_check-runtime-determimism.yml

---
# This workflow checks runtime determinism, ie it downloads production runtime from artifacts
# and compiles again production runtime from sources, and compares both files checksums
name: Build test node image and e2e client image
on:
  workflow_call:

jobs:
  main:
    name: Check runtime build determinism
    runs-on: [self-hosted, Linux, X64, large]
    env:
      RUST_BACKTRACE: full
      RUSTC_WRAPPER: sccache
    steps:
      - name: Checkout aleph-node source code
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: Cardinal-Cryptography/github-actions/install-rust-toolchain@v7
        with:
          targets: wasm32-unknown-unknown

      - name: Download production runtime from artifacts
        uses: actions/download-artifact@v4
        with:
          name: aleph-production-runtime

      - name: Build runtime 2nd time and compare checksum with previous build
        env:
          ARTIFACT: aleph_runtime.compact.compressed.wasm
          TARGET_DIR: target/production/wbuild/aleph-runtime
        run: |
          mkdir -p '${{ env.TARGET_DIR }}'
          mv '${{ env.ARTIFACT }}' '${{ env.TARGET_DIR }}'
          sha256sum '${{ env.TARGET_DIR }}/${{ env.ARTIFACT }}' > checksum.sha256
          cargo clean
          cargo build --profile production -p aleph-runtime
          sha256sum -c checksum.sha256