ci.yml

name: CI

on:
  push:
    branches: ["**"]
  pull_request:
    branches: ["**"]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      packages: ${{ steps.filter.outputs.packages }}
      web: ${{ steps.filter.outputs.web }}
    steps:
      - uses: actions/checkout@v7
      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            # Root manifests + lockfile affect every workspace project - a
            # dependency-only change must not skip the test jobs.
            packages:
              - 'packages/**'
              - 'tsconfig.base.json'
              - 'package.json'
              - 'pnpm-workspace.yaml'
              - 'pnpm-lock.yaml'
              - '.github/workflows/ci.yml'
            web:
              - 'apps/web/**'
              - 'packages/**'
              - 'package.json'
              - 'pnpm-workspace.yaml'
              - 'pnpm-lock.yaml'
              - '.github/workflows/ci.yml'

  lint:
    needs: changes
    if: ${{ needs.changes.outputs.packages == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6.0.9
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Lint packages
        run: pnpm lint
      - name: Check formatting
        run: pnpm format:check

  typecheck-packages:
    needs: changes
    if: ${{ needs.changes.outputs.packages == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      matrix:
        node-version: [20, 22]
      fail-fast: false
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6.0.9
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node-version }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Build abi-registry
        run: pnpm tsc -p packages/abi-registry/tsconfig.json
      - name: Build pulse-core
        run: pnpm tsc -p packages/pulse-core/tsconfig.json
      - name: Typecheck abi-registry
        run: pnpm tsc --noEmit -p packages/abi-registry/tsconfig.json
      - name: Typecheck pulse-webhooks
        run: pnpm tsc --noEmit -p packages/pulse-webhooks/tsconfig.json
      - name: Typecheck pulse-notify
        run: pnpm tsc --noEmit -p packages/pulse-notify/tsconfig.json
      - name: Typecheck anchor-sdk
        run: pnpm tsc --noEmit -p packages/anchor-sdk/tsconfig.json
      - name: Validate ABI specs
        run: pnpm --filter @orbital-stellar/abi-registry validate
      - name: Generate Horizon types & check drift
        run: |
          node scripts/generate-horizon-types.mjs
          git diff --exit-code packages/pulse-core/src/_raw-horizon.gen.ts || {
            echo "ERROR: Generated Horizon types are stale. Run 'pnpm generate:horizon-types' and commit the changes."
            exit 1
          }
      - name: Test packages
        run: pnpm -r --if-present test

  bundle-size:
    needs: changes
    if: ${{ needs.changes.outputs.packages == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6.0.9
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Build abi-registry
        run: pnpm tsc -p packages/abi-registry/tsconfig.json
      - name: Build pulse-core
        run: pnpm tsc -p packages/pulse-core/tsconfig.json
      - name: Build pulse-notify
        run: pnpm tsc -p packages/pulse-notify/tsconfig.json
      - name: Check bundle size
        id: size
        run: pnpm --filter @orbital-stellar/pulse-notify size
      - name: Explain the budget failure
        # size-limit prints the size and the delta against the budget; --why
        # adds the top contributing modules, which is what you actually need to
        # decide whether a dependency or your own code moved the number.
        if: failure() && steps.size.outcome == 'failure'
        run: pnpm --filter @orbital-stellar/pulse-notify run size:why

  chaos-tests:
    needs: changes
    if: ${{ needs.changes.outputs.packages == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6.0.9
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      # pulse-core imports @orbital-stellar/abi-registry, which resolves to its
      # dist output - the suite cannot load without it built first.
      - name: Build abi-registry
        run: pnpm tsc -p packages/abi-registry/tsconfig.json
      # Fixed seed on PRs so a failure here is always reproducible from the
      # branch alone. nightly-chaos.yml runs the same suite with a random seed.
      - name: Reconnection chaos suite (fixed seed)
        env:
          CHAOS_SEED: "20260802"
        run: pnpm --filter @orbital-stellar/pulse-core exec vitest run test/chaos

  typecheck-web:
    needs: changes
    if: ${{ needs.changes.outputs.web == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6.0.9
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Build abi-registry
        run: pnpm tsc -p packages/abi-registry/tsconfig.json
      - name: Build pulse-core
        run: pnpm tsc -p packages/pulse-core/tsconfig.json
      - name: Build pulse-webhooks
        run: pnpm tsc -p packages/pulse-webhooks/tsconfig.json
      - name: Typecheck apps/web
        run: pnpm tsc --noEmit -p apps/web/tsconfig.json

  build-web:
    needs: changes
    if: ${{ needs.changes.outputs.web == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6.0.9
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      # orbital/web's prebuild builds pulse-core + pulse-webhooks (with their
      # workspace deps, incl. abi-registry) and generates reference docs, so
      # no manual dependency-order steps here.
      - name: Build apps/web
        env:
          # Canary secrets for the post-build client-bundle assertion. None of
          # these may appear in .next/static (#892, #926).
          DEMO_EMITTER_SECRET: SDEMOSECRET_CANARY_DO_NOT_SHIP_000000000000000000000000000
          SOROBAN_INVOKER_SECRET: SINVOKER_CANARY_DO_NOT_SHIP_00000000000000000000000000000
          UPSTASH_REDIS_REST_TOKEN: UPSTASH_CANARY_DO_NOT_SHIP_000000000000000000000000000
        run: pnpm --filter orbital/web run build
      - name: Assert no secret reaches the client bundle
        env:
          # Canary values for every secret the web app can read; the assertion
          # greps .next/static for each. See SECURITY.md for the inventory.
          DEMO_EMITTER_SECRET: SDEMOSECRET_CANARY_DO_NOT_SHIP_000000000000000000000000000
          SOROBAN_INVOKER_SECRET: SINVOKER_CANARY_DO_NOT_SHIP_00000000000000000000000000000
          UPSTASH_REDIS_REST_TOKEN: UPSTASH_CANARY_DO_NOT_SHIP_000000000000000000000000000
        run: node scripts/assert-no-secrets-in-bundle.mjs

  cli-smoke-test:
    needs: changes
    if: ${{ needs.changes.outputs.packages == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6.0.9
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Build abi-registry
        run: pnpm tsc -p packages/abi-registry/tsconfig.json
      - name: Build pulse-core
        run: pnpm tsc -p packages/pulse-core/tsconfig.json
      - name: Build pulse-webhooks
        run: pnpm tsc -p packages/pulse-webhooks/tsconfig.json
      - name: Smoke test pulse-core (--help, --version)
        run: |
          cd packages/pulse-core
          pnpm pack --pack-destination /tmp/orbital-smoke
          cd /tmp/orbital-smoke
          npm install -g ./orbital-stellar-pulse-core-*.tgz
          orbital --help
          orbital --version
          orbital cursor --help
          orbital typegen --help
          npm uninstall -g @orbital-stellar/pulse-core
      - name: Smoke test pulse-webhooks (--help, --version)
        run: |
          cd packages/pulse-webhooks
          pnpm pack --pack-destination /tmp/orbital-smoke
          cd /tmp/orbital-smoke
          npm install -g ./orbital-stellar-pulse-webhooks-*.tgz
          orbital-dlq --help
          orbital-dlq --version
          npm uninstall -g @orbital-stellar/pulse-webhooks
      - name: Smoke test abi-registry (--help, --version)
        run: |
          cd packages/abi-registry
          pnpm pack --pack-destination /tmp/orbital-smoke
          cd /tmp/orbital-smoke
          npm install -g ./orbital-stellar-abi-registry-*.tgz
          abi-registry-generate --help
          abi-registry-generate --version
          npm uninstall -g @orbital-stellar/abi-registry

  coverage:
    needs: changes
    if: ${{ needs.changes.outputs.packages == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6.0.9
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      # Every package must be built, not just abi-registry: workspace packages
      # resolve each other through their published `main` (./dist/index.js), so
      # a cross-package import in a test file - e.g. anchor-sdk's sep10 suite
      # importing WebAuth from pulse-core - fails to resolve without a dist.
      - name: Build packages
        run: pnpm build
      - name: Run coverage (thresholds enforced)
        run: pnpm -r --if-present test:coverage
      - name: Upload coverage reports
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-reports
          path: |
            packages/*/coverage/
          retention-days: 14