ci.yml

name: CI

# Secure CI suite: format, lint (deny warnings), build, test on Linux + Windows,
# plus supply-chain checks (cargo-deny advisories/licenses/sources/bans and
# cargo-audit RUSTSEC). Runs on every PR and on pushes to main.
on:
  pull_request:
  push:
    branches: [main]

# Least privilege: CI only needs to read the repo. No token can write.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"        # reproducible, smaller caches in CI
  RUST_BACKTRACE: "1"
  # The workspace compiles wasmtime/cranelift (dig-node), whose debug symbols
  # dominate target/ and overran the runner disk ("No space left on device").
  # Strip debuginfo in CI — behaviour is identical; backtraces keep symbol names
  # (just not line numbers). This is the biggest single reduction in target/ size.
  CARGO_PROFILE_DEV_DEBUG: "0"
  CARGO_PROFILE_TEST_DEBUG: "0"

jobs:
  test:
    name: build & test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install pinned Rust toolchain
        shell: bash
        run: |
          rustup show   # installs the toolchain pinned in rust-toolchain.toml (channel + components + targets)
          rustc --version && cargo --version

      # The workspace now pulls in wasmtime/cranelift (dig-node) on top of the full
      # crate graph, and build+test of all targets overran the stock ubuntu runner's
      # ~14 GB free disk ("No space left on device"). Reclaim the large preinstalled
      # SDKs we never use (~25 GB: .NET, Android, GHC, CodeQL) before the build.
      # Linux only — Windows runners have ample disk and no apt/docker here.
      - name: Free disk space (ubuntu)
        if: matrix.os == 'ubuntu-latest'
        shell: bash
        run: |
          df -h /
          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/.ghcup \
            /usr/local/lib/android /opt/hostedtoolcache \
            /usr/local/share/boost /usr/share/swift /usr/local/share/powershell \
            /usr/local/lib/node_modules /usr/local/share/chromium \
            /usr/local/graalvm "${AGENT_TOOLSDIRECTORY:-}" || true
          sudo docker image prune --all --force || true
          df -h /

      - name: Cache cargo + target
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      # The CLI's build.rs embeds the real guest wasm (BINDING contract D6), so
      # the wasm32 guest must be built before anything that compiles digstore-cli.
      - name: Build guest wasm (required by digstore-cli build.rs)
        run: cargo build -p digstore-guest --target wasm32-unknown-unknown --release --locked

      - name: Format check
        if: matrix.os == 'ubuntu-latest'
        run: cargo fmt --all --check

      # Deny warnings (correctness, suspicious, security-relevant lints fail CI).
      # Two purely cosmetic style lints are allowed so the gate stays focused on
      # substance rather than churn over test-code idioms.
      - name: Clippy (deny warnings)
        run: >
          cargo clippy --workspace --all-targets --locked --
          -D warnings
          -A clippy::default_constructed_unit_structs
          -A clippy::field_reassign_with_default

      - name: Build
        run: cargo build --workspace --locked

      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest

      # cargo-nextest natively detects+reports flaky tests (retried-but-passed
      # surfaces as "FLAKY" in the run summary, not silently green) instead of
      # papering over intermittent failures with a bare re-run (#489).
      #
      # Intentionally a bare `cargo nextest run`, NOT `cargo llvm-cov nextest`:
      # main has no coverage measurement/gate today, so this PR (flaky-test
      # management only) must not introduce one. Coverage instrumentation also
      # measurably slows the instrumented `digstore` binary that CLI
      # integration tests spawn as a child process (e.g. `cli_dev`'s dev-server
      # startup poll), which blew existing CI-tuned timeouts under nextest's
      # parallelism and made an otherwise-passing test fail consistently. A
      # future PR can add `cargo llvm-cov` + an explicit `--fail-under-lines`
      # gate as its own, reviewable change.
      - name: Test (nextest, flaky-aware)
        run: cargo nextest run --workspace --locked --retries 2

      # nextest does not execute doctests (https://github.com/nextest-rs/nextest/issues/16) —
      # run them separately so they still gate CI.
      - name: Doctests
        run: cargo test --doc --workspace --locked

  # The read-crypto wasm crate (crates/dig-client-wasm) is EXCLUDED from the
  # workspace (it must resolve without chia-bls/blst, which don't build for
  # wasm32) so the `--workspace` job above never sees it. Gate it on its own:
  # fmt + clippy + the native parity tests, then build the publishable
  # @dignetwork/dig-client package (web + node) and verify it end-to-end. This
  # keeps the published package buildable and the publish workflow honest.
  dig-client-wasm:
    name: dig-client-wasm (read-crypto npm package)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install pinned Rust toolchain
        run: rustup show

      - name: Install wasm-pack (official installer)
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Format check
        working-directory: crates/dig-client-wasm
        run: cargo fmt --check

      - name: Clippy (deny warnings)
        working-directory: crates/dig-client-wasm
        run: cargo clippy --all-targets -- -D warnings

      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest

      # This crate is excluded from the `--workspace` job above (it must
      # resolve without chia-bls/blst for wasm32); its thin wasm-bindgen glue
      # in src/lib.rs is exercised end-to-end by the "Verify assembled
      # package" step below, not by these native parity tests. Flaky-aware
      # nextest only (no coverage gate anywhere in this workflow — see the
      # note on the workspace job's Test step).
      - name: Parity tests (native, vs digstore-crypto; flaky-aware)
        working-directory: crates/dig-client-wasm
        run: cargo nextest run --locked --retries 2

      # nextest does not execute doctests — run separately so they still gate CI.
      - name: Parity doctests
        working-directory: crates/dig-client-wasm
        run: cargo test --doc --locked

      - name: Build + assemble package (web + node -> pkg/)
        working-directory: crates/dig-client-wasm
        run: npm run build:pkg

      - name: Generate real-crypto smoke fixture
        working-directory: crates/dig-client-wasm
        run: cargo run --example gen_smoke_fixture > smoke_fixture.json

      - name: Verify assembled package (exports + .d.ts + integrity + runtime)
        working-directory: crates/dig-client-wasm
        run: node scripts/verify-pkg.mjs

  supply-chain:
    name: supply-chain audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install pinned Rust toolchain
        run: rustup show

      - name: Cache cargo tools
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
          key: ${{ runner.os }}-cargo-tools-deny

      - name: Install cargo-deny
        run: cargo install cargo-deny --locked || true

      # Security-relevant supply-chain checks: RUSTSEC advisories (known/accepted
      # ones ignored in deny.toml), yanked crates, dependency bans, and the source
      # registry allow-list. cargo-deny is a superset of cargo-audit, so a separate
      # audit step would be redundant. License compliance is deferred (see deny.toml).
      - name: cargo deny check
        run: cargo deny check advisories bans sources