# Copyright (c) The mlkem-native project authors
# Copyright (c) The mldsa-native project authors
# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT

name: Constant-time tests
permissions:
  contents: read
on:
  workflow_call:
  workflow_dispatch:

jobs:
  check-ct-varlat:
    # Using the patched Valgrind from the KyberSlash paper to detect divisions
    # In case the patch no longer applies after an update, we may want to switch back
    # to stock valgrind added in https://github.com/pq-code-package/mlkem-native/pull/687
    name: CT test ${{ matrix.nix-shell }} ${{ matrix.system }}
    strategy:
      fail-fast: false
      max-parallel: 10
      matrix:
        system: [ubuntu-latest, ubuntu-24.04-arm]
        nix-shell:
          - ci_valgrind-varlat_clang14
          - ci_valgrind-varlat_clang15
          - ci_valgrind-varlat_clang16
          - ci_valgrind-varlat_clang17
          - ci_valgrind-varlat_clang18
          - ci_valgrind-varlat_clang19
          - ci_valgrind-varlat_clang20
          - ci_valgrind-varlat_clang21
          - ci_valgrind-varlat_gcc48
          - ci_valgrind-varlat_gcc49
          - ci_valgrind-varlat_gcc7
          - ci_valgrind-varlat_gcc11
          - ci_valgrind-varlat_gcc12
          - ci_valgrind-varlat_gcc13
          - ci_valgrind-varlat_gcc14
          - ci_valgrind-varlat_gcc15
    runs-on: ${{ matrix.system }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Setup nix
        uses: ./.github/actions/setup-shell
        with:
          gh_token: ${{ secrets.GITHUB_TOKEN }}
          nix-shell: ${{ matrix.nix-shell }}
          nix-cache: true
      - name:  Build and run test (-Oz)
        # -Oz got introduced in gcc12
        if: ${{ matrix.nix-shell !=  'ci_valgrind-varlat_gcc48' && matrix.nix-shell !=  'ci_valgrind-varlat_gcc49' && matrix.nix-shell !=  'ci_valgrind-varlat_gcc7' && matrix.nix-shell !=  'ci_valgrind-varlat_gcc11'}}
        uses: ./.github/actions/ct-test
        with:
          cflags: -Oz -DMLD_CONFIG_KEYGEN_PCT
          valgrind_flags: --variable-latency-errors=yes
      - name:  Build and run test (-Os)
        uses: ./.github/actions/ct-test
        with:
          cflags: -Os -DMLD_CONFIG_KEYGEN_PCT
          valgrind_flags: --variable-latency-errors=yes
      - name:  Build and run test (-O3)
        uses: ./.github/actions/ct-test
        with:
          cflags: -O3 -DMLD_CONFIG_KEYGEN_PCT
          valgrind_flags: --variable-latency-errors=yes
      - name:  Build and run test (-Ofast)
        # -Ofast got deprecated in clang19; -O3 -ffast-math should be used instead
        if: ${{ matrix.nix-shell != 'ci_valgrind-varlat_clang19' &&  matrix.nix-shell !=  'ci_valgrind-varlat_clang20' && matrix.nix-shell !=  'ci_valgrind-varlat_clang21'}}
        uses: ./.github/actions/ct-test
        with:
          cflags: -Ofast -DMLD_CONFIG_KEYGEN_PCT
          valgrind_flags: --variable-latency-errors=yes
      - name:  Build and run test (-O3 -ffast-math)
        uses: ./.github/actions/ct-test
        with:
          cflags: -O3 -ffast-math -DMLD_CONFIG_KEYGEN_PCT
          valgrind_flags: --variable-latency-errors=yes
      - name:  Build and run test (-O2)
        uses: ./.github/actions/ct-test
        with:
          cflags: -O2 -DMLD_CONFIG_KEYGEN_PCT
          valgrind_flags: --variable-latency-errors=yes
      - name:  Build and run test (-O1)
        uses: ./.github/actions/ct-test
        with:
          cflags: -O1 -DMLD_CONFIG_KEYGEN_PCT
          valgrind_flags: --variable-latency-errors=yes
      - name:  Build and run test (-O0)
        uses: ./.github/actions/ct-test
        with:
          cflags: -O0 -DMLD_CONFIG_KEYGEN_PCT
          valgrind_flags: --variable-latency-errors=yes
