Merge pull request #1821 from Chigybillionz/draft-collab #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| permissions: | |
| contents: read | |
| actions: read | |
| jobs: | |
| client-checks: | |
| name: Client Checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Install dependencies | |
| run: bun install | |
| - name: Format Check | |
| run: bun x prettier --check . | |
| - name: Lint | |
| run: bun run lint | |
| - name: Typecheck | |
| run: bun x tsc --noEmit | |
| - name: Generate OpenAPI | |
| run: bun run generate:openapi | |
| - name: OpenAPI Compatibility | |
| run: | | |
| # Install Optic into a dedicated env with AJV overrides. | |
| # @useoptic/optic@1.0.9 bundles @stoplight/spectral-core whose | |
| # nested AJV generates broken function code (SyntaxError: ':'). | |
| # Forcing ajv>=8.17.1 via npm overrides dedups the nested copy | |
| # so spectral-core uses the patched version instead. | |
| # Note: no setup-node step — runner's default Node 24 is used | |
| # so that subsequent steps (vitest / @cloudflare/vite-plugin) | |
| # still have access to node:module.registerHooks (Node >=23.5). | |
| mkdir -p /tmp/optic-env | |
| cd /tmp/optic-env | |
| cat > package.json << 'EOF' | |
| { | |
| "name": "optic-env", | |
| "version": "1.0.0", | |
| "overrides": { | |
| "ajv": ">=8.17.1", | |
| "ajv-errors": ">=3.0.0" | |
| } | |
| } | |
| EOF | |
| npm install --save @useoptic/optic@latest --prefer-online | |
| cd "$GITHUB_WORKSPACE" | |
| /tmp/optic-env/node_modules/.bin/optic diff openapi.json --base origin/main --check | |
| env: | |
| OPTIC_TOKEN: ${{ secrets.OPTIC_TOKEN }} | |
| - name: Unit Tests | |
| run: bun run test | |
| - name: Build Client | |
| run: bun run build | |
| - name: Upload Client Artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: client-dist | |
| path: dist/ | |
| retention-days: 1 | |
| contract-checks: | |
| name: Contract Checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32v1-none | |
| - name: Rust Cache | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: contracts/soroban | |
| - name: Test Contracts | |
| run: | | |
| cd contracts/soroban | |
| cargo test --workspace | |
| - name: Build Contracts | |
| run: | | |
| cd contracts/soroban | |
| cargo build --target wasm32v1-none --release | |
| - name: Wasm Size | |
| run: | | |
| echo "### Wasm Binary Sizes" >> $GITHUB_STEP_SUMMARY | |
| echo "| Contract | Size |" >> $GITHUB_STEP_SUMMARY | |
| echo "| :--- | :--- |" >> $GITHUB_STEP_SUMMARY | |
| TARGET_DIR="contracts/soroban/target/wasm32v1-none/release" | |
| if [ -d "$TARGET_DIR" ]; then | |
| for wasm in $TARGET_DIR/*.wasm; do | |
| if [ -f "$wasm" ]; then | |
| size=$(ls -lh "$wasm" | awk '{print $5}') | |
| name=$(basename "$wasm") | |
| echo "| $name | $size |" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| done | |
| else | |
| echo "Target directory $TARGET_DIR not found." >> $GITHUB_STEP_SUMMARY | |
| fi | |
| - name: Upload Contract Artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: contract-wasm | |
| path: contracts/soroban/target/wasm32v1-none/release/*.wasm | |
| retention-days: 1 | |
| e2e: | |
| name: E2E Tests | |
| runs-on: ubuntu-latest | |
| needs: [client-checks] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.1.20 | |
| - name: Install dependencies | |
| run: bun install | |
| - name: Install Playwright browsers | |
| run: npx playwright install chromium --with-deps | |
| - name: Run E2E tests | |
| run: bun run test:e2e | |
| env: | |
| CI: true | |
| - name: Upload Playwright report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: playwright-report | |
| path: playwright-report/ | |
| retention-days: 7 | |
| - name: Upload Playwright traces | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: playwright-traces | |
| path: test-results/ | |
| retention-days: 7 | |
| security: | |
| name: Security & Dependency Review | |
| runs-on: ubuntu-latest | |
| env: | |
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| uses: actions/dependency-review-action@v4 | |
| - name: Secret Scanning | |
| if: ${{ env.GITLEAKS_LICENSE != '' }} | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| provenance: | |
| name: Provenance & Hashes | |
| needs: [client-checks, contract-checks] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: ./artifacts | |
| continue-on-error: true | |
| - name: Generate SHA-256 Hashes | |
| run: | | |
| echo "### Release Artifact Hashes" >> $GITHUB_STEP_SUMMARY | |
| echo "| Artifact | SHA-256 Hash |" >> $GITHUB_STEP_SUMMARY | |
| echo "| :--- | :--- |" >> $GITHUB_STEP_SUMMARY | |
| # Collect and hash important artifacts | |
| find . -name "*.wasm" -o -name "index.html" -o -name "*.js" -o -name "*.css" | grep -v "node_modules" | while read file; do | |
| hash=$(sha256sum "$file" | awk '{print $1}') | |
| name=$(basename "$file") | |
| echo "| $name | $hash |" >> $GITHUB_STEP_SUMMARY | |
| echo "$hash $file" >> SHA256SUMS | |
| done | |
| - name: Upload Hashes | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: release-hashes | |
| path: SHA256SUMS |