specs.yml

name: Specs

permissions: {}

on:
  push:
    branches: [main]
    paths:
      - "Cargo.lock"
      - "Cargo.toml"
      - "crates/**/Cargo.toml"
      - "tips/verify/**"
      - "crates/contracts/**"
      - "crates/precompiles/**"
      - "scripts/foundry-patch.sh"
      - ".github/workflows/specs.yml"
      - ".github/workflows/update-reth.yml"
  merge_group:
  pull_request:

env:
  CARGO_TERM_COLOR: always
  RUSTC_WRAPPER: "sccache"

jobs:
  check-specs-changes:
    name: Check specs changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      should_run: ${{ steps.filter.outputs.specs }}
      foundry_smoke: ${{ steps.filter.outputs.foundry_smoke }}
      release_only_sdk_crates: ${{ steps.release-only.outputs.release_only_sdk_crates }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
            specs:
              - 'tips/verify/**'
              - 'crates/contracts/**'
              - '!crates/contracts/CHANGELOG.md'
              - '!crates/contracts/Cargo.toml'
              - 'crates/precompiles/**'
              - '!crates/precompiles/CHANGELOG.md'
              - '!crates/precompiles/Cargo.toml'
              - '.github/workflows/specs.yml'
            foundry_smoke:
              - 'Cargo.lock'
              - 'Cargo.toml'
              - 'crates/**/Cargo.toml'
              - 'scripts/foundry-patch.sh'
              - '.github/workflows/specs.yml'
              - '.github/workflows/update-reth.yml'
      - name: Check release-only SDK crate changes
        id: release-only
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_REF: ${{ github.base_ref || github.event.merge_group.base_ref || 'main' }}
        run: |
          if [[ "$EVENT_NAME" == "push" ]]; then
            echo "release_only_sdk_crates=false" >> "$GITHUB_OUTPUT"
            echo "Not skipping Foundry precompile tests on push events."
            exit 0
          fi

          base_ref="${BASE_REF#refs/heads/}"
          changed_files="$(git diff --name-only "origin/${base_ref}...HEAD")"
          if [[ -z "$changed_files" ]]; then
            echo "release_only_sdk_crates=false" >> "$GITHUB_OUTPUT"
            echo "No changed files detected against origin/${base_ref}."
            exit 0
          fi

          # Release PRs may also add/delete consumed changelog fragments.
          allowed='^(Cargo\.lock|\.changelog/[^/]+\.md|crates/(alloy|chainspec|contracts|primitives|hardfork)/(Cargo\.toml|CHANGELOG\.md))$'
          if printf '%s\n' "$changed_files" | grep -Ev "$allowed" >/dev/null; then
            echo "release_only_sdk_crates=false" >> "$GITHUB_OUTPUT"
            echo "Found non-release-only SDK crate changes."
          else
            echo "release_only_sdk_crates=true" >> "$GITHUB_OUTPUT"
            echo "Skipping Foundry precompile tests: only SDK crate release metadata changed."
          fi

  foundry-resolver-smoke:
    name: Foundry Resolver Smoke
    needs: check-specs-changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Skip Foundry resolver smoke
        if: needs.check-specs-changes.outputs.foundry_smoke != 'true'
        run: |
          echo "Skipping Foundry resolver smoke: no dependency-sensitive files changed."

      - name: Checkout tempo
        if: needs.check-specs-changes.outputs.foundry_smoke == 'true'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          path: tempo
          persist-credentials: false

      - name: Checkout foundry
        if: needs.check-specs-changes.outputs.foundry_smoke == 'true'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: foundry-rs/foundry
          ref: master
          path: foundry
          persist-credentials: false

      - name: Setup Rust
        if: needs.check-specs-changes.outputs.foundry_smoke == 'true'
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable

      - name: Patch foundry to use checked-out tempo crates
        if: needs.check-specs-changes.outputs.foundry_smoke == 'true'
        env:
          RUSTC_WRAPPER: ""
        run: tempo/scripts/foundry-patch.sh "$GITHUB_WORKSPACE/tempo" "$GITHUB_WORKSPACE/foundry"

  check-precompiles:
    name: Check precompiles changes
    needs: check-specs-changes
    if: needs.check-specs-changes.outputs.should_run == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      coverage: ${{ steps.check.outputs.coverage }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Check for precompiles changes
        id: check
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_REF: ${{ github.base_ref }}
        run: |
          # Only run coverage on pull_request events when precompiles/contracts changed
          if [[ "$EVENT_NAME" != "pull_request" ]]; then
            echo "coverage=false" >> "$GITHUB_OUTPUT"
            echo "Skipping coverage: not a pull_request event (event: $EVENT_NAME)"
          elif git diff --name-only origin/"$BASE_REF"...HEAD \
            | grep -qE '^(crates/(precompiles|contracts)/|tips/verify/)' \
            && ! git diff --name-only origin/"$BASE_REF"...HEAD \
              | grep -vE '^(crates/(precompiles|contracts)/(Cargo\.toml|CHANGELOG\.md))$' \
              | grep -qE '^(crates/(precompiles|contracts)/|tips/verify/)'; then
            echo "coverage=false" >> "$GITHUB_OUTPUT"
            echo "Skipping coverage: only precompiles/contracts release metadata changed"
          elif git diff --name-only origin/"$BASE_REF"...HEAD | grep -qE '^(crates/(precompiles|contracts)/|tips/verify/)'; then
            echo "coverage=true" >> "$GITHUB_OUTPUT"
            echo "Running coverage: precompiles/contracts changed"
          else
            echo "coverage=false" >> "$GITHUB_OUTPUT"
            echo "Skipping coverage: no precompiles/contracts changes"
          fi

  build:
    name: Forge Build
    needs: check-specs-changes
    if: needs.check-specs-changes.outputs.should_run == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
        with:
          version: nightly

      - name: Run Forge build
        working-directory: tips/verify
        run: forge build --sizes

  abi-alignment-check:
    name: ABI Alignment Check
    needs: check-specs-changes
    if: needs.check-specs-changes.outputs.should_run == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable

      - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
        with:
          version: nightly

      - name: Build tempo-std interfaces
        working-directory: tips/verify/lib/tempo-std
        run: forge build --sizes

      - name: Run ABI alignment check
        run: cargo run -p tempo-xtask -- check-abi

  lint:
    name: Forge Fmt
    needs: check-specs-changes
    if: needs.check-specs-changes.outputs.should_run == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
        with:
          version: nightly

      - name: Run Forge fmt check
        working-directory: tips/verify
        run: forge fmt --check

  foundry-build:
    name: Build patched Forge
    needs: [check-specs-changes, check-precompiles]
    if: github.repository == 'tempoxyz/tempo' && needs.check-specs-changes.outputs.should_run == 'true' && needs.check-specs-changes.outputs.release_only_sdk_crates != 'true'
    runs-on: depot-ubuntu-latest-8
    timeout-minutes: 60
    permissions:
      contents: read
    steps:
      - name: Checkout tempo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          path: tempo
          persist-credentials: false

      - name: Checkout foundry
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: foundry-rs/foundry
          ref: master
          path: foundry
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable

      - uses: rui314/setup-mold@7e4f20ad28a2e8ca6fd0892ccf72e2abb706b9c3 # v1
      - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          workspaces: foundry

      - name: Install llvm-tools
        if: needs.check-precompiles.outputs.coverage == 'true'
        run: rustup component add llvm-tools-preview

      - name: Patch foundry to use checked-out tempo crates
        run: tempo/scripts/foundry-patch.sh "$GITHUB_WORKSPACE/tempo" "$GITHUB_WORKSPACE/foundry"

      # Build and run WITH coverage (only on PR when precompiles changed)
      - name: Build foundry forge with coverage instrumentation
        if: needs.check-precompiles.outputs.coverage == 'true'
        working-directory: foundry
        run: RUSTFLAGS="-C instrument-coverage" cargo build --bin forge --profile release --no-default-features

      # Build WITHOUT coverage on main/merge-group runs.
      - name: Build foundry forge
        if: needs.check-precompiles.outputs.coverage != 'true'
        working-directory: foundry
        run: cargo build --bin forge --profile release --no-default-features

      - name: Upload patched Forge
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: patched-forge
          path: foundry/target/release/forge
          retention-days: 1

  foundry-test:
    name: Forge Test (Rust Precompiles, ${{ matrix.profile }})
    needs: [check-specs-changes, check-precompiles, foundry-build]
    if: needs.foundry-build.result == 'success'
    strategy:
      fail-fast: false
      matrix:
        profile: [default, next]
    runs-on: depot-ubuntu-latest-8
    timeout-minutes: 60
    permissions:
      contents: read
    steps:
      - name: Checkout tempo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          path: tempo
          persist-credentials: false

      - name: Setup Rust
        if: needs.check-precompiles.outputs.coverage == 'true' && matrix.profile == 'default'
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          components: llvm-tools-preview

      - name: Download patched Forge
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: patched-forge
          path: foundry/target/release

      - name: Run Forge tests with Rust precompiles
        working-directory: tempo/tips/verify
        env:
          FOUNDRY_PROFILE: ${{ matrix.profile }}
          LLVM_PROFILE_FILE: ${{ needs.check-precompiles.outputs.coverage == 'true' && format('{0}/forge-coverage-%p.profraw', github.workspace) || '' }}
        run: |
          chmod +x ../../../foundry/target/release/forge
          echo "Running Forge tests with the ${{ matrix.profile }} profile"
          ../../../foundry/target/release/forge test -vvv

      - name: Generate coverage profdata
        if: needs.check-precompiles.outputs.coverage == 'true' && matrix.profile == 'default'
        run: |
          LLVM_BIN="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | grep host | cut -d' ' -f2)/bin"
          mkdir -p coverage
          "$LLVM_BIN/llvm-profdata" merge -sparse forge-coverage-*.profraw -o coverage/forge-test.profdata

      - name: Upload forge coverage artifacts
        if: needs.check-precompiles.outputs.coverage == 'true' && matrix.profile == 'default'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: forge-test-coverage
          path: |
            coverage/forge-test.profdata
            foundry/target/release/forge
          retention-days: 1

  specs-success:
    name: specs success
    runs-on: ubuntu-latest
    if: always()
    permissions: {}
    needs:
      - check-specs-changes
      - foundry-resolver-smoke
      - check-precompiles
      - build
      - abi-alignment-check
      - lint
      - foundry-build
      - foundry-test
    timeout-minutes: 5
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          allowed-skips: check-precompiles,build,abi-alignment-check,lint,foundry-build,foundry-test
          jobs: ${{ toJSON(needs) }}

  precompiles-coverage:
    name: Precompiles Coverage
    needs: [check-precompiles, specs-success]
    if: success() && needs.check-precompiles.outputs.coverage == 'true'
    uses: ./.github/workflows/coverage.yml
    with:
      commit_sha: ${{ github.event.pull_request.head.sha || github.sha }}
      pr_number: ${{ github.event.pull_request.number || 0 }}
    permissions:
      contents: read
      pull-requests: write
      actions: read