canister-tests.yml

# This describes all the tests we run on the canister code (various builds,
# integration tests, e2e tests). The canister code is built in docker and the
# wasm is then reused by subsequent build steps. We build various flavors of
# the code, see `docker-build-...` for more info.
name: Canister tests

on:
  push:

jobs:

  #####################
  # The docker builds #
  #####################

  # The image shared by all builds, containing pre-built rust deps
  docker-build-base:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # We use buildx and its GitHub Actions caching support `type=gha`. For
      # more information, see
      # https://github.com/docker/build-push-action/issues/539
      - name: Set up docker buildx
        uses: docker/setup-buildx-action@v2

      - name: Build base Docker image
        uses: docker/build-push-action@v3
        with:
          context: .
          file: Dockerfile
          cache-from: type=gha,scope=cached-stage
          cache-to: type=gha,scope=cached-stage,mode=max
          outputs: type=cacheonly
          target: deps

  docker-build-ii:
    runs-on: ubuntu-latest
    needs: docker-build-base
    strategy:
      # NOTE: the 'name' in the matrix should match the asset filename, because it is used in
      # .github/actions/release to figure out the job ID.
      #
      # NOTE: if you modify the flavors, update the #flavors table in README.md
      matrix:
        include:
          # The production build
          - name: internet_identity_production.wasm.gz
            II_FETCH_ROOT_KEY: 0
            II_DUMMY_CAPTCHA: 0
            II_DUMMY_AUTH: 0
            II_INSECURE_REQUESTS: 0

          # No captcha and fetching the root key, used in (our) tests, backend and
          # e2e.
          - name: internet_identity_test.wasm.gz
            II_FETCH_ROOT_KEY: 1
            II_DUMMY_CAPTCHA: 1
            II_DUMMY_AUTH: 0
            II_INSECURE_REQUESTS: 0

          # Everything disabled, used by third party developers who only care
          # about the login flow
          - name: internet_identity_dev.wasm.gz
            II_FETCH_ROOT_KEY: 1
            II_DUMMY_CAPTCHA: 1
            II_DUMMY_AUTH: 1
            II_INSECURE_REQUESTS: 1

    steps:
      - uses: actions/checkout@v4

      - name: Infer version
        id: version
        run: |
          version="$(./scripts/version)"
          echo "Inferred version: '$version'"
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Set up docker buildx
        uses: docker/setup-buildx-action@v2

      - name: Build ${{ matrix.name }}
        uses: docker/build-push-action@v3
        with:
          context: .
          file: Dockerfile
          build-args: |
            II_FETCH_ROOT_KEY=${{ matrix.II_FETCH_ROOT_KEY }}
            II_DUMMY_AUTH=${{ matrix.II_DUMMY_AUTH }}
            II_DUMMY_CAPTCHA=${{ matrix.II_DUMMY_CAPTCHA }}
            II_INSECURE_REQUESTS=${{ matrix.II_INSECURE_REQUESTS }}
            II_VERSION=${{ steps.version.outputs.version }}
          cache-from: type=gha,scope=cached-stage
          # Exports the artefacts from the final stage
          outputs: ./out
          target: scratch_internet_identity

      - run: mv out/internet_identity.wasm.gz ${{ matrix.name }}
      - run: sha256sum ${{ matrix.name }}
      - name: 'Upload ${{ matrix.name }}'
        uses: actions/upload-artifact@v4
        with:
          # name is the name used to display and retrieve the artifact
          name: ${{ matrix.name }}
          # path is the name used as the file to upload and the name of the
          # file when downloaded
          path: ${{ matrix.name }}

  docker-build-archive:
    runs-on: ubuntu-latest
    needs: docker-build-base
    steps:
      - uses: actions/checkout@v4

      - name: Set up docker buildx
        uses: docker/setup-buildx-action@v2

      - name: Build Archive Canister
        uses: docker/build-push-action@v3
        with:
          context: .
          file: Dockerfile
          cache-from: type=gha,scope=cached-stage
          # Exports the artefacts from the final stage
          outputs: ./out
          target: scratch_archive

      - run: mv out/archive.wasm.gz archive.wasm.gz
      - run: sha256sum archive.wasm.gz
      - name: 'Upload archive.wasm.gz'
        uses: actions/upload-artifact@v4
        with:
          # name is the name used to display and retrieve the artifact
          name: archive.wasm.gz
          # path is the name used as the file to upload and the name of the
          # downloaded file
          path: archive.wasm.gz

  wasm-size:
    runs-on: ubuntu-latest
    needs: docker-build-ii
    steps:
      - uses: actions/checkout@v4
      - name: 'Download wasm'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_production.wasm.gz
          path: .
      - id: record-size
        uses: ./.github/actions/file-size
        with:
          file: internet_identity_production.wasm.gz
          save: ${{ github.ref == 'refs/heads/main' }}
      - name: "Check canister size"
        run: |
          max_size=2097152 # maximum canister size, in bytes
          actual_size=${{ steps.record-size.outputs.size }}
          if (( actual_size > max_size ))
          then
            echo "Canister size too big"
            echo "($actual_size > $max_size)"
            exit 1
          fi

  vc_demo_issuer-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            demos/vc_issuer/target
          key: ${{ runner.os }}-cargo-${{ hashFiles('demos/vc_issuer/Cargo.lock', 'rust-toolchain.toml') }}
      - uses: ./.github/actions/bootstrap
      - uses: ./.github/actions/setup-node
      - run: npm ci
      - name: "Build VC issuer canister"
        working-directory: demos/vc_issuer
        run: ./build.sh
      - run: sha256sum vc_demo_issuer.wasm.gz
        working-directory: demos/vc_issuer
      - name: 'Upload VC issuer'
        uses: actions/upload-artifact@v4
        with:
          # name is the name used to display and retrieve the artifact
          name: vc_demo_issuer.wasm.gz
          # path is the name used as the file to upload and the name of the
          # downloaded file
          path: ./demos/vc_issuer/vc_demo_issuer.wasm.gz

  test-app-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            demos/test-app/target
          key: ${{ runner.os }}-cargo-${{ hashFiles('demos/test-app/Cargo.lock', 'rust-toolchain.toml') }}
      - uses: ./.github/actions/bootstrap
      - uses: ./.github/actions/setup-node
      - run: npm ci
      - name: "Build test app canister"
        working-directory: demos/test-app
        run: ./build.sh
      - name: 'Upload test app'
        uses: actions/upload-artifact@v4
        with:
          # name is the name used to display and retrieve the artifact
          name: test_app.wasm
          # path is the name used as the file to upload and the name of the
          # downloaded file
          path: ./demos/test-app/test_app.wasm

  #####################################
  # The Rust vc issuer canister tests #
  #####################################

  vc-issuer-test:
    runs-on: ubuntu-latest
    needs: [docker-build-ii, vc_demo_issuer-build]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            demos/vc_issuer/target
          key: ${{ runner.os }}-cargo-vc-tests-${{ hashFiles('demos/vc_issuer/Cargo.lock', 'rust-toolchain.toml') }}
      - uses: ./.github/actions/bootstrap
      - name: 'Download VC issuer wasm'
        uses: actions/download-artifact@v4
        with:
          name: vc_demo_issuer.wasm.gz
          path: demos/vc_issuer
      - name: 'Download II wasm'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_test.wasm.gz
          path: .
      - run: mv internet_identity_test.wasm.gz internet_identity.wasm.gz
      - name: Download ic-test-state-machine binary
        run: |
          uname_sys=$(uname -s | tr '[:upper:]' '[:lower:]')
          echo "uname_sys: $uname_sys"
          commit_sha=$(sed <.ic-commit 's/#.*$//' | sed '/^$/d')
          echo "commit sha: $commit_sha"
          curl -sLO "https://download.dfinity.systems/ic/$commit_sha/binaries/x86_64-$uname_sys/ic-test-state-machine.gz"
          gzip -d ic-test-state-machine.gz
          chmod a+x ic-test-state-machine
          ./ic-test-state-machine --version
      - name: "Run VC issuer canister tests"
        working-directory: demos/vc_issuer
        run: |
          # create dummy assets
          mkdir dist
          touch dist/index.{html,css,js}
          touch dist/index2.js
          cargo test

  ###########################
  # The Rust canister tests #
  ###########################

  # Run the tests, user the output of the docker build as Wasm module
  # (note: this runs _all_ cargo tests)
  canister-tests-build:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, macos-latest ]
    steps:
      - uses: actions/checkout@v4

      # Attempt to restore the pre-built test binaries from cache.
      # The test binaries are only dependent on rust code, because the front-end code is bundled in the `wasm` file
      # that is loaded by the test binaries.
      # If the binary can be restored from cache, we skip the build step, including even setting up the toolchain etc.
      - uses: actions/cache@v4
        id: cache-test-archive
        with:
          path: /tmp/test-archive
          key: ${{ runner.os }}-rust-test-archive-${{ hashFiles('src/**/*.rs', 'Cargo.*', 'src/*/*.toml', 'rust-toolchain.toml') }}

      - uses: ./.github/actions/bootstrap
        if: steps.cache-test-archive.outputs.cache-hit != 'true'

      - uses: actions/cache@v4
        if: steps.cache-test-archive.outputs.cache-hit != 'true'
        with:
          path: |
            ~/.cargo
            target
          key: ${{ runner.os }}-rust-test-cache-${{ hashFiles('Cargo.toml', 'rust-toolchain.toml', 'Cargo.lock') }}

      - name: Install nextest
        if: steps.cache-test-archive.outputs.cache-hit != 'true'
        run: |
          curl -LsSf https://get.nexte.st/latest/${{ matrix.os == 'macos-latest' && 'mac' || 'linux' }}  | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin

      # Rustup only installs cargo on the first call, so we use a dedicated step to get a good idea of how
      # time is spent in each step separately
      - if: steps.cache-test-archive.outputs.cache-hit != 'true'
        run: cargo check --help

      - name: Create dummy assets
        if: steps.cache-test-archive.outputs.cache-hit != 'true'
        run: |
          mkdir dist
          touch dist/index.html

      # Build the tests
      - name: Build test archive
        if: steps.cache-test-archive.outputs.cache-hit != 'true'
        run: |
          git checkout ${{ steps.git_info.outputs.commit_now }}
          cargo nextest archive --archive-file canister-tests-${{ matrix.os }}.tar.zst --release
          mkdir -p /tmp/test-archive/
          cp canister-tests-${{ matrix.os }}.tar.zst /tmp/test-archive

      - name: Restore test archive
        if: steps.cache-test-archive.outputs.cache-hit == 'true'
        run: |
          mv /tmp/test-archive/canister-tests-${{ matrix.os }}.tar.zst .

      - name: 'Upload canister test archive'
        uses: actions/upload-artifact@v4
        with:
          # name is the name used to display and retrieve the artifact
          name: canister-tests-${{ matrix.os }}.tar.zst
          # path is the name used as the file to upload and the name of the
          # downloaded file
          path: ./canister-tests-${{ matrix.os }}.tar.zst

  canister-tests-run:
    runs-on: ${{ matrix.os }}
    needs: [canister-tests-build, cached-build, docker-build-archive]
    strategy:
      matrix:
        os: [ ubuntu-latest, macos-latest ]
        partition: ['1/3', '2/3', '3/3']
    steps:
      - uses: actions/checkout@v4

      - name: Download nextest
        run: |
          set -euo pipefail
          curl -LsSf https://get.nexte.st/latest/${{ matrix.os == 'macos-latest' && 'mac' || 'linux' }}  | tar zxf -

      - name: 'Download nextest test archive'
        uses: actions/download-artifact@v4
        with:
          name: canister-tests-${{ matrix.os }}.tar.zst
          path: .
      - name: Download ic-test-state-machine binary
        run: |
          uname_sys=$(uname -s | tr '[:upper:]' '[:lower:]')
          echo "uname_sys: $uname_sys"
          commit_sha=$(sed <.ic-commit 's/#.*$//' | sed '/^$/d')
          echo "commit sha: $commit_sha"
          curl -sLO "https://download.dfinity.systems/ic/$commit_sha/binaries/x86_64-$uname_sys/ic-test-state-machine.gz"
          gzip -d ic-test-state-machine.gz
          chmod a+x ic-test-state-machine
          ./ic-test-state-machine --version

      - name: 'Download II wasm'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_test_cached.wasm.gz
          path: .

      - name: 'Download archive wasm'
        uses: actions/download-artifact@v4
        with:
          name: archive.wasm.gz
          path: .

      - name: Run Tests
        run: |
          mv internet_identity_test.wasm.gz internet_identity.wasm.gz
          # NOTE: Here we download changing assets (i.e. the latest release) meaning that in some rare cases (after a new release)
          # PRs that used to be green may become red (if the new release broke something). While this is not CI best practice, it's
          # a relatively small price to pay to make sure PRs are always tested against the latest release.
          curl -sSL https://github.com/dfinity/internet-identity/releases/latest/download/internet_identity_test.wasm.gz -o internet_identity_previous.wasm.gz
          curl -sSL https://github.com/dfinity/internet-identity/releases/latest/download/archive.wasm.gz -o archive_previous.wasm.gz

          # We are using --partition hash instead of count, because it makes sure that the tests partition is stable across runs
          # even if tests are added or removed. The tradeoff is that the balancing might be slightly worse, but we have enough
          # tests that it should not be a big issue.
          ./cargo-nextest nextest run --archive-file canister-tests-${{ matrix.os }}.tar.zst --partition hash:${{ matrix.partition }}
        env:
          RUST_BACKTRACE: 1

  ######################
  # The end-to-end tests #
  ######################

  e2e:
    runs-on: ubuntu-latest
    needs: [cached-build, test-app-build, vc_demo_issuer-build]
    strategy:
      matrix:
        device: [ 'desktop', 'mobile' ]
        # We run the integration tests on both the official and legacy domains, to make sure
        # the webapp (routes, csp, etc) works on both.
        domain: [ 'https://identity.internetcomputer.org', 'https://identity.ic0.app' ]
        # Specify some shards for jest (a jest instance will only run a subset of files
        # based on the shard assigned to it)
        # The jest parameter is actually 1/N, 2/N etc but we use a artifact-friendly
        # version here (with underscore).
        shard: [ '1_6', '2_6', '3_6', '4_6', '5_6', '6_6' ]
      # Make sure that one failing test does not cancel all other matrix jobs
      fail-fast: false

    env:
      # Suffix used for tagging artifacts
      artifact_suffix: ${{ contains(matrix.domain, 'internetcomputer') && 'current' || 'legacy' }}-${{ matrix.device }}-${{ matrix.shard }}

    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-node

      # npm ci is a slow operation that mostly involves downloading packages, so we run
      # it in the background while we set up the replica
      - name: Kickstart npm ci
        run: '{ npm ci --no-audit --no-fund; echo "$?" > ~/npm-ci-status; } &'

      - uses: ./.github/actions/setup-dfx

      # Helps with debugging
      - name: Show versions
        run: |
          echo dfx --version
          dfx --version
          echo node --version
          node --version

      - name: 'Run dfx'
        run: dfx start --background --artificial-delay 0

      - name: 'Download II wasm'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_test_cached.wasm.gz
          path: .

      - name: 'Download test app wasm'
        uses: actions/download-artifact@v4
        with:
          name: test_app.wasm
          path: demos/test-app

      - name: 'Download VC issuer wasm'
        uses: actions/download-artifact@v4
        with:
          name: vc_demo_issuer.wasm.gz
          path: demos/vc_issuer

      - name: Create Canisters
        run: dfx canister create --all

      - name: Deploy canisters
        run: |
          dfx canister install internet_identity --wasm internet_identity_test.wasm.gz
          dfx canister install test_app --wasm demos/test-app/test_app.wasm
          dfx canister install issuer --wasm demos/vc_issuer/vc_demo_issuer.wasm.gz

      - name: Provision issuer canister
        run: ./demos/vc_issuer/provision

      # Check the return code of npm ci
      - name: Check on npm ci
        # make sure we don't wait too long if for some unlikely reason the npm status file doesn't get created
        timeout-minutes: 5
        run: |
          until [ -f ~/npm-ci-status ]; do sleep 1; done
          exit $(cat ~/npm-ci-status)

      - name: Run dev server
        id: dev-server-start
        run: |
          TLS_DEV_SERVER=1 NO_HOT_RELOAD=1 npm run dev | tee -a > dev-server-logs.txt &
          dev_server_pid=$!
          echo "dev_server_pid=$dev_server_pid" >> "$GITHUB_OUTPUT"

      # run unit tests & e2e tests
      # NOTE: we run chrome in headless mode because that's the only thing that works in GHA
      # NOTE: the last bit (tr) replaces 1_N with 1/N
      - run: |
          II_URL=${{ matrix.domain }} \
            SCREEN=${{ matrix.device }} \
            II_E2E_CHROME_OPTS="--headless" \
            npm run test:e2e -- --shard=$(tr <<<'${{ matrix.shard }}' -s _ /)

      - name: Stop dfx
        if: ${{ always() }}
        run: dfx stop

      - name: Stop dev server
        if: ${{ always() }}
        run: kill ${{ steps.dev-server-start.outputs.dev_server_pid }}

      - name: Archive dev server logs
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: dev-server-logs-${{ env.artifact_suffix }}
          path: dev-server-logs.txt
          if-no-files-found: ignore

      - name: Archive test failures
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: e2e-test-failures-${{ env.artifact_suffix }}
          path: test-failures/*
          if-no-files-found: ignore

  # Aggregate all e2e matrix jobs, used in branch protection
  e2e-all:
    runs-on: ubuntu-latest
    needs: e2e
    steps:
      - run: echo e2e ok

  using-dev-build:
    runs-on: ubuntu-latest
    needs: docker-build-ii
    steps:
      - uses: actions/checkout@v4

      - run: |
          sudo apt-get update
          sudo apt-get --only-upgrade install google-chrome-stable
          google-chrome --version

      - uses: ./.github/actions/setup-node
      - uses: ./.github/actions/setup-dfx

      # Helps with debugging
      - name: Show versions
        run: |
          echo dfx --version
          dfx --version

      - name: Start replica
        run: |
          dfx start --background --artificial-delay 0

      - name: 'Download wasm'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_dev.wasm.gz
          path: .

      - name: Deploy II and run tests
        run: |
          set -euo pipefail

          # Copy example to make sure it does not rely on living inside the II repo
          builddir=$(mktemp -d)
          cp -r ./demos/using-dev-build/. "$builddir"

          ii_wasm="$PWD/internet_identity_dev.wasm.gz"
          ii_did="$PWD/src/internet_identity/internet_identity.did"

          pushd "$builddir"

          # Install npm deps
          npm ci
          sed -i "s;https://github.com/dfinity/internet-identity/releases/latest/download/internet_identity_dev.wasm.gz;$ii_wasm;" ./dfx.json
          sed -i "s;https://github.com/dfinity/internet-identity/releases/latest/download/internet_identity.did;$ii_did;" ./dfx.json

          dfx deploy --no-wallet

          npm run test
          popd
          rm -rf "$builddir"

      - name: Stop replica
        run: |
          dfx stop

  # This deploys the production build to mainnet (to a canister that we use for release testing) alongside
  # some other canisters useful for testing & playing with II.
  deploy:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/release-')
    needs: [docker-build-ii, docker-build-archive, test-app-build, vc_demo_issuer-build]
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/setup-dfx

      - name: 'Download II wasm'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_production.wasm.gz
          path: .

      - name: 'Download archive wasm'
        uses: actions/download-artifact@v4
        with:
          name: archive.wasm.gz
          path: .

      - name: 'Install key'
        env:
          DFX_DEPLOY_KEY: ${{ secrets.DFX_DEPLOY_KEY }}
        run: |
          key_pem=$(mktemp)
          printenv "DFX_DEPLOY_KEY" > "$key_pem"
          dfx identity import --disable-encryption --force default "$key_pem"
          rm "$key_pem"

      - name: "Deploy II"
        run: |
          wallet="cvthj-wyaaa-aaaad-aaaaq-cai"
          sha=$(shasum -a 256 ./archive.wasm.gz | cut -d ' ' -f1 | sed 's/../\\&/g')
          dfx canister --network ic --wallet "$wallet" install --mode upgrade \
            --argument "(opt record {archive_config = record { module_hash = blob \"$sha\"; entries_buffer_limit = 10000:nat64; entries_fetch_limit = 1000:nat16; polling_interval_ns = 60000000000:nat64}; canister_creation_cycles_cost = opt (1000000000000:nat64); })" \
            --wasm internet_identity_production.wasm.gz \
            fgte5-ciaaa-aaaad-aaatq-cai

      - name: 'Download test app wasm'
        uses: actions/download-artifact@v4
        with:
          name: test_app.wasm
          path: .

      - name: "Deploy test app"
        run: |
          wallet="cvthj-wyaaa-aaaad-aaaaq-cai"
          dfx canister --network ic --wallet "$wallet" install --mode upgrade \
            --wasm ./test_app.wasm \
            vt36r-2qaaa-aaaad-aad5a-cai

      - name: 'Download VC issuer wasm'
        uses: actions/download-artifact@v4
        with:
          name: vc_demo_issuer.wasm.gz
          path: .

      - name: "Deploy Issuer"
        run: |
          wallet="cvthj-wyaaa-aaaad-aaaaq-cai"
          dfx canister --network ic --wallet "$wallet" install --mode upgrade \
            --wasm vc_demo_issuer.wasm.gz \
            v2yvn-myaaa-aaaad-aad4q-cai
          ./demos/vc_issuer/provision \
            --ii-canister-id fgte5-ciaaa-aaaad-aaatq-cai \
            --dfx-network ic \
            --issuer-canister v2yvn-myaaa-aaaad-aad4q-cai

      - name: "Deploy archive"
        run: scripts/deploy-archive --wasm archive.wasm.gz --canister-id fgte5-ciaaa-aaaad-aaatq-cai --network ic


  # This prepares all the files necessary for a release (all flavors of Wasm, release notes).
  # On release tags, a new release is created and the assets are uploaded.
  release:
    runs-on: ubuntu-latest
    needs: [docker-build-ii, docker-build-archive, vc_demo_issuer-build]

    steps:
      - uses: actions/checkout@v4

      - name: 'Download test build'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_test.wasm.gz
          path: .

      - name: 'Download dev build'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_dev.wasm.gz
          path: .

      - name: 'Download production build'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_production.wasm.gz
          path: .

      - name: 'Download archive'
        uses: actions/download-artifact@v4
        with:
          name: archive.wasm.gz
          path: .

      - name: 'Download issuer'
        uses: actions/download-artifact@v4
        with:
          name: vc_demo_issuer.wasm.gz
          path: .

      - name: 'Get GHA job IDs'
        uses: actions/github-script@v6
        id: pipeline-jobs
        with:
          script: |
            return (await github.paginate("GET /repos/dfinity/internet-identity/actions/runs/${{ github.run_id }}/jobs"))
              .map(job => {
                return {
                  id: job.id,
                  name: job.name,
                  steps: job.steps.map(step => {
                    return {name: step.name, number: step.number}
                  }),
                  html_url: job.html_url}
              });

      - name: 'Get latest release'
        uses: actions/github-script@v6
        id: latest-release-tag
        with:
          result-encoding: string
          script: return (await github.rest.repos.getLatestRelease({owner:"dfinity", repo:"internet-identity"})).data.tag_name;

      # NOTE: we create the release notes ourselves, instead of letting GitHub do it with
      # 'generate_release_notes: true', here we can actually specify the release range. When doing
      # it on its own, GitHub is really bad at figuring which tag to use as the previous tag (for
      # listing contributions since).
      # https://github.com/github/feedback/discussions/5975
      - name: 'Generate CHANGELOG'
        uses: actions/github-script@v6
        id: changelog
        with:
          result-encoding: string
          script: |
            return (await github.rest.repos.generateReleaseNotes({
              owner: "dfinity",
              repo: "internet-identity",
              tag_name: "${{ github.ref }}",
              previous_tag_name: "${{ steps.latest-release-tag.outputs.result }}",
            })).data.body;

      - name: Print prepare-release-inputs
        env:
          # use an env variable so that the GitHub templating does not cause issues with string escaping
          # see: https://github.com/orgs/community/discussions/32012
          CHANGELOG: ${{ steps.changelog.outputs.result }}
        run: |
          echo -e 'pipeline jobs:\n${{ steps.pipeline-jobs.outputs.result }}'
          echo "latest-release-tag: ${{ steps.latest-release-tag.outputs.result }}"
          echo -e "changelog:\n$CHANGELOG"

      - name: Prepare release
        uses: ./.github/actions/release
        id: prepare-release
        with:
          assets: |
            internet_identity_production.wasm.gz
            internet_identity_dev.wasm.gz
            internet_identity_test.wasm.gz
            archive.wasm.gz
            vc_demo_issuer.wasm.gz
          production_asset: internet_identity_production.wasm.gz
          changelog: ${{ steps.changelog.outputs.result }}
          workflow_jobs: ${{ steps.pipeline-jobs.outputs.result }}

      - name: Release notes
        run: cat ${{ steps.prepare-release.outputs.notes-file }}

      - name: Publish release
        if: startsWith(github.ref, 'refs/tags/release-')
        run: |
          ./scripts/release \
            --tag ${{ github.ref }} \
            --notes-file ${{ steps.prepare-release.outputs.notes-file }} \
            -- \
            internet_identity_production.wasm.gz \
            internet_identity_dev.wasm.gz \
            internet_identity_test.wasm.gz \
            src/internet_identity/internet_identity.did \
            archive.wasm.gz \
            vc_demo_issuer.wasm.gz
        env:
          # populated by GitHub Actions
          # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


        # Bump the version in the download links and create A Pull Request
      - name: Update README
        env:
          PREVIOUS_RELEASE_TAG: ${{ steps.latest-release-tag.outputs.result }}
          NEW_RELEASE_TAG: ${{ github.ref_name }}
        run: |
          echo "II release: $PREVIOUS_RELEASE_TAG -> $NEW_RELEASE_TAG"
          sed -i "s|$PREVIOUS_RELEASE_TAG|$NEW_RELEASE_TAG|g" ./README.md
          cat ./README.md

      - name: Create Pull Request
        if: startsWith(github.ref, 'refs/tags/release-')
        uses: peter-evans/create-pull-request@v4
        with:
          token: ${{ secrets.GIX_BOT_PAT }}
          base: main
          add-paths: ./README.md
          commit-message: Update release in README
          committer: GitHub <noreply@github.com>
          author: gix-bot <gix-bot@users.noreply.github.com>
          branch: bot-release-readme-update
          delete-branch: true
          title: 'Update release in README'

        # Since this may be triggered on tag push, a failure won't be shown on any
        # PR status. To notify the team, we send a message to our Slack channel on failure.
      - name: Notify Slack on failure
        uses: ./.github/actions/slack
        if: ${{ startsWith(github.ref, 'refs/tags/') && failure() }}
        with:
          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          MESSAGE: "Release creation failed"

  # A native, fast cached build. We use the produced test assets to run the canister & e2e tests.
  # The asset's checksum is compared against that of the (slower) docker build.
  cached-build:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        id: cache
        with:
          path: |
            ~/.cargo
            target
          key: ${{ runner.os }}-cached-build-${{ hashFiles('rust-toolchain.toml', 'Cargo.lock', '.node-version', 'package-lock.json') }}

      - uses: ./.github/actions/bootstrap
      - uses: ./.github/actions/setup-node

      # run the build
      # NOTE: npm ci is only ~2s slower than an offline install (npm i --offline), so we use npm ci to have
      # a Clean Install
      - run: npm ci --no-audit --no-fund

      - name: Build test flavor
        env:
          II_FETCH_ROOT_KEY: 1
          II_DUMMY_CAPTCHA: 1
          II_DUMMY_AUTH: 0
          II_INSECURE_REQUESTS: 0
        run: ./scripts/build

      - run: mv internet_identity.wasm.gz internet_identity_test.wasm.gz
      - name: 'Upload test build'
        uses: actions/upload-artifact@v4
        with:
          # name is the name used to display and retrieve the artifact
          name: internet_identity_test_cached.wasm.gz
          # path is the name used as the file to upload and the name of the
          # file when downloaded
          path: internet_identity_test.wasm.gz

  # Make sure that the asset we're testing is the same as that produced by the (slower) docker builds
  cached-build-check:
    runs-on: ubuntu-22.04
    needs: [docker-build-ii, cached-build]
    steps:
      - uses: actions/checkout@v4
      - name: 'Download docker build'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_test.wasm.gz
          path: .
      - run: mv internet_identity_test.wasm.gz docker.wasm.gz
      - name: 'Download native cached build'
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_test_cached.wasm.gz
          path: .
      - run: mv internet_identity_test.wasm.gz native.wasm.gz
      - run: |
          native_sha256=$(shasum -a 256 ./native.wasm.gz | cut -d ' ' -f1)
          docker_sha256=$(shasum -a 256 ./docker.wasm.gz | cut -d ' ' -f1)
          echo "shas: native '$native_sha256', docker '$docker_sha256'"
          if [ "$native_sha256" == "$docker_sha256" ]
          then
            echo output sha256 matches expected
          else
            echo "sha mismatch"
            exit 1
          fi

  clean-build:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        # On main, we run the checks across all platforms. On other branches, in order to speed up checks (on PRs) we skip most platforms
        # (in particular the slow macos builds). A single ubuntu build is not long and gives us some signal.
        # XXX: GHA does not support proper if/else so we implement a workaround: https://github.com/actions/runner/issues/409
        # XXX: GHA fails if we return the matrix object directly, so we have to pretend it's JSON
        os: ${{ github.ref == 'refs/heads/main' && fromJson('[ "ubuntu-22.04", "ubuntu-20.04", "macos-11", "macos-12" ]') || fromJson('[ "ubuntu-22.04" ]') }}
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/check-build
      - run: mv internet_identity.wasm.gz internet_identity_clean_build_${{ matrix.os }}.wasm.gz
      - name: 'Upload clean build'
        uses: actions/upload-artifact@v4
        with:
          # name is the name used to display and retrieve the artifact
          name: internet_identity_clean_build_${{ matrix.os }}.wasm.gz
          # path is the name used as the file to upload and the name of the
          # file when downloaded
          path: internet_identity_clean_build_${{ matrix.os }}.wasm.gz



  verify-clean-build-hash:
    needs: ['clean-build', 'docker-build-ii']
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        # On main, we run the hash check across all platforms where the non-dockerized build is reproducible (i.e. not mac-os).
        # On other branches, in order to speed up checks (on PRs) we skip most platforms. A single ubuntu build is not long and gives us some signal.
        # XXX: GHA does not support proper if/else so we implement a workaround: https://github.com/actions/runner/issues/409
        # XXX: GHA fails if we return the matrix object directly, so we have to pretend it's JSON
        os: ${{ github.ref == 'refs/heads/main' && fromJson('[ "ubuntu-22.04", "ubuntu-20.04"]') || fromJson('[ "ubuntu-22.04" ]') }}
    steps:
      - name: Download internet_identity_clean_build_${{ matrix.os }}.wasm.gz
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_clean_build_${{ matrix.os }}.wasm.gz
          path: .

      - name: Download internet_identity_production.wasm.gz
        uses: actions/download-artifact@v4
        with:
          name: internet_identity_production.wasm.gz
          path: .

      - name: Check hashes
        run: |
          clean_build_sha256=$(shasum -a 256 ./internet_identity_clean_build_${{ matrix.os }}.wasm.gz | cut -d ' ' -f1)
          echo got clean build sha "$clean_build_sha256"
          prod_build_sha256=$(shasum -a 256 ./internet_identity_production.wasm.gz | cut -d ' ' -f1)
          echo got prod build sha "$prod_build_sha256"
          if [ "$clean_build_sha256" == "$prod_build_sha256" ]
          then
            echo output clean build sha256 matches prod build sha256
          else
            echo "sha mismatch: clean build '$clean_build_sha256' /= prod build '$prod_build_sha256'"
            exit 1
          fi


  interface-compatibility:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-didc
      - name: "Check canister interface compatibility"
        run: |
          curl -sSL https://github.com/dfinity/internet-identity/releases/latest/download/internet_identity.did -o internet_identity_previous.did
          didc check src/internet_identity/internet_identity.did internet_identity_previous.did