build.yml

name: CI on PRs
run-name: ${{ github.actor }} is perfoming a Pull Request

on:
    pull_request:
        types: [opened, reopened, synchronize, edited]
permissions:
    contents: read

concurrency:
    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
    cancel-in-progress: true

jobs:
    version-config:
        runs-on: ubuntu-latest
        outputs:
            daml_release_version: ${{ steps.version.outputs.daml_release_version }}
            devnet_canton_version: ${{ steps.version.outputs.devnet_canton_version }}
            mainnet_canton_version: ${{ steps.version.outputs.mainnet_canton_version }}
            devnet_splice_version: ${{ steps.version.outputs.devnet_splice_version }}
            mainnet_splice_version: ${{ steps.version.outputs.mainnet_splice_version }}
        steps:
            - name: Checkout
              uses: actions/checkout@v6

            - name: Resolve version config outputs
              id: version
              shell: bash
              run: |
                  CONFIG=$(cat scripts/src/lib/version-config.json)
                  echo "daml_release_version=$(echo "$CONFIG" | jq -r '.DAML_RELEASE_VERSION' | tr -d '\r\n')" >> "$GITHUB_OUTPUT"
                  echo "devnet_canton_version=$(echo "$CONFIG" | jq -r '.SUPPORTED_VERSIONS.devnet.canton.version')" >> "$GITHUB_OUTPUT"
                  echo "mainnet_canton_version=$(echo "$CONFIG" | jq -r '.SUPPORTED_VERSIONS.mainnet.canton.version')" >> "$GITHUB_OUTPUT"
                  echo "devnet_splice_version=$(echo "$CONFIG" | jq -r '.SUPPORTED_VERSIONS.devnet.splice.version')" >> "$GITHUB_OUTPUT"
                  echo "mainnet_splice_version=$(echo "$CONFIG" | jq -r '.SUPPORTED_VERSIONS.mainnet.splice.version')" >> "$GITHUB_OUTPUT"

    build:
        runs-on: ubuntu-latest
        needs: version-config
        steps:
            - name: Checkout
              uses: actions/checkout@v6

            - uses: ./.github/actions/setup_yarn/initial
              with:
                  daml_release_version: ${{ needs.version-config.outputs.daml_release_version }}
                  save_cache: 'true'

            - name: Build project
              run: yarn build:all

            - name: Upload build artifacts
              uses: actions/upload-artifact@v7
              with:
                  name: build-dist-${{ github.run_id }}
                  path: |
                      .yarn/cache/
                      .yarn/unplugged/
                      .yarn/install-state.gz
                      .pnp.cjs
                      .pnp.loader.mjs
                      core/**/dist/
                      sdk/**/dist/
                      wallet-gateway/**/dist/
                      damljs
                      .nx/cache
                      .nx/workspace-data
                  if-no-files-found: error
                  retention-days: 1

    hydrate-canton-caches:
        name: hydrate-canton-caches (${{ matrix.network }}, ${{ matrix.instance }})
        runs-on: ubuntu-latest
        needs: [version-config, build]
        strategy:
            fail-fast: false
            matrix:
                network: [devnet, mainnet]
                instance: [canton, localnet]
        steps:
            - name: Checkout
              uses: actions/checkout@v6

            - uses: ./.github/actions/setup_yarn/artifacts
              with:
                  daml_release_version: ${{ needs.version-config.outputs.daml_release_version }}

            - uses: ./.github/actions/setup_canton/initial
              if: matrix.instance == 'canton'
              with:
                  network: ${{ matrix.network }}
                  canton_version: ${{ matrix.network == 'devnet' && needs.version-config.outputs.devnet_canton_version || needs.version-config.outputs.mainnet_canton_version }}

            - uses: ./.github/actions/setup_localnet/initial
              if: matrix.instance == 'localnet'
              with:
                  network: ${{ matrix.network }}
                  splice_version: ${{ matrix.network == 'devnet' && needs.version-config.outputs.devnet_splice_version || needs.version-config.outputs.mainnet_splice_version }}

    clear-blockdaemon-policies:
        runs-on: ubuntu-latest
        steps:
            - name: Clear Blockdaemon policies
              run: |

                  BLOCKDAEMON_API_URL="${{ vars.BLOCKDAEMON_API_URL }}"
                  BLOCKDAEMON_POLICY_BASE_URL="${BLOCKDAEMON_API_URL%/api/cwp/canton}"

                  # this clear policies, with each deployment blockdaemon renables them
                  curl -s -X PUT "$BLOCKDAEMON_POLICY_BASE_URL/api/v2/policies/12" \
                    -H "authorization: Bearer ${{ vars.BLOCKDAEMON_API_KEY }}" \
                    -H "content-type: application/json" \
                    -H "x-api-version: 2.0" \
                    -d '{"entries":[],"skipConfirmations":true}'

                  # this clear policies, with each deployment blockdaemon renables them
                  curl -s -X PUT "$BLOCKDAEMON_POLICY_BASE_URL/api/v2/policies/29" \
                    -H "authorization: Bearer ${{ vars.BLOCKDAEMON_API_KEY }}" \
                    -H "content-type: application/json" \
                    -H "x-api-version: 2.0" \
                    -d '{"entries":[],"skipConfirmations":true}'

    build-docs:
        runs-on: ubuntu-latest
        needs: build
        steps:
            - name: Checkout
              uses: actions/checkout@v6

            - name: Setup Python
              id: setup-python
              uses: actions/setup-python@v6
              with:
                  python-version-file: .python-version

            - name: Install and configure Poetry
              uses: snok/install-poetry@v1
              with:
                  version: 2.1.3

            # load cached venv if cache exists
            - name: Load cached venv
              id: cached-poetry-dependencies
              uses: actions/cache/restore@v5
              with:
                  path: docs/wallet-integration-guide/.venv
                  key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('docs/wallet-integration-guide/poetry.lock') }}

            # install dependencies if cache does not exist
            - name: Install dependencies
              if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
              working-directory: docs/wallet-integration-guide
              run: poetry install --no-interaction --no-root

            - name: Save venv cache
              uses: ./.github/actions/save_cache_if_absent
              with:
                  path: docs/wallet-integration-guide/.venv
                  key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('docs/wallet-integration-guide/poetry.lock') }}

            - name: Build docs
              working-directory: docs/wallet-integration-guide
              run: poetry run sphinx-build -c . src build --fail-on-warning

    test-static:
        runs-on: ubuntu-latest
        needs: [version-config, build]
        steps:
            - name: Checkout
              uses: actions/checkout@v6

            - uses: ./.github/actions/setup_yarn/artifacts
              with:
                  daml_release_version: ${{ needs.version-config.outputs.daml_release_version }}

            - name: Validate current PR title with commitlint
              run: echo "$TITLE" | yarn commitlint --verbose
              env:
                  TITLE: ${{ github.event.pull_request.title }}

            - name: check package.json names
              run: yarn script:cleancoding

            - name: run typechecking
              run: yarn nx run-many -t typecheck --parallel

            - name: check open-rpc specs titles
              run: yarn script:openrpc:titles

            - name: prettier code
              run: yarn run prettier . --check

            - name: eslint code
              run: yarn nx run-many -t lint --parallel

            - name: check wg schema docs
              run: yarn docs:update-wg-config

    test-unit:
        runs-on: ubuntu-latest
        needs: [version-config, build]
        steps:
            - name: Checkout
              uses: actions/checkout@v6
              with:
                  fetch-depth: 0

            - uses: ./.github/actions/setup_yarn/artifacts
              with:
                  daml_release_version: ${{ needs.version-config.outputs.daml_release_version }}

            - uses: ./.github/actions/setup_playwright

            - name: Run affected unit tests
              run: |
                  yarn nx affected -t test:coverage \
                    --base=origin/${{ github.base_ref }} \
                    --head=HEAD \
                    --parallel

    check-migration-lock:
        # Verifies migrations.lock.json is in sync with src/migrations for any
        # affected SQL store package that defines a `migrations:check-lock`
        # script. Catches accidental migration edits
        needs: build
        runs-on: ubuntu-latest
        steps:
            - name: Checkout
              uses: actions/checkout@v6
              with:
                  fetch-depth: 0

            - uses: ./.github/actions/setup_yarn/artifacts

            - name: Check migration lock files
              run: |
                  yarn nx affected -t migrations:check-lock \
                    --base=origin/${{ github.base_ref }} \
                    --head=HEAD \
                    --parallel

    test-migrations:
        # Runs SQL migration tests for any affected package that defines a
        # `test:migrations` script
        runs-on: ubuntu-latest
        needs: build
        steps:
            - name: Checkout
              uses: actions/checkout@v6
              with:
                  fetch-depth: 0

            - uses: ./.github/actions/setup_yarn/artifacts

            - name: Run affected migration tests
              run: |
                  yarn nx affected -t test:migrations \
                    --base=origin/${{ github.base_ref }} \
                    --head=HEAD \
                    --parallel=1

    ping-e2e:
        name: ping-e2e (${{ matrix.network }}, ${{ matrix.db }})
        runs-on: ubuntu-latest
        needs: [version-config, hydrate-canton-caches]
        strategy:
            fail-fast: false
            matrix:
                network: [devnet, mainnet]
                db: [sqlite, postgres]
        steps:
            - name: Checkout
              uses: actions/checkout@v6

            - uses: ./.github/actions/setup_yarn/artifacts
              with:
                  daml_release_version: ${{ needs.version-config.outputs.daml_release_version }}

            - uses: ./.github/actions/setup_canton/artifacts
              with:
                  network: ${{ matrix.network }}
                  canton_version: ${{ matrix.network == 'devnet' && needs.version-config.outputs.devnet_canton_version || needs.version-config.outputs.mainnet_canton_version }}

            - name: Start Postgres container
              if: matrix.db == 'postgres'
              run: |
                  docker run -d --name wk-postgres \
                    -e POSTGRES_USER=postgres \
                    -e POSTGRES_PASSWORD=postgres \
                    -e POSTGRES_DB=postgres \
                    -p 5432:5432 \
                    --health-cmd="pg_isready -U postgres" \
                    --health-interval=2s \
                    postgres:16-alpine

                  until [ "$(docker inspect -f '{{.State.Health.Status}}' wk-postgres)" = "healthy" ]; do
                    sleep 5
                  done
                  docker inspect -f '{{.State.Health.Status}}' wk-postgres | grep -q healthy

            - name: Point gateway config at Postgres
              if: matrix.db == 'postgres'
              run: |
                  CONFIG=wallet-gateway/test/config.json
                  jq '.store.connection = {
                        type: "postgres",
                        host: "localhost",
                        port: 5432,
                        user: "postgres",
                        password: "postgres",
                        database: "wallet"
                      }
                      | .signingStore.connection = {
                        type: "postgres",
                        host: "localhost",
                        port: 5432,
                        user: "postgres",
                        password: "postgres",
                        database: "signing"
                      }' "$CONFIG" > "$CONFIG.tmp"
                  mv "$CONFIG.tmp" "$CONFIG"

            - name: Start remote WK
              run: |
                  BLOCKDAEMON_API_URL="${{ vars.BLOCKDAEMON_API_URL }}" \
                  BLOCKDAEMON_API_KEY="${{ vars.BLOCKDAEMON_API_KEY }}" \
                  BLOCKDAEMON_API_EMAIL="${{ vars.BLOCKDAEMON_API_EMAIL }}" \
                  yarn pm2 start ecosystem.ci.config.js --env development

            - uses: ./.github/actions/setup_playwright

            - name: Run example e2e
              env:
                  CI_SECRET_DEPENDENCY: ${{ github.event.pull_request.head.repo.fork == false }}
              run: yarn nx playwright:e2e @canton-network/example-ping

            - name: Collect remote PM2 logs
              if: ${{ !cancelled() }}
              run: yarn pm2 logs remote --raw --nostream --lines 10000 > "wallet-gateway-remote.log" 2>&1 || true

            - uses: actions/upload-artifact@v7
              if: ${{ !cancelled() }}
              with:
                  name: example-ping-playwright-report-${{ matrix.network }}-${{ matrix.db }}
                  path: examples/ping/playwright-report/
                  retention-days: 5

            - uses: actions/upload-artifact@v7
              if: ${{ !cancelled() }}
              with:
                  name: ping-wallet-gateway-remote-log-${{ matrix.network }}-${{ matrix.db }}
                  path: wallet-gateway-remote.log
                  retention-days: 5

            - name: Stop Postgres container
              if: ${{ always() && matrix.db == 'postgres' }}
              run: docker rm -f wk-postgres || true

    test-ping-e2e:
        runs-on: ubuntu-latest
        needs: ping-e2e
        if: always()
        steps:
            - name: Report ping e2e execution
              run: |
                  if [ "${{ needs.ping-e2e.result }}" != "success" ]; then
                    echo "ping-e2e did not succeed"
                    exit 1
                  fi
                  echo "test-ping-e2e passed"

    portfolio-e2e:
        name: portfolio-e2e (${{ matrix.network }})
        runs-on: ubuntu-latest
        needs: [version-config, hydrate-canton-caches]
        strategy:
            fail-fast: false
            matrix:
                network: [devnet, mainnet]
        steps:
            - name: Checkout
              uses: actions/checkout@v6
            - uses: ./.github/actions/setup_yarn/artifacts
              with:
                  daml_release_version: ${{ needs.version-config.outputs.daml_release_version }}

            - uses: ./.github/actions/setup_localnet/artifacts
              with:
                  network: ${{ matrix.network }}
                  splice_version: ${{ matrix.network == 'devnet' && needs.version-config.outputs.devnet_splice_version || needs.version-config.outputs.mainnet_splice_version }}

            - name: Start remote WK
              run: yarn pm2 start ecosystem.ci.config.js --env development

            - uses: ./.github/actions/setup_playwright

            - name: Run example e2e
              run: yarn nx playwright:e2e @canton-network/example-portfolio

            - name: Collect remote PM2 logs
              if: ${{ !cancelled() }}
              run: yarn pm2 logs remote --raw --nostream --lines 10000 > "wallet-gateway-remote.log" 2>&1 || true

            - uses: actions/upload-artifact@v7
              if: ${{ !cancelled() }}
              with:
                  name: example-portfolio-playwright-report-${{ matrix.network }}
                  path: examples/portfolio/playwright-report/
                  retention-days: 5

            - uses: actions/upload-artifact@v7
              if: ${{ !cancelled() }}
              with:
                  name: portfolio-wallet-gateway-remote-log-${{ matrix.network }}
                  path: wallet-gateway-remote.log
                  retention-days: 5

    test-portfolio-e2e:
        runs-on: ubuntu-latest
        needs: portfolio-e2e
        if: always()
        steps:
            - name: Report portfolio e2e execution
              run: |
                  if [ "${{ needs.portfolio-e2e.result }}" != "success" ]; then
                    echo "portfolio-e2e did not succeed"
                    exit 1
                  fi
                  echo "portfolio-e2e passed"

    wallet-sdk-snippets-e2e:
        name: wallet-sdk-snippets-e2e (${{ matrix.network }})
        runs-on: ubuntu-latest
        needs: [version-config, hydrate-canton-caches]
        strategy:
            fail-fast: false
            matrix:
                network: [devnet, mainnet]

        steps:
            - name: Checkout
              uses: actions/checkout@v6

            - uses: ./.github/actions/setup_yarn/artifacts
              with:
                  daml_release_version: ${{ needs.version-config.outputs.daml_release_version }}

            - uses: ./.github/actions/setup_localnet/artifacts
              with:
                  network: ${{ matrix.network }}
                  splice_version: ${{ matrix.network == 'devnet' && needs.version-config.outputs.devnet_splice_version || needs.version-config.outputs.mainnet_splice_version }}

            - uses: ./.github/actions/check_resources

            - name: Test example snippets (${{ matrix.network }})
              run: yarn nx snippets docs-wallet-integration-guide-examples

            - uses: ./.github/actions/check_resources

            - name: Stop Localnet (${{ matrix.network }})
              if: always()
              run: yarn stop:localnet -- --network=${{ matrix.network }}

            - name: Save container logs
              if: failure()
              run: |
                  #!/usr/bin/env bash
                  set -euo pipefail
                  mkdir -p logs
                  for c in $(docker ps -a --format '{{.Names}}'); do
                    docker logs "$c" &> "logs/$c.log" || true
                  done

            - name: Upload logs as artifacts
              if: failure()
              uses: actions/upload-artifact@v7
              with:
                  name: docker-logs-snippets-${{ matrix.network }}
                  path: logs/

    wallet-sdk-scripts-e2e:
        name: wallet-sdk-scripts-e2e (${{ matrix.network }})
        runs-on: ubuntu-latest
        needs: [version-config, hydrate-canton-caches]
        strategy:
            fail-fast: false
            matrix:
                network: [devnet, mainnet]

        steps:
            - name: Checkout
              uses: actions/checkout@v6

            - uses: ./.github/actions/setup_yarn/artifacts
              with:
                  daml_release_version: ${{ needs.version-config.outputs.daml_release_version }}

            - uses: ./.github/actions/setup_localnet/artifacts
              with:
                  network: ${{ matrix.network }}
                  splice_version: ${{ matrix.network == 'devnet' && needs.version-config.outputs.devnet_splice_version || needs.version-config.outputs.mainnet_splice_version }}

            - uses: ./.github/actions/check_resources

            - name: Test example scripts (${{ matrix.network }})
              env:
                  MAX_IO_LISTENERS: '50'
              run: yarn script:test:examples

            - uses: ./.github/actions/check_resources

            - name: Stop Localnet (${{ matrix.network }})
              if: always()
              run: yarn stop:localnet -- --network=${{ matrix.network }}

            - name: Save container logs
              if: failure()
              run: |
                  #!/usr/bin/env bash
                  set -euo pipefail
                  mkdir -p logs
                  for c in $(docker ps -a --format '{{.Names}}'); do
                    docker logs "$c" &> "logs/$c.log" || true
                  done

            - name: Upload logs as artifacts
              if: failure()
              uses: actions/upload-artifact@v7
              with:
                  name: docker-logs-scripts-${{ matrix.network }}
                  path: logs/

    test-wallet-sdk-e2e:
        name: test-wallet-sdk-e2e
        runs-on: ubuntu-latest
        needs: [wallet-sdk-snippets-e2e, wallet-sdk-scripts-e2e, wallet-sdk-pkg]
        if: always()
        steps:
            - name: Report wallet-sdk e2e execution
              run: |
                  if [ "${{ needs.wallet-sdk-snippets-e2e.result }}" != "success" ]; then
                    echo "wallet-sdk snippets e2e did not succeed"
                    exit 1
                  fi
                  if [ "${{ needs.wallet-sdk-scripts-e2e.result }}" != "success" ]; then
                    echo "wallet-sdk scripts e2e did not succeed"
                    exit 1
                  fi
                  if [ "${{ needs.wallet-sdk-pkg.result }}" != "success" ]; then
                    echo "wallet-sdk package validation did not succeed"
                    exit 1
                  fi
                  echo "all wallet-sdk-e2e jobs passed"

    wallet-sdk-pkg:
        runs-on: ubuntu-latest
        needs: [version-config, build]
        steps:
            - name: Checkout
              uses: actions/checkout@v6
            - uses: ./.github/actions/setup_yarn/artifacts
              with:
                  daml_release_version: ${{ needs.version-config.outputs.daml_release_version }}

            - name: Validate SDK package install
              run: yarn script:validate:package