main.yml

name: ARM
on:
  pull_request:
    types: [opened, reopened, synchronize]
  push:
    branches:
      - main
  schedule:
    # Daily at 6:00 AM UTC
    - cron: '0 6 * * *'
  workflow_dispatch:
    # Manual trigger from GitHub UI

# security/LOW: scope GITHUB_TOKEN to read-only and remove the
# workflow-wide env export. Steps that genuinely need the token can
# pass it explicitly via `env:` on that step. Smallest viable scope
# for a read-mostly CI workflow.
permissions:
  contents: read

env:
  # Increase available memory for node to reduce ganache crashes
  # https://nodejs.org/api/cli.html#cli_max_old_space_size_size_in_megabytes
  NODE_OPTIONS: --max_old_space_size=4096

jobs:
  # ╔══════════════════════════════════════════════════════════════════════════════╗
  # ║                                  LINTER                                      ║
  # ╚══════════════════════════════════════════════════════════════════════════════╝
  lint:
    name: Contracts Linter
    runs-on: ubuntu-latest
    # Skip on scheduled runs (only need to lint on actual code changes)
    if: github.event_name != 'schedule'
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup environment
        uses: ./.github/actions/setup

      - name: Run Linter
        run: forge fmt --check

  # ╔══════════════════════════════════════════════════════════════════════════════╗
  # ║                                   BUILD                                      ║
  # ╚══════════════════════════════════════════════════════════════════════════════╝
  build:
    name: Contracts Build
    runs-on: ubuntu-latest
    # Skip on scheduled runs
    if: github.event_name != 'schedule'
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup environment
        uses: ./.github/actions/setup
        with:
          install-pnpm: 'true'
          ssh-key: ${{ secrets.TALOS_DEPLOY_KEY }}

      - name: Compile all contracts
        run: forge build

      - name: Ensure contract sizes are within limits
        # LidoARM/EtherFiARM/OriginARM are skipped: they sit at/over the EIP-170 runtime limit and are
        # being superseded by MultiAssetARM, so they should not gate CI.
        run: forge build --sizes --skip "test/**" --skip "script/**" --skip "*/forge-std/*" --skip "**/LidoARM.sol" --skip "**/EtherFiARM.sol" --skip "**/OriginARM.sol"

  # ╔══════════════════════════════════════════════════════════════════════════════╗
  # ║                              CONCRETE TESTS                                  ║
  # ╚══════════════════════════════════════════════════════════════════════════════╝
  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-latest
    # Skip on scheduled runs
    if: github.event_name != 'schedule'
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup environment
        uses: ./.github/actions/setup
        with:
          install-pnpm: 'true'
          ssh-key: ${{ secrets.TALOS_DEPLOY_KEY }}

      - name: Run unit tests
        run: forge test --summary --fail-fast --show-progress --mp 'test/unit/**'

  fork-tests:
    name: Fork Tests
    runs-on: ubuntu-latest
    env:
      MAINNET_URL: ${{ secrets.MAINNET_URL }}
      FLY_API_KEY: ${{ secrets.FLY_API_KEY }}
      SONIC_URL: ${{ secrets.SONIC_URL }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup environment
        uses: ./.github/actions/setup
        with:
          install-pnpm: 'true'
          ssh-key: ${{ secrets.TALOS_DEPLOY_KEY }}

      - name: Run fork tests
        run: forge test --summary --fail-fast --show-progress --mp 'test/fork/**'

  smoke-tests:
    name: Smoke Tests
    runs-on: ubuntu-latest
    env:
      MAINNET_URL: ${{ secrets.MAINNET_URL }}
      FLY_API_KEY: ${{ secrets.FLY_API_KEY }}
      SONIC_URL: ${{ secrets.SONIC_URL }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup environment
        uses: ./.github/actions/setup
        with:
          install-pnpm: 'true'
          ssh-key: ${{ secrets.TALOS_DEPLOY_KEY }}

      - name: Run smoke tests
        run: forge build && forge test --summary --fail-fast --show-progress --mp 'test/smoke/**'

  # ╔══════════════════════════════════════════════════════════════════════════════╗
  # ║                              INVARIANT TESTS                                 ║
  # ╚══════════════════════════════════════════════════════════════════════════════╝
  # Profile selection:
  #   - ci:   schedule, workflow_dispatch, push to main
  #   - lite: pull_request, push to feature branches

  invariant-tests-LidoARM:
    name: Invariant Tests - LidoARM
    runs-on: ubuntu-latest
    env:
      FOUNDRY_PROFILE: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) && 'ci' || 'lite' }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup environment
        uses: ./.github/actions/setup

      - name: Run invariant tests (LidoARM) [${{ env.FOUNDRY_PROFILE }}]
        run: |
          FOUNDRY_INVARIANT_FAIL_ON_REVERT=true \
          FOUNDRY_MATCH_CONTRACT=FuzzerFoundry_LidoARM \
          forge test --summary --fail-fast --show-progress

  invariant-tests-EthenaARM:
    name: Invariant Tests - EthenaARM
    runs-on: ubuntu-latest
    env:
      FOUNDRY_PROFILE: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) && 'ci' || 'lite' }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup environment
        uses: ./.github/actions/setup

      - name: Run invariant tests (EthenaARM) [${{ env.FOUNDRY_PROFILE }}]
        run: |
          FOUNDRY_INVARIANT_FAIL_ON_REVERT=true \
          FOUNDRY_MATCH_CONTRACT=FuzzerFoundry_EthenaARM \
          forge test --summary --fail-fast --show-progress

      # Medusa fuzzing (only on full runs)
      - name: Setup Go
        if: env.FOUNDRY_PROFILE == 'ci'
        uses: actions/setup-go@v5
        with:
          go-version: '1.21'

      - name: Set up Python
        if: env.FOUNDRY_PROFILE == 'ci'
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'

      - name: Install Crytic Compile
        if: env.FOUNDRY_PROFILE == 'ci'
        run: pip install crytic-compile

      - name: Install Medusa from Source
        if: env.FOUNDRY_PROFILE == 'ci'
        run: go install github.com/crytic/medusa@latest

      - name: Run Medusa
        if: env.FOUNDRY_PROFILE == 'ci'
        working-directory: test/invariants/EthenaARM/
        run: medusa fuzz --timeout 1800 --seq-len 500 --fail-fast