contracts.yml

name: Smart Contract CI

on:
  pull_request:
    branches: [main, add_Soroban_invariant_test]
    paths:
      - "Dechat/stellar-contracts/**"
      - ".github/workflows/contracts.yml"
  push:
    branches: [main, add_Soroban_invariant_test]
    paths:
      - "Dechat/stellar-contracts/**"

permissions:
  contents: read

env:
  # Regression guard for the deployed contract only. Raised from the
  # previous 55000: that limit was never actually enforced (the old
  # check globbed *.wasm, so SIZE held two values and `[` aborted with
  # "too many arguments" — which, as an `if` condition, silently read
  # as false). The contract has since grown to ~94 KB. Hoisted to
  # workflow level so the size-report job below stays in sync with it.
  MAX_WASM_BYTES: "98500"

jobs:
  test:
    name: Test & Build
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: Dechat/stellar-contracts

    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0

      - name: Check Cargo.lock is not drifting alone
        if: github.event_name == 'pull_request'
        working-directory: .
        run: |
          set -euo pipefail
          git fetch origin "${{ github.base_ref }}" --depth=1
          CHANGED=$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" -- Dechat/stellar-contracts/Cargo.lock Dechat/stellar-contracts/Cargo.toml Dechat/stellar-contracts/**/Cargo.toml)

          if echo "$CHANGED" | grep -q "Cargo.lock" && ! echo "$CHANGED" | grep -q "Cargo.toml"; then
            echo "Error: Dechat/stellar-contracts/Cargo.lock changed without a matching Cargo.toml change."
            echo "Lockfile drift (e.g. from an unpinned transitive dependency bump) must be accompanied by an intentional manifest change, or reverted."
            exit 1
          fi

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
        with:
          toolchain: stable
          components: clippy
          targets: wasm32-unknown-unknown

      - name: Cache Cargo registry
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            Dechat/stellar-contracts/target
          key: ${{ runner.os }}-cargo-${{ hashFiles('Dechat/stellar-contracts/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Run tests
        run: cargo test

      - name: Build WASM release
        run: cargo build --target wasm32-unknown-unknown --release

      - name: Check WASM size
        run: |
          set -euo pipefail
          ARTIFACT=target/wasm32-unknown-unknown/release/stellar_contracts.wasm

          ls -la target/wasm32-unknown-unknown/release/*.wasm

          if [ ! -f "$ARTIFACT" ]; then
            echo "Error: expected contract artifact $ARTIFACT was not produced"
            exit 1
          fi

          SIZE=$(wc -c < "$ARTIFACT" | tr -d '[:space:]')
          echo "Contract WASM size: $SIZE bytes (limit ${MAX_WASM_BYTES})"
          echo "Contract WASM size: \`$SIZE\` bytes (limit \`${MAX_WASM_BYTES}\`)" >> "$GITHUB_STEP_SUMMARY"

          if [ "$SIZE" -gt "$MAX_WASM_BYTES" ]; then
            echo "Error: WASM size $SIZE bytes exceeds ${MAX_WASM_BYTES} byte limit"
            exit 1
          fi

      - name: Run clippy (deny warnings)
        run: cargo clippy --all-targets --all-features -- -D warnings

  deny:
    name: License & Advisory Check
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Run cargo-deny (licenses & advisories)
        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
        with:
          manifest-path: Dechat/stellar-contracts/Cargo.toml
          command: check licenses advisories bans sources

  wasm-size-report:
    name: WASM Size Report
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout PR head
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          path: head
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Checkout PR base
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          path: base
          ref: ${{ github.event.pull_request.base.sha }}

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown

      - name: Cache Cargo registry & shared target dir
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            .wasm-size-target
          key: ${{ runner.os }}-cargo-wasm-size-${{ hashFiles('head/Dechat/stellar-contracts/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-wasm-size-

      - name: Build head WASM
        working-directory: head/Dechat/stellar-contracts
        # --lib only: this crate also has src/bin/deploy_fiat_bridge_futurenet.rs,
        # which compiles to its own .wasm and would collide with a glob match.
        run: cargo build --target wasm32-unknown-unknown --release --lib
        env:
          CARGO_TARGET_DIR: ${{ github.workspace }}/.wasm-size-target

      - name: Record head size
        id: head_size
        run: |
          SIZE=$(wc -c < "${{ github.workspace }}/.wasm-size-target/wasm32-unknown-unknown/release/stellar_contracts.wasm" | tr -d '[:space:]')
          echo "size=$SIZE" >> "$GITHUB_OUTPUT"

      - name: Build base WASM
        working-directory: base/Dechat/stellar-contracts
        run: cargo build --target wasm32-unknown-unknown --release --lib
        env:
          CARGO_TARGET_DIR: ${{ github.workspace }}/.wasm-size-target

      - name: Record base size
        id: base_size
        run: |
          SIZE=$(wc -c < "${{ github.workspace }}/.wasm-size-target/wasm32-unknown-unknown/release/stellar_contracts.wasm" | tr -d '[:space:]')
          echo "size=$SIZE" >> "$GITHUB_OUTPUT"

      - name: Write size report
        run: |
          cat > wasm-size-report.json <<EOF
          {
            "pr_number": ${{ github.event.pull_request.number }},
            "base_sha": "${{ github.event.pull_request.base.sha }}",
            "head_sha": "${{ github.event.pull_request.head.sha }}",
            "base_size": ${{ steps.base_size.outputs.size }},
            "head_size": ${{ steps.head_size.outputs.size }},
            "limit": ${{ env.MAX_WASM_BYTES }}
          }
          EOF

      # PRs from forks get a read-only GITHUB_TOKEN under the `pull_request`
      # event, so this job can't post a comment directly. The report is
      # handed off as an artifact to wasm-size-comment.yml, which runs via
      # `workflow_run` in the base repo's context (write-capable token) and
      # only ever reads this JSON — it never checks out or executes PR code,
      # so it stays safe from a malicious PR's build script.
      - name: Upload size report artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: wasm-size-report
          path: wasm-size-report.json
          retention-days: 7