test.yml

name: CI

on:
  push:
    branches:
      - main
      - develop
      - "feature/**"
  pull_request:
  workflow_dispatch:

env:
  FOUNDRY_PROFILE: ci
  FOUNDRY_VERSION: v1.5.1

# npm ci requires package-lock.json in the repo root; keep it committed.

jobs:
  vault_agent_matrix_preflight:
    name: Vault-Agent Matrix Preflight
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup CI environment (cached)
        uses: ./.github/actions/setup-snx

      - name: Validate vault-agent matrix resolution
        env:
          EVENT_NAME: workflow_dispatch
          AGENT_INPUT: all
          NETWORK_INPUT: sepolia
        run: node scripts/vault-agent-matrix.mjs --strict-empty

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup CI environment (cached)
        uses: ./.github/actions/setup-snx
        with:
          submodules: "true"
          foundry: "true"
          forge-build-cache: "default"

      - name: Show Forge version
        run: forge --version

      - name: Build contracts
        run: forge build --sizes
        id: build

  test:
    name: Tests
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup CI environment (cached)
        uses: ./.github/actions/setup-snx
        with:
          submodules: "true"
          foundry: "true"
          # Shares the build job's forge cache key so `forge test` skips
          # recompilation when sources are unchanged.
          forge-build-cache: "default"

      - name: Run tests
        run: forge test -vvv
        id: tests

  coverage:
    name: Coverage
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v5

      - name: Setup CI environment (cached)
        uses: ./.github/actions/setup-snx
        with:
          submodules: "true"
          foundry: "true"
          # --ir-minimum produces different artifacts; isolate from the
          # default forge cache so neither evicts the other.
          forge-build-cache: "coverage"

      - name: Generate LCOV
        run: forge coverage --ir-minimum --report lcov --report-file lcov.info

      - name: Upload coverage to Codecov
        id: codecov_upload
        continue-on-error: true
        uses: codecov/codecov-action@v5
        with:
          files: lcov.info
          disable_search: true
          fail_ci_if_error: false
          use_oidc: true

      - name: Retry Codecov upload once on transient failure
        if: steps.codecov_upload.outcome == 'failure'
        continue-on-error: true
        uses: codecov/codecov-action@v5
        with:
          files: lcov.info
          disable_search: true
          fail_ci_if_error: false
          use_oidc: true

  web_unit:
    name: Web Unit Tests
    runs-on: ubuntu-latest
    steps:
      # No submodules: apps/web has no references to lib/forge-std or
      # lib/solady. ABIs are committed under apps/web/src/abi/.
      - uses: actions/checkout@v5

      - name: Setup CI environment (cached)
        uses: ./.github/actions/setup-snx

      - name: Run web Vitest suite
        run: npm --prefix apps/web run test

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup CI environment (cached)
        uses: ./.github/actions/setup-snx
        with:
          submodules: "true"
          foundry: "true"

      - name: Check Solidity formatting
        run: forge fmt --check

      - name: Lint web app
        run: npm run lint:web

  e2e:
    name: E2E (Web + Anvil)
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup CI environment (cached)
        uses: ./.github/actions/setup-snx
        with:
          submodules: "true"
          foundry: "true"
          forge-build-cache: "default"
          playwright: "true"

      - name: Start Anvil
        run: nohup anvil --host 127.0.0.1 --port 8545 > /tmp/anvil.log 2>&1 &

      - name: Deploy local contracts for E2E
        run: npm run deploy:local

      - name: Run E2E tests
        env:
          NEXT_PUBLIC_E2E_TEST_MODE: "1"
          E2E_RPC_URL: "http://127.0.0.1:8545"
          NEXT_PUBLIC_PRIVY_APP_ID: ${{ secrets.NEXT_PUBLIC_PRIVY_APP_ID }}
          PRIVY_TEST_EMAIL: ${{ secrets.PRIVY_TEST_EMAIL }}
          PRIVY_TEST_OTP: ${{ secrets.PRIVY_TEST_OTP }}
        run: npm run test:e2e:ci

      - name: Upload E2E artifacts
        if: failure()
        uses: actions/upload-artifact@v5
        with:
          name: web-e2e-artifacts
          path: |
            apps/web/playwright-report
            apps/web/test-results
            /tmp/anvil.log

  cross_chain_e2e:
    name: Cross-Chain E2E (Dual Anvil + Envio)
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup CI environment (cached)
        uses: ./.github/actions/setup-snx
        with:
          submodules: "true"
          foundry: "true"
          forge-build-cache: "default"
          playwright: "true"

      - name: Start Hub Anvil (port 8545, chain ID 31337)
        run: nohup anvil --host 127.0.0.1 --port 8545 --chain-id 31337 > /tmp/anvil-hub.log 2>&1 &

      - name: Start Spoke Anvil (port 8546, chain ID 31338)
        run: nohup anvil --host 127.0.0.1 --port 8546 --chain-id 31338 > /tmp/anvil-spoke.log 2>&1 &

      - name: Wait for Anvil nodes
        run: |
          for i in {1..30}; do
            curl -s http://127.0.0.1:8545 -X POST -H "Content-Type: application/json" --data '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' && break
            sleep 1
          done
          for i in {1..30}; do
            curl -s http://127.0.0.1:8546 -X POST -H "Content-Type: application/json" --data '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' && break
            sleep 1
          done

      - name: Deploy hub contracts
        run: CHAIN=local npm run deploy:local

      - name: Deploy spoke contracts
        run: CHAIN=local-spoke forge script script/DeploySpoke.s.sol:DeploySpoke --rpc-url http://127.0.0.1:8546 --broadcast || true

      - name: Generate Envio local config
        working-directory: apps/envio
        run: node scripts/gen-local-config.mjs

      # Envio has its own lockfile outside the root npm workspace. Cache its
      # node_modules directly so cron-style repeat runs skip `npm ci` here too.
      - name: Restore Envio node_modules cache
        id: cache-envio-modules
        uses: actions/cache@v4
        with:
          path: apps/envio/node_modules
          key: envio-node-modules-${{ runner.os }}-node22-${{ hashFiles('apps/envio/package-lock.json') }}

      - name: Install Envio dependencies (cache miss)
        if: steps.cache-envio-modules.outputs.cache-hit != 'true'
        working-directory: apps/envio
        run: npm ci

      - name: Start Envio dev server
        working-directory: apps/envio
        run: |
          npx envio dev --config config.local.generated.yaml > /tmp/envio.log 2>&1 &
          echo "Waiting for Envio..."
          for i in {1..60}; do
            curl -s http://127.0.0.1:8080/health && break
            sleep 2
          done

      - name: Run cross-chain E2E tests
        env:
          NEXT_PUBLIC_E2E_TEST_MODE: "1"
          NEXT_PUBLIC_ENVIO_URL: "http://127.0.0.1:8080/v1/graphql"
          E2E_HUB_RPC_URL: "http://127.0.0.1:8545"
          E2E_SPOKE_RPC_URL: "http://127.0.0.1:8546"
          E2E_HUB_CHAIN_ID: "31337"
          E2E_SPOKE_CHAIN_ID: "31338"
          E2E_ENVIO_URL: "http://127.0.0.1:8080/v1/graphql"
        run: npx --prefix apps/web playwright test --grep "cross-chain|Envio" || true

      - name: Upload E2E artifacts
        if: failure()
        uses: actions/upload-artifact@v5
        with:
          name: cross-chain-e2e-artifacts
          path: |
            apps/web/playwright-report
            apps/web/test-results
            /tmp/anvil-hub.log
            /tmp/anvil-spoke.log
            /tmp/envio.log

  keeper_tests:
    name: Keeper Service Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup CI environment (cached)
        uses: ./.github/actions/setup-snx

      - name: Run keeper tests
        run: npm test --prefix services/keeper

  push_worker:
    name: Push Worker Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup CI environment (cached)
        uses: ./.github/actions/setup-snx

      - name: Run push-worker tests
        run: npm run --prefix apps/push-worker test