xebra/.github/workflows/ci.yml at main · drydocs/xebra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
name: CI

# Runs on every push and pull request. The point is not ceremony: this repo holds a Soroban
# contract live on mainnet and a web app that builds the transfers users sign, and the tests that
# guard both — the fee arithmetic, the CCTP message offsets, the bounds on Circle's `max_fee` — are
# worth nothing if nobody runs them before a change lands.

on:
  push:
    branches: ["**"]
  pull_request:

concurrency:
  # A superseded run tells you about code nobody is going to merge.
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  # Every service refuses to boot without a coherent network, and .env.production is git-ignored,
  # so CI supplies the values the way a hosting platform does. These are the pinned mainnet
  # constants from .env.production.example — all public, none of them secret, and
  # packages/network-config validates that they agree with each other.
  NETWORK: mainnet
  NEXT_PUBLIC_NETWORK: mainnet
  NEXT_PUBLIC_SOROBAN_RPC_URL: https://mainnet.sorobanrpc.com
  NEXT_PUBLIC_HORIZON_URL: https://horizon.stellar.org
  NEXT_PUBLIC_STELLAR_NETWORK_PASSPHRASE: "Public Global Stellar Network ; September 2015"
  NEXT_PUBLIC_STELLAR_USDC_SAC_ADDRESS: CCW67TSZV3SSS2HXMBQ5JFGCKJNXKZM7UQUWUZPUTHXSTZLEO7SJMI75
  NEXT_PUBLIC_STELLAR_TOKEN_MESSENGER_ADDRESS: CAE2G5Z77UP7GYPYGFOWFGW7C7J6I4YP2AFGSADRKQY62SYUFLPNFTXL
  NEXT_PUBLIC_SOLANA_CCTP_DOMAIN_ID: "5"
  NEXT_PUBLIC_SOLANA_RPC_URL: https://api.mainnet-beta.solana.com
  NEXT_PUBLIC_SOLANA_USDC_MINT: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v

jobs:
  javascript:
    name: lint, typecheck, test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 9.15.0

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - run: pnpm lint

      # Typecheck depends on the workspace packages' .d.ts, so they have to be built first.
      - run: pnpm build --filter='./packages/*'

      - name: Guard the env files
        # Blocks secret-shaped keys from anything tracked, and catches a dynamic `process.env[...]`
        # in client-bundled code — which is invisible in Node and undefined in the browser.
        # Runs after the packages are built so the coherence check can use the real validator on
        # the configuration this workflow supplies, instead of skipping itself.
        run: pnpm check:env

      # The contracts are workspace packages whose `build` and `test` shell out to forge and
      # cargo, and turbo pulls `build` in ahead of a typecheck. Neither toolchain exists on this
      # runner, and both contract suites have their own job below with the toolchain they need —
      # so this job stays on the JavaScript side of the workspace.
      - run: pnpm exec turbo run typecheck --filter='!./contracts/*'

      - run: pnpm exec turbo run test --filter='!./contracts/*'

  soroban:
    name: soroban contracts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            contracts/stellar-cctp-wrapper -> target
            contracts/stellar-cctp-wrapper-v2 -> target

      # v1 is the retired wrapper; v2 below inherits its suite. These tests cover the fee
      # arithmetic, the parameter ceilings a compromised admin cannot exceed, and the no-hang
      # paths where a failure must revert the whole transaction.
      - run: cargo test --manifest-path contracts/stellar-cctp-wrapper/Cargo.toml
      # v2 is the forwarding wrapper (docs/forwarding-wrapper.md), live on mainnet. It inherits v1's
      # suite and adds the tests that bound the one new risk: Circle charges the whole `max_fee`.
      - run: cargo test --manifest-path contracts/stellar-cctp-wrapper-v2/Cargo.toml
      - run: cargo test --manifest-path contracts/stellar-soroban/Cargo.toml

  evm:
    name: arc contracts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: foundry-rs/foundry-toolchain@v1

      # `contracts/*/lib/` is git-ignored and these are not submodules, so a checkout arrives
      # with no dependencies. Versions are pinned to what the contracts are developed against:
      # OpenZeppelin 5.7.0 and forge-std 1.16.2.
      - name: Install Foundry dependencies
        working-directory: contracts/arc-evm
        run: |
          forge install --no-git --shallow \
            OpenZeppelin/openzeppelin-contracts@v5.7.0 \
            foundry-rs/forge-std@v1.16.2

      - run: forge test
        working-directory: contracts/arc-evm