generate-check.yaml

name: Check Generated Code
on:
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  generate-check:
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-latest
          - arch: arm64
            runner: ubuntu-24.04-arm
    name: Generate (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod

      - name: Install BPF build dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends clang llvm lld libbpf-dev linux-headers-$(uname -r)
          sudo apt-get install -y --no-install-recommends linux-tools-$(uname -r) linux-tools-common || true

      - name: Run make generate for ${{ matrix.arch }}
        run: |
          # Generate BPF objects and Go bindings for this runner's native arch only,
          # then run the remaining (non-BPF) generators.
          GOARCH=${{ matrix.arch }} go generate ./pkg/plugin/...
          go generate ./...

      - name: Check for uncommitted changes
        run: |
          # Ignore .o files — they are empty stubs in the repo and get
          # populated with real BPF objects during generate. Only the
          # generated .go files matter for correctness.
          git diff --exit-code -- ':!*.o' || {
            echo ""
            echo "============================================================"
            echo "ERROR: Generated code is out of date."
            echo ""
            echo "The following files differ after running 'make generate':"
            git diff --name-only -- ':!*.o'
            echo ""
            echo "Please run 'make generate' locally and commit the changes."
            echo "============================================================"
            exit 1
          }

      - name: Check for untracked generated files
        run: |
          untracked=$(git ls-files --others --exclude-standard -- '*.go' | head -20)
          if [ -n "$untracked" ]; then
            echo ""
            echo "============================================================"
            echo "ERROR: New generated files are not committed."
            echo ""
            echo "$untracked"
            echo ""
            echo "Please run 'make generate' locally and commit the new files."
            echo "============================================================"
            exit 1
          fi

      - name: Check that committed .o files are empty stubs
        run: |
          # Tracked .o files must be empty (0 bytes). They exist so that
          # Go source files with //go:embed or bpf2go references compile
          # without running go generate first. Real BPF objects are built
          # at image build time — committing non-empty .o files bloats
          # the repo and may contain host-specific binaries.
          non_empty=$(git ls-files '*.o' | xargs -I{} sh -c 'test -s "{}" && echo "{}"')
          if [ -n "$non_empty" ]; then
            echo ""
            echo "============================================================"
            echo "ERROR: The following .o files must be empty stubs (0 bytes)."
            echo ""
            echo "$non_empty"
            echo ""
            echo "Run 'make empty-bpf-objects' to truncate them, then commit."
            echo "============================================================"
            exit 1
          fi