ci.yml

name: CI Pipeline

on:
  push:
    branches:
      - main
      - develop
      - m3-implementation
      - 'release/**'
  pull_request:
    branches:
      - main
      - develop
      - m3-implementation
  workflow_dispatch:
    inputs:
      backend:
        description: 'Backend to test (zaino | lwd | both)'
        required: false
        default: 'both'
      upload_artifacts:
        description: 'Artifact upload policy (always | on-failure | never)'
        required: false
        default: 'on-failure'

permissions:
  contents: read
  packages: write

jobs:
  # ============================================================
  # JOB 1: Build and Push Docker Images (matrix)
  # ============================================================
  build-and-push:
    name: "Build Image – ${{ matrix.service }} (${{ matrix.platform }})"
    strategy:
      fail-fast: false
      matrix:
        service: [zebrad, zebra-sync, lightwalletd, zaino, zingo, zeckit-faucet]
        platform: [amd64, arm64]
        include:
          - platform: amd64
            runner: ubuntu-latest
            os_arch: linux/amd64
          - platform: arm64
            runner: ubuntu-24.04-arm
            os_arch: linux/arm64
          - service: zeckit-faucet
            context: .
            dockerfile: ./zeckit-faucet/Dockerfile
          - service: zebrad
            context: ./docker/zebra
          - service: zebra-sync
            context: ./docker/zebra
          - service: lightwalletd
            context: ./docker/lightwalletd
          - service: zaino
            context: ./docker/zaino
          - service: zingo
            context: ./docker/zingo

    runs-on: ${{ matrix.runner }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Lowercase repo
        id: repo
        shell: bash
        run: echo "name=${GITHUB_REPOSITORY,,}" >> $GITHUB_OUTPUT

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile || format('{0}/Dockerfile', matrix.context) }}
          platforms: ${{ matrix.os_arch }}
          outputs: type=image,name=ghcr.io/${{ steps.repo.outputs.name }}/${{ matrix.service }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=${{ matrix.service }}-${{ matrix.platform }}
          cache-to: type=gha,mode=max,scope=${{ matrix.service }}-${{ matrix.platform }}

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ matrix.service }}-${{ matrix.platform }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # ============================================================
  # JOB 2: Merge Manifests and Tag as Latest
  # ============================================================
  merge:
    name: "Merge Manifests – ${{ matrix.service }}"
    runs-on: ubuntu-latest
    needs: build-and-push
    if: always() && !cancelled()
    strategy:
      matrix:
        service: [zebrad, zebra-sync, lightwalletd, zaino, zingo, zeckit-faucet]
    steps:
      - name: Download digests
        id: download
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-${{ matrix.service }}-*
          merge-multiple: true

      - name: Set up Docker Buildx
        if: steps.download.outcome == 'success'
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        if: steps.download.outcome == 'success'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Lowercase repo
        if: steps.download.outcome == 'success'
        id: repo
        shell: bash
        run: echo "name=${GITHUB_REPOSITORY,,}" >> $GITHUB_OUTPUT

      - name: Create manifest list and push
        if: steps.download.outcome == 'success'
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< '{"tags":["ghcr.io/${{ steps.repo.outputs.name }}/${{ matrix.service }}:latest"]}') \
            $(printf 'ghcr.io/${{ steps.repo.outputs.name }}/${{ matrix.service }}@sha256:%s ' *)

      - name: Inspect image
        if: steps.download.outcome == 'success'
        run: |
          docker buildx imagetools inspect ghcr.io/${{ steps.repo.outputs.name }}/${{ matrix.service }}:latest

  # ============================================================
  # JOB 3: E2E Test Suite (depends on merge)
  # ============================================================
  e2e-tests:
    name: "E2E Test Suite – ${{ matrix.os }}"
    needs: merge
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    
    timeout-minutes: 120
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        
      - name: Setup Docker (macOS only)
        if: runner.os == 'macOS' && false # Temporarily disabled as GH ARM runners lack nested virtualization
        uses: douglascamata/setup-docker-macos-action@v1-alpha
      
      - name: Run Unit Tests
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  Running Unit Tests"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          cargo test --workspace --exclude zeckit-e2e
          echo "✓ Unit tests passed"
          echo ""
      
      - name: Check environment
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  Environment Check"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          if command -v docker >/dev/null 2>&1; then
            docker --version
            docker compose version
          else
            echo "Docker not available on this runner"
          fi
          rustc --version
          cargo --version
          echo ""
      
      - name: Clean up previous runs
        if: runner.os != 'macOS'
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  Cleaning Up Previous Runs"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          
          # Stop containers
          echo "Stopping containers..."
          docker compose down 2>/dev/null || true
          
          # Remove volumes to clear stale data (names match docker-compose.yml volumes section)
          echo "Removing stale volumes..."
          docker volume rm zeckit_zebra-miner-data 2>/dev/null || true
          docker volume rm zeckit_zebra-sync-data 2>/dev/null || true
          docker volume rm zeckit_zaino-data 2>/dev/null || true
          docker volume rm zeckit_lightwalletd-data 2>/dev/null || true
          docker volume rm zeckit_faucet-data 2>/dev/null || true
          docker volume rm zeckit_zingo-data 2>/dev/null || true
          
          # Remove orphaned containers
          docker compose down --remove-orphans 2>/dev/null || true

          
          echo "✓ Cleanup complete"
          echo ""
      
      - name: Build CLI binary
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  Building zeckit CLI"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          cargo build --release -p zeckit
          echo "✓ CLI binary built"
          ls -lh target/release/zeckit
          echo ""
      
      - name: Verify binary execution
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  Verifying Binary Execution"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          ./target/release/zeckit --help
          echo "✓ Binary is operational"
          echo ""
      
      - name: Start devnet with zaino backend
        if: runner.os != 'macOS'
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  Starting ZecKit Devnet"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo ""
          
          # Set IMAGE_PREFIX to pull pre-built images from GHCR
          REPO_LOWER=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          export IMAGE_PREFIX="ghcr.io/$REPO_LOWER"
          
          # Force pre-built image pulls from GHCR (prevents slow CI builds)
          export ZECKIT_ALLOW_BUILD=false
          export ZECKIT_SRC_PATH=${{ github.workspace }}

          # Use 20 minute timeout for image pulls + node initialization + 200-block mining
          ./target/release/zeckit up --backend zaino --timeout 20 --image-prefix "ghcr.io/$REPO_LOWER" &

          PID=$!
          
          SECONDS=0
          MAX_SECONDS=3600
          
          while kill -0 $PID 2>/dev/null && [ $SECONDS -lt $MAX_SECONDS ]; do
            sleep 30
            ELAPSED_MIN=$((SECONDS / 60))
            echo "⏱️  Starting devnet... ($ELAPSED_MIN minutes elapsed)"
          done
          
          if kill -0 $PID 2>/dev/null; then
            echo "✗ Devnet startup timed out after 1 hour"
            kill $PID 2>/dev/null || true
            echo ""
            echo "Container logs:"
            docker compose logs || true
            exit 1
          fi
          
          wait $PID
          EXIT_CODE=$?
          
          if [ $EXIT_CODE -ne 0 ]; then
            echo "✗ Devnet startup failed!"
            echo ""
            echo "Container logs:"
            docker compose logs || true
            exit 1
          fi
          
          echo ""
          echo "✓ Devnet started successfully"
          echo ""
      
      - name: Run smoke tests
        if: runner.os != 'macOS'
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  Running Smoke Tests"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo ""
          
          ./target/release/zeckit test
          
          TEST_EXIT_CODE=$?
          
          echo ""
          if [ $TEST_EXIT_CODE -eq 0 ]; then
            echo "✓ All smoke tests PASSED!"
          else
            echo "✗ Smoke tests FAILED!"
            exit 1
          fi
          echo ""
      
      - name: Check wallet balance
        if: always() && runner.os != 'macOS'
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  Wallet Status"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo ""
          
          docker compose exec -T faucet-zaino bash -c "echo -e 'balance\nquit' | zingo-cli --data-dir /var/zingo --server http://zaino:9067 --chain regtest --nosync" 2>/dev/null || echo "Could not retrieve balance"
          echo ""
      
      - name: Check faucet status
        if: always() && runner.os != 'macOS'
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  Faucet Status"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo ""
          
          curl -s http://127.0.0.1:8080/stats | jq . || echo "Could not get faucet stats"
          echo ""
      
      - name: Collect logs
        if: always() && runner.os != 'macOS'
        run: |
          echo "Collecting logs for artifact..."
          mkdir -p logs
          
          docker compose logs zebra-miner > logs/zebra-miner.log 2>&1 || true
          docker compose logs zebra-sync > logs/zebra-sync.log 2>&1 || true
          docker compose logs zaino > logs/zaino.log 2>&1 || true
          docker compose logs faucet-zaino > logs/faucet.log 2>&1 || true
          docker ps -a > logs/containers.log 2>&1 || true
          docker network ls > logs/networks.log 2>&1 || true
          
          echo "✓ Logs collected"
      
      - name: Upload logs on failure
        if: failure() && runner.os != 'macOS'
        uses: actions/upload-artifact@v4
        with:
          name: e2e-test-logs-${{ github.run_number }}
          path: logs/
          retention-days: 7
      
      - name: Cleanup
        if: always() && runner.os != 'macOS'
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  Cleanup"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo ""
          
          echo "Stopping containers (keeping images for next run)..."
          docker compose down --remove-orphans 2>/dev/null || true
          
          echo "✓ Cleanup complete"
          echo ""
      
      - name: Test summary
        if: always()
        run: |
          echo ""
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "  E2E Test Execution Summary"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo ""
          
          if [ "${{ job.status }}" == "success" ]; then
            echo "✓ Status: ALL CHECKS PASSED ✓"
            echo ""
            echo "Completed tasks:"
            echo "  ✓ Environment checked"
            echo "  ✓ Unit tests passed"
            echo "  ✓ CLI binary built"
            echo "  ✓ Binary execution verified"
            if [ "${{ runner.os }}" != "macOS" ]; then
              echo "  ✓ Devnet started (Linux only)"
              echo "  ✓ Smoke tests passed (Linux only)"
              echo "  ✓ Wallet synced (Linux only)"
              echo "  ✓ Faucet operational (Linux only)"
            else
              echo "  - Note: Docker E2E skipped on macOS ARM runner"
            fi
            echo ""
            echo "The ZecKit devnet is working correctly!"
          else
            echo "✗ Status: TESTS FAILED ✗"
            echo ""
            echo "Check the logs above for details"
            echo "Artifact logs: e2e-test-logs-${{ github.run_number }}"
          fi
          
          echo ""
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo ""

  # ============================================================
  # JOB 4: Build backend matrix for composite test
  # ============================================================
  set-matrix:
    name: Set test matrix
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.matrix.outputs.matrix }}
    steps:
      - name: Build backend matrix
        id: matrix
        shell: bash
        run: |
          requested="${{ github.event.inputs.backend }}"

          if [[ "$requested" == "zaino" ]]; then
            echo 'matrix={"backend":["zaino"]}' >> "$GITHUB_OUTPUT"
          elif [[ "$requested" == "lwd" ]]; then
            echo 'matrix={"backend":["lwd"]}' >> "$GITHUB_OUTPUT"
          else
            # Default: both backends
            echo 'matrix={"backend":["zaino","lwd"]}' >> "$GITHUB_OUTPUT"
          fi

  # ============================================================
  # JOB 5: Composite Action E2E Self-Test (depends on merge)
  # ============================================================
  composite-action-test:
    name: "Composite Action – ${{ matrix.backend }}"
    needs: [merge, set-matrix]
    runs-on: ubuntu-latest
    timeout-minutes: 45

    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.set-matrix.outputs.matrix) }}

    steps:
      - name: Checkout ZecKit
        uses: actions/checkout@v4

      - name: Compute image prefix
        id: image-prefix
        shell: bash
        run: echo "value=ghcr.io/${GITHUB_REPOSITORY,,}" >> $GITHUB_OUTPUT

      - name: Run ZecKit E2E composite action (self-test)
        id: e2e
        uses: ./
        with:
          backend:                 ${{ matrix.backend }}
          startup_timeout_minutes: '20'
          block_wait_seconds:      '75'
          allow_build:             'false'
          send_amount:             '0.05'
          send_memo:               'CI self-test – ${{ matrix.backend }}'
          upload_artifacts:        ${{ github.event.inputs.upload_artifacts || 'on-failure' }}
          ghcr_token:              ${{ secrets.GITHUB_TOKEN }}
          image_prefix:            ${{ steps.image-prefix.outputs.value }}

      - name: Print action outputs
        if: always()
        shell: bash
        run: |
          echo "unified_address       : ${{ steps.e2e.outputs.unified_address }}"
          echo "transparent_address   : ${{ steps.e2e.outputs.transparent_address }}"
          echo "shield_txid           : ${{ steps.e2e.outputs.shield_txid }}"
          echo "send_txid             : ${{ steps.e2e.outputs.send_txid }}"
          echo "final_orchard_balance : ${{ steps.e2e.outputs.final_orchard_balance }} ZEC"
          echo "block_height          : ${{ steps.e2e.outputs.block_height }}"
          echo "test_result           : ${{ steps.e2e.outputs.test_result }}"

      - name: Assert test_result is 'pass'
        shell: bash
        run: |
          result="${{ steps.e2e.outputs.test_result }}"
          if [[ "$result" != "pass" ]]; then
            echo "::error::Golden E2E returned test_result='$result' (expected 'pass')."
            exit 1
          fi
          echo "✓ test_result=pass"

  # ============================================================
  # JOB 6: CI Gate (aggregated status check)
  # ============================================================
  ci-gate:
    name: CI Gate
    needs:
      - e2e-tests
      - composite-action-test
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Check all jobs
        shell: bash
        run: |
          e2e="${{ needs.e2e-tests.result }}"
          composite="${{ needs.composite-action-test.result }}"

          echo "e2e-tests             : $e2e"
          echo "composite-action-test : $composite"

          if [[ "$e2e" != "success" ]] || [[ "$composite" != "success" ]]; then
            echo "::error::One or more test jobs failed."
            exit 1
          fi
          echo "✓ All CI jobs passed."