ci.yml

name: CI

# Lock the token down — this workflow only reads the repo.
permissions:
  contents: read

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  # Cancel superseded PR runs but never cancel the push-to-main run
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: short
  # Workspace members that compile to wasm32 Soroban contracts.
  CONTRACTS: >-
    -p orbitchain-campaign
    -p orbitchain-common
    -p orbitchain-batch-donor
    -p orbitchain-core
    -p orbitchain-token-bridge
  # The native CLI crate. Covered by the tool-* jobs below (issue #122). It is
  # a host binary, not a contract, so it is built for the host target only and
  # kept in its own package scope rather than folded into CONTRACTS.
  TOOLS: -p orbitchain-tools

jobs:
  fmt:
    name: Format check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust toolchain
        # Honors rust-toolchain.toml (channel + targets + components)
        uses: dtolnay/rust-toolchain@stable
        with:
          # No `cache: true` here — Swatinem/rust-cache handles caching below.
          cache: false
      - name: Cache cargo registry and target
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: cargo fmt --check (contracts)
        # Scope to the four Soroban contract crates only. crates/tools is a
        # native CLI with separate formatting conventions and pre-existing
        # rustfmt drift that is intentionally out of scope for this CI gate
        # — see the PR description for the tracked follow-up.
        run: cargo fmt ${{ env.CONTRACTS }} -- --check

  clippy:
    name: Clippy lint
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          cache: false
      - name: Cache cargo registry and target
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: cargo clippy (contracts)
        # Scope is intentionally narrower than the workspace because
        # crates/tools is a native CLI with separate lint conventions.
        run: cargo clippy ${{ env.CONTRACTS }} -- -D warnings

  test:
    # Multi-OS matrix (issue #123): host-target tests are the one place OS
    # differences can bite (path handling, linkers, libc); fmt/clippy are
    # style checks and wasm-check cross-compiles to the same wasm32 target
    # from any host, so those stay on ubuntu only.
    name: Tests (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          cache: false
      - name: Cache cargo registry and target
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: cargo test (contracts)
        run: cargo test ${{ env.CONTRACTS }}

  wasm-check:
    name: WASM compile check
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust toolchain with wasm target
        uses: dtolnay/rust-toolchain@stable
        with:
          # wasm32v1-none is the target Soroban SDK 26.x requires on stable
          # Rust (>=1.84); wasm32-unknown-unknown on Rust >=1.82 enables
          # reference-types/multi-value which the Soroban host cannot honour.
          targets: wasm32v1-none
          cache: false
      - name: Cache cargo registry and target
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: cargo check --target wasm32v1-none (contracts)
        run: cargo check ${{ env.CONTRACTS }} --target wasm32v1-none

  mobile-wallet-e2e:
    name: Mobile wallet deep-link (Playwright)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - name: Install JS dependencies
        run: npm ci
      - name: Install Playwright browsers
        run: npx playwright install --with-deps chromium webkit
      - name: SEP-10 curl smoke test
        # Closed-loop check: challenge -> sign -> verify against the
        # reference auth server, independent of the browser tests below.
        run: |
          node scripts/sep10-server.mjs &
          echo $! > /tmp/sep10-server.pid
          for i in $(seq 1 30); do
            curl -sf http://localhost:4000/auth?account=GATOACHAPPG72R2KKG5K47ORQVZKGBQ4UYVWLIYITEKMNFXQLNPJFJI3 >/dev/null && break
            sleep 0.5
          done
          bash scripts/smoke-test-sep10.sh
          kill "$(cat /tmp/sep10-server.pid)"
      - name: Playwright wallet_connect.html mobile-viewport tests
        run: npx playwright test
      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 14

  # ── crates/tools (native CLI) — issue #122 ─────────────────────────────────
  # The CLI is a major part of the user-facing surface and was previously
  # unbuilt/untested in CI. These four jobs mirror the contract jobs above,
  # scoped to $TOOLS, and all block merge: the crate's accumulated fmt and
  # clippy drift was cleared when coverage was restored, so there is no
  # grace period to manage.
  tool-fmt:
    name: Tool Format check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          cache: false
      - name: Cache cargo registry and target
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: cargo fmt --check (tools)
        run: cargo fmt ${{ env.TOOLS }} -- --check

  tool-clippy:
    name: Tool Clippy lint
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          cache: false
      - name: Cache cargo registry and target
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: cargo clippy (tools)
        run: cargo clippy ${{ env.TOOLS }} --all-targets -- -D warnings

  tool-check:
    name: Tool compile check
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          cache: false
      - name: Cache cargo registry and target
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: cargo check (tools)
        run: cargo check ${{ env.TOOLS }} --all-targets

  tool-test:
    name: Tool tests (host target)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          cache: false
      - name: Cache cargo registry and target
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      # Acceptance criterion (#122): a PR that fails this blocks merge.
      - name: cargo test (tools)
        run: cargo test ${{ env.TOOLS }}