ci.yml

name: CI

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

jobs:
  backend:
    name: Backend Checks
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: server
    env:
      DATABASE_URL: "postgresql://test:test@localhost:5432/stellaryield_test"
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: stellaryield_test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: server/package-lock.json

      - name: Harden npm network settings
        run: |
          npm config set fetch-retries 5
          npm config set fetch-retry-mintimeout 20000
          npm config set fetch-retry-maxtimeout 120000
          npm config set fetch-timeout 120000

      - name: Install backend dependencies
        run: npm ci --no-audit --prefer-offline

      - name: Lint backend
        continue-on-error: true
        run: npm run lint

      - name: Generate Prisma client
        run: npx prisma generate

      - name: Push Prisma schema
        run: npx prisma db push

      - name: Run backend tests
        run: npm test

  frontend:
    name: Frontend Checks
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: client
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: client/package-lock.json

      - name: Harden npm network settings
        run: |
          npm config set fetch-retries 5
          npm config set fetch-retry-mintimeout 20000
          npm config set fetch-retry-maxtimeout 120000
          npm config set fetch-timeout 120000

      - name: Install client dependencies
        run: npm ci --no-audit --prefer-offline

      - name: Lint frontend (CI scoped)
        continue-on-error: true
        run: npm run lint:ci-scope

      - name: Run frontend tests
        id: frontend_tests
        continue-on-error: true
        shell: bash
        run: |
          set -o pipefail
          npm test 2>&1 | tee frontend-test.log

      - name: Build frontend and capture logs
        id: frontend_build
        continue-on-error: true
        shell: bash
        run: |
          set -o pipefail
          npm run build 2>&1 | tee frontend-build.log

      - name: Upload frontend failure artifacts
        if: steps.frontend_tests.outcome == 'failure' || steps.frontend_build.outcome == 'failure'
        uses: actions/upload-artifact@v4
        with:
          name: frontend-failure-artifacts-${{ github.run_id }}
          path: |
            client/frontend-test.log
            client/frontend-build.log
            client/dist
          if-no-files-found: ignore
          retention-days: 7

      - name: Fail frontend job if tests failed
        if: steps.frontend_tests.outcome == 'failure'
        run: exit 1

  contracts:
    name: Soroban Contract Checks
    runs-on: ubuntu-latest
    continue-on-error: true
    defaults:
      run:
        working-directory: contracts
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Run Clippy
        continue-on-error: true
        run: cargo clippy --workspace --all-targets

      - name: Run contract tests
        id: contract_tests
        continue-on-error: true
        shell: bash
        run: |
          set -o pipefail
          cargo test --workspace 2>&1 | tee contract-test.log

      - name: Upload contract test logs
        if: steps.contract_tests.outcome == 'failure'
        uses: actions/upload-artifact@v4
        with:
          name: contract-test-logs-${{ github.run_id }}
          path: contracts/contract-test.log
          if-no-files-found: error
          retention-days: 7

      - name: Fail contracts job if tests failed
        if: steps.contract_tests.outcome == 'failure'
        run: exit 1

  readme-commands:
    name: README Command Verification
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Verify documented README commands
        run: node scripts/verify-readme-commands.js

  verification:
    name: Formal Verification (Kani)
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch'
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: nightly
          components: rustfmt

      - name: Install Kani
        run: |
          cargo install --locked kani-verifier
          cargo kani setup

      - name: Run Kani verification
        run: cd contracts/yield_vault && cargo kani --harness verification::prove_fee_bounds --harness verification::prove_flash_loan_security --harness verification::prove_deposit_share_calculation