teleport/.github/workflows/bloat.yaml

name: Bloat Check
on:
  pull_request:
    paths:
      - '.github/workflows/bloat.yaml'
  push:
    paths:
      - '.github/workflows/bloat.yaml'
      - '**.go'
      - 'go.mod'
      - 'go.sum'
      - '**.rs'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'Makefile'
      - '*.mk'
    branches:
      - master
      - branch/**

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.merge_group.head_sha || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  bloat_check:
    name: Bloat Check
    runs-on: ubuntu-22.04-4core
    outputs:
      base_stats_file: ${{ steps.build_base.outputs.base_stats_file }}
      current_build_dir: ${{ steps.build_branch.outputs.build_dir }}

    permissions:
      contents: read
      id-token: write

    container:
      image: ghcr.io/gravitational/teleport-buildbox:teleport19

    steps:
      - name: Get runtime values from kvstore
        id: kvstore
        uses: gravitational/shared-workflows/tools/env-kvstore@tools/env-kvstore/v1.0.2
        with:
          cognito-identity-pool-id: "us-west-2:da53389e-a459-4a28-bd54-43eeb8e4b579"
          cognito-role-arn: "arn:aws:iam::247230412011:role/github-actions-cognito-oidc"
          values: |
            REVIEWERS_APP_ID,variable
            REVIEWERS_PRIVATE_KEY,secret
            REVIEWERS,secret
      - name: Checkout base
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.base.sha || github.event.before }}

      - name: Prepare workspace
        uses: ./.github/actions/prepare-workspace

      - name: Checkout shared-workflow
        uses: actions/checkout@v6
        with:
          repository: gravitational/shared-workflows
          path: .github/shared-workflows
          ref: 986f92841a4f032e262477e5bb15f214d50b1015 # workflows/v0.0.6

      - name: Setup base cache
        uses: actions/cache/restore@v5
        id: cache-build-restore
        with:
          path: |
            ~/teleport_base_build_stats
          key: ${{ github.job }}-${{ runner.os }}-${{ github.event.pull_request.base.sha || github.event.before }}

      - name: Generate GitHub Token
        id: generate_token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ env.REVIEWERS_APP_ID }}
          private-key: ${{ env.REVIEWERS_PRIVATE_KEY }}

      - if: ${{ steps.cache-build-restore.outputs.cache-hit != 'true' }}
        name: Build base
        id: build_base
        run: |
          TELEPORT_UPDATE_DEV_BUILD=1 make WEBASSETS_SKIP_BUILD=1 BUILDDIR=base_build binaries
          cd .github/shared-workflows/bot && go run main.go -workflow=binary-sizes --artifacts="tbot,tctl,teleport,tsh,teleport-update,fdpass-teleport,sessionhelper" --builddir="../../../base_build" -token="${{ steps.generate_token.outputs.token }}" -reviewers="${{ env.REVIEWERS }}"  > ~/teleport_base_build_stats
          echo "base_stats_file=~/teleport_base_build_stats" >> $GITHUB_OUTPUT
          echo "base_stats=$(cat ~/teleport_base_build_stats)" >> $GITHUB_ENV

      - if: ${{ steps.cache-build-restore.outputs.cache-hit != 'true' }}
        name: Save base build
        id: base-build-save
        uses: actions/cache/save@v5
        with:
          path: |
            ${{ steps.build_base.outputs.base_stats_file }}
          key: ${{ github.job }}-${{ runner.os }}-${{ github.event.pull_request.base.sha || github.event.before }}

      - if: ${{ steps.cache-build-restore.outputs.cache-hit == 'true' }}
        name: Restore base stats
        id: restore-base-stats
        run: |
          echo "base_stats=$(cat ~/teleport_base_build_stats)" >> $GITHUB_ENV

      - name: Checkout branch
        uses: actions/checkout@v6
        with:
          clean: false

      - name: Checkout shared-workflow
        uses: actions/checkout@v6
        with:
          repository: gravitational/shared-workflows
          path: .github/shared-workflows
          ref: 986f92841a4f032e262477e5bb15f214d50b1015 # workflows/v0.0.6

      - name: Build Binaries
        id: build_branch
        run: |
          BUILD_SECRET=FAKE_SECRET TELEPORT_UPDATE_DEV_BUILD=1 make WEBASSETS_SKIP_BUILD=1 binaries

      - name: Check for Environment Leak
        id: check_branch_env_leak
        run: |
          for binary in $(pwd)/build/*; do \
            if strings $binary | grep -q 'FAKE_SECRET'; then \
              echo "Error: $binary contains FAKE_SECRET"; \
              exit 1; \
            fi; \
          done

      - name: Check for bloat
        id: check_branch_bloat
        run: |
          current=$(pwd)/build
          cd .github/shared-workflows/bot && go run main.go -workflow=bloat --artifacts="tbot,tctl,teleport,tsh,teleport-update,fdpass-teleport,sessionhelper" --base="${base_stats}" --builddir="${current}" -token="${{ steps.generate_token.outputs.token }}" -reviewers="${{ env.REVIEWERS }}" > $GITHUB_STEP_SUMMARY