fix(digstore-chain): anchor verify_pinned_root to the unforgeable lau… #300
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Secure CI suite: format, lint (deny warnings), build, test on Linux + Windows, | |
| # plus supply-chain checks (cargo-deny advisories/licenses/sources/bans and | |
| # cargo-audit RUSTSEC). Runs on every PR and on pushes to main. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| # Least privilege: CI only needs to read the repo. No token can write. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: "0" # reproducible, smaller caches in CI | |
| RUST_BACKTRACE: "1" | |
| # The workspace compiles wasmtime/cranelift (dig-node), whose debug symbols | |
| # dominate target/ and overran the runner disk ("No space left on device"). | |
| # Strip debuginfo in CI — behaviour is identical; backtraces keep symbol names | |
| # (just not line numbers). This is the biggest single reduction in target/ size. | |
| CARGO_PROFILE_DEV_DEBUG: "0" | |
| CARGO_PROFILE_TEST_DEBUG: "0" | |
| jobs: | |
| test: | |
| name: build & test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinned Rust toolchain | |
| shell: bash | |
| run: | | |
| rustup show # installs the toolchain pinned in rust-toolchain.toml (channel + components + targets) | |
| rustc --version && cargo --version | |
| # The workspace now pulls in wasmtime/cranelift (dig-node) on top of the full | |
| # crate graph, and build+test of all targets overran the stock ubuntu runner's | |
| # ~14 GB free disk ("No space left on device"). Reclaim the large preinstalled | |
| # SDKs we never use (~25 GB: .NET, Android, GHC, CodeQL) before the build. | |
| # Linux only — Windows runners have ample disk and no apt/docker here. | |
| - name: Free disk space (ubuntu) | |
| if: matrix.os == 'ubuntu-latest' | |
| shell: bash | |
| run: | | |
| df -h / | |
| sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/.ghcup \ | |
| /usr/local/lib/android /opt/hostedtoolcache \ | |
| /usr/local/share/boost /usr/share/swift /usr/local/share/powershell \ | |
| /usr/local/lib/node_modules /usr/local/share/chromium \ | |
| /usr/local/graalvm "${AGENT_TOOLSDIRECTORY:-}" || true | |
| sudo docker image prune --all --force || true | |
| df -h / | |
| - name: Cache cargo + target | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo- | |
| # The CLI's build.rs embeds the real guest wasm (BINDING contract D6), so | |
| # the wasm32 guest must be built before anything that compiles digstore-cli. | |
| - name: Build guest wasm (required by digstore-cli build.rs) | |
| run: cargo build -p digstore-guest --target wasm32-unknown-unknown --release --locked | |
| - name: Format check | |
| if: matrix.os == 'ubuntu-latest' | |
| run: cargo fmt --all --check | |
| # Deny warnings (correctness, suspicious, security-relevant lints fail CI). | |
| # Two purely cosmetic style lints are allowed so the gate stays focused on | |
| # substance rather than churn over test-code idioms. | |
| - name: Clippy (deny warnings) | |
| run: > | |
| cargo clippy --workspace --all-targets --locked -- | |
| -D warnings | |
| -A clippy::default_constructed_unit_structs | |
| -A clippy::field_reassign_with_default | |
| - name: Build | |
| run: cargo build --workspace --locked | |
| - name: Install cargo-nextest | |
| uses: taiki-e/install-action@nextest | |
| # cargo-nextest natively detects+reports flaky tests (retried-but-passed | |
| # surfaces as "FLAKY" in the run summary, not silently green) instead of | |
| # papering over intermittent failures with a bare re-run (#489). | |
| # | |
| # Intentionally a bare `cargo nextest run`, NOT `cargo llvm-cov nextest`: | |
| # main has no coverage measurement/gate today, so this PR (flaky-test | |
| # management only) must not introduce one. Coverage instrumentation also | |
| # measurably slows the instrumented `digstore` binary that CLI | |
| # integration tests spawn as a child process (e.g. `cli_dev`'s dev-server | |
| # startup poll), which blew existing CI-tuned timeouts under nextest's | |
| # parallelism and made an otherwise-passing test fail consistently. A | |
| # future PR can add `cargo llvm-cov` + an explicit `--fail-under-lines` | |
| # gate as its own, reviewable change. | |
| - name: Test (nextest, flaky-aware) | |
| run: cargo nextest run --workspace --locked --retries 2 | |
| # nextest does not execute doctests (https://github.com/nextest-rs/nextest/issues/16) — | |
| # run them separately so they still gate CI. | |
| - name: Doctests | |
| run: cargo test --doc --workspace --locked | |
| # The read-crypto wasm crate (crates/dig-client-wasm) is EXCLUDED from the | |
| # workspace (it must resolve without chia-bls/blst, which don't build for | |
| # wasm32) so the `--workspace` job above never sees it. Gate it on its own: | |
| # fmt + clippy + the native parity tests, then build the publishable | |
| # @dignetwork/dig-client package (web + node) and verify it end-to-end. This | |
| # keeps the published package buildable and the publish workflow honest. | |
| dig-client-wasm: | |
| name: dig-client-wasm (read-crypto npm package) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinned Rust toolchain | |
| run: rustup show | |
| - name: Install wasm-pack (official installer) | |
| run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - name: Format check | |
| working-directory: crates/dig-client-wasm | |
| run: cargo fmt --check | |
| - name: Clippy (deny warnings) | |
| working-directory: crates/dig-client-wasm | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: Install cargo-nextest | |
| uses: taiki-e/install-action@nextest | |
| # This crate is excluded from the `--workspace` job above (it must | |
| # resolve without chia-bls/blst for wasm32); its thin wasm-bindgen glue | |
| # in src/lib.rs is exercised end-to-end by the "Verify assembled | |
| # package" step below, not by these native parity tests. Flaky-aware | |
| # nextest only (no coverage gate anywhere in this workflow — see the | |
| # note on the workspace job's Test step). | |
| - name: Parity tests (native, vs digstore-crypto; flaky-aware) | |
| working-directory: crates/dig-client-wasm | |
| run: cargo nextest run --locked --retries 2 | |
| # nextest does not execute doctests — run separately so they still gate CI. | |
| - name: Parity doctests | |
| working-directory: crates/dig-client-wasm | |
| run: cargo test --doc --locked | |
| - name: Build + assemble package (web + node -> pkg/) | |
| working-directory: crates/dig-client-wasm | |
| run: npm run build:pkg | |
| - name: Generate real-crypto smoke fixture | |
| working-directory: crates/dig-client-wasm | |
| run: cargo run --example gen_smoke_fixture > smoke_fixture.json | |
| - name: Verify assembled package (exports + .d.ts + integrity + runtime) | |
| working-directory: crates/dig-client-wasm | |
| run: node scripts/verify-pkg.mjs | |
| supply-chain: | |
| name: supply-chain audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinned Rust toolchain | |
| run: rustup show | |
| - name: Cache cargo tools | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/bin | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| key: ${{ runner.os }}-cargo-tools-deny | |
| - name: Install cargo-deny | |
| run: cargo install cargo-deny --locked || true | |
| # Security-relevant supply-chain checks: RUSTSEC advisories (known/accepted | |
| # ones ignored in deny.toml), yanked crates, dependency bans, and the source | |
| # registry allow-list. cargo-deny is a superset of cargo-audit, so a separate | |
| # audit step would be redundant. License compliance is deferred (see deny.toml). | |
| - name: cargo deny check | |
| run: cargo deny check advisories bans sources |