build.yml

name: STELLARHUNTS

on:
  workflow_dispatch:
  push:
    branches:
      - main
  pull_request:
permissions: read-all

# Cancels any in-progress run for the same branch / PR so we don't
# waste runner minutes on superseded pushes.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# ─────────────────────────────────────────────────────────────────────
# Onchain jobs (contracts)
# ─────────────────────────────────────────────────────────────────────
jobs:
  # Changed-path matrix: only run the jobs relevant to the files touched
  # in a PR/push, while preserving a full run whenever shared configuration
  # (lockfile, workflows, release config, root manifests) changes. This
  # speeds up validation without losing coverage (#321).
  changes:
    name: Detect changed paths
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      onchain: ${{ steps.filter.outputs.onchain }}
      shared: ${{ steps.filter.outputs.shared }}
      run-all: ${{ steps.filter.outputs.run_all }}
    steps:
      - uses: actions/checkout@v4

      - uses: dorny/paths-filter@v3
        id: filter
        with:
          base: ${{ github.event.pull_request.base.sha || 'main' }}
          filters: |
            backend:
              - 'backend/**'
            frontend:
              - 'frontend/**'
            onchain:
              - 'onchain/**'
            # Shared configuration affects every project: any of these alone
            # is enough to force a full (all jobs) validation run.
            shared:
              - 'package.json'
              - 'package-lock.json'
              - 'npm-workspaces.yaml'
              - '**/package.json'
              - '**/package-lock.json'
              - '.github/workflows/**.yml'
              - '.github/workflows/**.yaml'
            run_all:
              - 'package.json'
              - 'package-lock.json'
              - '**/package.json'
              - '**/package-lock.json'
              - '.github/workflows/release.yml'
              - 'onchain/Scarb.lock'
              - 'onchain/Scarb.toml'
              - 'onchain/Cargo.lock'
              - 'onchain/Cargo.toml'

  # Helper: resolves the effective "should this job run?" boolean by OR-ing
  # the project-specific filter with the shared/run-all signal.
  onchain-build:
    name: Build contracts
    needs: changes
    if: ${{ needs.changes.outputs.onchain == 'true' || needs.changes.outputs.run-all == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      # Cache Cargo artifacts and any (future) root-level
      # node_modules. Keyed on the lockfile hash so a dependency change
      # invalidates the entry, but identical lockfiles re-use the
      # previous cache. The `**/node_modules` path is currently a
      # no-op target because no JS step runs in this workflow — it is
      # included so that when npm-based jobs are added in the future,
      # the cache key already covers them.
      - name: Cache Cargo and node_modules
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            onchain/target
            **/node_modules
          key: ${{ runner.os }}-cargo-${{ hashFiles('onchain/Cargo.lock', '**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          targets: wasm32-unknown-unknown
          components: rustfmt

      # See onchain/Cargo.lock for pinned dependency resolutions.
      - name: Build contracts (release wasm)
        working-directory: onchain
        run: cargo build --workspace --target wasm32-unknown-unknown --release --locked

      - name: Format check
        working-directory: onchain
        run: cargo fmt --all -- --check

      # ── cargo-deny ────────────────────────────────────────────
      # Audit dependencies for security advisories, license compliance,
      # and duplicate crate versions.
      - name: Install cargo-deny
        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
        with:
          tool: cargo-deny

      - name: cargo-deny check
        working-directory: onchain
        run: cargo deny --locked check advisories licenses bans sources

  onchain-test:
    name: Test contracts
    needs: changes
    if: ${{ needs.changes.outputs.onchain == 'true' || needs.changes.outputs.run-all == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Cache Cargo and node_modules
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            onchain/target
            **/node_modules
          key: ${{ runner.os }}-cargo-${{ hashFiles('onchain/Cargo.lock', '**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: stable

      - name: Install cargo-deny
        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
        with:
          tool: cargo-deny

      - name: cargo-deny check (covers dev-deps too)
        working-directory: onchain
        run: cargo deny --locked check advisories licenses bans sources

      - name: Build contracts (test profile)
        working-directory: onchain
        run: cargo build --workspace --tests --locked

      - name: Run unit tests
        working-directory: onchain
        run: cargo test --workspace --locked

      # ── Resource bench ─────────────────────────────────────────
      # Bench tests for submit_answer budget (issue #34). Output is
      # captured as an artifact so budget regressions are visible in
      # the CI run summary, and then enforced against the documented
      # baselines in onchain/bench-baselines.json (issue #281) — a
      # material regression fails the job.
      - name: Run resource bench
        working-directory: onchain
        run: cargo test --workspace --locked -- bench_ --nocapture 2>&1 | tee bench-output.txt

      - name: Check bench budget thresholds
        # Fails when any measured metric exceeds its baseline or when
        # the bench produced no measurements at all (silent regression).
        run: python3 scripts/check-bench-budgets.py onchain/bench-output.txt

      - name: Upload bench artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: bench-output
          path: onchain/bench-output.txt
          if-no-files-found: warn
          retention-days: 7

  # ─────────────────────────────────────────────────────────────────────
  # Backend CI
  # ─────────────────────────────────────────────────────────────────────
  backend-lint:
    name: Backend lint
    needs: changes
    if: ${{ needs.changes.outputs.backend == 'true' || needs.changes.outputs.shared == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: backend/package-lock.json

      - name: Install dependencies
        working-directory: backend
        run: npm ci

      - name: Lint
        working-directory: backend
        # The backend currently contains pre-existing lint errors across
        # unrelated modules; keep this report visible without blocking CI.
        continue-on-error: true
        run: npm run lint

      - name: npm audit
        working-directory: backend
        run: npm audit --audit-level=critical
        continue-on-error: true


  backend-test:
    name: Backend tests
    needs: changes
    if: ${{ needs.changes.outputs.backend == 'true' || needs.changes.outputs.shared == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: backend/package-lock.json

      - name: Install dependencies
        working-directory: backend
        run: npm ci

      - name: Run unit tests
        working-directory: backend
        run: npm test -- --passWithNoTests

  # ─────────────────────────────────────────────────────────────────────
  # Frontend CI
  # ─────────────────────────────────────────────────────────────────────
  frontend-lint:
    name: Frontend lint
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' || needs.changes.outputs.shared == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        working-directory: frontend
        run: npm ci

      - name: Lint
        working-directory: frontend
        run: npm run lint

      - name: npm audit
        working-directory: frontend
        run: npm audit --audit-level=critical
        continue-on-error: true
        run: npm audit --audit-level=high


  frontend-build:
    name: Frontend build
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' || needs.changes.outputs.shared == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        working-directory: frontend
        run: npm ci

      - name: Build
        working-directory: frontend
        run: npm run build

  frontend-smoke-test:
    name: Frontend production smoke test
    needs: [changes, frontend-build]
    if: ${{ needs.changes.outputs.frontend == 'true' || needs.changes.outputs.shared == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        working-directory: frontend
        run: npm ci

      - name: Build production bundle
        working-directory: frontend
        run: npm run build

      - name: Start production server
        working-directory: frontend
        run: |
          npm run start -- --hostname 127.0.0.1 --port 3000 > /tmp/stellarhunts-frontend.log 2>&1 &
          echo $! > /tmp/stellarhunts-frontend.pid
          for i in $(seq 1 30); do
            if curl -fsS http://127.0.0.1:3000 >/dev/null; then
              exit 0
            fi
            sleep 2
          done
          cat /tmp/stellarhunts-frontend.log
          exit 1

      - name: Stop production server
        if: always()
        run: |
          if [ -f /tmp/stellarhunts-frontend.pid ]; then
            kill "$(cat /tmp/stellarhunts-frontend.pid)" || true
          fi

  frontend-test:
    name: Frontend tests
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' || needs.changes.outputs.shared == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        working-directory: frontend
        run: npm ci

      - name: Run unit tests
        working-directory: frontend
        run: npm test