ci.yml

name: ci
# PR comparison marker – no functional impact

on:
  push:
    branches: [master, main, v2-rebuild]
  pull_request:
    branches: [master, main, v2-rebuild]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  typescript:
    name: TypeScript build + tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 8.15.0

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile=false

      - name: Test repository scripts
        run: pnpm test:scripts

      - name: Validate deployment JSON
        run: pnpm validate:deployments

      - name: Build SDK
        run: pnpm --filter @oversync/sdk build

      - name: Typecheck — SDK
        run: pnpm --filter @oversync/sdk exec tsc --noEmit

      - name: Typecheck — coordinator
        run: pnpm --filter @oversync/coordinator exec tsc --noEmit

      - name: Typecheck — resolver
        run: pnpm --filter @oversync/resolver exec tsc --noEmit

      - name: Typecheck — frontend
        run: pnpm --filter @oversync/frontend exec tsc --noEmit

      - name: Typecheck — relayer
        run: pnpm --filter @oversync/relayer exec tsc --noEmit

      - name: Lint — relayer
        run: pnpm --filter @oversync/relayer lint

      - name: Test — SDK
        run: pnpm --filter @oversync/sdk test

      - name: Test — frontend
        run: pnpm --filter @oversync/frontend test

      - name: Test — coordinator
        run: pnpm --filter @oversync/coordinator test

      - name: Test — resolver
        run: pnpm --filter @oversync/resolver test

      - name: Test — cross-chain authorization parity
        run: pnpm --filter @oversync/e2e test

      - name: Compile contracts
        run: pnpm --filter @oversync/contracts compile

      - name: Test — contracts (Hardhat)
        run: pnpm --filter @oversync/contracts exec hardhat test test/v2/HTLCEscrow.test.ts test/v2/ResolverRegistry.test.ts

      - name: Check evidence links (advisory)
        run: node scripts/check-evidence-links.mjs
        continue-on-error: true

      - name: Generate CI evidence summary
        env:
          JOB_STATUS: ${{ job.status }}
        run: node scripts/generate-ci-evidence.mjs

      - name: Upload CI evidence summary
        uses: actions/upload-artifact@v4
        with:
          name: ci-evidence-summary-typescript
          path: evidence-summary.md

  soroban:
    name: Soroban contracts
    runs-on: ubuntu-latest
    timeout-minutes: 30
    defaults:
      run:
        working-directory: soroban
    steps:
      - uses: actions/checkout@v4

      # Pinned deliberately. `@stable` resolves to a toolchain that rejects
      # ethnum 1.5.0 (pinned by stellar-cli 22.8.1's own lockfile, which we keep
      # via --locked): rustc nightly-2026-04-18 grew `TryFromIntError` from 0 to
      # 1 byte, so ethnum's `transmute(())` fails with E0512.
      #
      # The floor is 1.84, the first release with the `wasm32v1-none` target
      # that `stellar contract build` requires. Staying below ~1.97 keeps the
      # `TryFromIntError` layout ethnum expects.
      #
      # To move off this pin: upgrade stellar-cli past 22.8.1 to a release whose
      # lockfile uses ethnum >= 1.5.3, then return to `@stable`.
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: 1.86.0
          targets: wasm32-unknown-unknown,wasm32v1-none

      # Install the released binary instead of `cargo install`: stellar-cli
      # 22.8.1 depends on ethnum 1.5.0, which no longer compiles under current
      # stable Rust (E0512 transmute size check).
      - name: Install Stellar CLI
        run: |
          cargo install --locked stellar-cli --version 22.8.1
          stellar --version

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            soroban/target
          key: soroban-${{ runner.os }}-${{ hashFiles('soroban/Cargo.toml', 'soroban/contracts/**/Cargo.toml') }}

      - name: Install cargo-binstall
        uses: cargo-bins/cargo-binstall@main

      - name: Install Stellar CLI
        run: |
          cargo binstall -y stellar-cli --version 22.8.1
          stellar --version
      - name: Who needs ed25519-dalek 3.0.0
        run: cargo tree -i ed25519-dalek@3.0.0
        continue-on-error: true

      - name: Pin ed25519-dalek to 2.x
        run: cargo update -p ed25519-dalek@3.0.0 --precise 2.2.0

      - name: Build WASM
        run: stellar contract build

      # soroban-env-host 22.1.3 declares ed25519-dalek as an open `>=2.0.0` range,
      # which Cargo now resolves to 3.x; that release's rand_core 0.9 traits are
      # incompatible with the rand_chacha 0.3 ChaCha20Rng the crate's testutils
      # pass to SigningKey::generate, so the test build fails. Cargo does not
      # unify an open range with a manifest pin, so force the 2.x line in the
      # resolved graph. soroban/Cargo.lock is gitignored, hence generating it
      # first.
      - name: Pin ed25519-dalek to the 2.x line
        run: |
          cargo generate-lockfile
          cargo update -p ed25519-dalek@3.0.0 --precise 2.2.0

      - name: Run unit tests
        run: cargo test --release

      - name: Generate CI evidence summary (Soroban)
        env:
          JOB_STATUS: ${{ job.status }}
        run: node ${{ github.workspace }}/scripts/generate-ci-evidence.mjs

      - name: Upload CI evidence summary (Soroban)
        uses: actions/upload-artifact@v4
        with:
          name: ci-evidence-summary-soroban
          path: evidence-summary.md