main.yml

name: main

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read
  actions: read
  security-events: write
  packages: write

jobs:
  code-analysis:
    uses: ./.github/workflows/codeql.yml

  lint-latest-commit-messages:
    uses: ./.github/workflows/lint-commit-messages.yml
    permissions:
      contents: read
      pull-requests: read
    secrets: inherit

  component-changelog-upload:
    if: github.ref == 'refs/heads/main'
    needs: [lint-latest-commit-messages]
    uses: ./.github/workflows/component-changelog-upload.yml

  component-changelog-commit:
    if: github.ref == 'refs/heads/main'
    needs: [component-changelog-upload]
    permissions:
      contents: write
      pull-requests: write
    uses: ./.github/workflows/component-changelog-commit.yml
    secrets: inherit

  filter-commit-changes:
    needs: [lint-latest-commit-messages]
    runs-on: gha-lfdt-lineth-ss-ubuntu-24-amd64-small
    name: Filter commit changes
    outputs:
      coordinator: ${{ steps.filter.outputs.coordinator }}
      staterecovery: ${{ steps.filter.outputs.staterecovery }}
      postman: ${{ steps.filter.outputs.postman }}
      prover: ${{ steps.filter.outputs.prover }}
      prover-ray: ${{ steps.filter.outputs.prover-ray }}
      rollup-spec: ${{ steps.filter.outputs.rollup-spec }}
      transaction-exclusion-api: ${{ steps.filter.outputs.transaction-exclusion-api }}
      linea-besu: ${{ steps.filter.outputs.linea-besu }}
      linea-besu-package: ${{ steps.filter.outputs.linea-besu-package }}
      smart-contracts: ${{ steps.filter.outputs.smart-contracts }}
      linea-sequencer-plugin: ${{ steps.filter.outputs.linea-sequencer-plugin }}
      native-yield-automation-service: ${{ steps.filter.outputs.native-yield-automation-service }}
      lido-governance-monitor: ${{ steps.filter.outputs.lido-governance-monitor }}
      tracer: ${{ steps.filter.outputs.tracer }}
      tracer-constraints: ${{ steps.filter.outputs.tracer-constraints }}
      maru: ${{ steps.filter.outputs.maru }}
      has-changes-requiring-build: ${{ steps.exclusion-filter.outputs.has-changes-requiring-build }}
      has-changes-requiring-linea-besu-package-build: ${{ steps.filter.outputs.linea-sequencer-plugin == 'true' || steps.filter.outputs.tracer == 'true' || steps.filter.outputs.tracer-constraints == 'true' ||  steps.filter.outputs.linea-besu == 'true' || steps.filter.outputs.linea-besu-package == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Filter commit changes
        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: filter
        with:
          base: ${{ github.ref }}
          list-files: "json"
          filters: |
            coordinator:
              - 'coordinator/**'
              - 'testdata/**'
              - 'buildSrc/**'
              - 'jvm-libs/**'
              - 'gradle/**'
              - 'build.gradle'
              - 'gradle.properties'
              - 'settings.gradle'
              - '.github/workflows/coordinator-*.yml'
              - '.github/workflows/build-and-publish.yml'
              - '.github/workflows/main.yml'
            staterecovery:
              - 'state-recovery/**'
              - 'buildSrc/**'
              - 'jvm-libs/**'
              - 'gradle/**'
              - 'build.gradle'
              - 'gradle.properties'
              - 'settings.gradle'
              - '.github/workflows/staterecovery-*.yml'
              - '.github/workflows/main.yml'
            postman:
              - 'postman/**'
              - 'ts-libs/sdk/**'
              - 'ts-libs/linea-native-libs/**'
              - 'ts-libs/linea-shared-utils/**'
              - '.github/workflows/postman-*.yml'
              - '.github/workflows/build-and-publish.yml'
              - '.github/workflows/main.yml'
              - '.nvmrc'
            prover:
              - 'prover/**'
              - '.github/workflows/prover-testing.yml'
              - '.github/workflows/build-and-publish.yml'
              - '.github/workflows/main.yml'
            prover-ray:
              - 'prover-ray/**'
              - '.github/workflows/prover-ray-testing.yml'
              - '.github/workflows/main.yml'
            rollup-spec:
              - 'rollup_spec/src/**'
              - 'rollup_spec/tests/**'
              - 'rollup_spec/requirements.txt'
              - 'rollup_spec/pyproject.toml'
              - '.github/workflows/rollup-spec-testing.yml'
            transaction-exclusion-api:
              - 'transaction-exclusion-api/**'
              - 'jvm-libs/generic/extensions/futures/**'
              - 'jvm-libs/generic/extensions/kotlin/**'
              - 'jvm-libs/generic/json-rpc/**'
              - 'jvm-libs/generic/persistence/**'
              - 'jvm-libs/generic/vertx-helper/**'
              - 'jvm-libs/linea/core/long-running-service/**'
              - 'jvm-libs/linea/core/metrics/**'
              - 'jvm-libs/linea/metrics/**'
              - '.github/workflows/transaction-exclusion-api-*.yml'
              - '.github/workflows/build-and-publish.yml'
              - '.github/workflows/main.yml'
              - 'buildSrc/**'
              - 'gradle/**'
              - 'build.gradle'
              - 'gradle.properties'
              - 'settings.gradle'
            smart-contracts:
              - 'contracts/**'
              - 'testdata/**'
              - 'prover/**'
              - '.github/workflows/main.yml'
              - '.github/workflows/run-smc-tests.yml'
            linea-sequencer-plugin:
              - 'linea-besu/plugins/linea-sequencer/**'
              - '.github/workflows/linea-sequencer-plugin-testing.yml'
              - 'buildSrc/**'
              - 'gradle/**'
              - 'build.gradle'
              - 'gradle.properties'
              - 'settings.gradle'
            linea-besu:
              - 'linea-besu/besu/**'
            linea-besu-package:
              - 'linea-besu/package/versions.env'
              - 'linea-besu/package/scripts/assemble-packages.sh'
            native-yield-automation-service:
              - 'operations/native-yield/automation-service/**'
              - 'ts-libs/linea-shared-utils/**'
              - '.github/workflows/native-yield-automation-service-*.yml'
              - '.nvmrc'
            lido-governance-monitor:
              - 'operations/native-yield/lido-governance-monitor/**'
              - 'ts-libs/linea-shared-utils/**'
              - '.github/workflows/lido-governance-monitor-*.yml'
              - '.nvmrc'
            tracer:
              - 'gradle/**'
              - 'tracer/**'
            tracer-constraints:
              - 'gradle/**'
              - 'tracer-constraints/**'
              - '.github/workflows/tracer-constraints-*.yml'
              - 'tracer/gradle/corset.gradle'
            maru:
              - 'maru/**'
              - 'buildSrc/**'
              - 'jvm-libs/**'
              - 'gradle/**'
              - 'build.gradle'
              - 'gradle.properties'
              - 'settings.gradle'
              - '.github/workflows/maru-*.yml'
              - '.github/workflows/build-and-publish.yml'
              - '.github/workflows/main.yml'

      - name: Filter out commit changes
        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: exclusion-filter
        with:
          base: ${{ github.ref }}
          list-files: "json"
          filters: |
            has-changes-requiring-build:
              - '!**/*.md'
              - '!**/*.mdx'
              - '!**/docs/**'
              - '!docs/**'
              - '!contracts/token-generation-event/**'
              - '!.github/workflows/codeql.yml'
          # Means that ALL (and not just one) filter patterns must match. In other words applies the 'AND' operator to filter patterns.
          # The default is 'some', which requires just one filter pattern match and applies the 'OR' operator.
          # For 'has-changes-requiring-build', it means we have an exclusion list that we can append to.
          predicate-quantifier: "every"

  compute-commit-tags:
    needs: [filter-commit-changes]
    uses: ./.github/workflows/reusable-compute-commit-tags.yml

  testing:
    needs: [filter-commit-changes, compute-commit-tags]
    if: ${{ always() && needs.filter-commit-changes.outputs.has-changes-requiring-build == 'true' && needs.compute-commit-tags.outputs.commit_tag != '' }}
    uses: ./.github/workflows/testing.yml
    with:
      commit_tag: ${{ needs.compute-commit-tags.outputs.commit_tag }}
      coordinator_changed: ${{ needs.filter-commit-changes.outputs.coordinator }}
      linea_sequencer_changed: ${{ needs.filter-commit-changes.outputs.linea-sequencer-plugin }}
      postman_changed: ${{ needs.filter-commit-changes.outputs.postman }}
      prover_changed: ${{ needs.filter-commit-changes.outputs.prover }}
      prover_ray_changed: ${{ needs.filter-commit-changes.outputs.prover-ray }}
      rollup_spec_changed: ${{ needs.filter-commit-changes.outputs.rollup-spec }}
      smart_contracts_changed: ${{ needs.filter-commit-changes.outputs.smart-contracts }}
      staterecovery_changed: false # disable until we have time to address it ${{ needs.filter-commit-changes.outputs.staterecovery }}
      transaction_exclusion_api_changed: ${{ needs.filter-commit-changes.outputs.transaction-exclusion-api }}
      native_yield_automation_service_changed: ${{ needs.filter-commit-changes.outputs.native-yield-automation-service }}
      lido_governance_monitor_changed: ${{ needs.filter-commit-changes.outputs.lido-governance-monitor }}
      tracer_changed: ${{ needs.filter-commit-changes.outputs.tracer }}
      constraints_changed: ${{ needs.filter-commit-changes.outputs.tracer-constraints }}
      maru_changed: ${{ needs.filter-commit-changes.outputs.maru }}
    secrets: inherit

  get-has-changes-requiring-e2e-testing:
    needs: [filter-commit-changes]
    uses: ./.github/workflows/get-has-changes-requiring-e2e-testing.yml

  manual-docker-build-and-e2e-tests:
    runs-on: gha-lfdt-lineth-ss-ubuntu-24-amd64-small
    needs: [compute-commit-tags, get-has-changes-requiring-e2e-testing]
    if: ${{ needs.get-has-changes-requiring-e2e-testing.outputs.has-changes-requiring-e2e-testing == 'true' }}
    environment: ${{ github.ref != 'refs/heads/main' && 'docker-build-and-e2e' || '' }}
    concurrency:
      group: manual-docker-build-and-e2e-tests-${{ github.workflow }}-${{ github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
    steps:
      - name: Deploy environment
        run: |
          echo "Build and e2e test environment deployed"

  docker-build:
    needs:
      [
        filter-commit-changes,
        compute-commit-tags,
        manual-docker-build-and-e2e-tests,
      ]
    uses: ./.github/workflows/build-and-publish.yml
    with:
      commit_tag: ${{ needs.compute-commit-tags.outputs.commit_tag }}
      develop_tag: ${{ needs.compute-commit-tags.outputs.develop_tag }}
      coordinator_changed: ${{ needs.filter-commit-changes.outputs.coordinator }}
      postman_changed: ${{ needs.filter-commit-changes.outputs.postman }}
      prover_changed: ${{ needs.filter-commit-changes.outputs.prover }}
      transaction_exclusion_api_changed: ${{ needs.filter-commit-changes.outputs.transaction-exclusion-api }}
      native_yield_automation_service_changed: ${{ needs.filter-commit-changes.outputs.native-yield-automation-service }}
      lido_governance_monitor_changed: ${{ needs.filter-commit-changes.outputs.lido-governance-monitor }}
      maru_changed: ${{ needs.filter-commit-changes.outputs.maru }}
      build_linea_besu_package: ${{ needs.filter-commit-changes.outputs.has-changes-requiring-linea-besu-package-build }}
    secrets: inherit

  run-e2e-tests:
    needs:
      [
        compute-commit-tags,
        docker-build,
        get-has-changes-requiring-e2e-testing,
        manual-docker-build-and-e2e-tests,
      ]
    # Make this execute for has-changes-requiring-e2e-testing == 'false' so that we can get to the required job @ which is in reusable-run-e2e-tests.yml
    if: ${{ always() && needs.get-has-changes-requiring-e2e-testing.outputs.has-changes-requiring-e2e-testing == 'false' || needs.docker-build.result == 'success' }}
    concurrency:
      group: run-e2e-tests-${{ github.workflow }}-${{ github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
    uses: ./.github/workflows/reusable-run-e2e-tests.yml
    with:
      image_tag: ${{ needs.compute-commit-tags.outputs.commit_tag }}
      linea_besu_package_tag: ${{ needs.docker-build.outputs.linea_besu_package_tag }}
      e2e-tests-logs-dump: true
      has-changes-requiring-e2e-testing: ${{ needs.get-has-changes-requiring-e2e-testing.outputs.has-changes-requiring-e2e-testing }}
    secrets: inherit

  publish-linea-besu-after-run-tests-success:
    needs: [run-e2e-tests]
    # Only run for same-repo PRs: do not checkout and run PR head from forks (avoids untrusted code with contents/packages write).
    if: ${{ always() && github.ref != 'refs/heads/main' && needs.run-e2e-tests.outputs.tests_outcome == 'success' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) }}
    permissions:
      contents: write
      actions: read
      packages: write
    uses: ./.github/workflows/linea-besu-build-and-publish.yml
    secrets: inherit

  cleanup-deployments:
    needs: [run-e2e-tests]
    if: ${{ always() && github.event.pull_request.head.repo.fork == false }}
    runs-on: gha-lfdt-lineth-ss-ubuntu-24-amd64-small
    permissions:
      contents: read
      deployments: write
    steps:
      - uses: strumwolf/delete-deployment-environment@035f6d27c8b8951729f4d71b2d3d6a7975139476 #v4.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          environment: docker-build-and-e2e
          # ref_name is incorrect for PR trigger - https://github.com/strumwolf/delete-deployment-environment/issues/42
          # head_ref is correct for PR trigger, but only available for PR trigger
          ref: ${{ github.head_ref || github.ref_name }}
          onlyRemoveDeployments: true

  notify:
    needs:
      [
        filter-commit-changes,
        compute-commit-tags,
        code-analysis,
        testing,
        get-has-changes-requiring-e2e-testing,
        manual-docker-build-and-e2e-tests,
        docker-build,
        run-e2e-tests,
        cleanup-deployments,
      ]
    if: ${{ always() && github.ref == 'refs/heads/main' && contains(needs.*.result, 'failure') }}
    permissions:
      contents: read
      actions: read
    uses: ./.github/workflows/slack-notify-failed-jobs.yml
    with:
      title: "Main workflow Failed"
      run_id: ${{ github.run_id }}
      enable_ai_analysis: ${{ needs.run-e2e-tests.result == 'failure' }}
    secrets:
      channel_id: ${{ secrets.SLACK_ENGINEERING_ALERTS_CHANNEL_ID }}
      slack_bot_token: ${{ secrets.SLACK_GITHUB_ACTIONS_ALERTS_BOT_TOKEN }}
      anthropic_api_key: ${{ secrets.LITELLM_KEY_CI_FAILURE_ANALYSIS }}