test(remote): publish mainnet golden store + un-gate #843 live rpc read proof #299

Workflow file for this run

	name: CI

	# Secure CI suite: format, lint (deny warnings), build, test on Linux + Windows,
	# plus supply-chain checks (cargo-deny advisories/licenses/sources/bans and
	# cargo-audit RUSTSEC). Runs on every PR and on pushes to main.
	on:
	pull_request:
	push:
	branches: [main]

	# Least privilege: CI only needs to read the repo. No token can write.
	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	env:
	CARGO_TERM_COLOR: always
	CARGO_INCREMENTAL: "0" # reproducible, smaller caches in CI
	RUST_BACKTRACE: "1"
	# The workspace compiles wasmtime/cranelift (dig-node), whose debug symbols
	# dominate target/ and overran the runner disk ("No space left on device").
	# Strip debuginfo in CI — behaviour is identical; backtraces keep symbol names
	# (just not line numbers). This is the biggest single reduction in target/ size.
	CARGO_PROFILE_DEV_DEBUG: "0"
	CARGO_PROFILE_TEST_DEBUG: "0"

	jobs:
	test:
	name: build & test (${{ matrix.os }})
	runs-on: ${{ matrix.os }}
	strategy:
	fail-fast: false
	matrix:
	os: [ubuntu-latest, windows-latest]
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	persist-credentials: false

	- name: Install pinned Rust toolchain
	shell: bash
	run: \|
	rustup show # installs the toolchain pinned in rust-toolchain.toml (channel + components + targets)
	rustc --version && cargo --version

	# The workspace now pulls in wasmtime/cranelift (dig-node) on top of the full
	# crate graph, and build+test of all targets overran the stock ubuntu runner's
	# ~14 GB free disk ("No space left on device"). Reclaim the large preinstalled
	# SDKs we never use (~25 GB: .NET, Android, GHC, CodeQL) before the build.
	# Linux only — Windows runners have ample disk and no apt/docker here.
	- name: Free disk space (ubuntu)
	if: matrix.os == 'ubuntu-latest'
	shell: bash
	run: \|
	df -h /
	sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/.ghcup \
	/usr/local/lib/android /opt/hostedtoolcache \
	/usr/local/share/boost /usr/share/swift /usr/local/share/powershell \
	/usr/local/lib/node_modules /usr/local/share/chromium \
	/usr/local/graalvm "${AGENT_TOOLSDIRECTORY:-}" \|\| true
	sudo docker image prune --all --force \|\| true
	df -h /

	- name: Cache cargo + target
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry/index
	~/.cargo/registry/cache
	~/.cargo/git/db
	target
	key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
	restore-keys: ${{ runner.os }}-cargo-

	# The CLI's build.rs embeds the real guest wasm (BINDING contract D6), so
	# the wasm32 guest must be built before anything that compiles digstore-cli.
	- name: Build guest wasm (required by digstore-cli build.rs)
	run: cargo build -p digstore-guest --target wasm32-unknown-unknown --release --locked

	- name: Format check
	if: matrix.os == 'ubuntu-latest'
	run: cargo fmt --all --check

	# Deny warnings (correctness, suspicious, security-relevant lints fail CI).
	# Two purely cosmetic style lints are allowed so the gate stays focused on
	# substance rather than churn over test-code idioms.
	- name: Clippy (deny warnings)
	run: >
	cargo clippy --workspace --all-targets --locked --
	-D warnings
	-A clippy::default_constructed_unit_structs
	-A clippy::field_reassign_with_default

	- name: Build
	run: cargo build --workspace --locked

	- name: Install cargo-nextest
	uses: taiki-e/install-action@nextest

	# cargo-nextest natively detects+reports flaky tests (retried-but-passed
	# surfaces as "FLAKY" in the run summary, not silently green) instead of
	# papering over intermittent failures with a bare re-run (#489).
	#
	# Intentionally a bare `cargo nextest run`, NOT `cargo llvm-cov nextest`:
	# main has no coverage measurement/gate today, so this PR (flaky-test
	# management only) must not introduce one. Coverage instrumentation also
	# measurably slows the instrumented `digstore` binary that CLI
	# integration tests spawn as a child process (e.g. `cli_dev`'s dev-server
	# startup poll), which blew existing CI-tuned timeouts under nextest's
	# parallelism and made an otherwise-passing test fail consistently. A
	# future PR can add `cargo llvm-cov` + an explicit `--fail-under-lines`
	# gate as its own, reviewable change.
	- name: Test (nextest, flaky-aware)
	run: cargo nextest run --workspace --locked --retries 2

	# nextest does not execute doctests (https://github.com/nextest-rs/nextest/issues/16) —
	# run them separately so they still gate CI.
	- name: Doctests
	run: cargo test --doc --workspace --locked

	# The read-crypto wasm crate (crates/dig-client-wasm) is EXCLUDED from the
	# workspace (it must resolve without chia-bls/blst, which don't build for
	# wasm32) so the `--workspace` job above never sees it. Gate it on its own:
	# fmt + clippy + the native parity tests, then build the publishable
	# @dignetwork/dig-client package (web + node) and verify it end-to-end. This
	# keeps the published package buildable and the publish workflow honest.
	dig-client-wasm:
	name: dig-client-wasm (read-crypto npm package)
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	persist-credentials: false

	- name: Install pinned Rust toolchain
	run: rustup show

	- name: Install wasm-pack (official installer)
	run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf \| sh

	- uses: actions/setup-node@v4
	with:
	node-version: 20

	- name: Format check
	working-directory: crates/dig-client-wasm
	run: cargo fmt --check

	- name: Clippy (deny warnings)
	working-directory: crates/dig-client-wasm
	run: cargo clippy --all-targets -- -D warnings

	- name: Install cargo-nextest
	uses: taiki-e/install-action@nextest

	# This crate is excluded from the `--workspace` job above (it must
	# resolve without chia-bls/blst for wasm32); its thin wasm-bindgen glue
	# in src/lib.rs is exercised end-to-end by the "Verify assembled
	# package" step below, not by these native parity tests. Flaky-aware
	# nextest only (no coverage gate anywhere in this workflow — see the
	# note on the workspace job's Test step).
	- name: Parity tests (native, vs digstore-crypto; flaky-aware)
	working-directory: crates/dig-client-wasm
	run: cargo nextest run --locked --retries 2

	# nextest does not execute doctests — run separately so they still gate CI.
	- name: Parity doctests
	working-directory: crates/dig-client-wasm
	run: cargo test --doc --locked

	- name: Build + assemble package (web + node -> pkg/)
	working-directory: crates/dig-client-wasm
	run: npm run build:pkg

	- name: Generate real-crypto smoke fixture
	working-directory: crates/dig-client-wasm
	run: cargo run --example gen_smoke_fixture > smoke_fixture.json

	- name: Verify assembled package (exports + .d.ts + integrity + runtime)
	working-directory: crates/dig-client-wasm
	run: node scripts/verify-pkg.mjs

	supply-chain:
	name: supply-chain audit
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	persist-credentials: false

	- name: Install pinned Rust toolchain
	run: rustup show

	- name: Cache cargo tools
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/bin
	~/.cargo/registry/index
	~/.cargo/registry/cache
	key: ${{ runner.os }}-cargo-tools-deny

	- name: Install cargo-deny
	run: cargo install cargo-deny --locked \|\| true

	# Security-relevant supply-chain checks: RUSTSEC advisories (known/accepted
	# ones ignored in deny.toml), yanked crates, dependency bans, and the source
	# registry allow-list. cargo-deny is a superset of cargo-audit, so a separate
	# audit step would be redundant. License compliance is deferred (see deny.toml).
	- name: cargo deny check
	run: cargo deny check advisories bans sources

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

test(remote): publish mainnet golden store + un-gate #843 live rpc read proof #299

Workflow file

test(remote): publish mainnet golden store + un-gate #843 live rpc read proof #299

Uh oh!

Workflow file for this run