feat(cli): allow --ica check with non-deployed warp routes (#7919)

Author: ltyu

.changeset/cli-ica-check-non-deployed.md

@@ -0,0 +1,5 @@
+---
+'@hyperlane-xyz/cli': minor
+---
+
+Allowed `warp check --ica` to validate ICA ownership on chains before warp apply/extension by moving config filtering after the ICA check.

typescript/cli/src/commands/warp.ts

@@ -454,12 +454,8 @@ export const check: CommandModuleWithContext<
       warpCoreConfigPath: warp,
     });
 
-    ({ warpCoreConfig, warpDeployConfig } = filterWarpConfigsToMatchingChains(
-      warpDeployConfig,
-      warpCoreConfig,
-    ));
-
     // If --ica flag is set, run ICA owner check instead of the regular config check
+    // Note: ICA check uses full warpDeployConfig (not filtered) to support pre-deployed chains
     if (ica) {
       assert(origin, '--origin is required when using --ica');
 
@@ -474,6 +470,11 @@ export const check: CommandModuleWithContext<
       process.exit(0);
     }
 
+    ({ warpCoreConfig, warpDeployConfig } = filterWarpConfigsToMatchingChains(
+      warpDeployConfig,
+      warpCoreConfig,
+    ));
+
     const deployedRoutersAddresses =
       getRouterAddressesFromWarpCoreConfig(warpCoreConfig);
 

typescript/cli/src/tests/ethereum/warp/warp-check-ica.e2e-test.ts

@@ -14,6 +14,7 @@ import {
   type ChainMetadata,
   InterchainAccount,
   TokenType,
+  type WarpCoreConfig,
   type WarpRouteDeployConfig,
 } from '@hyperlane-xyz/sdk';
 import {
@@ -374,4 +375,48 @@ describe('hyperlane warp check --ica e2e tests', async function () {
     expect(output.text()).to.include('EXPECTED');
     expect(output.text()).to.include(normalizeAddressEvm(nonConfigOwnerIca));
   });
+
+  it('should work with non-deployed chains using deploy config and empty warpCoreConfig', async function () {
+    // Create a warp deploy config WITHOUT deploying it
+    // This tests that --ica works before warp apply/extension
+    const nonDeployedConfig: WarpRouteDeployConfig = {
+      [CHAIN_NAME_2]: {
+        type: TokenType.collateral,
+        token: token.address,
+        mailbox: chain2Addresses.mailbox,
+        owner: icaOwnerAddress,
+      },
+      [CHAIN_NAME_3]: {
+        type: TokenType.synthetic,
+        mailbox: chain3Addresses.mailbox,
+        owner: expectedIcaAddress,
+      },
+    };
+
+    const warpDeployPath = combinedWarpCoreConfigPath.replace(
+      '-config.yaml',
+      '-ica-non-deployed-deploy.yaml',
+    );
+    writeYamlOrJson(warpDeployPath, nonDeployedConfig);
+
+    // Create an empty warpCoreConfig (no deployed tokens yet)
+    const emptyWarpCoreConfig: WarpCoreConfig = { tokens: [] };
+    const warpCorePath = combinedWarpCoreConfigPath.replace(
+      '-config.yaml',
+      '-ica-non-deployed-core.yaml',
+    );
+    writeYamlOrJson(warpCorePath, emptyWarpCoreConfig);
+
+    // Run ICA check with both configs - the deploy config has chains, warpCoreConfig is empty
+    // This simulates checking ICA ownership before warp apply/extension
+    const output = await hyperlaneWarpCheckRaw({
+      warpDeployPath,
+      warpCoreConfigPath: warpCorePath,
+      ica: true,
+      origin: CHAIN_NAME_2,
+    }).nothrow();
+
+    expect(output.exitCode).to.equal(0);
+    expect(output.text()).to.include('No violations found');
+  });
 });