ci.yml

name: CI

on:
  pull_request:
  pull_request_target:
    types: [labeled]
    paths-ignore:
      - '.github/**'
  push:
    branches: master

jobs:
  setup:
    name: Define CI matrix
    runs-on: ubuntu-latest
    strategy:
      matrix:
        cfg:
          - data:
            - name: Debian-bookworm
              tier: 1
              platform: Debian Bookworm
              build_os: ubuntu-20.04-8cores
              test_os: ubuntu-20.04
              container: electriccoinco/debian-helper:bookworm
              host: x86_64-pc-linux-gnu

            - name: Debian-bullseye
              tier: 1
              platform: Debian bullseye
              build_os: ubuntu-20.04-8cores
              test_os: ubuntu-20.04
              container: electriccoinco/debian-helper:bullseye
              host: x86_64-pc-linux-gnu

            - name: Debian-buster
              tier: 1
              platform: Debian buster
              build_os: ubuntu-20.04-8cores
              test_os: ubuntu-20.04
              container: electriccoinco/debian-helper:buster
              host: x86_64-pc-linux-gnu

            - name: ubuntu-20.04
              tier: 1
              platform: Ubuntu 20.04
              build_os: ubuntu-20.04-8cores
              test_os: ubuntu-20.04
              host: x86_64-pc-linux-gnu

            - name: ubuntu-22.04
              tier: 3
              platform: Ubuntu 22.04
              build_os: ubuntu-22.04-8cores
              test_os: ubuntu-22.04
              host: x86_64-pc-linux-gnu

            - name: macos-11
              tier: 3
              platform: macOS Big Sur 11
              build_os: macos-11
              test_os: macos-11
              brew_deps: >
                autoconf
                automake
                coreutils
                libtool
                pkgconfig
              host: x86_64-apple-darwin

            - name: mingw32
              tier: 3
              platform: Windows (64-bit MinGW)
              build_os: ubuntu-22.04-8cores
              test_os: windows-latest
              cross_deps: >
                mingw-w64
              host: x86_64-w64-mingw32
              file_ext: ".exe"

            - name: aarch64-linux
              tier: 3
              platform: ARM64 Linux
              build_os: ubuntu-22.04-8cores
              cross_deps: >
                g++-aarch64-linux-gnu
              host: aarch64-linux-gnu

    outputs:
      build_matrix: ${{ steps.set-matrices.outputs.build_matrix }}
      build_names: ${{ steps.set-matrices.outputs.build_names }}
      test_matrix: ${{ steps.set-matrices.outputs.test_matrix }}
      test_names: ${{ steps.set-matrices.outputs.test_names }}
      unix_test_matrix: ${{ steps.set-matrices.outputs.unix_test_matrix }}
      unix_test_names: ${{ steps.set-matrices.outputs.unix_test_names }}

    steps:
      # Configure the build and test matrices. Notes:
      # - The `*_names` lists of platforms are combined with job-specific lists to build
      #   strategy matrices. The `*_matrix` lists then augment the matrix with parameters
      #   for each platform.
      # - We can only run tests on the subset of platforms that have a compatible runner
      #   (i.e. excluding cross-compiled platforms).
      # - Some tests don't currently work on Windows platforms, so we have a Unix subset.
      - id: set-matrices
        env:
          CFG: ${{ toJSON(matrix.cfg) }}
        run: |
          jq -r -n 'env.CFG | fromjson | @json "build_matrix=\(.data)"' >> $GITHUB_OUTPUT
          jq -r -n 'env.CFG | fromjson | [.data[] | .name] | @json "build_names=\(.)"' >> $GITHUB_OUTPUT
          jq -r -n 'env.CFG | fromjson | [.data[] | select(.test_os)] | @json "test_matrix=\(.)"' >> $GITHUB_OUTPUT
          jq -r -n 'env.CFG | fromjson | [.data[] | select(.test_os) | .name] | @json "test_names=\(.)"' >> $GITHUB_OUTPUT
          jq -r -n 'env.CFG | fromjson | [.data[] | select(.test_os and .test_os != "windows-latest")] | @json "unix_test_matrix=\(.)"' >> $GITHUB_OUTPUT
          jq -r -n 'env.CFG | fromjson | [.data[] | select(.test_os and .test_os != "windows-latest") | .name] | @json "unix_test_names=\(.)"' >> $GITHUB_OUTPUT

      - name: Download Sprout parameters
        run: |
          mkdir zcash-params
          wget -c https://download.z.cash/downloads/sprout-groth16.params -O zcash-params/sprout-groth16.params      

      - name: Cache Sprout parameters
        uses: actions/cache@v3
        with:
          path: zcash-params
          key: zcash-params
          restore-keys: |
            zcash-params

  build:
    name: Build tier ${{ matrix.tier }} platform ${{ matrix.platform }}
    needs: setup
    runs-on: ${{ matrix.build_os }}
    container:
      image: ${{ matrix.container }}
      env:
        HOME: /root
        PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
    continue-on-error: ${{ matrix.tier == 3 }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.setup.outputs.build_matrix) }}

    steps:
      - uses: actions/checkout@v4

      - name: Install Homebrew build dependencies
        if: matrix.brew_deps != ''
        run: brew install ${{ matrix.brew_deps }}

      - name: Install cross-compilation build dependencies
        if: matrix.cross_deps != ''
        run: sudo apt update && sudo apt install ${{ matrix.cross_deps }}

      - name: Configure MinGW to use POSIX variant
        if: matrix.name == 'mingw32'
        run: |
          sudo update-alternatives --set x86_64-w64-mingw32-gcc $(update-alternatives --query x86_64-w64-mingw32-gcc | grep Alternative | grep posix | cut -d' ' -f2)
          sudo update-alternatives --set x86_64-w64-mingw32-g++ $(update-alternatives --query x86_64-w64-mingw32-g++ | grep Alternative | grep posix | cut -d' ' -f2)

      - name: Cache built dependencies
        uses: actions/cache@v3
        with:
          path: depends/built
          key: ${{ matrix.name }}-built-${{ hashFiles('depends/Makefile', 'depends/funcs.mk') }}-${{ hashFiles('depends/packages/*.mk', 'depends/patches/**/*') }}
          restore-keys: |
            ${{ matrix.name }}-built-${{ hashFiles('depends/Makefile', 'depends/funcs.mk') }}-

      - name: Prepare ccache timestamp
        id: ccache_cache_timestamp
        shell: bash
        run: echo "timestamp=$(date +'%Y-%m-%d-%H;%M;%S')" >> "$GITHUB_OUTPUT"

      - name: Cache ccache files
        uses: actions/cache@v3
        with:
          path: ${{ runner.os == 'macOS' && '~/Library/Caches/ccache' || '~/.cache/ccache' }}
          key: ${{ matrix.name }}-ccache-${{ steps.ccache_cache_timestamp.outputs.timestamp }}
          restore-keys: |
            ${{ matrix.name }}-ccache-

      - name: Get the number of available processing cores
        id: nproc
        shell: bash
        run: echo "count=$(nproc 2> /dev/null || sysctl -n hw.logicalcpu)" >> "$GITHUB_OUTPUT"

      - name: Build zcashd
        id: build
        env:
          HOST: ${{ matrix.host }}
        run: >
          ./zcutil/build.sh
          -j"${{ steps.nproc.outputs.count }}"

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Upload zcashd artifact
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ${{ format('./src/zcashd{0}', matrix.file_ext) }}
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src

      - name: Upload zcash-cli artifact
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ${{ format('./src/zcash-cli{0}', matrix.file_ext) }}
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src

      - name: Upload zcashd-wallet-tool artifact
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ${{ format('./src/zcashd-wallet-tool{0}', matrix.file_ext) }}
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src

      - name: Upload zcash-inspect artifact
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ${{ format('./src/zcash-inspect{0}', matrix.file_ext) }}
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src

      - name: Upload zcash-tx artifact
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ${{ format('./src/zcash-tx{0}', matrix.file_ext) }}
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src

      - name: Upload zcash-btest artifact
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ${{ format('./src/test/test_bitcoin{0}', matrix.file_ext) }}
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src/test

      - name: Upload zcash-gtest artifact
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ${{ format('./src/zcash-gtest{0}', matrix.file_ext) }}
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src

      - name: Upload src/test/buildenv.py
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ./src/test/buildenv.py
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src/test

      - name: Upload src/secp256k1
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ./src/secp256k1
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src

      - name: Upload src/univalue
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ./src/univalue
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src

      - name: Upload depends/${{ matrix.host }}/native/bin
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ./depends/${{ matrix.host }}/native/bin
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/depends/${{ matrix.host }}/native

      - name: Upload depends/${{ matrix.host }}/lib
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ./depends/${{ matrix.host }}/lib
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/depends/${{ matrix.host }}

      - name: Upload bench_bitcoin artifact
        uses: google-github-actions/upload-cloud-storage@v2
        with:
          path: ${{ format('./src/bench/bench_bitcoin{0}', matrix.file_ext) }}
          destination: gh-zcash/${{ github.run_id }}/${{ matrix.name }}/src/bench

  bitrot:
    name: Bitrot check tier ${{ matrix.tier }} platform ${{ matrix.platform }} flag '${{ matrix.configure_flag }}'
    needs: [setup, build]
    runs-on: ${{ matrix.build_os }}
    container:
      image: ${{ matrix.container }}
      env:
        HOME: /root
        PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
    continue-on-error: ${{ matrix.tier == 3 }}
    strategy:
      matrix:
        name: ${{ fromJson(needs.setup.outputs.build_names) }}
        configure_flag:
          - '--with-libs'
          - '--disable-wallet'
          - '--disable-mining'
        include: ${{ fromJson(needs.setup.outputs.build_matrix) }}

    steps:
      - uses: actions/checkout@v4

      - name: Install Homebrew build dependencies
        if: matrix.brew_deps != ''
        run: brew install ${{ matrix.brew_deps }}

      - name: Install cross-compilation build dependencies
        if: matrix.cross_deps != ''
        run: sudo apt update && sudo apt install ${{ matrix.cross_deps }}

      - name: Configure MinGW to use POSIX variant
        if: matrix.name == 'mingw32'
        run: |
          sudo update-alternatives --set x86_64-w64-mingw32-gcc $(update-alternatives --query x86_64-w64-mingw32-gcc | grep Alternative | grep posix | cut -d' ' -f2)
          sudo update-alternatives --set x86_64-w64-mingw32-g++ $(update-alternatives --query x86_64-w64-mingw32-g++ | grep Alternative | grep posix | cut -d' ' -f2)

      - name: Cache built dependencies
        uses: actions/cache@v3
        with:
          path: depends/built
          key: ${{ matrix.name }}-built-${{ hashFiles('depends/Makefile', 'depends/funcs.mk') }}-${{ hashFiles('depends/packages/*.mk', 'depends/patches/**/*') }}
          restore-keys: |
            ${{ matrix.name }}-built-${{ hashFiles('depends/Makefile', 'depends/funcs.mk') }}-

      - name: Prepare ccache timestamp
        id: ccache_cache_timestamp
        shell: bash
        run: echo "timestamp=$(date +'%Y-%m-%d-%H;%M;%S')" >> "$GITHUB_OUTPUT"

      - name: Cache ccache files
        uses: actions/cache@v3
        with:
          path: ${{ runner.os == 'macOS' && '~/Library/Caches/ccache' || '~/.cache/ccache' }}
          key: ${{ matrix.name }}-ccache-${{ steps.ccache_cache_timestamp.outputs.timestamp }}
          restore-keys: |
            ${{ matrix.name }}-ccache-

      - name: Get the number of available processing cores
        id: nproc
        shell: bash
        run: echo "count=$(nproc 2> /dev/null || sysctl -n hw.logicalcpu)" >> "$GITHUB_OUTPUT"

      - name: Build zcashd with the flag being checked
        env:
          CONFIGURE_FLAGS: "${{ matrix.configure_flag }}"
          HOST: ${{ matrix.host }}
        run: >
          ./zcutil/build.sh
          -j"${{ steps.nproc.outputs.count }}"

  test-btest:
    name: Boost.Test tier ${{ matrix.tier }} platform ${{ matrix.platform }}
    needs: [setup, build]
    runs-on: ${{ matrix.test_os }}
    container:
      image: ${{ matrix.container }}
      env:
        HOME: /root
        PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
    continue-on-error: ${{ matrix.tier != 1 }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.setup.outputs.test_matrix) }}
    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Download zcash-btest artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/test/test_bitcoin{0}', matrix.file_ext) }}
          destination: ./

      - name: Make artifact executable
        if: runner.os != 'Windows'
        run: chmod +x ${{ format('./test_bitcoin{0}', matrix.file_ext) }}

      - name: Run Boost.Tests
        run: ${{ format('./test_bitcoin{0}', matrix.file_ext) }} -p

  test-gtest:
    name: GoogleTest tier ${{ matrix.tier }} platform ${{ matrix.platform }} - shard ${{ matrix.shard_index }}
    needs: [setup, build]
    runs-on: ${{ matrix.test_os }}
    container:
      image: ${{ matrix.container }}
      env:
        HOME: /root
        PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
    continue-on-error: ${{ matrix.tier != 1 }}
    strategy:
      matrix:
        name: ${{ fromJson(needs.setup.outputs.test_names) }}
        shard_index: [0, 1]
        include: ${{ fromJson(needs.setup.outputs.test_matrix) }}
    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Download zcash-gtest artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/zcash-gtest{0}', matrix.file_ext) }}
          destination: ./

      - name: Make artifact executable
        if: runner.os != 'Windows'
        run: chmod +x ${{ format('./zcash-gtest{0}', matrix.file_ext) }}

      - name: Cache Sprout parameters
        uses: actions/cache@v3
        with:
          path: zcash-params
          key: zcash-params
          restore-keys: |
            zcash-params

      - name: Download Sprout parameters
        # In case the cache of Sprout parameters step fails
        shell: bash
        run: |
          mkdir zcash-params || echo ""
          curl -L -C - https://download.z.cash/downloads/sprout-groth16.params -o zcash-params/sprout-groth16.params          

      - name: Setup zcash-params
        shell: bash
        run: |
          if [ "${{ runner.os }}" == "Windows" ]; then
            mv zcash-params "$APPDATA/ZcashParams"
          elif [ "${{ runner.os }}" == "macOS" ]; then
            mv zcash-params "$HOME/Library/Application Support/ZcashParams"
          elif [ "${{ runner.os }}" == "Linux" ]; then
            mv zcash-params "$HOME/.zcash-params"
          fi

      - name: Run GoogleTests
        env:
          GTEST_TOTAL_SHARDS: 2
          GTEST_SHARD_INDEX: ${{ matrix.shard_index }}
        run: ${{ format('./zcash-gtest{0}', matrix.file_ext) }}

  test-rust:
    name: Rust test tier ${{ matrix.tier }} platform ${{ matrix.platform }}
    needs: [setup, build]
    runs-on: ${{ matrix.test_os }}
    container:
      image: ${{ matrix.container }}
      env:
        HOME: /root
        PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
    continue-on-error: ${{ matrix.tier != 1 }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.setup.outputs.test_matrix) }}

    steps:
      - uses: actions/checkout@v4
      - name: Run Rust tests
        run: cargo test

  # Not designed for Windows
  test-secp256k1:
    name: secp256k1 tier ${{ matrix.tier }} platform ${{ matrix.platform }}
    needs: [setup, build]
    runs-on: ${{ matrix.test_os }}
    container:
      image: ${{ matrix.container }}
      env:
        HOME: /root
        PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
    continue-on-error: ${{ matrix.tier != 1 }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.setup.outputs.unix_test_matrix) }}
    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Download native/bin artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: depends/${{ matrix.host }}/native/bin
          destination: ./depends/${{ matrix.host }}/native/

      - name: Download src/secp256k1 artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: src/secp256k1
          destination: ./src/
          remove-first-if-exists: ./src/secp256k1

      - name: Run secp256k1 test
        shell: bash
        run: python3 ./qa/zcash/full_test_suite.py secp256k1
        env:
          HOST: ${{ matrix.host }}

  # Not designed for Windows
  test-univalue:
    name: univalue tier ${{ matrix.tier }} platform ${{ matrix.platform }}
    needs: [setup, build]
    runs-on: ${{ matrix.test_os }}
    container:
      image: ${{ matrix.container }}
      env:
        HOME: /root
        PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
    continue-on-error: ${{ matrix.tier != 1 }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.setup.outputs.unix_test_matrix) }}
    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Download native/bin artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: depends/${{ matrix.host }}/native/bin
          destination: ./depends/${{ matrix.host }}/native/

      - name: Download src/univalue artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: src/univalue
          destination: ./src/
          remove-first-if-exists: ./src/univalue

      - name: Make artifact executable
        if: runner.os != 'Windows'
        run: chmod +x ./src/univalue/build-aux/install-sh

      - name: Run univalue test
        shell: bash
        run: python3 ./qa/zcash/full_test_suite.py univalue
        env:
          HOST: ${{ matrix.host }}

  # Not designed for Windows
  test-util:
    name: util-test tier ${{ matrix.tier }} platform ${{ matrix.platform }}
    needs: [setup, build]
    runs-on: ${{ matrix.test_os }}
    container:
      image: ${{ matrix.container }}
      env:
        HOME: /root
        PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
    continue-on-error: ${{ matrix.tier != 1 }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.setup.outputs.unix_test_matrix) }}

    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Download zcash-tx artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/zcash-tx{0}', matrix.file_ext) }}
          destination: ./src/

      - name: Download src/test/buildenv.py artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: src/test/buildenv.py
          destination: ./src/test/

      - name: Make artifact executable
        if: runner.os != 'Windows'
        run: chmod +x ${{ format('./src/zcash-tx{0}', matrix.file_ext) }}

      - name: Run util-test test
        shell: bash
        run: python3 ./qa/zcash/full_test_suite.py util-test
        env:
          HOST: ${{ matrix.host }}

  no-dot-so:
    name: not-dot-so tier ${{ matrix.tier }} platform ${{ matrix.platform }}
    needs: [setup, build]
    runs-on: ${{ matrix.test_os }}
    container:
      image: ${{ matrix.container }}
      env:
        HOME: /root
        PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
    continue-on-error: ${{ matrix.tier != 1 }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.setup.outputs.test_matrix) }}

    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Download depends/${{ matrix.host }}/lib artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: depends/${{ matrix.host }}/lib
          destination: ./depends/${{ matrix.host }}/

      - name: Run no-dot-so test
        run: python3 ./qa/zcash/full_test_suite.py no-dot-so
        env:
          HOST: ${{ matrix.host }}

  # Not working in Windows
  sec-hard:
    name: sec-hard tier ${{ matrix.tier }} platform ${{ matrix.platform }}
    needs: [setup, build]
    runs-on: ${{ matrix.test_os }}
    container:
      image: ${{ matrix.container }}
      env:
        HOME: /root
        PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
    continue-on-error: ${{ matrix.tier != 1 }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.setup.outputs.unix_test_matrix) }}

    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Download ${{ format('src/zcash-inspect{0}', matrix.file_ext) }} artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/zcash-inspect{0}', matrix.file_ext) }}
          destination: ./src/

      - name: Download ${{ format('src/bench/bench_bitcoin{0}', matrix.file_ext) }}  artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/bench/bench_bitcoin{0}', matrix.file_ext) }}
          destination: ./src/bench/

      - name: Download ${{ format('src/test/test_bitcoin{0}', matrix.file_ext) }}  artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/test/test_bitcoin{0}', matrix.file_ext) }}
          destination: ./src/test/

      - name: Download ${{ format('src/zcashd-wallet-tool{0}', matrix.file_ext) }}  artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/zcashd-wallet-tool{0}', matrix.file_ext) }}
          destination: ./src/

      - name: Download ${{ format('src/zcash-tx{0}', matrix.file_ext) }}  artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/zcash-tx{0}', matrix.file_ext) }}
          destination: ./src/

      - name: Download ${{ format('src/zcash-gtest{0}', matrix.file_ext) }}  artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/zcash-gtest{0}', matrix.file_ext) }}
          destination: ./src/

      - name: Download ${{ format('src/zcashd{0}', matrix.file_ext) }} artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/zcashd{0}', matrix.file_ext) }}
          destination: ./src/

      - name: Download ${{ format('src/zcash-cli{0}', matrix.file_ext) }} artifact
        uses: ./.github/actions/gcs-download-cloud-storage
        with:
          path-prefix: ${{ github.run_id }}/${{ matrix.name }}
          source: ${{ format('src/zcash-cli{0}', matrix.file_ext) }}
          destination: ./src/

      - name: Make artifact executable
        if: runner.os != 'Windows'
        run: |
          chmod +x ${{ format('./src/test/test_bitcoin{0}', matrix.file_ext) }}
          chmod +x ${{ format('./src/bench/bench_bitcoin{0}', matrix.file_ext) }}
          chmod +x ${{ format('./src/zcashd{0}', matrix.file_ext) }}
          chmod +x ${{ format('./src/zcash-cli{0}', matrix.file_ext) }}
          chmod +x ${{ format('./src/zcash-gtest{0}', matrix.file_ext) }}
          chmod +x ${{ format('./src/zcashd-wallet-tool{0}', matrix.file_ext) }}
          chmod +x ${{ format('./src/zcash-tx{0}', matrix.file_ext) }}

      - name: Run sec-hard test
        shell: bash
        run: python3 ./qa/zcash/full_test_suite.py sec-hard
        env:
          HOST: ${{ matrix.host }}