ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Build & Test Contracts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.70
        with:
          targets: wasm32-unknown-unknown

      - name: Cache cargo registry & build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles("**/Cargo.lock", "**/Cargo.toml") }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Build contracts
        run: cargo build --release --target wasm32-unknown-unknown

      - name: Verify wasm build output
        run: |
          set -euo pipefail
          out_dir="target/wasm32-unknown-unknown/release"
          expected="credential_nft learn_token progress_tracker"
          for name in $expected; do
            wasm_file="$out_dir/$name.wasm"
            if [ ! -f "$wasm_file" ]; then
              echo "::error::Expected wasm output missing: $wasm_file"
              exit 1
            fi
            size=$(stat -c%s "$wasm_file")
            if [ "$size" -eq 0 ]; then
              echo "::error::Wasm output is empty: $wasm_file"
              exit 1
            fi
            echo "OK: $wasm_file ($size bytes)"
          done

      - name: Run tests
        run: cargo test --workspace

      - name: Run clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Install cargo-audit
        run: cargo install cargo-audit

      - name: Run security audit
        run: cargo audit

      - name: Check licenses, advisories & banned dependencies
        uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check all