ci.yml

name: CI

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

env:
  CARGO_TERM_COLOR: always

jobs:
  ci:
    name: Continuous Integration
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install pinned Rust toolchain
        # Pinned to 1.85.0: the transitive dep `ethnum 1.5.0` (via soroban-env-common
        # 20.3.0) fails to compile on newer rustc (E0512 transmute in its error.rs),
        # and `base64ct 1.8.3` requires the edition2024 feature stabilized in 1.85.
        # 1.85.0 is the lowest stable that satisfies both. Do not bump without
        # re-verifying `cargo clippy -p sanctifier-core` compiles ethnum.
        uses: dtolnay/rust-toolchain@1.85.0
        with:
          components: rustfmt, clippy

      - name: Cache cargo registry & build artifacts
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libz3-dev libdbus-1-dev

      - name: Check formatting
        run: cargo fmt --all --check

      - name: Run Clippy
        run: |
          cargo clippy -p sanctifier-core --all-targets --all-features -- -D warnings
          cd tooling/sanctifier-cli && cargo clippy --all-targets -- -D warnings

      - name: Build All (Debug)
        run: |
          cargo build -p sanctifier-core --all-features
          cd tooling/sanctifier-cli && cargo build

      - name: CLI reference is up to date
        # Regenerates docs/cli.md from the clap command definitions and fails if
        # it differs from the committed copy, so the CLI reference can never drift
        # from the parser. Regenerate locally with:
        #   cargo run -p sanctifier-cli -- generate-docs > docs/cli.md
        run: |
          cargo run -p sanctifier-cli --manifest-path tooling/sanctifier-cli/Cargo.toml \
            -- generate-docs > docs/cli.md
          git diff --exit-code -- docs/cli.md \
            || { echo "::error::docs/cli.md is stale. Run: cargo run -p sanctifier-cli -- generate-docs > docs/cli.md"; exit 1; }

      - name: Run All Tests
        run: |
          cargo test -p sanctifier-core --all-features
          cd tooling/sanctifier-cli && cargo test

      - name: Install cargo-insta
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-insta

      - name: Detector golden snapshots (insta)
        # Fails the build if any detector's findings differ from its reviewed
        # snapshot. Regenerate locally with `cargo insta test` then review with
        # `cargo insta review` (see tooling/sanctifier-core/tests/README.md).
        run: cargo insta test -p sanctifier-core --all-features --check --unreferenced reject

      - name: Install tarpaulin
        # Prebuilt binary (like cargo-insta above) so it doesn't have to compile
        # against the pinned 1.85 toolchain — the latest cargo-tarpaulin's deps
        # (icu_*, ruzstd) require rustc >= 1.86/1.87 and fail to build here.
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-tarpaulin

      - name: Generate Coverage Report
        run: cargo tarpaulin -p sanctifier-core --out Xml

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
        with:
          file: cobertura.xml
          fail_ci_if_error: false

      - name: Build Release CLI
        run: cd tooling/sanctifier-cli && cargo build --release

      - name: Build reentrancy-guard and protected-vault
        run: |
          cargo build -p reentrancy-guard
          cargo build -p protected-vault

      - name: Build and test SEP-41 reference token (issue #735)
        # contracts/sep41-token-invariants is the SEP-41 conformance property
        # set (transfer/approve/allowance/transfer_from/burn/mint, all pure
        # + #[invariant]-annotated). Previously built locally but never run
        # in CI, so it could silently bit-rot; the Kani proofs are covered
        # separately by the fv-kani.yml KANI_PACKAGES matrix.
        run: |
          cargo build -p sep41-token-invariants
          cargo test -p sep41-token-invariants

      - name: Verify SMT proof — supply_conserved
        run: |
          cd tooling/sanctifier-cli
          ./target/release/sanctifier prove \
            --invariant supply_conserved \
            --no-save

      - name: Verify SEP-41 reference token invariants are discovered
        # "Checked against a reference token" (issue #735): confirms
        # `sanctifier verify` finds and correctly attributes all 3
        # #[invariant] declarations on contracts/sep41-token-invariants.
        run: |
          cd tooling/sanctifier-cli
          output=$(./target/release/sanctifier verify ../../contracts/sep41-token-invariants)
          echo "$output"
          echo "$output" | grep -q "Sep41Token :: pure :: supply_conserved_after_transfer " \
            || { echo "::error::supply_conserved_after_transfer invariant not discovered"; exit 1; }
          echo "$output" | grep -q "Sep41Token :: pure :: supply_conserved_after_transfer_from" \
            || { echo "::error::supply_conserved_after_transfer_from invariant not discovered"; exit 1; }
          echo "$output" | grep -q "Sep41Token :: pure :: allowance_is_set_by_approve" \
            || { echo "::error::allowance_is_set_by_approve invariant not discovered"; exit 1; }

  soroban-sdk-compat:
    # Compatibility matrix (issue #779): verify each supported soroban-sdk
    # release compiles against the pinned toolchain. Runs an isolated probe
    # crate per version so the workspace lockfile is never mutated. Keep this
    # list in sync with docs/soroban-sdk-compatibility.md.
    name: soroban-sdk ${{ matrix.soroban-sdk }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        soroban-sdk: ["20.3.0", "20.4.0", "20.5.0"]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install pinned Rust toolchain
        uses: dtolnay/rust-toolchain@1.85.0

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: ${{ runner.os }}-cargo-compat-${{ matrix.soroban-sdk }}
          restore-keys: |
            ${{ runner.os }}-cargo-compat-

      - name: Probe soroban-sdk ${{ matrix.soroban-sdk }}
        run: ./scripts/soroban-sdk-compat.sh "${{ matrix.soroban-sdk }}"