ci.yml

---
name: CI

on:
  push:
    branches: [main]
    tags: ['**']
  pull_request:

env:
  CARGO_TERM_COLOR: always

# Cancel superseded PR runs only. `main` pushes and tag pushes are
# preserved so artefacts produced under one SHA aren't lost when a
# newer push lands (and release tags must complete).
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # ┌──────────────────────────────────────────────────────────────┐
  # │ Group B — per-cell pipeline                                   │
  # │   build → fmt(msrv) → doc(msrv) → lint(1.91) → test → bench   │
  # └──────────────────────────────────────────────────────────────┘
  pipeline:
    name: ${{ matrix.cell }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    continue-on-error: ${{ matrix.experimental }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # `msrv-full` cell: full feature matrix (opentelemetry + splice
          # + simd on top of default jemallocator). Hosts the
          # workspace-wide fmt + doc steps; no bench. `msrv-bare` below
          # is the bare-default baseline for feature-off breakage.
          - cell: msrv-full
            toolchain: '1.93.1'
            flags: '--features opentelemetry,splice,simd'
            bench: false
            experimental: false
          # `msrv-bare` baseline: only the workspace defaults
          # (`jemallocator + crypto-ring`). Catches breakage when the
          # optional features (`opentelemetry`, `splice`, `simd`) are
          # *off* and only the default-features path is built. Mirrors
          # `cargo install sozu` for a fresh user install.
          - cell: msrv-bare
            toolchain: '1.93.1'
            flags: ''
            bench: false
            experimental: false
          # The four crypto-provider cells now exercise the full
          # feature matrix (`<crypto>,opentelemetry,splice,simd`) so
          # the CI cells reflect what release artefacts ship with
          # (matches the feature flags the published Docker image is
          # built with). `--no-default-features` explicitly excludes
          # `jemallocator` (the binary feature) because the lib-only
          # test runs do not link the bin crate.
          - cell: crypto-ring
            toolchain: '1.93.1'
            flags: '--no-default-features --features crypto-ring,opentelemetry,splice,simd'
            bench: true
            experimental: false
          - cell: crypto-aws-lc-rs
            toolchain: '1.93.1'
            flags: '--no-default-features --features crypto-aws-lc-rs,opentelemetry,splice,simd'
            bench: true
            experimental: false
          - cell: crypto-openssl
            toolchain: '1.93.1'
            flags: '--no-default-features --features crypto-openssl,opentelemetry,splice,simd'
            bench: true
            experimental: false
          - cell: fips
            toolchain: '1.93.1'
            flags: '--no-default-features --features fips,opentelemetry,splice,simd'
            bench: true
            experimental: false
          # Toolchain-drift cells: same politics as msrv (default
          # features, no bench). Lint is gated to the 1.91 MSRV cell
          # because newer toolchains (1.95+) fire additional untriaged
          # lints across the workspace.
          - cell: stable
            toolchain: stable
            flags: ''
            bench: false
            experimental: false
          - cell: beta
            toolchain: beta
            flags: ''
            bench: false
            experimental: false
          # Nightly stays "experimental" — keep building/testing it
          # to catch future-Rust regressions early without gating CI.
          - cell: nightly
            toolchain: nightly
            flags: ''
            bench: false
            experimental: true
    steps:
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler cmake

      # h2spec is needed by `tests::test_h2spec_conformance` (e2e). The
      # release tarball is small; install once per job.
      - name: Install h2spec
        run: |
          H2SPEC_VERSION=2.6.0
          curl -fsSL "https://github.com/summerwind/h2spec/releases/download/v${H2SPEC_VERSION}/h2spec_linux_amd64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin h2spec
          h2spec --version

      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install rust ${{ matrix.toolchain }}
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.toolchain }}
          components: clippy

      # rustfmt.toml uses the unstable `ignore = [...]` key, so the
      # format check must run on nightly. Only the msrv-full cell
      # hosts the fmt step (provider-agnostic, single run is enough).
      - name: Install nightly rustfmt (msrv-full cell only)
        if: matrix.cell == 'msrv-full'
        run: |
          rustup toolchain install nightly --profile minimal
          rustup component add rustfmt --toolchain nightly

      - name: Cache cargo target
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
        with:
          cache-all-crates: true
          prefix-key: ci-${{ matrix.cell }}

      - name: Build
        run: cargo build --locked ${{ matrix.flags }}

      # Format and doc both run only on the msrv-full cell to avoid
      # repeating provider-agnostic checks 5+ times in the matrix.
      - name: Format check
        if: matrix.cell == 'msrv-full'
        run: cargo +nightly fmt --all -- --check

      - name: Build documentation
        if: matrix.cell == 'msrv-full'
        run: cargo doc --no-deps --all-features --locked

      # Lint runs on the 1.93.1 MSRV cell so feature-specific lints
      # (e.g. only firing under `--features fips`) get caught.
      # Excluded on stable/beta/nightly because 1.95+ fires
      # `mismatched_lifetime_syntaxes` and a handful of other new
      # lints that have not been triaged across the workspace.
      - name: Lint (clippy)
        if: matrix.toolchain == '1.93.1'
        run: cargo clippy --all-targets --locked ${{ matrix.flags }} -- -D warnings

      - name: Test sozu-lib
        run: cargo test -p sozu-lib --locked ${{ matrix.flags }} --verbose

      # `tests::fuzz_tests::*` is `#[ignore]`d here and exercised in
      # the dedicated `fuzz` job below. Skipping it keeps the e2e
      # step from rebuilding the fuzz/ crate under aws-lc-rs / fips
      # caches (cache key mismatch caused 30+ minute compile loops).
      - name: Test sozu-e2e
        run: "cargo test -p sozu-e2e --locked ${{ matrix.flags }} --verbose -- --skip tests::fuzz_tests::"

      # Criterion benches walk every `[[bench]]` in `lib/benches/`:
      # `crypto_provider`, `h2_scheduling`, `header_formatting`. The
      # full set runs per provider so handshake / pseudo-header /
      # cert-load regressions show up in any direction.
      - name: Bench (Criterion)
        if: matrix.bench
        run: cargo bench -p sozu-lib ${{ matrix.flags }}

      - name: Upload Criterion report
        if: always() && matrix.bench
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: criterion-${{ matrix.cell }}
          path: target/criterion
          retention-days: 14

  # ┌──────────────────────────────────────────────────────────────┐
  # │ Group C — dedicated fuzz job (nightly toolchain, real fuzzing)│
  # └──────────────────────────────────────────────────────────────┘
  fuzz:
    name: Fuzz (nightly)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler cmake

      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install rust nightly
        uses: dtolnay/rust-toolchain@nightly

      - name: Cache cargo target
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
        with:
          cache-all-crates: true
          prefix-key: ci-fuzz
          workspaces: . -> target/

      # `+nightly` is REQUIRED here: the repo's `rust-toolchain` file pins
      # 1.93.1, and that directory override beats the nightly default installed
      # above. Without the explicit toolchain, `cargo install` runs under 1.93.1
      # and cargo-fuzz's locked dep tree (cargo-platform 0.3.3, rust-version
      # 1.91) fails the MSRV gate. The fuzz steps below use `cargo +nightly`.
      - name: Install cargo-fuzz
        run: cargo +nightly install cargo-fuzz --locked

      # Budget: 4 × 300 s of fuzzing ≈ 20 min wall, PLUS each
      # `cargo +nightly fuzz run` first building its target (per-target
      # sanitizer builds, partially cold cache) and the toolchain +
      # cargo-fuzz install above — observed ~30 min total on a cold-ish
      # cache (run 29088526469 was cancelled at 30:16 mid-last-target),
      # hence the 45-min job timeout. cargo-fuzz writes crash artefacts
      # to `fuzz/artifacts/<target>/`, picked up by the upload step.
      - name: Fuzz fuzz_frame_parser (300s)
        working-directory: fuzz
        run: cargo +nightly fuzz run fuzz_frame_parser -- -max_total_time=300

      - name: Fuzz fuzz_hpack_decoder (300s)
        working-directory: fuzz
        run: cargo +nightly fuzz run fuzz_hpack_decoder -- -max_total_time=300

      - name: Fuzz fuzz_udp_flow (300s)
        working-directory: fuzz
        run: cargo +nightly fuzz run fuzz_udp_flow -- -max_total_time=300

      - name: Fuzz fuzz_tcp_clienthello (300s)
        working-directory: fuzz
        run: cargo +nightly fuzz run fuzz_tcp_clienthello -- -max_total_time=300

      - name: Upload fuzz crashes
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: fuzz-crashes
          path: fuzz/artifacts
          retention-days: 14

  # ┌──────────────────────────────────────────────────────────────┐
  # │ Group C′ — cargo audit: surface RUSTSEC advisories on the    │
  # │   whole workspace including the `tui` feature surface, which │
  # │   pulls 12 optional crates (color-eyre, crossterm, ratatui,  │
  # │   tui-input, tui-big-text, …) outside the default build's    │
  # │   coverage. Treats every advisory as a warning; the job      │
  # │   fails only on `--deny warnings` so a maintainer can react  │
  # │   before the next release lands.                              │
  # └──────────────────────────────────────────────────────────────┘
  cargo-audit:
    name: cargo audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install rust 1.93.1
        uses: dtolnay/rust-toolchain@1.93.1

      - name: Cache cargo target
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
        with:
          cache-all-crates: true
          prefix-key: ci-audit
          workspaces: . -> target/

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run cargo audit (default features)
        run: cargo audit --deny warnings

      - name: Run cargo audit (all features incl. tui)
        run: |
          # `cargo audit` reads `Cargo.lock`, which already includes the
          # `tui`-feature transitive deps since this PR landed them as
          # workspace-locked entries. Re-running with the same lockfile
          # produces a consistent advisory set; the duplicate invocation
          # is kept symmetrical with the per-feature build matrix above.
          cargo audit --deny warnings

  # ┌──────────────────────────────────────────────────────────────┐
  # │ Group C″ — test hygiene: reject a bare `#[ignore]` (one with  │
  # │   no reason string). Per CONTRIBUTING.md / doc/testing.md,    │
  # │   `#[ignore]` must carry a reason and only gate an            │
  # │   environment dependency or a tracked follow-up — never hide  │
  # │   a failing test. Doc-comment mentions of `#[ignore]` (lines  │
  # │   starting with `//`) are excluded.                          │
  # └──────────────────────────────────────────────────────────────┘
  test-hygiene:
    name: Test hygiene
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Reject bare #[ignore] (must carry a reason string)
        run: |
          matches=$(grep -rEn '#\[ignore\]' --include='*.rs' . | grep -vE ':[[:space:]]*//' || true)
          if [ -n "$matches" ]; then
            echo "::error::bare #[ignore] without a reason string — use #[ignore = \"...\"] (see CONTRIBUTING.md#testing / doc/testing.md):"
            echo "$matches"
            exit 1
          fi
          echo "OK: every #[ignore] carries a reason string."

  # ┌──────────────────────────────────────────────────────────────┐
  # │ Group C‴ — moonpool-sim deterministic simulations (UDP core + │
  # │   TCP passthrough SNI-preread core, sozu-proxy/sozu#1279).    │
  # │   The sozu-sim harness is cfg-gated off in the main matrix    │
  # │   (no tokio_unstable), so run MODEST seeded sweeps here with   │
  # │   the flag as the per-PR gate; the deep swarms run nightly     │
  # │   (simulation-sweep.yml). Debug build keeps the in-core        │
  # │   `debug_assert!` invariants live.                             │
  # └──────────────────────────────────────────────────────────────┘
  udp-simulation:
    name: UDP simulation (moonpool)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      # Scopes the unstable flag to THIS job; cfg-gated deps mean the rest of the
      # workspace (and the main test matrix) never sets it.
      RUSTFLAGS: '--cfg tokio_unstable'
      # Modest per-PR sweep — moonpool builds a fresh tokio runtime per seed
      # (~100x slower per seed-step than a pure loop); the nightly job goes deep.
      SOZU_UDP_SIM_SEEDS: '64'
      SOZU_UDP_SIM_STEPS: '2000'
      # tcp_preread_sim has no per-seed tokio runtime (SniPrereadCore is a
      # small, near-stateless per-connection state machine, not a long-lived
      # flow table), so it is far cheaper per seed than the UDP sim — a
      # locally measured 2048 seeds × 200 connections/seed runs in ~14s.
      # Still kept modest here on principle; the nightly job goes deeper.
      SOZU_TCP_PREREAD_SIM_SEEDS: '512'
      SOZU_TCP_PREREAD_SIM_STEPS: '64'
    steps:
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install rust 1.93.1
        uses: dtolnay/rust-toolchain@1.93.1

      - name: Cache cargo target
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
        with:
          cache-all-crates: true
          prefix-key: sim-pr
          workspaces: . -> target/

      - name: UDP simulation sweep (debug, asserts live)
        run: cargo test -p sozu-sim --locked --test udp_simulation -- --nocapture

      - name: TCP preread simulation sweep (debug, asserts live)
        run: cargo test -p sozu-sim --locked --test tcp_preread_sim -- --nocapture

  # ┌──────────────────────────────────────────────────────────────┐
  # │ Group D — Bombardier load benches (folded from benchmark.yml) │
  # └──────────────────────────────────────────────────────────────┘
  build-bombardier:
    name: Build bombardier
    runs-on: ubuntu-latest
    steps:
      - name: Clone bombardier
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: codesenberg/bombardier
          path: .

      - uses: actions/setup-go@v7
        with:
          go-version: '1.24'
          check-latest: false

      - name: Build bombardier
        run: go build -o bombardier

      - name: Upload bombardier
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: bombardier
          path: bombardier

  build-lagging_server:
    name: Build lagging_server
    runs-on: ubuntu-latest
    steps:
      - name: Install rust 1.93.1
        uses: dtolnay/rust-toolchain@1.93.1

      - name: Clone lagging_server
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: CleverCloud/lagging_server
          path: .

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
        with:
          cache-all-crates: true
          prefix-key: lagging_server

      - name: Build lagging_server
        run: cargo build --release

      - name: Upload lagging_server
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: lagging_server
          path: target/release/lagging_server

  build-bench-logger:
    name: Build bench_logger
    runs-on: ubuntu-latest
    steps:
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Install rust 1.93.1
        uses: dtolnay/rust-toolchain@1.93.1

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      # Reuse the crypto-ring pipeline cache so the example build is
      # incremental over its compiled deps.
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
        with:
          cache-all-crates: true
          prefix-key: ci-crypto-ring

      - name: Build bench_logger
        run: cargo build --release --example bench_logger

      - name: Upload bench_logger
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: bench_logger
          path: target/release/examples/bench_logger

  bench-bombardier:
    name: Bombardier bench (${{ matrix.provider }})
    runs-on: ubuntu-latest
    needs: [pipeline, build-bombardier, build-lagging_server]
    strategy:
      fail-fast: false
      matrix:
        provider:
          - crypto-ring
          - crypto-aws-lc-rs
          - crypto-openssl
          - fips
    steps:
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler cmake

      - name: Install rust 1.93.1
        uses: dtolnay/rust-toolchain@1.93.1

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      # Restore the per-provider pipeline cache so the release build
      # of `sozu` is incremental over warm registry + compiled deps.
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
        with:
          cache-all-crates: true
          prefix-key: ci-${{ matrix.provider }}

      - name: Build sozu (release, ${{ matrix.provider }})
        run: cargo build --release -p sozu --no-default-features --features jemallocator,${{ matrix.provider }}

      - name: Stage sozu binary
        run: cp target/release/sozu .github/workflows/sozu

      - name: Download bombardier
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
        with:
          name: bombardier
          path: .github/workflows

      - name: Download lagging_server
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
        with:
          name: lagging_server
          path: .github/workflows

      - name: Host mapping sozu.io domains
        run: |
          sudo echo "0.0.0.0 sozu.io" | sudo tee -a /etc/hosts
          sudo echo "0.0.0.0 rsa-2048.sozu.io" | sudo tee -a /etc/hosts
          sudo echo "0.0.0.0 rsa-4096.sozu.io" | sudo tee -a /etc/hosts
          sudo echo "0.0.0.0 ecdsa.sozu.io" | sudo tee -a /etc/hosts

      - name: Generate TLS key rsa 2048
        working-directory: .github/workflows
        run: |
          openssl req -newkey rsa:2048 -nodes -keyout rsa-2048.key -out rsa-2048.csr -config rsa-2048.cnf
          openssl x509 -req -days 365 -in rsa-2048.csr -signkey rsa-2048.key -out rsa-2048.pem -extensions req_ext -extfile rsa-2048.cnf
          openssl x509 -in rsa-2048.pem -noout -checkhost rsa-2048.sozu.io
          sudo cp rsa-2048.pem /usr/local/share/ca-certificates/rsa-2048.crt
          sudo update-ca-certificates

      - name: Generate TLS key rsa 4096
        working-directory: .github/workflows
        run: |
          openssl req -newkey rsa:4096 -nodes -keyout rsa-4096.key -out rsa-4096.csr -config rsa-4096.cnf
          openssl x509 -req -days 365 -in rsa-4096.csr -signkey rsa-4096.key -out rsa-4096.pem -extensions req_ext -extfile rsa-4096.cnf
          openssl x509 -in rsa-4096.pem -noout -checkhost rsa-4096.sozu.io
          sudo cp rsa-4096.pem /usr/local/share/ca-certificates/rsa-4096.crt
          sudo update-ca-certificates

      - name: Generate TLS key ecdsa
        working-directory: .github/workflows
        run: |
          openssl ecparam -name prime256v1 -genkey -out ecdsa.key
          openssl req -new -key ecdsa.key -out ecdsa.csr -config ecdsa.cnf
          openssl x509 -req -days 365 -in ecdsa.csr -signkey ecdsa.key -out ecdsa.pem -extensions req_ext -extfile ecdsa.cnf
          openssl x509 -in ecdsa.pem -noout -checkhost ecdsa.sozu.io
          sudo cp ecdsa.pem /usr/local/share/ca-certificates/ecdsa.crt
          sudo update-ca-certificates

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: 3.12

      - name: Fix rights
        working-directory: .github/workflows
        run: |
          chmod +x bombardier
          chmod +x lagging_server
          chmod +x sozu

      - name: Launch bench
        working-directory: .github/workflows
        run: python bench.py

  bench-logs:
    name: Bench logger
    runs-on: ubuntu-latest
    needs: [pipeline, build-bench-logger]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Install rust 1.93.1
        uses: dtolnay/rust-toolchain@1.93.1

      # Reuse the crypto-ring pipeline cache for the release sozu
      # build that the logger bench drives.
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
        with:
          cache-all-crates: true
          prefix-key: ci-crypto-ring

      - name: Build sozu (release, crypto-ring)
        run: cargo build --release -p sozu --no-default-features --features jemallocator,crypto-ring

      - name: Stage sozu binary
        run: cp target/release/sozu .github/workflows/sozu

      - name: Download bench_logger
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
        with:
          name: bench_logger
          path: .github/workflows

      - name: Fix rights
        working-directory: .github/workflows
        run: |
          chmod +x sozu
          chmod +x bench_logger

      - name: Bench logs
        working-directory: .github/workflows
        run: python bench_logs.py

  # ┌──────────────────────────────────────────────────────────────┐
  # │ Group E — Publish (kept as-is)                                │
  # └──────────────────────────────────────────────────────────────┘
  dockerhub:
    name: Docker build and push to Docker Hub
    # Tag pushes are handled by `.github/workflows/release.yml`, which
    # publishes `clevercloud/sozu:${VERSION}` and `:latest` (stable tags
    # only). This job continues to publish `:${SHA}` aliases for branch
    # pushes and same-repo `pull_request` events; fork PRs cannot push
    # because they have no access to `secrets.DOCKERHUB_TOKEN`.
    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4
      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7
        with:
          context: .
          push: 'true'
          tags: clevercloud/sozu:${{ github.sha }}
...