tholos/.github/workflows/ci.yml at main · drydocs/tholos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Block committed contract addresses
        run: |
          # test_snapshots/ is excluded: those JSON files are written by
          # soroban-sdk's test harness and contain synthetic, deterministic
          # mock addresses from the mocked test environment, not real
          # deployed addresses, and are committed deliberately for
          # reproducibility (see CONTRIBUTING.md's testing section).
          #
          # docs/src/DEPLOYMENT.md is excluded: its "Canonical testnet
          # deployment" section deliberately documents the one shared,
          # long-lived Tholos instance integrators should point at (see
          # INTEGRATION.md), which is exactly where that address belongs.
          # This exception is for that one reference table, not a general
          # license to hardcode addresses elsewhere; application code and
          # examples must still use placeholder env vars.
          if grep -rnE --exclude-dir=.git --exclude-dir=target --exclude-dir=test_snapshots --exclude=DEPLOYMENT.md '\bC[A-Z2-7]{55}\b' .; then
            echo "::error::Found what looks like a Stellar contract address committed to the repo. Contract addresses must never be committed, since a deployed address can't be tied to a specific source commit without an independent rebuild. Use placeholder env vars in examples instead (see CONTRIBUTING.md)."
            exit 1
          fi

      - name: Verify workspace membership
        run: |
          # A crate that exists on disk but isn't in the root [workspace]
          # members list is invisible to `cargo build/test/clippy --workspace`,
          # so CI can pass while never touching it (see #43).
          missing=0
          for manifest in contracts/*/Cargo.toml tools/*/Cargo.toml; do
            dir=$(dirname "$manifest")
            if ! grep -qF "\"$dir\"" Cargo.toml; then
              echo "::error::$dir has a Cargo.toml but is not listed in the root Cargo.toml's [workspace] members. Add it there before this crate can be built, tested, or linted by CI."
              missing=1
            fi
          done
          exit $missing

      # ubuntu-latest ships rustup preinstalled. Any rustup/cargo/rustc
      # invocation below auto-installs whatever rust-toolchain.toml pins,
      # so the version lives in exactly one place instead of being
      # duplicated into this workflow.
      - name: Install Rust
        run: |
          rustup target add wasm32v1-none
          rustup component add rustfmt clippy

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Check formatting
        run: cargo fmt --check

      - name: Lint shell scripts
        run: shellcheck scripts/*.sh

      # demo-consumer imports tholos's compiled wasm at compile time
      # (contractimport!), so it must exist before anything below this
      # touches demo-consumer: clippy and test both compile it.
      - name: Build tholos wasm
        run: cargo build -p tholos --target wasm32v1-none --release --locked

      - name: Run clippy
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

      - name: Run tests
        run: cargo test --workspace --locked

      # --lib: wasm32v1-none has no std, so tools/compute-commitment (a
      # plain host-side binary, not a contract) can't compile for this
      # target at all; only each crate's library (the actual deployable
      # contract) needs to.
      - name: Build contract wasm
        run: cargo build --workspace --lib --target wasm32v1-none --release --locked

  demo:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 10

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: |
            packages/tholos-sdk/pnpm-lock.yaml
            demos/freelance-escrow/pnpm-lock.yaml

      # demos/freelance-escrow depends on packages/tholos-sdk as a local
      # file: dependency, which needs dist/ to already exist before this
      # job's own `pnpm install` can resolve it; see tholos-sdk's own
      # README for why (pnpm applies npm's pack-list filtering even to
      # local directory deps, and dist/ is gitignored).
      - name: Build tholos-sdk
        working-directory: packages/tholos-sdk
        run: |
          pnpm install --frozen-lockfile
          pnpm build

      - name: Install dependencies
        working-directory: demos/freelance-escrow
        run: pnpm install --frozen-lockfile

      - name: Lint
        working-directory: demos/freelance-escrow
        run: pnpm lint

      - name: Build
        working-directory: demos/freelance-escrow
        run: pnpm build

  sdk:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        run: rustup target add wasm32v1-none

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2
        with:
          key: sdk

      # stellar-cli pulls in libdbus-sys (dbus-1) and hidapi (libudev, for
      # hardware wallet support), neither preinstalled on ubuntu-latest.
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev libudev-dev pkg-config

      # Pinned to the version used to originally generate packages/tholos-sdk.
      # Bump deliberately, not incidentally, since a newer CLI could change
      # the generated output's shape.
      - name: Install Stellar CLI
        run: cargo install --locked stellar-cli --version 27.0.0

      - name: Build tholos wasm
        run: cargo build -p tholos --target wasm32v1-none --release --locked

      - name: Regenerate TS bindings and check for drift
        run: |
          stellar contract bindings typescript \
            --wasm target/wasm32v1-none/release/tholos.wasm \
            --output-dir /tmp/tholos-sdk-regenerated \
            --overwrite
          if ! diff -rq packages/tholos-sdk/src /tmp/tholos-sdk-regenerated/src; then
            echo "::error::packages/tholos-sdk/src is out of date with contracts/tholos's current public interface. Regenerate it (see packages/tholos-sdk/README.md) and commit the result."
            exit 1
          fi

      - uses: pnpm/action-setup@v4
        with:
          version: 10

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: packages/tholos-sdk/pnpm-lock.yaml

      - name: Install SDK package dependencies
        working-directory: packages/tholos-sdk
        run: pnpm install --frozen-lockfile

      - name: Build SDK package
        working-directory: packages/tholos-sdk
        run: pnpm build