ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  SCCACHE_GHA_ENABLED: "true"
  RUSTC_WRAPPER: "sccache"

permissions:
  contents: read

jobs:
  lockfile:
    name: Lockfile
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup
      - name: Validate Cargo.lock is up to date
        run: cargo metadata --format-version 1 --no-deps --locked >/dev/null

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup
        with:
          free-disk: "true"
          native-deps: "true"
          mold: "true"
          foundry: "true"
          rust-cache-shared-key: "stable"
          rust-cache-save: ${{ github.ref == 'refs/heads/main' }}
      - run: just build::ci

  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      BASE_REF: ${{ github.base_ref || 'main' }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: ${{ github.event_name == 'pull_request' && 0 || 1 }}
      - name: Fetch base branch
        if: github.event_name == 'pull_request'
        run: git fetch origin "$BASE_REF":refs/remotes/origin/"$BASE_REF"
      - uses: ./.github/actions/setup
        with:
          free-disk: "true"
          native-deps: "true"
          mold: "true"
          foundry: "true"
          tools: cargo-nextest
          rust-cache-shared-key: "stable"
      - name: Run tests
        run: |
          if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
            just test-affected-ci "origin/$BASE_REF"
          else
            just test-ci
          fi

  test-musl-sigsegv:
    name: Test SIGSEGV (musl)
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup
      - name: Install musl toolchain
        run: |
          sudo apt-get update && sudo apt-get install -y musl-tools
          rustup target add x86_64-unknown-linux-musl
      - name: Run SIGSEGV tests under musl
        run: cargo test --locked -p base-cli-utils --test sigsegv_test --target x86_64-unknown-linux-musl

  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup
        with:
          toolchain: nightly
          components: rustfmt
          rust-cache-shared-key: "nightly"
          rust-cache-save: ${{ github.ref == 'refs/heads/main' }}
      - run: just check::format

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup
        with:
          free-disk: "true"
          native-deps: "true"
          mold: "true"
          foundry: "true"
          components: clippy
          rust-cache-shared-key: "stable"
      - run: just check::clippy-ci

  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      docker: ${{ steps.filter.outputs.docker }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            docker:
              - 'etc/docker/Dockerfile.*'
              - 'etc/docker/docker-bake.hcl'
              - '.dockerignore'

  docker:
    name: Docker
    runs-on: ubuntu-latest
    needs: changes
    if: github.event_name == 'push' || needs.changes.outputs.docker == 'true'
    permissions:
      contents: read
      packages: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Login to GHCR
        if: github.event.pull_request.head.repo.fork != true
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Docker image
        run: |
          docker buildx bake -f etc/docker/docker-bake.hcl client --load

  bench:
    name: Benchmarks
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup
        with:
          free-disk: "true"
          native-deps: "true"
          mold: "true"
          rust-cache-shared-key: "stable"
      - run: cargo bench --locked -p base-proof-mpt --bench trie_node -- --test

  udeps:
    name: udeps
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup
        with:
          free-disk: "true"
          toolchain: nightly
          native-deps: "true"
          mold: "true"
          foundry: "true"
          tools: cargo-udeps
          rust-cache-shared-key: "nightly"
      - run: just check::udeps

  crate-deps:
    name: Crate Dependencies
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup
      - run: just check::crate-deps

  deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup
        with:
          tools: cargo-deny
      - run: just check::deny

  devnet-tests:
    name: Devnet Tests
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
      - uses: ./.github/actions/setup
        with:
          free-disk: "true"
          native-deps: "true"
          mold: "true"
          foundry: "true"
          tools: cargo-nextest
          rust-cache-shared-key: "stable"
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Pre-pull docker images
        run: just devnet pull-images
      - name: Run devnet tests
        run: just devnet tests-ci