
          echo "--- utun interfaces ---"; ifconfig | grep -i utun || true
          grep -q "tunnel up" smoke.log && echo "PASS: macOS utun data plane came up" \
            || { echo "FAIL: utun did not come up"; exit 1; }
      - name: Windows — bring up Wintun and assert tunnel up
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          Invoke-WebRequest -Uri "https://www.wintun.net/builds/wintun-0.14.1.zip" -OutFile wintun.zip
          Expand-Archive wintun.zip -DestinationPath wintun-extract -Force
          Copy-Item wintun-extract/wintun/bin/amd64/wintun.dll target/release/wintun.dll
          $home2 = Join-Path $env:TEMP akv
          ./target/release/akurai-node.exe install --home $home2
          $pub = Get-Content (Join-Path $home2 config/identity.pub)
          "100.88.0.2 $pub peer" | Out-File -Encoding ascii (Join-Path $home2 config/peers)
          $p = Start-Process -FilePath ./target/release/akurai-node.exe `
            -ArgumentList "tunnel","--home",$home2,"--overlay-ip","100.88.0.3","--relay","127.0.0.1:51820","--peers",(Join-Path $home2 config/peers) `
            -RedirectStandardError smoke.log -RedirectStandardOutput smoke.out -PassThru -NoNewWindow
          Start-Sleep -Seconds 6
          Stop-Process -Id $p.Id -Force -ErrorAction SilentlyContinue
          Write-Host "--- node output ---"; Get-Content smoke.log -ErrorAction SilentlyContinue
          if (Select-String -Path smoke.log -Pattern "tunnel up" -Quiet) { Write-Host "PASS: Windows Wintun data plane came up" }
          else { Write-Host "FAIL: Wintun did not come up"; exit 1 }