teleport/.github/workflows/bloat.yaml

name: Bloat Check
on:
  pull_request:
    paths:
      - '.github/workflows/bloat.yaml'
  push:
    paths:
      - '.github/workflows/bloat.yaml'
      - '**.go'
      - 'go.mod'
      - 'go.sum'
      - '**.rs'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'Makefile'
      - '*.mk'
    branches:
      - master
      - branch/**

jobs:
  bloat_check:
    name: Bloat Check
    runs-on: ubuntu-22.04-4core
    outputs:
      base_stats_file: ${{ steps.build_base.outputs.base_stats_file }}
      current_build_dir: ${{ steps.build_branch.outputs.build_dir }}

    permissions:
      contents: read

    container:
      image: ghcr.io/gravitational/teleport-buildbox:teleport19

    steps:
      - name: Checkout base
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.base.sha || github.event.before }}

      - name: Prepare workspace
        uses: ./.github/actions/prepare-workspace

      - name: Checkout shared-workflow
        uses: actions/checkout@v6
        with:
          repository: gravitational/shared-workflows
          path: .github/shared-workflows
          ref: dd8f30e8fd5dd1d1655b9d27049e5d0f6f4f9ef2 # workflows/v0.0.3

      - name: Setup base cache
        uses: actions/cache/restore@v5
        id: cache-build-restore
        with:
          path: |
            ~/teleport_base_build_stats
          key: ${{ github.job }}-${{ runner.os }}-${{ github.event.pull_request.base.sha || github.event.before }}

      - name: Generate GitHub Token
        id: generate_token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ secrets.REVIEWERS_APP_ID }}
          private-key: ${{ secrets.REVIEWERS_PRIVATE_KEY }}

      - if: ${{ steps.cache-build-restore.outputs.cache-hit != 'true' }}
        name: Build base
        id: build_base
        run: |
          make WEBASSETS_SKIP_BUILD=1 BUILDDIR=base_build binaries
          cd .github/shared-workflows/bot && go run main.go -workflow=binary-sizes --artifacts="tbot,tctl,teleport,tsh,teleport-update,fdpass-teleport,sessionhelper" --builddir="../../../base_build" -token="${{ steps.generate_token.outputs.token }}" -reviewers="${{ secrets.reviewers }}"  > ~/teleport_base_build_stats
          echo "base_stats_file=~/teleport_base_build_stats" >> $GITHUB_OUTPUT
          echo "base_stats=$(cat ~/teleport_base_build_stats)" >> $GITHUB_ENV

      - if: ${{ steps.cache-build-restore.outputs.cache-hit != 'true' }}
        name: Save base build
        id: base-build-save
        uses: actions/cache/save@v5
        with:
          path: |
            ${{ steps.build_base.outputs.base_stats_file }}
          key: ${{ github.job }}-${{ runner.os }}-${{ github.event.pull_request.base.sha || github.event.before }}

      - if: ${{ steps.cache-build-restore.outputs.cache-hit == 'true' }}
        name: Restore base stats
        id: restore-base-stats
        run: |
          echo "base_stats=$(cat ~/teleport_base_build_stats)" >> $GITHUB_ENV

      - name: Checkout branch
        uses: actions/checkout@v6
        with:
          clean: false

      - name: Checkout shared-workflow
        uses: actions/checkout@v6
        with:
          repository: gravitational/shared-workflows
          path: .github/shared-workflows
          ref: dd8f30e8fd5dd1d1655b9d27049e5d0f6f4f9ef2 # workflows/v0.0.3

      - name: Build Binaries
        id: build_branch
        run: |
          BUILD_SECRET=FAKE_SECRET make WEBASSETS_SKIP_BUILD=1 binaries

      - name: Check for Environment Leak
        id: check_branch_env_leak
        run: |
          for binary in $(pwd)/build/*; do \
            if strings $binary | grep -q 'FAKE_SECRET'; then \
              echo "Error: $binary contains FAKE_SECRET"; \
              exit 1; \
            fi; \
          done

      - name: Check for bloat
        id: check_branch_bloat
        run: |
          current=$(pwd)/build
          cd .github/shared-workflows/bot && go run main.go -workflow=bloat --artifacts="tbot,tctl,teleport,tsh,teleport-update,fdpass-teleport,sessionhelper" --base="${base_stats}" --builddir="${current}" -token="${{ steps.generate_token.outputs.token }}" -reviewers="${{ secrets.reviewers }}" > $GITHUB_STEP_SUMMARY