anchor.yml

name: Anchor v2

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - main
  # These projects have no committed Cargo.lock (.gitignore ignores **/*/Cargo.lock),
  # so their transitive dependencies resolve fresh on every run and can break with
  # nobody touching the code. Dependabot does not cover them either: it is configured
  # for directory "/", which is the root workspace, and the per-project anchor/ workspaces are
  # what `anchor build` actually resolves. A weekly
  # build catches that drift on a cadence instead of at whatever unrelated pull request
  # happens to touch these files next. The analyze step already treats a scheduled run
  # as "build everything".
  schedule:
    - cron: '0 3 * * 1'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  MAX_JOBS: 64
  MIN_PROJECTS_PER_JOB: 4
  MIN_PROJECTS_FOR_MATRIX: 4
  # See https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      changed_projects: ${{ steps.analyze.outputs.changed_projects }}
      total_projects: ${{ steps.analyze.outputs.total_projects }}
      matrix: ${{ steps.matrix.outputs.matrix }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 2
      - uses: dorny/paths-filter@v4
        id: changes
        if: github.event_name == 'pull_request'
        with:
          list-files: shell
          filters: |
            anchor:
              - added|modified: '**/anchor/**'
            workflow:
              - added|modified: '.github/workflows/anchor.yml'
      - name: Analyze Changes
        id: analyze
        run: |
          # Generate ignore pattern, excluding comments
          ignore_pattern=$(grep -v '^#' .github/.ghaignore | grep -v '^$' | tr '\n' '|' | sed 's/|$//')
          echo "Ignore pattern: $ignore_pattern"

          # Single source of truth for "what is an Anchor v2 project": a directory
          # whose name is exactly "anchor". `find -type d -name anchor` gives us
          # that by construction — no substring matching, no path-segment trickery,
          # so siblings like "anchor-example/" or nested files such as
          # "anchor-example/app/pages/api/foo.ts" can never enter the build list.
          # It is also what keeps the two Anchor workflows disjoint: the Anchor v1
          # projects live in "anchor-v1" directories, built by
          # .github/workflows/anchor-v1.yml, and an exact-name match on "anchor"
          # never sees them.
          function get_projects() {
            # An empty .ghaignore makes ignore_pattern empty, and `grep -vE ""`
            # matches everything, silently emptying the project list - only
            # filter when there is actually a pattern.
            if [[ -n "$ignore_pattern" ]]; then
              find . -type d -name "anchor" | grep -vE "$ignore_pattern" | sort
            else
              find . -type d -name "anchor" | sort
            fi
          }

          # Filter the full project list down to projects touched by the given
          # changed files. A file "touches" a project iff it lives inside that
          # project directory (prefix match on "<project>/"). This is an
          # intersection against get_projects(), so the result is always a subset
          # of the authoritative project list.
          function filter_by_changes() {
            local all_projects="$1"
            shift
            local changed_files=("$@")
            echo "$all_projects" | while read -r project; do
              [ -z "$project" ] && continue
              # Strip leading ./ so prefix comparison matches git's output
              local project_prefix="${project#./}/"
              for file in "${changed_files[@]}"; do
                if [[ "$file" == "$project_prefix"* ]]; then
                  echo "$project"
                  break
                fi
              done
            done | sort -u
          }

          # Determine which projects to build and test
          if [[ "${{ github.event_name }}" == "schedule" || "${{ steps.changes.outputs.workflow }}" == "true" ]]; then
            # Workflow file changed or schedule — build everything
            projects=$(get_projects)
          elif [[ "${{ github.event_name }}" == "push" ]]; then
            # On push, only build projects with changes since parent commit
            mapfile -t changed_files < <(git diff --name-only HEAD~1 HEAD 2>/dev/null || true)
            if [ ${#changed_files[@]} -eq 0 ]; then
              projects=$(get_projects)
            else
              projects=$(filter_by_changes "$(get_projects)" "${changed_files[@]}")
            fi
          elif [[ "${{ steps.changes.outputs.anchor }}" == "true" ]]; then
            changed_files=(${{ steps.changes.outputs.anchor_files }})
            projects=$(filter_by_changes "$(get_projects)" "${changed_files[@]}")
          else
            projects=""
          fi

          # Output project information
          if [[ -n "$projects" ]]; then
            echo "Projects to build and test"
            echo "$projects"
            total_projects=$(echo "$projects" | wc -l)
            echo "Total projects: $total_projects"
            echo "total_projects=$total_projects" >> $GITHUB_OUTPUT
            echo "changed_projects=$(echo "$projects" | jq -R -s -c 'split("\n")[:-1]')" >> $GITHUB_OUTPUT
          else
            echo "No projects to build and test."
            echo "total_projects=0" >> $GITHUB_OUTPUT
            echo "changed_projects=[]" >> $GITHUB_OUTPUT
          fi
      - name: Generate matrix
        id: matrix
        run: |
          total_projects=${{ steps.analyze.outputs.total_projects }}
          max_jobs=${{ env.MAX_JOBS }}
          min_projects_per_job=${{ env.MIN_PROJECTS_PER_JOB }}
          min_projects_for_matrix=${{ env.MIN_PROJECTS_FOR_MATRIX }}

          # Generate matrix based on number of projects
          if [ "$total_projects" -lt "$min_projects_for_matrix" ]; then
            echo "matrix=[0]" >> $GITHUB_OUTPUT
          else
            projects_per_job=$(( (total_projects + max_jobs - 1) / max_jobs ))
            projects_per_job=$(( projects_per_job > min_projects_per_job ? projects_per_job : min_projects_per_job ))
            num_jobs=$(( (total_projects + projects_per_job - 1) / projects_per_job ))

            indices=$(seq 0 $(( num_jobs - 1 )))
            echo "matrix=[$(echo $indices | tr ' ' ',')]" >> $GITHUB_OUTPUT
          fi

  build-and-test:
    needs: changes
    if: needs.changes.outputs.total_projects != '0'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        index: ${{ fromJson(needs.changes.outputs.matrix) }}
    name: build-and-test-group-${{ matrix.index }}
    outputs:
      failed_projects: ${{ steps.set-failed.outputs.failed_projects }}
    steps:
      - uses: actions/checkout@v5
      - name: Setup sccache
        uses: mozilla-actions/sccache-action@v0.0.9
      - name: Configure sccache
        run: |
          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
      - name: Cache Cargo registry and git
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.toml', '**/Cargo.lock') }}
          restore-keys: |
            cargo-${{ runner.os }}-
      - uses: pnpm/action-setup@v4
      # Replaces heyAyushh/setup-anchor@v4.999. That action's version-detection step
      # runs `anchor --version | awk '{print $2}'` and writes the result straight to
      # $GITHUB_OUTPUT. `anchor --version` now prints more than one line, so the value
      # becomes multi-line and the step dies with "Invalid format", aborting the whole
      # job before any project is built. These steps install the toolchain directly
      # (Solana via the Anza installer, the Anchor CLI from crates.io) and read the
      # version from the first line only. The other workflows that use setup-anchor
      # (native, quasar, pinocchio, solana-asm) hit the same latent bug once their
      # matrices run; migrate them the same way once this is confirmed green.
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Install Solana CLI
        run: |
          sh -c "$(curl -sSfL https://release.anza.xyz/v3.1.14/install)"
          echo "$HOME/.local/share/solana/install/active_release/bin" >> "$GITHUB_PATH"
      - name: Cache Anchor toolchain
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/anchor
          # Pinned to match the anchor-lang/anchor-spl crate version the programs depend on.
          key: anchor-cli-crates-io-${{ runner.os }}-2.0.0-rc.1
      - name: Install Anchor 2.0.0-rc.1
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          # `anchor --version` can emit more than one line; read the first line only so
          # a multi-line value never reaches downstream parsing.
          current="$(anchor --version 2>/dev/null | head -n1 | awk '{print $2}' || true)"
          if [ "$current" != "2.0.0-rc.1" ]; then
            # Install the CLI from crates.io rather than through avm. avm has no
            # prebuilt binary for this pre-release (a plain `avm install` 404s), and
            # its --from-source path builds the CLI from the git tag, which is not
            # the same code as the published anchor-lang 2.0.0-rc.1 the programs
            # compile against: `anchor idl build` then emits a shim referencing
            # `anchor_lang::IdlBuild`, which that crate does not have, and writes
            # IDL JSON the parser rejects with "missing field `variants`".
            # Installing the CLI from crates.io keeps it and the library on one
            # published release. --locked builds it against its own published
            # lockfile so the result does not drift with the registry.
            cargo install anchor-cli --version 2.0.0-rc.1 --locked --force
          fi
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Install Surfpool
        run: curl -sL https://run.surfpool.run/ | bash
      - name: Display Versions
        run: |
          solana -V
          # it's okay to use --force in github action since all programs are tested in isolation
          solana-keygen new --no-bip39-passphrase --force
          rustc -V
          anchor -V
          surfpool --version
      - name: Build and Test
        env:
          TOTAL_PROJECTS: ${{ needs.changes.outputs.total_projects }}
          PROJECTS_PER_JOB: ${{ env.MIN_PROJECTS_PER_JOB }}
        run: |
          function build_and_test() {
            local project=$1
            echo "Building and Testing $project"
            cd "$project" || return 1

            # Install dependencies first
            if ! pnpm install --frozen-lockfile; then
              echo "::error::pnpm install failed for $project"
              echo "$project: pnpm install failed" >> $GITHUB_WORKSPACE/failed_projects.txt
              cd - > /dev/null
              return 1
            fi

            # Sync program IDs (Anchor requires the keypair and declare_id! to match)
            anchor keys sync

            # Update IDL address fields to match the synced keys.
            # declare_program!(name) reads the address from idls/<name>.json, so
            # after keys sync changes the program IDs, the IDLs must match too —
            # otherwise LiteSVM tests load the .so at the old IDL address while
            # the compiled program expects the new declare_id!() address.
            if [ -d "idls" ]; then
              for idl_file in idls/*.json; do
                program_name=$(basename "$idl_file" .json)
                # Look up the new address from Anchor.toml [programs.localnet]
                new_address=$(grep "^${program_name} " Anchor.toml | head -1 | sed 's/.*= *"\(.*\)"/\1/')
                if [ -n "$new_address" ]; then
                  # Update the "address" field in the IDL JSON
                  tmp=$(mktemp)
                  jq --arg addr "$new_address" '.address = $addr' "$idl_file" > "$tmp" && mv "$tmp" "$idl_file"
                fi
              done
            fi

            # TEMPORARY WORKAROUND - delete this block and the `$idl_flag` and
            # `$test_flag` below once an Anchor release after 2.0.0-rc.1 is out.
            #
            # anchor-derive-accounts 2.0.0-rc.1 emits enum type definitions with
            # the JSON key "fields" where the IDL spec requires "variants", so
            # `anchor build` cannot parse the IDL it just generated and dies
            # with `Error: missing field variants`. Every project below has
            # an enum reachable from its IDL and hits it. Reproduce with any
            # program containing `#[derive(IdlType)] pub enum E { A, B }`.
            #
            # Fixed upstream, unreleased at time of writing:
            # https://github.com/otter-sec/anchor/pull/4947
            #
            # Patching just the derive crate to that fix is not an option: it
            # requires solana-address 2.7, and these programs pin
            # `>=2.6, <2.7` because anchor-lang 2.0.0-rc.1 is built against
            # wincode 0.5 while solana-address 2.7 moved to 0.6.
            #
            # Skipping IDL generation costs nothing today: none of these
            # projects consumes a generated IDL (no `idls/` directory, no
            # `declare_program!`). The program is still compiled and its tests
            # still run.
            #
            # The skip also means `anchor test` must not start a validator for
            # these projects. Surfpool 1.6 deploys the program at startup
            # through a runbook that reads `target/idl/<program>.json`, and with
            # no IDL it exits with `Runbook execution failed` before any test
            # runs. None of these projects needs a validator: each one's
            # Anchor.toml runs `cargo test`, which tests against LiteSVM
            # in-process.
            case "$project" in
              ./basics/pyth/anchor \
              |./finance/betting-market/anchor \
              |./finance/options/anchor \
              |./finance/order-book/anchor \
              |./finance/perpetual-futures/anchor \
              |./finance/prop-amm/anchor \
              |./tokens/token-extensions/default-account-state/anchor \
              |./tokens/token-extensions/metadata/anchor \
              |./tokens/token-extensions/transfer-hook/allow-block-list-token/anchor)
                echo "::notice::skipping IDL generation for $project (anchor#4947)"
                idl_flag="--no-idl"
                test_flag="--skip-local-validator"
                ;;
              *)
                idl_flag=""
                test_flag=""
                ;;
            esac

            # Run anchor build
            if ! anchor build $idl_flag; then
              echo "::error::anchor build failed for $project"
              echo "$project: anchor build failed" >> $GITHUB_WORKSPACE/failed_projects.txt
              rm -rf target node_modules
              cd - > /dev/null
              return 1
            fi

            # Run anchor test. It regenerates the IDL too, so the skip above
            # has to apply here as well or the projects it exempts fail at the
            # test step instead of the build step.
            if ! anchor test $idl_flag $test_flag; then
              echo "::error::anchor test failed for $project"
              echo "$project: anchor test failed" >> $GITHUB_WORKSPACE/failed_projects.txt
              rm -rf target node_modules
              cd - > /dev/null
              return 1
            fi

            echo "Build and tests succeeded for $project."
            rm -rf target node_modules
            cd - > /dev/null
            return 0
          }

          # Determine which projects to build in this job
          readarray -t all_projects < <(echo '${{ needs.changes.outputs.changed_projects }}' | jq -r '.[]?')
          start_index=$(( ${{ matrix.index }} * PROJECTS_PER_JOB ))
          end_index=$(( start_index + PROJECTS_PER_JOB ))
          end_index=$(( end_index > TOTAL_PROJECTS ? TOTAL_PROJECTS : end_index ))

          echo "Projects to build and test in this job"
          for i in $(seq $start_index $(( end_index - 1 ))); do
            echo "${all_projects[$i]}"
          done

          # Build and test projects
          failed=false
          failed_projects=()
          for i in $(seq $start_index $(( end_index - 1 ))); do
            echo "::group::Building and testing ${all_projects[$i]}"
            if ! build_and_test "${all_projects[$i]}"; then
              failed=true
              failed_projects+=("${all_projects[$i]}")
            fi
            echo "::endgroup::"
          done

          if [[ "$failed" == "true" ]]; then
            echo "::group::Failed projects"
            cat $GITHUB_WORKSPACE/failed_projects.txt
            echo "::endgroup::"
            echo "failed_projects=${failed_projects[@]}" >> $GITHUB_OUTPUT
            exit 1
          else
            echo "failed_projects=" >> $GITHUB_OUTPUT
          fi

      - name: Set failed projects output
        id: set-failed
        if: failure()
        run: |
          # Prepare failed projects list for output
          failed_projects=$(cat $GITHUB_WORKSPACE/failed_projects.txt | jq -R -s -c 'split("\n")[:-1]')
          echo "failed_projects=$failed_projects" >> $GITHUB_OUTPUT
      - name: Show sccache stats
        if: always()
        run: sccache --show-stats

  summary:
    needs: [changes, build-and-test]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Create job summary
        run: |
          echo "## Anchor v2 Workflow Summary" >> $GITHUB_STEP_SUMMARY
          echo "- Total projects: ${{ needs.changes.outputs.total_projects }}" >> $GITHUB_STEP_SUMMARY

          # List all processed projects
          echo "<details>" >> $GITHUB_STEP_SUMMARY
          echo "<summary>Projects processed (click to expand)</summary>" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '${{ needs.changes.outputs.changed_projects }}' | jq -r '.[]' | while read project; do
            echo "- $project" >> $GITHUB_STEP_SUMMARY
          done
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "</details>" >> $GITHUB_STEP_SUMMARY

          # Report build and test results
          if [[ "${{ needs.build-and-test.result }}" == "failure" ]]; then
            echo "## :x: Build or tests failed" >> $GITHUB_STEP_SUMMARY
            echo "<details>" >> $GITHUB_STEP_SUMMARY
            echo "<summary>Failed projects (click to expand)</summary>" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            failed_projects='${{ needs.build-and-test.outputs.failed_projects }}'
            if [[ -n "$failed_projects" ]]; then
              echo "$failed_projects" | jq -r '.[]' | while IFS=: read -r project failure_reason; do
                echo "- **$project**" >> $GITHUB_STEP_SUMMARY
                echo "  - Failure reason: $failure_reason" >> $GITHUB_STEP_SUMMARY
              done
            else
              echo "No failed projects reported. This might indicate an unexpected error in the workflow." >> $GITHUB_STEP_SUMMARY
            fi
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "</details>" >> $GITHUB_STEP_SUMMARY
          elif [[ "${{ needs.build-and-test.result }}" == "success" ]]; then
            echo "## :white_check_mark: All builds and tests passed" >> $GITHUB_STEP_SUMMARY
          else
            echo "## :warning: Build and test job was skipped or canceled" >> $GITHUB_STEP_SUMMARY
          fi