hardfork-gitian-verify.yml

name: Hard Fork Gitian Verify

on:
  workflow_dispatch:
  push:
    branches:
      - fix/orchard-nu62-hardfork
  pull_request:
    branches:
      - master
      - fix/orchard-freeze-softfork

permissions:
  contents: read

jobs:
  native-tests:
    name: Native build and tests
    runs-on: ubuntu-22.04
    timeout-minutes: 360

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            autoconf \
            automake \
            bsdmainutils \
            build-essential \
            curl \
            git \
            libtool \
            pkg-config \
            python3 \
            python3-pip \
            python3-zmq \
            ruby

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.96.0

      - name: Cargo check
        run: cargo check --locked

      - name: Build depends
        run: make -C depends HOST=x86_64-pc-linux-gnu -j"$(nproc)"

      - name: Configure
        run: |
          ./autogen.sh
          CONFIG_SITE="$PWD/depends/x86_64-pc-linux-gnu/share/config.site" \
            ./configure --enable-werror

      - name: Build
        run: make -j"$(nproc)"

      - name: Run focused Orchard hard-fork gtests
        run: |
          if [ -x src/zcash-gtest ]; then
            src/zcash-gtest --gtest_filter='TransactionBuilder.TemporaryOrchardDisablingSoftFork:TransactionBuilder.OrchardProvingCircuitTracksNU6point2Activation:TransactionBuilder.OrchardNonCanonicalProofSizeRejectedFromNU6point2:TransactionBuilder.OrchardNonCanonicalProofSizeAllowedBeforeNU6point2:TransactionBuilder.OrchardPreNu6point2CircuitRejectedFromNU6point2:ChecktransactionTests.NU5EnforcesOrchardRulesOnShieldedCoinbase:ChecktransactionTests.CoinbaseRejectsPositiveSaplingValueBalance:Validation.BanOnPoolValueOutOfRange'
          else
            echo "src/zcash-gtest not found after build" >&2
            exit 1
          fi

      - name: Run focused Orchard hard-fork RPC test
        run: |
          mkdir -p "${{ runner.temp }}/junocash-rpc-bin"
          printf '%s\n' \
            '#!/usr/bin/env sh' \
            'exec "$GITHUB_WORKSPACE/src/junocashd" -regtest "$@"' \
            > "${{ runner.temp }}/junocash-rpc-bin/junocashd-regtest"
          chmod +x "${{ runner.temp }}/junocash-rpc-bin/junocashd-regtest"
          PYTHON_DEBUG=1 ZCASHD="${{ runner.temp }}/junocash-rpc-bin/junocashd-regtest" timeout 900 \
            qa/pull-tester/rpc-tests.py orchard_nu6_2.py --tmpdir="${{ runner.temp }}/orchard_nu6_2" --nocleanup

      - name: Run make check
        run: make check

      - name: Upload native test logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: native-test-logs
          path: |
            src/test-suite.log
            src/*.log
            src/test/*.log
            src/gtest/*.log
            src/wallet/gtest/*.log
            ${{ runner.temp }}/orchard_nu6_2/**
          if-no-files-found: ignore

  gitian-linux:
    name: Gitian Linux release build
    runs-on: ubuntu-22.04
    timeout-minutes: 720

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            apt-cacher-ng \
            autoconf \
            automake \
            build-essential \
            curl \
            git \
            libtool \
            pkg-config \
            python3 \
            ruby

      - name: Start apt-cacher-ng
        run: |
          sudo sed -i 's/^#\?BindAddress:.*/BindAddress: 0.0.0.0/' /etc/apt-cacher-ng/acng.conf
          sudo systemctl restart apt-cacher-ng
          curl --fail --silent --show-error http://127.0.0.1:3142/acng-report.html >/dev/null

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.96.0

      - name: Show Docker environment
        run: |
          docker version
          docker info

      - name: Build Gitian Linux release
        run: ./zcutil/build-release.sh --linux -g --tag "$GITHUB_SHA" --jobs "$(nproc)"

      - name: Verify Gitian Linux artifact
        run: |
          shopt -s nullglob
          artifacts=(release/junocash-*-linux64.tar.gz)
          if [ "${#artifacts[@]}" -eq 0 ]; then
            echo "No Linux release archive produced by Gitian build" >&2
            find release -maxdepth 2 -type f -print 2>/dev/null || true
            exit 1
          fi
          printf 'Found Gitian Linux artifact: %s\n' "${artifacts[@]}"

      - name: Upload release artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gitian-linux-release
          path: |
            release/**
          if-no-files-found: warn

      - name: Collect Gitian diagnostic logs
        if: always()
        run: |
          mkdir -p gitian-diagnostics
          if [ -d ../gitian-builder/var ]; then
            cp -a ../gitian-builder/var gitian-diagnostics/
          fi
          if [ -f ../gitian-builder/build.log ]; then
            cp -a ../gitian-builder/build.log gitian-diagnostics/
          fi
          if [ -d ../gitian-builder/build/out ]; then
            mkdir -p gitian-diagnostics/build
            cp -a ../gitian-builder/build/out gitian-diagnostics/build/
          fi

      - name: Upload Gitian diagnostic logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gitian-diagnostics
          path: |
            gitian-diagnostics/**
          if-no-files-found: ignore