cardano-node.yaml

name: "Antithesis on cardano-node testnet"
env:
  # workflow_dispatch passes `inputs.test`; cron has no inputs so
  # falls through to the default. Without the `inputs.test` lookup
  # here, every manual dispatch silently ran against
  # cardano_node_master regardless of the -f test=... flag.
  TESTNET: ${{ inputs.test || 'cardano_node_master' }}
  REGISTRY: ghcr.io/cardano-foundation/cardano-node-antithesis
  EMAILS: 'antithesis@cardanofoundation.org'
  DURATION: ${{ inputs.duration || 3 }}
on:
  # can be dispatched manually
  workflow_dispatch:
     inputs:
       test:
        description: 'Test configuration to run (a directory in testnets)'
        required: true
        default: cardano_node_master
        type: string
       duration:
        description: 'Test duration (in hours)'
        required: false
        default: 3
        type: number
       no-faults:
        description: 'Run the test without injecting faults'
        required: false
        default: false
        type: boolean
  schedule:
    # run every 6 hours
    - cron:  '5 1,7,13,19 * * *'

jobs:
  run-cardano-node:
    runs-on: ubuntu-latest
    env:
      MOOG_GITHUB_PAT: ${{ secrets.MOOG_GITHUB_PAT }}
      MOOG_WALLET_FILE: wallet.json
      MOOG_MPFS_HOST: ${{ vars.MOOG_MPFS_HOST }}
      MOOG_TOKEN_ID: ${{ vars.MOOG_TOKEN_ID }}
      MOOG_PLATFORM: github
      MOOG_REQUESTER: cfhal

    timeout-minutes: 600

    # required permissions to be able to push to registry
    permissions:
      packages: write
      contents: read
      attestations: write
      id-token: write


    steps:
    - name: 🚧 Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: 📥 Checkout repository
      uses: actions/checkout@v6

    - name: 🔑 Login Docker Registry
      uses: docker/login-action@v3
      with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

    - name: Install moog
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        set -euo pipefail
        # Latest moog release. The portable Linux requester binary is the
        # statically-linked musl tarball (the old `*-linux64.tar.gz`
        # asset was dropped at the 0.5.x packaging change).
        TAG=$(gh release view -R cardano-foundation/moog --json tagName -q .tagName)
        echo "moog release: $TAG"
        gh release download "$TAG" -R cardano-foundation/moog \
          -p 'moog-*-x86_64-linux-musl.tar.gz' --clobber
        TARBALL=$(ls moog-*-x86_64-linux-musl.tar.gz | grep -vE 'moog-(agent|oracle)-' | head -1)
        echo "using $TARBALL"
        tar xzf "$TARBALL"
        sudo install -m 0755 moog /usr/local/bin/moog
        moog --version

    - name: Configure moog wallet
      run: printf '%s' "${{ secrets.MOOG_REQUESTER_WALLET }}" | base64 --decode > "$MOOG_WALLET_FILE"

    - name: Submit test
      id: request
      run: |
        set -euo pipefail
        COMMIT="${{ github.sha }}"
        TESTNET_DIR="testnets/$TESTNET"
        TRY=$(moog facts test-runs --whose "$MOOG_REQUESTER" | jq \
          --arg commit "$COMMIT" \
          --arg directory "$TESTNET_DIR" \
          --arg platform "$MOOG_PLATFORM" \
          --arg repository "$GITHUB_REPOSITORY" \
          --arg requester "$MOOG_REQUESTER" \
          'map(select(
            .key.type == "test-run"
            and .key.commitId == $commit
            and .key.directory == $directory
            and .key.platform == $platform
            and ((.key.repository.organization + "/" + .key.repository.repo) == $repository)
            and .key.requester == $requester
          )) | length')
        TRY=$((TRY + 1)) # start with try=1
        echo "TRY=$TRY for $TESTNET_DIR"
        if [ "${{ inputs.no-faults }}" = "true" ]; then
          render_args=(--no-faults)
        else
          render_args=()
        fi
        RESULT=$(moog requester create-test -d "$TESTNET_DIR" \
          -c "$COMMIT" \
          -r "$GITHUB_REPOSITORY" \
          --try "$TRY" \
          -t "$DURATION" \
          "${render_args[@]}")
        echo "$RESULT"

        # Passing -e and -r in separate jq calls ensures we both unwrap
        # the string quotes and fail if the json isn't as expected.
        ID=$(echo "$RESULT" | jq -e .value.testRunId | jq -r .)
        TXID=$(echo "$RESULT" | jq -e .txHash | jq -r .)
        echo "id=$ID" >> "$GITHUB_OUTPUT"
        echo "txHash=$TXID" >> "$GITHUB_OUTPUT"

    - name: Wait for results
      run: timeout $(((DURATION + 1) * 3600)) ./scripts/wait-for-test.sh "${{ steps.request.outputs.id }}"