azure-pipelines.yml

# Copyright lowRISC contributors (OpenTitan project).
# Licensed under the Apache License, Version 2.0, see LICENSE for details.
# SPDX-License-Identifier: Apache-2.0
#
# Azure Pipelines CI build configuration
# Documentation at https://aka.ms/yaml

variables:
  #
  # If updating VERILATOR_VERSION, TOOLCHAIN_VERSION, update the
  # definitions in util/container/Dockerfile as well.
  #
  VERILATOR_VERSION: 4.210
  TOOLCHAIN_PATH: /opt/buildcache/riscv
  VERIBLE_VERSION: v0.0-3622-g07b310a3
  # Release tag from https://github.com/lowRISC/lowrisc-toolchains/releases
  TOOLCHAIN_VERSION: 20220210-1
  # This controls where builds happen, and gets picked up by build_consts.sh.
  BUILD_ROOT: $(Build.ArtifactStagingDirectory)
  VIVADO_VERSION: "2021.1"

trigger:
  batch: true
  branches:
    include:
    - "*"
    # Don't run workflow on auto-created backport branches (PR workflow will be run)
    exclude:
    - "backport-*"
  tags:
    include:
    - "*"
pr:
  branches:
    include:
    - "*"

jobs:
- job: checkout
  displayName: Checkout repository
  pool:
    vmImage: ubuntu-20.04
  steps:
  - checkout: self
    path: opentitan-repo
  - bash: |
      tar -C $(Pipeline.Workspace)/opentitan-repo -czf $(Pipeline.Workspace)/opentitan-repo.tar.gz .
    displayName: Pack up repository
  - publish: $(Pipeline.Workspace)/opentitan-repo.tar.gz
    artifact: opentitan-repo
    displayName: Upload repository

- job: lint
  displayName: Quality (quick lint)
  # Run code quality checks (quick lint)
  dependsOn: checkout
  pool: ci-public
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
    ## !!!
    ##
    ##   The steps below here are duplicated in ci/jobs/quick-lint.sh
    ##   to allow developers to "run CI" locally. Keep them in sync.
    ##
    ## !!!
  - bash: ci/scripts/show-env.sh
    displayName: Environment Info
    # Display environment information
  - bash: ci/scripts/lint-commits.sh $SYSTEM_PULLREQUEST_TARGETBRANCH
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: Commit metadata
  - bash: ci/scripts/check-licence-headers.sh $SYSTEM_PULLREQUEST_TARGETBRANCH
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: Licence Headers
  - bash: ci/scripts/exec-check.sh
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: Executable Bits
  - bash: ci/scripts/check-ascii.sh
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: ASCII Chars
    # Check for non-ASCII characters in source code
  - bash: ci/scripts/python-lint.sh $SYSTEM_PULLREQUEST_TARGETBRANCH
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: flake8 (Python lint)
    # Run Python lint (flake8)
  - bash: ci/scripts/mypy.sh
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: mypy (Python lint)
    # Run Python lint (mypy)
  - bash: ci/scripts/clang-format.sh $SYSTEM_PULLREQUEST_TARGETBRANCH
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: clang-format (C/C++ lint)
    # Use clang-format to check C/C++ coding style
  - bash: ci/scripts/rust-format.sh $SYSTEM_PULLREQUEST_TARGETBRANCH
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: rustfmt
  - bash: |
      ci/bazelisk.sh test //quality:shellcheck_check || {
        echo -n "##vso[task.logissue type=error]"
        echo "Shellcheck failed. Run util/sh/scripts/run-shellcheck.sh to see errors."
        exit 1
      }
    displayName: shellcheck
  - bash: ci/scripts/include-guard.sh $SYSTEM_PULLREQUEST_TARGETBRANCH
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: Header guards
    # Check formatting on header guards
  - bash: ci/scripts/whitespace.sh $SYSTEM_PULLREQUEST_TARGETBRANCH
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: Check trailing whitespace
  - bash: ci/scripts/check-links.sh
    displayName: Check File Links
  - bash: ci/scripts/check-cmdgen.sh
    displayName: Check CMDGEN Blocks
  - bash: ci/scripts/get-build-type.sh "$SYSTEM_PULLREQUEST_TARGETBRANCH" "$(Build.Reason)"
    displayName: Type of change
    # Check what kinds of changes the PR contains
    name: DetermineBuildType
  - bash: ci/scripts/check-no-bazelrc-site.sh
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: Confirm no .bazelrc-site files

- job: airgapped_bazel_build
  displayName: Test an airgapped Bazel build
  timeoutInMinutes: 120
  dependsOn: checkout
  condition: eq(variables['Build.Reason'], 'PullRequest')
  pool:
    vmImage: ubuntu-20.04
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - bash: ci/scripts/test-airgapped-build.sh

- job: slow_lints
  displayName: Quality (in-depth lint)
  # Run code quality checks (in-depth lint)
  dependsOn: lint
  pool:
    vmImage: ubuntu-20.04
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  # Check that all earlgrey countermeasures are implemented.
  - bash: ci/scripts/check-countermeasures.sh earlgrey
    displayName: Check countermeasures for top_earlgrey
    continueOnError: True
  # Bazel test suites are a common cause of problematic tags. Check test suites
  # before checking for other tag issues.
  - bash:  ci/scripts/check_bazel_test_suites.py
    displayName: Check Bazel test suites (Experimental)
    continueOnError: True
  # #21973: Disabled until Verilator tags are fixed in our build tree.
  #- bash: ci/scripts/check-bazel-tags.sh
  #  displayName: Check Bazel Tags (Experimental)
  #  continueOnError: True
  - bash: ci/scripts/check-bazel-banned-rules.sh
    displayName: Check for banned rules
  - bash:  ci/scripts/check_bazel_target_names.py
    displayName: Check Bazel target names (Experimental)
    continueOnError: True
  - bash: ci/scripts/check_dv_sw_images.sh
    displayName: Check DV software images (Experimental)
    continueOnError: True
  - bash: ci/scripts/build-docs.sh
    displayName: Render documentation
  # Define OT_DESTRUCTIVE=1 to enable ci/scripts/check-generated.sh to delete
  # uncommitted changes.
  - bash: OT_DESTRUCTIVE=1 ci/scripts/check-generated.sh
    displayName: Check Generated
    # Ensure all generated files are clean and up-to-date
  - bash: ci/bazelisk.sh test //quality:buildifier_check --test_output=streamed
    displayName: Buildifier (Bazel lint)
  - bash: ci/scripts/check-vendoring.sh
    displayName: Vendored directories
  - bash: ci/scripts/verible-lint.sh rtl
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: Verible RTL (Verilog lint)
  - bash: ci/scripts/verible-lint.sh dv
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: Verible DV (Verilog lint)
  - bash: ci/scripts/verible-lint.sh fpv
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: Verible FPV (Verilog lint)

- job: sw_build
  displayName: Earl Grey SW Build
  # Build software tests for the Earl Grey toplevel design
  timeoutInMinutes: 120
  dependsOn: lint
  condition: and(succeeded(), eq(dependencies.lint.outputs['DetermineBuildType.onlyDocChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyCdcChanges'], '0'))
  pool: ci-public
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/load-bazel-cache-write-creds.yml
  - bash: |
      set -x -e

      # Check the entire build graph for conflicts in loading or analysis
      # phases. For context, see issue #18726.
      # First, test with an empty bitstream cache entry.
      ci/scripts/test-empty-bitstream-cache.sh
      # Now redo with the real bitstream cache included.
      ci/bazelisk.sh build --nobuild //...

      # This command selects the unit tests to be built:
      # * It excludes //quality because that's the purview of `slow_lints`.
      # * It excludes //sw/otbn/crypto because that's tested in `otbn_crypto_tests`.
      # * It excludes the tests from //third_party/riscv-compliance because
      #   they're already covered by `execute_fpga_tests_cw310`.
      # * It excludes //hw:all to avoid building Verilator, which is pulled in
      #   because //... effectively asks to build //hw:verilator_real and other
      #   targets in //hw:all that depend on it. Note that this is only a
      #   shallow exclusion; tests deeper under //hw will still be found.
      # * It excludes targets that depend on bitstream_splice rules, since the
      #   environment does not have access to Vivado.
      # * It excludes all <ip>_regs targets under //hw/ip_templates, since
      #   it makes no sense to build these under ip_templates. These IPs need
      #   to be updated as more migrate to ipgen.
      TARGET_PATTERN_FILE=target_pattern.txt
      echo //... > "${TARGET_PATTERN_FILE}"
      echo -//quality/... >> "${TARGET_PATTERN_FILE}"
      echo -//sw/otbn/crypto/... >> "${TARGET_PATTERN_FILE}"
      echo -//third_party/riscv-compliance/... >> "${TARGET_PATTERN_FILE}"
      echo -//hw:all >> "${TARGET_PATTERN_FILE}"
      ci/bazelisk.sh cquery \
        --noinclude_aspects \
        --output=starlark \
        --starlark:expr='"-{}".format(target.label)' \
        --define DISABLE_VERILATOR_BUILD=true \
        -- "rdeps(//..., kind(bitstream_splice, //...))" \
        >> "${TARGET_PATTERN_FILE}"

      # Build all unit tests and their dependencies.
      ci/bazelisk.sh build \
        --build_tests_only=false \
        --define DISABLE_VERILATOR_BUILD=true \
        --test_tag_filters=-broken,-cw310,-verilator,-dv \
        --target_pattern_file="${TARGET_PATTERN_FILE}"
    displayName: Build SW
  - publish: target_pattern.txt
    artifact: target_pattern_file
  - bash: |
      set -x -e
      . util/build_consts.sh
      # copy the rom to a specific location
      ROM_TARGET="${BIN_DIR}/sw/device/silicon_creator/rom"
      mkdir -p "${ROM_TARGET}"
      ROM_REAL_TARGETS="//sw/device/silicon_creator/rom:package"
      QUERY_CMD_ARGS=(outquery-all --noinclude_aspects --noimplicit_deps)
      ROM_REAL_FILES=($(ci/bazelisk.sh "${QUERY_CMD_ARGS[@]}" "${ROM_REAL_TARGETS}" | sort | uniq))
      cp -Lvt "${ROM_TARGET}" "${ROM_REAL_FILES[@]}"
  - template: ci/upload-artifacts-template.yml
    parameters:
      includePatterns:
        - "/sw/***"

- job: sw_test
  displayName: Earl Grey SW Test
  timeoutInMinutes: 120
  dependsOn: sw_build
  pool: ci-public
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/load-bazel-cache-write-creds.yml
  - download: current
    artifact: target_pattern_file
  - bash: |
      TARGET_PATTERN_FILE="$(Pipeline.Workspace)/target_pattern_file/target_pattern.txt"
      ci/bazelisk.sh test \
        --build_tests_only=false \
        --test_output=errors \
        --define DISABLE_VERILATOR_BUILD=true \
        --test_tag_filters=-broken,-cw310,-verilator,-dv,-silicon \
        --target_pattern_file="${TARGET_PATTERN_FILE}"
    displayName: Build & test SW
  - template: ci/publish-bazel-test-results.yml

- job: chip_englishbreakfast_verilator
  displayName: Verilated English Breakfast (Build)
  # Build Verilator simulation of the English Breakfast toplevel design
  dependsOn: lint
  condition: and(succeeded(), eq(dependencies.lint.outputs['DetermineBuildType.onlyDocChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyCdcChanges'], '0'))
  pool:
    vmImage: ubuntu-20.04
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - bash: |
      python3 --version
      fusesoc --version
      verilator --version
      verible-verilog-lint --version
    displayName: Display environment
  # Check that all englishbreakfast countermeasures are implemented.
  - bash: ci/scripts/check-countermeasures.sh englishbreakfast
    displayName: Check countermeasures for top_englishbreakfast
    continueOnError: True
  - bash: ci/scripts/build-chip-verilator.sh englishbreakfast
    displayName: Build simulation with Verilator
  - template: ci/upload-artifacts-template.yml
    parameters:
      includePatterns:
        - "/hw/top_englishbreakfast/Vchip_englishbreakfast_verilator"

- job: execute_verilated_tests
  displayName: Fast Verilated Earl Grey tests
  # Build and run fast tests on sim_verilator
  pool: ci-public
  timeoutInMinutes: 240
  dependsOn: lint
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/load-bazel-cache-write-creds.yml
  - bash: |
      set -x -e
      ci/scripts/run-verilator-tests.sh
    displayName: Build & execute tests
  - template: ci/publish-bazel-test-results.yml
  # TODO: build and cache the verilator model to avoid building twice (#12574)
  # NOTE: The new build/test rules reference verilator as a dependency, but under the
  #       platforms transition of that rule.  Therefore, verilator is built under a
  #       configuration like 'k8-opt-exec-$host-FOR-$target'.  In order to get the
  #       verilator binary, we query the output of one of the verilated tests and ask
  #       for the verilator binary, which is in a subdir named 'build.verilator_<stuff>'.
  - bash: |
      . util/build_consts.sh
      mkdir -p "$BIN_DIR/hw/top_earlgrey/"
      cp $(ci/bazelisk.sh outquery-build.verilator //sw/device/tests:uart_smoketest_sim_verilator) \
        "$BIN_DIR/hw/top_earlgrey/Vchip_earlgrey_verilator"
    displayName: Copy verilated binary to $BIN_DIR
  - template: ci/upload-artifacts-template.yml
    parameters:
      includePatterns:
        - "/hw/top_earlgrey/Vchip_earlgrey_verilator"

# Software targeting the English Breakfast top level is produced by patching
# the source tree before building. This builds a selected subset of software
# only.
# TODO: This is a rather ugly hack, which will go away once we properly support
# building more than one top-level design with different parametrizations.
# Work towards this goal is tracked in issue #4669.
- job: build_and_execute_verilated_tests_englishbreakfast
  displayName: Verilated English Breakfast (Execute)
  # Build and execute tests on the Verilated English Breakfast toplevel design with Bazel
  pool:
    vmImage: ubuntu-20.04
  dependsOn: chip_englishbreakfast_verilator
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - chip_englishbreakfast_verilator
  - template: ci/load-bazel-cache-write-creds.yml
  - bash: |
      . util/build_consts.sh
      ci/scripts/run-english-breakfast-verilator-tests.sh
    displayName: Execute tests
  - bash: |
      . util/build_consts.sh
      mkdir -p "$BIN_DIR/sw/device/lib/testing/test_rom"
      cp $(ci/scripts/target-location.sh \
          //sw/device/lib/testing/test_rom:test_rom_fpga_cw305 \
          --features=-rv32_bitmanip \
          --copt=-DOT_IS_ENGLISH_BREAKFAST_REDUCED_SUPPORT_FOR_INTERNAL_USE_ONLY_) \
        "$BIN_DIR/sw/device/lib/testing/test_rom"
    displayName: Copy test_rom_fpga_cw305 to $BIN_DIR
  - template: ci/upload-artifacts-template.yml
    parameters:
      includePatterns:
        - "/sw/device/lib/testing/test_rom/test_rom_fpga_cw305.32.vmem"

- job: otbn_standalone_tests
  displayName: Run OTBN Smoke Test
  dependsOn: lint
  condition: and(succeeded(), eq(dependencies.lint.outputs['DetermineBuildType.onlyCdcChanges'], '0'))
  pool:
    vmImage: ubuntu-20.04
  timeoutInMinutes: 10
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - bash: |
      set -x
      sudo util/get-toolchain.py \
        --install-dir="$TOOLCHAIN_PATH" \
        --release-version="$TOOLCHAIN_VERSION" \
        --update
      echo "##vso[task.prependpath]$TOOLCHAIN_PATH/bin"
    displayName: Install toolchain
  - bash: |
      python3 --version
      fusesoc --version
      verilator --version
    displayName: Display environment
  - bash: |
      make -C hw/ip/otbn/dv/otbnsim test
    displayName: OTBN ISS Test
  - bash: |
      ./hw/ip/otbn/dv/smoke/run_smoke.sh
    displayName: OTBN Smoke Test
  - bash: |
      make -C hw/ip/otbn/util asm-check
    displayName: Assemble & link code snippets

- job: otbn_crypto_tests
  displayName: Run OTBN crypto tests
  dependsOn: lint
  condition: and(succeeded(), eq(dependencies.lint.outputs['DetermineBuildType.onlyCdcChanges'], '0'))
  pool:
    vmImage: ubuntu-20.04
  timeoutInMinutes: 60
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/load-bazel-cache-write-creds.yml
  - bash: |
      ci/bazelisk.sh test --test_tag_filters=-nightly //sw/otbn/crypto/...
    displayName: Execute tests

- job: chip_earlgrey_cw310
  displayName: CW310's Earl Grey Bitstream
  # Build CW310 variant of the Earl Grey toplevel design using Vivado
  dependsOn:
    - lint
  condition: and(succeeded(), eq(dependencies.lint.outputs['DetermineBuildType.onlyDocChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyDvChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyCdcChanges'], '0'))
  pool: ci-public-eda
  timeoutInMinutes: 240
  steps:
  - template: ci/fpga-template.yml
    parameters:
      top_name: earlgrey
      design_suffix: cw310

- job: chip_earlgrey_cw310_hyperdebug
  displayName: CW310's Earl Grey Bitstream for Hyperdebug
  # Build CW310-hyperdebug variant of the Earl Grey toplevel design using Vivado
  dependsOn:
    - lint
  condition: and(succeeded(), eq(dependencies.lint.outputs['DetermineBuildType.onlyDocChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyDvChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyCdcChanges'], '0'))
  pool: ci-public-eda
  timeoutInMinutes: 240
  steps:
  - template: ci/fpga-template.yml
    parameters:
      top_name: earlgrey
      design_suffix: cw310_hyperdebug

- job: chip_earlgrey_cw340
  displayName: CW340's Earl Grey Bitstream
  # Build CW340 variant of the Earl Grey toplevel design using Vivado
  dependsOn:
    - lint
  condition: and(succeeded(), eq(dependencies.lint.outputs['DetermineBuildType.onlyDocChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyDvChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyCdcChanges'], '0'))
  pool: ci-public-eda
  timeoutInMinutes: 150
  steps:
  - template: ci/fpga-template.yml
    parameters:
      top_name: earlgrey
      design_suffix: cw340

- job: chip_englishbreakfast_cw305
  displayName: CW305's Bitstream
  # Build CW305 variant of the English Breakfast toplevel design using Vivado
  dependsOn: build_and_execute_verilated_tests_englishbreakfast
  condition: and(succeeded(), eq(dependencies.lint.outputs['DetermineBuildType.onlyDocChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyDvChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyCdcChanges'], '0'))
  pool: ci-public-eda
  timeoutInMinutes: 120 # 2 hours
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - build_and_execute_verilated_tests_englishbreakfast
  - bash: |
      set -e
      module load "xilinx/vivado/$(VIVADO_VERSION)"
      ci/scripts/build-bitstream-vivado.sh top_englishbreakfast cw305
    displayName: Build bitstream
  - template: ci/upload-artifacts-template.yml
    parameters:
      includePatterns:
        - "/hw/top_englishbreakfast/lowrisc_systems_chip_englishbreakfast_cw305_0.1.bit"

- job: cache_bitstreams
  displayName: Cache bitstreams to GCP
  pool:
    vmImage: ubuntu-20.04
  dependsOn:
    - chip_earlgrey_cw310
    - chip_earlgrey_cw310_hyperdebug
    - chip_earlgrey_cw340
  condition: eq(variables['Build.SourceBranchName'], 'master')
  steps:
    - template: ci/download-artifacts-template.yml
      parameters:
        downloadPartialBuildBinFrom:
          - chip_earlgrey_cw310
          - chip_earlgrey_cw310_hyperdebug
          - chip_earlgrey_cw340
    - bash: |
        set -x
        . util/build_consts.sh
    - template: ci/gcp-upload-bitstream-template.yml
      parameters:
        fragmentFiles:
          - "$BIN_DIR/hw/top_earlgrey/chip_earlgrey_cw310/manifest.json"
          - "$BIN_DIR/hw/top_earlgrey/chip_earlgrey_cw310_hyperdebug/manifest.json"
          - "$BIN_DIR/hw/top_earlgrey/chip_earlgrey_cw340/manifest.json"
        gcpKeyFile: "gcpkey.json"
        bucketURI: "gs://opentitan-bitstreams/master"

- job: execute_test_rom_fpga_tests_cw310
  displayName: CW310 Test ROM Tests
  pool:
    name: $(fpga_pool)
    demands: BOARD -equals cw310
  timeoutInMinutes: 60
  dependsOn:
    - chip_earlgrey_cw310
    - sw_build
  condition: succeeded( 'chip_earlgrey_cw310', 'sw_build' )
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - chip_earlgrey_cw310
        - sw_build
  - template: ci/load-bazel-cache-write-creds.yml
  - bash: |
      set -e
      . util/build_consts.sh
      module load "xilinx/vivado/$(VIVADO_VERSION)"
      ci/scripts/run-fpga-tests.sh cw310 cw310_test_rom,-manuf || { res=$?; echo "To reproduce failures locally, follow the instructions at https://opentitan.org/book/doc/getting_started/setup_fpga.html#reproducing-fpga-ci-failures-locally"; exit "${res}"; }
    displayName: Execute tests
  - template: ci/publish-bazel-test-results.yml

- job: execute_rom_fpga_tests_cw310
  displayName: CW310 ROM Tests
  pool:
    name: $(fpga_pool)
    demands: BOARD -equals cw310
  timeoutInMinutes: 90
  dependsOn:
    - chip_earlgrey_cw310
    - sw_build
  condition: succeeded( 'chip_earlgrey_cw310', 'sw_build' )
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - chip_earlgrey_cw310
        - sw_build
  - template: ci/load-bazel-cache-write-creds.yml
  - bash: |
      set -e
      . util/build_consts.sh
      module load "xilinx/vivado/$(VIVADO_VERSION)"
      ci/scripts/run-fpga-tests.sh cw310 cw310_rom_but_not_manuf_and_sival_tests || { res=$?; echo "To reproduce failures locally, follow the instructions at https://opentitan.org/book/doc/getting_started/setup_fpga.html#reproducing-fpga-ci-failures-locally"; exit "${res}"; }
    displayName: Execute tests
  - template: ci/publish-bazel-test-results.yml

- job: execute_sival_fpga_tests_cw310
  displayName: CW310 SiVal non-ROM_EXT Tests
  pool:
    name: $(fpga_pool)
    demands: BOARD -equals cw310
  timeoutInMinutes: 75
  dependsOn:
    - chip_earlgrey_cw310_hyperdebug
    - sw_build
  condition: succeeded( 'chip_earlgrey_cw310_hyperdebug', 'sw_build' )
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - chip_earlgrey_cw310_hyperdebug
        - sw_build
  - template: ci/load-bazel-cache-write-creds.yml
  # We run the update command twice to workaround an issue with udev on the container,
  # where rusb cannot dynamically update its device list in CI (udev is not completely
  # functional). If the device is in normal mode, the first thing that opentitantool
  # does is to switch it to DFU mode and wait until it reconnects. This reconnection is
  # never detected. But if we run the tool another time, the device list is queried again
  # and opentitantool can finish the update. The device will now reboot in normal mode
  # and work for the hyperdebug job.
  - bash: |
      ci/bazelisk.sh run \
        //sw/host/opentitantool:opentitantool -- \
        --interface=hyperdebug_dfu transport update-firmware \
      || ci/bazelisk.sh run \
        //sw/host/opentitantool:opentitantool -- \
        --interface=hyperdebug_dfu transport update-firmware || true
    displayName: "Update the hyperdebug firmware"
  - bash: |
      set -e
      . util/build_consts.sh
      module load "xilinx/vivado/$(VIVADO_VERSION)"
      ci/scripts/run-fpga-tests.sh hyper310 cw310_sival_but_not_rom_ext_tests || { res=$?; echo "To reproduce failures locally, follow the instructions at https://opentitan.org/book/doc/getting_started/setup_fpga.html#reproducing-fpga-ci-failures-locally"; exit "${res}"; }
    displayName: Execute tests
  - template: ci/publish-bazel-test-results.yml

- job: execute_sival_rom_ext_fpga_tests_cw310
  displayName: CW310 SiVal ROM_EXT Tests
  pool:
    name: $(fpga_pool)
    demands: BOARD -equals cw310
  timeoutInMinutes: 45
  dependsOn:
    - chip_earlgrey_cw310_hyperdebug
    - sw_build
  condition: succeeded( 'chip_earlgrey_cw310_hyperdebug', 'sw_build' )
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - chip_earlgrey_cw310_hyperdebug
        - sw_build
  - template: ci/load-bazel-cache-write-creds.yml
  # We run the update command twice to workaround an issue with udev on the container,
  # where rusb cannot dynamically update its device list in CI (udev is not completely
  # functional). If the device is in normal mode, the first thing that opentitantool
  # does is to switch it to DFU mode and wait until it reconnects. This reconnection is
  # never detected. But if we run the tool another time, the device list is queried again
  # and opentitantool can finish the update. The device will now reboot in normal mode
  # and work for the hyperdebug job.
  - bash: |
      ci/bazelisk.sh run \
        //sw/host/opentitantool:opentitantool -- \
        --interface=hyperdebug_dfu transport update-firmware \
      || ci/bazelisk.sh run \
        //sw/host/opentitantool:opentitantool -- \
        --interface=hyperdebug_dfu transport update-firmware || true
    displayName: "Update the hyperdebug firmware"
  - bash: |
      set -e
      . util/build_consts.sh
      module load "xilinx/vivado/$(VIVADO_VERSION)"
      ci/scripts/run-fpga-tests.sh hyper310 cw310_sival_rom_ext || { res=$?; echo "To reproduce failures locally, follow the instructions at https://opentitan.org/book/doc/getting_started/setup_fpga.html#reproducing-fpga-ci-failures-locally"; exit "${res}"; }
    displayName: Execute tests
  - template: ci/publish-bazel-test-results.yml

- job: execute_rom_fpga_tests_cw340
  displayName: CW340 ROM Tests
  pool:
    name: $(fpga_pool)
    demands: BOARD -equals cw340
  timeoutInMinutes: 60
  dependsOn:
    - chip_earlgrey_cw340
    - sw_build
  condition: succeeded( 'chip_earlgrey_cw340', 'sw_build' )
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - chip_earlgrey_cw340
        - sw_build
  - template: ci/load-bazel-cache-write-creds.yml
  - bash: |
      set -e
      . util/build_consts.sh
      module load "xilinx/vivado/$(VIVADO_VERSION)"
      ci/scripts/run-fpga-tests.sh cw340 cw340_rom_with_fake_keys,cw340_rom_with_real_keys,-manuf || { res=$?; echo "To reproduce failures locally, follow the instructions at https://opentitan.org/book/doc/getting_started/setup_fpga.html#reproducing-fpga-ci-failures-locally"; exit "${res}"; }
    displayName: Execute tests
  - template: ci/publish-bazel-test-results.yml

- job: execute_sival_rom_ext_fpga_tests_cw340
  displayName: CW340 SiVal ROM_EXT Tests
  pool:
    name: $(fpga_pool)
    demands: BOARD -equals cw340
  timeoutInMinutes: 45
  dependsOn:
    - chip_earlgrey_cw340
    - sw_build
  condition: succeeded( 'chip_earlgrey_cw340', 'sw_build' )
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - chip_earlgrey_cw340
        - sw_build
  - template: ci/load-bazel-cache-write-creds.yml
  # We run the update command twice to workaround an issue with udev on the container,
  # where rusb cannot dynamically update its device list in CI (udev is not completely
  # functional). If the device is in normal mode, the first thing that opentitantool
  # does is to switch it to DFU mode and wait until it reconnects. This reconnection is
  # never detected. But if we run the tool another time, the device list is queried again
  # and opentitantool can finish the update. The device will now reboot in normal mode
  # and work for the hyperdebug job.
  - bash: |
      ci/bazelisk.sh run \
        //sw/host/opentitantool:opentitantool -- \
        --interface=hyperdebug_dfu transport update-firmware \
      || ci/bazelisk.sh run \
        //sw/host/opentitantool:opentitantool -- \
        --interface=hyperdebug_dfu transport update-firmware || true
    displayName: "Update the hyperdebug firmware"
  - bash: |
      set -e
      . util/build_consts.sh
      module load "xilinx/vivado/$(VIVADO_VERSION)"
      ci/scripts/run-fpga-tests.sh cw340 cw340_sival_rom_ext || { res=$?; echo "To reproduce failures locally, follow the instructions at https://opentitan.org/book/doc/getting_started/setup_fpga.html#reproducing-fpga-ci-failures-locally"; exit "${res}"; }
    displayName: Execute tests
  - template: ci/publish-bazel-test-results.yml

- job: execute_fpga_manuf_tests_cw310
  displayName: CW310 Manufacturing Tests
  pool:
    name: $(fpga_pool)
    demands: BOARD -equals cw310
  timeoutInMinutes: 60
  dependsOn:
    - chip_earlgrey_cw310_hyperdebug
    - sw_build
  condition: succeeded( 'chip_earlgrey_cw310_hyperdebug', 'sw_build' )
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - chip_earlgrey_cw310_hyperdebug
        - sw_build
  - template: ci/load-bazel-cache-write-creds.yml
  # We run the update command for the same reasons stated above.
  - bash: |
      ci/bazelisk.sh run \
        //sw/host/opentitantool:opentitantool -- \
        --interface=hyperdebug_dfu transport update-firmware \
      || ci/bazelisk.sh run \
        //sw/host/opentitantool:opentitantool -- \
        --interface=hyperdebug_dfu transport update-firmware || true
    displayName: "Update the hyperdebug firmware"
  - bash: |
      set -e
      . util/build_consts.sh
      module load "xilinx/vivado/$(VIVADO_VERSION)"
      ci/scripts/run-fpga-tests.sh hyper310 manuf,-cw310_sival,-broken,-cw340 || { res=$?; echo "To reproduce failures locally, follow the instructions at https://opentitan.org/book/doc/getting_started/setup_fpga.html#reproducing-fpga-ci-failures-locally"; exit "${res}"; }
    displayName: Execute tests
  - template: ci/publish-bazel-test-results.yml

- job: execute_fpga_manuf_tests_cw340
  displayName: CW340 Manufacturing Tests
  pool:
    name: $(fpga_pool)
    demands: BOARD -equals cw340
  timeoutInMinutes: 60
  dependsOn:
    - chip_earlgrey_cw340
    - sw_build
  condition: succeeded( 'chip_earlgrey_cw340', 'sw_build' )
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - chip_earlgrey_cw340
        - sw_build
  - template: ci/load-bazel-cache-write-creds.yml
  - bash: |
      set -e
      . util/build_consts.sh
      module load "xilinx/vivado/$(VIVADO_VERSION)"
      ci/scripts/run-fpga-tests.sh cw340 manuf,-cw340_sival,-broken,-hyper310 || { res=$?; echo "To reproduce failures locally, follow the instructions at https://opentitan.org/book/doc/getting_started/setup_fpga.html#reproducing-fpga-ci-failures-locally"; exit "${res}"; }
    displayName: Execute tests
  - template: ci/publish-bazel-test-results.yml

- job: deploy_release_artifacts
  displayName: Package & deploy release
  pool:
    vmImage: ubuntu-20.04
  dependsOn:
    - lint
    - sw_build
    - execute_verilated_tests
    - chip_earlgrey_cw310
    - chip_englishbreakfast_verilator
  condition: and(eq(dependencies.lint.outputs['DetermineBuildType.onlyDocChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyDvChanges'], '0'), eq(dependencies.lint.outputs['DetermineBuildType.onlyCdcChanges'], '0'))
  steps:
  - template: ci/checkout-template.yml
  - template: ci/install-package-dependencies.yml
  - template: ci/download-artifacts-template.yml
    parameters:
      downloadPartialBuildBinFrom:
        - sw_build
        - execute_verilated_tests
        - chip_earlgrey_cw310
        - chip_englishbreakfast_verilator
  - bash: |
      . util/build_consts.sh
      ci/scripts/make_distribution.sh
      tar --list -f $BIN_DIR/opentitan-*.tar.xz
      # Put the resulting tar file into a directory the |publish| step below can reference.
      mkdir "$BUILD_ROOT/dist-final"
      mv $BIN_DIR/opentitan-*.tar.xz "$BUILD_ROOT/dist-final"
    displayName: Create final dist
  - publish: $(Build.ArtifactStagingDirectory)/dist-final
    artifact: opentitan-dist
    displayName: Upload release
  - task: GithubRelease@0
    displayName: Upload to GitHub releases (only tags)
    condition: and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags/'))
    inputs:
      gitHubConnection: opentitan-release-upload
      repositoryName: lowrisc/opentitan
      addChangeLog: false
      assets: |
          $(Build.ArtifactStagingDirectory)/dist-final/*

- job: build_docker_containers
  displayName: "Build Docker Containers"
  pool:
    vmImage: ubuntu-20.04
  dependsOn:
    - lint
  steps:
  - template: ci/checkout-template.yml
  - task: Docker@2
    displayName: Build Developer Utility Container
    continueOnError: True
    inputs:
      command: build
      Dockerfile: ./util/container/Dockerfile
      buildContext: .
  - task: Docker@2
    displayName: Build Documentation Redirector Container
    inputs:
      command: build
      Dockerfile: ./site/redirector/landing/Dockerfile
      buildContext: ./site/redirector/landing