ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

permissions:
  contents: read
  actions: read

jobs:
  client-checks:
    name: Client Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14

      - name: Install dependencies
        run: bun install

      - name: Format Check
        run: bun x prettier --check .

      - name: Lint
        run: bun run lint

      - name: Typecheck
        run: bun x tsc --noEmit

      - name: Generate OpenAPI
        run: bun run generate:openapi

      - name: OpenAPI Compatibility
        run: |
          # Install Optic into a dedicated env with AJV overrides.
          # @useoptic/optic@1.0.9 bundles @stoplight/spectral-core whose
          # nested AJV generates broken function code (SyntaxError: ':').
          # Forcing ajv>=8.17.1 via npm overrides dedups the nested copy
          # so spectral-core uses the patched version instead.
          # Note: no setup-node step — runner's default Node 24 is used
          # so that subsequent steps (vitest / @cloudflare/vite-plugin)
          # still have access to node:module.registerHooks (Node >=23.5).
          mkdir -p /tmp/optic-env
          cd /tmp/optic-env
          cat > package.json << 'EOF'
          {
            "name": "optic-env",
            "version": "1.0.0",
            "overrides": {
              "ajv": ">=8.17.1",
              "ajv-errors": ">=3.0.0"
            }
          }
          EOF
          npm install --save @useoptic/optic@latest --prefer-online
          cd "$GITHUB_WORKSPACE"
          /tmp/optic-env/node_modules/.bin/optic diff openapi.json --base origin/main --check
        env:
          OPTIC_TOKEN: ${{ secrets.OPTIC_TOKEN }}

      - name: Unit Tests
        run: bun run test

      - name: Build Client
        run: bun run build

      - name: Upload Client Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: client-dist
          path: dist/
          retention-days: 1

  contract-checks:
    name: Contract Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32v1-none

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: contracts/soroban

      - name: Test Contracts
        run: |
          cd contracts/soroban
          cargo test --workspace

      - name: Build Contracts
        run: |
          cd contracts/soroban
          cargo build --target wasm32v1-none --release

      - name: Wasm Size
        run: |
          echo "### Wasm Binary Sizes" >> $GITHUB_STEP_SUMMARY
          echo "| Contract | Size |" >> $GITHUB_STEP_SUMMARY
          echo "| :--- | :--- |" >> $GITHUB_STEP_SUMMARY
          TARGET_DIR="contracts/soroban/target/wasm32v1-none/release"
          if [ -d "$TARGET_DIR" ]; then
            for wasm in $TARGET_DIR/*.wasm; do
              if [ -f "$wasm" ]; then
                size=$(ls -lh "$wasm" | awk '{print $5}')
                name=$(basename "$wasm")
                echo "| $name | $size |" >> $GITHUB_STEP_SUMMARY
              fi
            done
          else
            echo "Target directory $TARGET_DIR not found." >> $GITHUB_STEP_SUMMARY
          fi

      - name: Upload Contract Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: contract-wasm
          path: contracts/soroban/target/wasm32v1-none/release/*.wasm
          retention-days: 1

  e2e:
    name: E2E Tests
    runs-on: ubuntu-latest
    needs: [client-checks]
    steps:
      - uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.1.20

      - name: Install dependencies
        run: bun install

      - name: Install Playwright browsers
        run: npx playwright install chromium --with-deps

      - name: Run E2E tests
        run: bun run test:e2e
        env:
          CI: true

      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7

      - name: Upload Playwright traces
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-traces
          path: test-results/
          retention-days: 7

  security:
    name: Security & Dependency Review
    runs-on: ubuntu-latest
    env:
      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
    steps:
      - uses: actions/checkout@v4

      - name: Dependency Review
        if: github.event_name == 'pull_request'
        uses: actions/dependency-review-action@v4

      - name: Secret Scanning
        if: ${{ env.GITLEAKS_LICENSE != '' }}
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  provenance:
    name: Provenance & Hashes
    needs: [client-checks, contract-checks]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: ./artifacts
        continue-on-error: true

      - name: Generate SHA-256 Hashes
        run: |
          echo "### Release Artifact Hashes" >> $GITHUB_STEP_SUMMARY
          echo "| Artifact | SHA-256 Hash |" >> $GITHUB_STEP_SUMMARY
          echo "| :--- | :--- |" >> $GITHUB_STEP_SUMMARY

          # Collect and hash important artifacts
          find . -name "*.wasm" -o -name "index.html" -o -name "*.js" -o -name "*.css" | grep -v "node_modules" | while read file; do
            hash=$(sha256sum "$file" | awk '{print $1}')
            name=$(basename "$file")
            echo "| $name | $hash |" >> $GITHUB_STEP_SUMMARY
            echo "$hash  $file" >> SHA256SUMS
          done

      - name: Upload Hashes
        uses: actions/upload-artifact@v4
        with:
          name: release-hashes
          path: SHA256SUMS