ci.yml

name: CI

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  workflow_dispatch:
  pull_request:
  merge_group:
  push:
    branches:
      - main
  # Primes the new week's Rust cache on main right after the weekly `prefix-key` rolls
  # over at UTC Sun 00:00. Without this, the first PR on Sunday pays a full cold-build
  # cost and (since `save-if` requires main) doesn't save, so every subsequent Sunday
  # PR keeps cold-building until something merges to main. See near/mpc#2828.
  schedule:
    - cron: "5 0 * * 0"

jobs:
  # Downstream gates use `if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}`.
  # `!cancelled()` overrides GitHub's implicit `success()` on `needs`, so a
  # failed detector doesn't silently skip dependents (skipped checks satisfy
  # required-check rules and could let a PR merge with zero CI signal). Only
  # an explicit `'false'` (docs-only PR) skips the job. Unlike `always()`, it
  # stops evaluating to true once the run is cancelled, so a new push cancels
  # the in-progress run instead of queueing behind it.
  changes:
    name: "Detect non-docs changes"
    permissions:
      contents: read
      pull-requests: read
    uses: ./.github/workflows/changes.yml

  docker-tee-build:
    name: "Build MPC Node TEE Docker image"
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
    runs-on: warp-ubuntu-2604-x64-16x
    timeout-minutes: 60
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Allow unprivileged user namespaces (needed by repro-env)
        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Install repro-env
        run: |
          sudo apt-get update
          sudo apt-get install -y repro-env

      - name: Build MPC Node binary and image
        run: |
          export NODE_IMAGE_NAME=test_image_tag_ci
          ./deployment/build-images.sh --node

      - name: Check mpc-node docker image can initialize and start
        run: |
          export NODE_IMAGE_NAME=test_image_tag_ci
          ./scripts/check-mpc-node-docker-starts.sh

  docker-rust-launcher-build-and-verify:
    name: "Build Rust Launcher Docker image and verify"
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
    runs-on: warp-ubuntu-2604-x64-8x
    timeout-minutes: 60
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Allow unprivileged user namespaces (needed by repro-env)
        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y liblzma-dev repro-env

      - name: Build Rust launcher docker image
        shell: bash
        run: |
          ./deployment/build-images.sh --rust-launcher

      - name: Run Rust launcher non-TEE runtime check
        shell: bash
        run: |
          ./scripts/check-mpc-node-docker-starts.sh --rust-launcher

  mpc-unittests:
    name: "Cargo test: ${{ matrix.group }}"
    needs: changes
    # Start (unless the run is cancelled) so GitHub expands the matrix and
    # registers each check name ("Cargo test: node", etc.).
    # Skipping at the job level only registers unexpanded template name and
    # required checks will be stuck.
    if: ${{ !cancelled() }}
    runs-on: ${{ matrix.runner || 'warp-ubuntu-2604-x64-16x' }}
    timeout-minutes: 60
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - group: "node"
            nextest-args: "-p mpc-node"
          - group: "contract"
            nextest-args: "--profile=ci-contract -p mpc-contract"
            extra-tools: true
            runner: warp-ubuntu-2604-x64-32x
          - group: "other"
            nextest-args: "--profile=ci-other"
            extra-tools: true

    steps:
      - name: Checkout repository
        if: needs.changes.outputs.code_changed != 'false'
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Install Nix
        if: needs.changes.outputs.code_changed != 'false'
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

      - name: Restore /nix from cache
        id: nix-cache
        if: needs.changes.outputs.code_changed != 'false'
        uses: ./.github/actions/restore-nix-cache

      - run: echo "WEEK=$(date -u +%Y-%U)" >> "$GITHUB_ENV"
        if: needs.changes.outputs.code_changed != 'false'
      - name: Cache Rust dependencies
        if: needs.changes.outputs.code_changed != 'false'
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-provider: "warpbuild"
          prefix-key: v1-rust-tests-${{ matrix.group }}-week-${{ env.WEEK }}-nix-${{ steps.nix-cache.outputs.cache-key-hash }}

      - name: Run cargo-nextest
        if: needs.changes.outputs.code_changed != 'false'
        run: nix develop --command cargo nextest run --cargo-profile=test-release --all-features --locked ${{ matrix.nextest-args }}

  mpc-contract-reproducible-build:
    name: "MPC contract reproducible build"
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
    runs-on: warp-ubuntu-2604-x64-16x
    timeout-minutes: 60
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

      # only save nix cache in this single job to avoid duplicate cache saves from other jobs
      - name: Restore /nix from cache
        uses: ./.github/actions/restore-nix-cache
        with:
          save: ${{ github.ref == 'refs/heads/main' }}

      # Reproducible build that carries NEP-330 metadata; this is what the
      # release artifact uses and what sourcescan.io / nearblocks replay.
      - name: Build mpc-contract (reproducible, cargo-near)
        run: nix develop --command cargo near build reproducible-wasm --manifest-path crates/contract/Cargo.toml

      - name: Check contract WASM size
        run: nix develop --command bash scripts/check-contract-wasm-size.sh target/near/mpc_contract/mpc_contract.wasm

  # Independent reproducible path: the Nix derivation produces the contract WASM
  # without a third-party Docker image. Kept exercised alongside the cargo-near
  # build; see docs/reproducible-builds.md.
  nix-build-mpc-contract:
    name: "Nix build mpc-contract"
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
    runs-on: warp-ubuntu-2604-x64-16x
    timeout-minutes: 60
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

      - name: Restore /nix from cache
        uses: ./.github/actions/restore-nix-cache

      - name: Build mpc-contract (Nix)
        run: nix build -L .#mpc-contract

  nix-build-mpc-node:
    name: "Nix build mpc-node"
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
    permissions:
      contents: read
    uses: ./.github/workflows/nix-build-mpc-node.yml

  fast-ci-checks:
    name: "Fast CI checks"
    runs-on: warp-ubuntu-2604-x64-8x
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

      - name: Restore /nix from cache
        id: nix-cache
        uses: ./.github/actions/restore-nix-cache

      - run: echo "WEEK=$(date -u +%Y-%U)" >> "$GITHUB_ENV"
      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-provider: "warpbuild"
          prefix-key: v1-rust-week-${{ env.WEEK }}-nix-${{ steps.nix-cache.outputs.cache-key-hash }}

      - name: Run cargo-make fast checks
        run: nix develop --command cargo make check-all-fast

  mpc-e2e-tests:
    name: "MPC E2E tests"
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
    runs-on: warp-ubuntu-2604-x64-32x
    timeout-minutes: 60
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

      - name: Restore /nix from cache
        id: nix-cache
        uses: ./.github/actions/restore-nix-cache

      - run: echo "WEEK=$(date -u +%Y-%U)" >> "$GITHUB_ENV"
      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-provider: "warpbuild"
          prefix-key: v1-rust-e2e-week-${{ env.WEEK }}-nix-${{ steps.nix-cache.outputs.cache-key-hash }}

      - name: Build mpc-node
        run: nix develop --command cargo make build-mpc-node-network-hardship-simulation

      # Both build paths emit target/near/mpc_contract/mpc_contract.wasm, which
      # MPC_CONTRACT_WASM points at. On main we exercise the fully reproducible
      # (docker) build; on PRs the faster non-reproducible cargo-near build.
      - name: Build mpc-contract
        if: github.ref != 'refs/heads/main'
        run: nix develop --command cargo make build-mpc-contract-optimized

      - name: Build mpc-contract reproducibly
        if: github.ref == 'refs/heads/main'
        run: nix develop --command cargo near build reproducible-wasm --manifest-path crates/contract/Cargo.toml

      - name: Build tee-verifier
        run: nix develop --command cargo make build-tee-verifier-optimized

      - name: Build test-parallel-contract
        run: nix develop --command cargo make build-test-parallel-contract-optimized

      - name: Build backup-cli
        run: nix develop --command cargo build -p backup-cli --release --locked

      - name: Run E2E tests
        run: nix develop --command cargo make e2e-tests-skip-build
        env:
          RUST_LOG: info,e2e_tests=debug

  ci-extra:
    name: "Extra CI checks"
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
    runs-on: warp-ubuntu-2604-x64-2x
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

      - name: Restore /nix from cache
        uses: ./.github/actions/restore-nix-cache

      - name: Run cargo-make extra checks
        run: nix develop --command cargo make check-extra

  check-todo-closed-issues:
    name: "Check TODOs for issues closed by this PR"
    if: github.event_name == 'pull_request'
    runs-on: warp-ubuntu-2604-x64-2x
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Check TODOs for issues closed by this PR
        run: bash .github/scripts/check-todo-closed-issues.sh
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}