feat: add tholos-monitor event monitoring/alerting service (closes #189) #405
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Block committed contract addresses | |
| run: | | |
| # test_snapshots/ is excluded: those JSON files are written by | |
| # soroban-sdk's test harness and contain synthetic, deterministic | |
| # mock addresses from the mocked test environment, not real | |
| # deployed addresses, and are committed deliberately for | |
| # reproducibility (see CONTRIBUTING.md's testing section). | |
| # | |
| # docs/src/DEPLOYMENT.md is excluded: its "Canonical testnet | |
| # deployment" section deliberately documents the one shared, | |
| # long-lived Tholos instance integrators should point at (see | |
| # INTEGRATION.md), which is exactly where that address belongs. | |
| # This exception is for that one reference table, not a general | |
| # license to hardcode addresses elsewhere; application code and | |
| # examples must still use placeholder env vars. | |
| if grep -rnE --exclude-dir=.git --exclude-dir=target --exclude-dir=test_snapshots --exclude=DEPLOYMENT.md '\bC[A-Z2-7]{55}\b' .; then | |
| echo "::error::Found what looks like a Stellar contract address committed to the repo. Contract addresses must never be committed, since a deployed address can't be tied to a specific source commit without an independent rebuild. Use placeholder env vars in examples instead (see CONTRIBUTING.md)." | |
| exit 1 | |
| fi | |
| - name: Verify workspace membership | |
| run: | | |
| # A crate that exists on disk but isn't in the root [workspace] | |
| # members list is invisible to `cargo build/test/clippy --workspace`, | |
| # so CI can pass while never touching it (see #43). | |
| missing=0 | |
| for manifest in contracts/*/Cargo.toml tools/*/Cargo.toml; do | |
| dir=$(dirname "$manifest") | |
| if ! grep -qF "\"$dir\"" Cargo.toml; then | |
| echo "::error::$dir has a Cargo.toml but is not listed in the root Cargo.toml's [workspace] members. Add it there before this crate can be built, tested, or linted by CI." | |
| missing=1 | |
| fi | |
| done | |
| exit $missing | |
| # ubuntu-latest ships rustup preinstalled. Any rustup/cargo/rustc | |
| # invocation below auto-installs whatever rust-toolchain.toml pins, | |
| # so the version lives in exactly one place instead of being | |
| # duplicated into this workflow. | |
| - name: Install Rust | |
| run: | | |
| rustup target add wasm32v1-none | |
| rustup component add rustfmt clippy | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Check formatting | |
| run: cargo fmt --check | |
| # scripts/*.sh doesn't cover the shared helpers the load tests source | |
| # from scripts/lib/, so that directory is listed explicitly; -x makes | |
| # shellcheck follow the `source` lines and check each script against | |
| # the helpers it actually gets, instead of reporting SC1091 and | |
| # analysing the two halves in isolation. | |
| - name: Lint shell scripts | |
| run: shellcheck -x scripts/*.sh scripts/lib/*.sh | |
| # demo-consumer imports tholos's compiled wasm at compile time | |
| # (contractimport!), so it must exist before anything below this | |
| # touches demo-consumer: clippy and test both compile it. | |
| - name: Build tholos wasm | |
| run: cargo build -p tholos --target wasm32v1-none --release --locked | |
| - name: Run clippy | |
| run: cargo clippy --workspace --all-targets --locked -- -D warnings | |
| - name: Run tests | |
| run: cargo test --workspace --locked | |
| # --lib: wasm32v1-none has no std, so tools/compute-commitment (a | |
| # plain host-side binary, not a contract) can't compile for this | |
| # target at all; only each crate's library (the actual deployable | |
| # contract) needs to. | |
| - name: Build contract wasm | |
| run: cargo build --workspace --lib --target wasm32v1-none --release --locked | |
| demo: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| cache-dependency-path: | | |
| packages/tholos-sdk/pnpm-lock.yaml | |
| demos/freelance-escrow/pnpm-lock.yaml | |
| # demos/freelance-escrow depends on packages/tholos-sdk as a local | |
| # file: dependency, which needs dist/ to already exist before this | |
| # job's own `pnpm install` can resolve it; see tholos-sdk's own | |
| # README for why (pnpm applies npm's pack-list filtering even to | |
| # local directory deps, and dist/ is gitignored). | |
| - name: Build tholos-sdk | |
| working-directory: packages/tholos-sdk | |
| run: | | |
| pnpm install --frozen-lockfile | |
| pnpm build | |
| - name: Install dependencies | |
| working-directory: demos/freelance-escrow | |
| run: pnpm install --frozen-lockfile | |
| - name: Lint | |
| working-directory: demos/freelance-escrow | |
| run: pnpm lint | |
| - name: Build | |
| working-directory: demos/freelance-escrow | |
| run: pnpm build | |
| sdk: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust | |
| run: rustup target add wasm32v1-none | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: sdk | |
| # stellar-cli pulls in libdbus-sys (dbus-1) and hidapi (libudev, for | |
| # hardware wallet support), neither preinstalled on ubuntu-latest. | |
| - name: Install system dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev libudev-dev pkg-config | |
| # Pinned to the version used to originally generate packages/tholos-sdk. | |
| # Bump deliberately, not incidentally, since a newer CLI could change | |
| # the generated output's shape. | |
| - name: Install Stellar CLI | |
| run: cargo install --locked stellar-cli --version 27.0.0 | |
| - name: Build tholos wasm | |
| run: cargo build -p tholos --target wasm32v1-none --release --locked | |
| - name: Regenerate TS bindings and check for drift | |
| run: | | |
| stellar contract bindings typescript \ | |
| --wasm target/wasm32v1-none/release/tholos.wasm \ | |
| --output-dir /tmp/tholos-sdk-regenerated \ | |
| --overwrite | |
| if ! diff -rq packages/tholos-sdk/src /tmp/tholos-sdk-regenerated/src; then | |
| echo "::error::packages/tholos-sdk/src is out of date with contracts/tholos's current public interface. Regenerate it (see packages/tholos-sdk/README.md) and commit the result." | |
| exit 1 | |
| fi | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| cache-dependency-path: packages/tholos-sdk/pnpm-lock.yaml | |
| - name: Install SDK package dependencies | |
| working-directory: packages/tholos-sdk | |
| run: pnpm install --frozen-lockfile | |
| - name: Build SDK package | |
| working-directory: packages/tholos-sdk | |
| run: pnpm build |