ci.yml

name: 'ckSOL'

on:
  pull_request:
    types:
      - opened
      - reopened
      - edited
      - synchronize
      - ready_for_review
  merge_group:
  push:
    branches:
      - main
    paths-ignore:
      - "README.md"
env:
  SOLANA_CLI_VERSION: "2.1.15"
  POCKET_IC_SERVER_VERSION: "12.0.0"
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-Dwarnings"

jobs:
  conventional-pr-title:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    env:
      TITLE: ${{ github.event.pull_request.title }}
    steps:
      # Conventional commit patterns:
      #   verb: description
      #   verb!: description of breaking change
      #   verb(scope): Description of change to $scope
      #   verb(scope)!: Description of breaking change to $scope
      # verb: feat, fix, ...
      # scope: refers to the part of code being changed.  E.g. " (accounts)" or " (accounts,canisters)"
      # !: Indicates that the PR contains a breaking change.
      - run: |
          if [[ "$TITLE" =~ ^(feat|fix|chore|build|ci|docs|style|refactor|perf|test)(\([-a-zA-Z0-9_,]+\))?\!?\: ]]; then
              echo pass
          else
              echo "PR title does not match conventions"
              exit 1
          fi

  lint:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 'Setup mise'
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        env:
          MISE_LOCKED: 1
        with:
          # Disable cache to avoid issues with wasm32 target
          # See https://github.com/jdx/mise-action/issues/215
          cache: false

      - name: 'Check code'
        run: just lint

  reproducible-build:
    runs-on: ubuntu-22.04
    steps:
      - name: 'Checkout'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 'Setup mise'
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        env:
          MISE_LOCKED: 1
        with:
          # Disable cache to avoid issues with wasm32 target
          # See https://github.com/jdx/mise-action/issues/215
          cache: false

      - name: 'Docker build'
        run: just docker-build

      - name: 'Archive Artifact'
        # `archive: false` uploads the file as-is, without zip-wrapping. The
        # artifact name is taken from the file name (the `name:` input is
        # ignored in this mode). Downloaders get exactly the bytes whose
        # SHA-256 is shown in the job summary below.
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          path: ./wasms/cksol_minter.wasm.gz
          if-no-files-found: error
          archive: false

      - name: 'Add summary'
        run: |
          hash=`sha256sum ./wasms/cksol_minter.wasm.gz`
          echo "SHA-256 :hash: ${hash}" >> $GITHUB_STEP_SUMMARY

  # Independently rebuild the canister on a different runner image and assert
  # the SHA-256 matches the artifact produced by `reproducible-build`. This
  # gates any non-determinism leaking in from the runner environment, the
  # Docker daemon version, or accidental host-state dependencies in the build.
  reproducibility-verify:
    needs: [reproducible-build]
    runs-on: ubuntu-24.04
    steps:
      - name: 'Checkout'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 'Setup mise'
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        env:
          MISE_LOCKED: 1
        with:
          # Disable cache to avoid issues with wasm32 target
          # See https://github.com/jdx/mise-action/issues/215
          cache: false

      - name: 'Independent Docker build'
        run: just docker-build

      - name: 'Download canonical artifact'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: cksol_minter.wasm.gz
          path: ./canonical

      - name: 'Compare hashes'
        run: |
          canonical_hash=$(sha256sum ./canonical/cksol_minter.wasm.gz | awk '{print $1}')
          local_hash=$(sha256sum ./wasms/cksol_minter.wasm.gz | awk '{print $1}')
          echo "Canonical: $canonical_hash"
          echo "Local:     $local_hash"
          if [[ "$canonical_hash" != "$local_hash" ]]; then
            echo "::error::Reproducibility check failed — hashes differ between runners"
            echo "SHA-256 mismatch :x:" >> $GITHUB_STEP_SUMMARY
            echo "- canonical (\`reproducible-build\` on ubuntu-22.04): \`$canonical_hash\`" >> $GITHUB_STEP_SUMMARY
            echo "- this job (ubuntu-24.04): \`$local_hash\`" >> $GITHUB_STEP_SUMMARY
            exit 1
          fi
          echo "SHA-256 reproducibility OK :white_check_mark: \`$local_hash\`" >> $GITHUB_STEP_SUMMARY

  unit-tests:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: 'Setup mise'
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        env:
          MISE_LOCKED: 1
        with:
          # Disable cache to avoid issues with wasm32 target
          # See https://github.com/jdx/mise-action/issues/215
          cache: false

      - name: 'Run unit tests'
        run: just unit-tests

  coverage:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 'Setup mise'
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        env:
          MISE_LOCKED: 1
        with:
          # Disable cache to avoid issues with wasm32 target
          # See https://github.com/jdx/mise-action/issues/215
          cache: false

      - name: 'Measure coverage'
        run: ./scripts/coverage

      - name: 'Add summary'
        run: cat ./coverage/summary.md >> "$GITHUB_STEP_SUMMARY"

      - name: 'Archive Artifact'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage
          path: ./coverage
          if-no-files-found: error

  benchmarks:
    runs-on: ubuntu-latest
    env:
      MISE_ENV: bench
    steps:
      - name: 'Checkout'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 'Setup mise'
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        env:
          MISE_LOCKED: 1
        with:
          # Disable cache to avoid issues with wasm32 target
          # See https://github.com/jdx/mise-action/issues/215
          cache: false

      - name: 'Run benchmarks'
        run: cd minter && canbench --less-verbose

  integration-tests:
    needs: [ reproducible-build ]
    runs-on: ubuntu-22.04
    steps:
      - name: 'Checkout'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 'Setup mise'
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        env:
          MISE_LOCKED: 1
        with:
          # Disable cache to avoid issues with wasm32 target
          # See https://github.com/jdx/mise-action/issues/215
          cache: false

      - name: 'Download Artifacts'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: cksol_minter.wasm.gz

      - name: 'Set CKSOL_MINTER_WASM_PATH'
        run: |
          echo "CKSOL_MINTER_WASM_PATH=$GITHUB_WORKSPACE/cksol_minter.wasm.gz" >> "$GITHUB_ENV"

      - name: 'Install PocketIC server'
        uses: dfinity/pocketic@20c33db1aa87cc6ece50857ac632c37acf5e0322 # main
        with:
          pocket-ic-server-version: ${{ env.POCKET_IC_SERVER_VERSION }}

      - name: 'Install Solana CLI'
        run: |
          sh -c "$(curl -sSfL https://release.anza.xyz/v${SOLANA_CLI_VERSION}/install)"
          echo "/home/runner/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH
        shell: bash

      - name: 'Run integration tests'
        run: just integration-tests

  # Gate job: the single required status check for the merge queue.
  # Adding or removing CI jobs only requires updating the `needs` list below,
  # with no change to the repo's ruleset.
  ci-pass:
    if: always()
    needs:
      - conventional-pr-title
      - lint
      - reproducible-build
      - reproducibility-verify
      - unit-tests
      - coverage
      - benchmarks
      - integration-tests
    runs-on: ubuntu-latest
    steps:
      - run: |
          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            exit 1
          fi