ci.yml

name: Rust CI

on:
  push:
    branches: [main]
    paths:
      - 'docs/**'
      - 'rust/**'
      - 'scripts/ci/**'
      - 'tests/network/01-ping-node/**'
      - 'tests/network/02-run-devnet1/**'
      - 'tests/network/05-mining/**'
      - 'tests/network/observer-catchup/**'
      - 'tests/network/test-lib.sh'
      - '.github/workflows/ci.yml'
  pull_request:
    branches: [main]
    paths:
      - 'docs/**'
      - 'rust/**'
      - 'scripts/ci/**'
      - 'tests/network/01-ping-node/**'
      - 'tests/network/02-run-devnet1/**'
      - 'tests/network/05-mining/**'
      - 'tests/network/observer-catchup/**'
      - 'tests/network/test-lib.sh'
      - '.github/workflows/ci.yml'
  # The release workflow runs the whole of CI on the commit it builds.
  workflow_call:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_HTTP_MULTIPLEXING: "false"
  CARGO_NET_RETRY: "10"
  RUSTFLAGS: "-D warnings"

jobs:
  keys:
    name: No live-network keys
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Refuse private keys a live network trusts
        run: python3 scripts/ci/check-no-live-keys.py

  check:
    name: Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.94.1

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-registry-
            
      - name: Cache cargo build
        uses: actions/cache@v5
        with:
          path: rust/target
          key: ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-build-
      
      - name: Install system dependencies
        timeout-minutes: 40
        run: |
          sudo sed -i 's|http://azure.archive.ubuntu.com/ubuntu|https://archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true
          grep -ril 'packages.microsoft.com' /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null | xargs -r sudo sed -i 's/^\([^#].*\)$/# disabled for CI: \1/'
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 update
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 install -y cmake clang libssl-dev pkg-config
          
      - name: Cargo check
        working-directory: rust
        run: cargo check --all

      - name: Cargo check tests and examples
        working-directory: rust
        run: cargo check --all --tests --examples

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.94.1

      - name: Free runner disk space
        run: |
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf /usr/local/lib/android
          sudo rm -rf /opt/hostedtoolcache/CodeQL
        
      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-registry-
            
      - name: Cache cargo build
        uses: actions/cache@v5
        with:
          path: rust/target
          key: ${{ runner.os }}-cargo-test-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-test-
      
      - name: Install system dependencies
        timeout-minutes: 40
        run: |
          sudo sed -i 's|http://azure.archive.ubuntu.com/ubuntu|https://archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true
          grep -ril 'packages.microsoft.com' /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null | xargs -r sudo sed -i 's/^\([^#].*\)$/# disabled for CI: \1/'
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 update
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 install -y cmake clang libssl-dev pkg-config lsof
          
      - name: Run tests
        working-directory: rust
        # Miner chain tests use fast SHA-256 fixtures; explicit RandomX coverage remains.
        run: cargo test --all

      - name: Build modal for network smoke test
        working-directory: rust
        run: cargo build -p modal

      - name: Boot and ping two local nodes
        working-directory: tests/network/01-ping-node
        timeout-minutes: 5
        run: |
          export PATH="$GITHUB_WORKSPACE/rust/target/debug:$PATH"
          bash ./test.sh

      - name: Boot and certify a local sequencer round
        working-directory: tests/network/02-run-devnet1
        timeout-minutes: 5
        run: |
          export PATH="$GITHUB_WORKSPACE/rust/target/debug:$PATH"
          bash ./test.sh

      - name: Mine and persist a local block
        working-directory: tests/network/05-mining
        timeout-minutes: 6
        run: |
          export PATH="$GITHUB_WORKSPACE/rust/target/debug:$PATH"
          bash ./test.sh

      - name: Catch up an observer and verify explorer balances
        working-directory: tests/network/observer-catchup
        timeout-minutes: 6
        run: |
          export PATH="$GITHUB_WORKSPACE/rust/target/debug:$PATH"
          bash ./test.sh

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.94.1
          components: clippy
          
      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-registry-
            
      - name: Cache cargo build
        uses: actions/cache@v5
        with:
          path: rust/target
          key: ${{ runner.os }}-cargo-clippy-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-clippy-
      
      - name: Install system dependencies
        timeout-minutes: 40
        run: |
          sudo sed -i 's|http://azure.archive.ubuntu.com/ubuntu|https://archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true
          grep -ril 'packages.microsoft.com' /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null | xargs -r sudo sed -i 's/^\([^#].*\)$/# disabled for CI: \1/'
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 update
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 install -y cmake clang libssl-dev pkg-config
          
      - name: Run Clippy
        working-directory: rust
        run: cargo clippy --all -- -D warnings -A clippy::too_many_arguments

  build-release:
    name: Build (Release Mode)
    runs-on: ubuntu-latest
    # Only run on main to verify release compilation - does NOT publish anything
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v5
      
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.94.1
        
      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-registry-
            
      - name: Cache cargo release build
        uses: actions/cache@v5
        with:
          path: rust/target
          key: ${{ runner.os }}-cargo-release-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-release-
      
      - name: Install system dependencies
        timeout-minutes: 40
        run: |
          sudo sed -i 's|http://azure.archive.ubuntu.com/ubuntu|https://archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true
          grep -ril 'packages.microsoft.com' /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null | xargs -r sudo sed -i 's/^\([^#].*\)$/# disabled for CI: \1/'
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 update
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 install -y cmake clang libssl-dev pkg-config
          
      - name: Verify release build compiles
        working-directory: rust
        run: cargo build --release