ci.yml

name: CI

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

env:
  CARGO_TERM_COLOR: always
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  ci:
    name: Continuous Integration
    strategy:
      matrix:
        # Pruned to Linux for reliability; cross-OS Rust build is covered by rust.yml.
        os: [ubuntu-latest]
    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install stable Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Install WASM target
        run: rustup target add wasm32-unknown-unknown

      - name: Cache cargo registry & build artifacts
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install Z3 (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libz3-dev

      - name: Install Z3 (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install z3 llvm
          echo "Z3_SYS_Z3_HEADER=$(brew --prefix z3)/include/z3.h" >> $GITHUB_ENV
          echo "LIBRARY_PATH=$(brew --prefix z3)/lib:$LIBRARY_PATH" >> $GITHUB_ENV
          echo "CPATH=$(brew --prefix z3)/include:$CPATH" >> $GITHUB_ENV
          echo "LLVM_CONFIG_PATH=$(brew --prefix llvm)/bin/llvm-config" >> $GITHUB_ENV

      - name: Install Z3 (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $z3Version = "4.13.3"
          $url = "https://github.com/Z3Prover/z3/releases/download/z3-$z3Version/z3-$z3Version-x64-win.zip"
          Invoke-WebRequest -Uri $url -OutFile "$env:TEMP\z3.zip"
          Expand-Archive "$env:TEMP\z3.zip" -DestinationPath "C:\z3"
          $z3Dir = (Get-ChildItem "C:\z3" -Directory | Select-Object -First 1).FullName
          echo "Z3_SYS_Z3_HEADER=$z3Dir\include\z3.h" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          echo "LIB=$z3Dir\bin;$env:LIB" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          echo "CPATH=$z3Dir\include;$env:CPATH" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          echo "LIBCLANG_PATH=C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Install system dependencies (Linux only)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libdbus-1-dev libudev-dev pkg-config

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Install dependencies and Lint (make lint smoke test)
        run: |
          npm ci
          make lint

      - name: Check formatting
        run: cargo fmt --all --check

      - name: Run Clippy (workspace)
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings

      - name: Run Clippy (runtime guard wasm target)
        run: cargo clippy -p runtime-guard-wrapper --target wasm32-unknown-unknown -- -D warnings

      - name: Build All (Debug)
        run: |
          cargo build -p sanctifier-core --all-features
          cd tooling/sanctifier-cli && cargo build

      - name: Run All Tests
        run: |
          cargo test -p sanctifier-core --all-features
          cargo test -p sanctifier-cli

      - name: Run action unit tests
        run: |
          python -m unittest discover -s tests/action -p "test_*.py"
          python -m unittest discover -s tests/vulnerability_db -p "test_*.py"

      - name: Code coverage (Linux only)
        if: runner.os == 'Linux'
        continue-on-error: true
        run: |
          command -v cargo-tarpaulin >/dev/null || cargo install cargo-tarpaulin --locked --quiet
          cargo tarpaulin --workspace --out Xml --output-dir coverage/

      - name: Upload coverage to Codecov (Linux only)
        if: runner.os == 'Linux'
        continue-on-error: true
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: coverage/cobertura.xml
          fail_ci_if_error: false
          slug: HyperSafeD/Sanctifier

      - name: Build Release CLI
        run: cd tooling/sanctifier-cli && cargo build --release

  frontend-test:
    name: Frontend Unit Tests
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Build WASM stub
        run: |
          mkdir -p tooling/sanctifier-wasm/pkg
          echo '{"name":"@sanctifier/wasm","version":"0.0.0","main":"index.js"}' > tooling/sanctifier-wasm/pkg/package.json
          echo 'module.exports = {};' > tooling/sanctifier-wasm/pkg/index.js

      - name: Install frontend dependencies
        run: cd frontend && npm install

      - name: Run unit tests
        run: cd frontend && npm test

      - name: Generate coverage report
        run: cd frontend && npm run test:coverage
        continue-on-error: true

      - name: Upload coverage artifact
        uses: actions/upload-artifact@v6
        with:
          name: frontend-coverage
          path: frontend/coverage/
          retention-days: 7

  docs-specs-integration:
    name: Docs/specs integration coverage
    runs-on: ubuntu-latest
    # Documentation/spec coverage is informative; do not block core CI on it.
    continue-on-error: true

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Validate docs/specs coverage
        run: npm run docs:specs:check

  contracts-sep41-fixtures:
    name: Contracts SEP-41 Fixture Coverage
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install stable Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Build Sanctifier CLI
        run: cargo build -p sanctifier-cli

      - name: Run SEP-41 fixture contract tests
        run: cargo test -p my-contract

      - name: Validate S012 fixture output via CLI
        run: |
          cargo run --quiet --bin sanctifier -- analyze contracts/fixtures/finding-codes/s012_token_interface.rs --format json > /tmp/s012-report.json
          grep -q '"S012"' /tmp/s012-report.json

  frontend-e2e:
    name: Frontend E2E Tests (Playwright)
    runs-on: ubuntu-latest
    # Browser E2E is flaky under CI containers; keep it running but non-blocking.
    continue-on-error: true
    container:
      image: mcr.microsoft.com/playwright:v1.59.1-jammy
    timeout-minutes: 20

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Build WASM stub
        run: |
          mkdir -p tooling/sanctifier-wasm/pkg
          echo '{"name":"@sanctifier/wasm","version":"0.0.0","main":"index.js"}' > tooling/sanctifier-wasm/pkg/package.json
          echo 'module.exports = {};' > tooling/sanctifier-wasm/pkg/index.js

      - name: Install frontend dependencies
        run: cd frontend && npm install

      - name: Run e2e tests
        continue-on-error: true
        run: cd frontend && npm run test:e2e

      - name: Upload Playwright artifacts
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: playwright-artifacts
          path: |
            frontend/playwright-report/
            frontend/test-results/
          retention-days: 7

  frontend-schema-e2e:
    name: Frontend Schema Rendering E2E
    runs-on: ubuntu-latest
    # Browser E2E is flaky under CI containers; keep it running but non-blocking.
    continue-on-error: true
    container:
      image: mcr.microsoft.com/playwright:v1.59.1-jammy
    timeout-minutes: 20

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Build WASM stub
        run: |
          mkdir -p tooling/sanctifier-wasm/pkg
          echo '{"name":"@sanctifier/wasm","version":"0.0.0","main":"index.js"}' > tooling/sanctifier-wasm/pkg/package.json
          echo 'module.exports = {};' > tooling/sanctifier-wasm/pkg/index.js

      - name: Install frontend dependencies
        run: cd frontend && npm install

      - name: Run schema rendering e2e suite
        continue-on-error: true
        run: cd frontend && npm run test:e2e:schema

  contract-docs:
    name: Contract ABI / Interface Docs
    runs-on: ubuntu-latest
    continue-on-error: true  # non-blocking: cargo doc can fail on transient crates.io network errors

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install stable Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry & build artifacts
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-contract-docs-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-contract-docs-

      - name: Generate contract docs and interface summary
        run: make contract-docs

      - name: Verify interface summary is up-to-date
        run: |
          # Run extraction-only check (rustdoc already generated above)
          SKIP_RUSTDOC=1 bash scripts/gen-contract-docs.sh --check

      - name: Run ABI surface stability tests (amm-pool)
        run: cargo test -p amm-pool --test integration_tests abi_ -- --nocapture

      - name: Upload rustdoc artifact
        uses: actions/upload-artifact@v6
        with:
          name: contract-rustdoc
          path: target/doc/
          retention-days: 14

      - name: Upload interface JSON artifact
        uses: actions/upload-artifact@v6
        with:
          name: contract-interfaces-json
          path: docs/generated/contract-interfaces.json
          retention-days: 14

  commitlint:
    name: Lint Commit Messages
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Install commitlint
        run: |
          cd frontend
          npm install --save-dev @commitlint/cli @commitlint/config-conventional

      - name: Validate PR commits
        run: |
          cd frontend
          npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

  wasm:
    name: Build WASM Package
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install stable Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown

      - name: Cache cargo registry & build artifacts
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            tooling/sanctifier-wasm/target/
          key: ${{ runner.os }}-wasm-${{ hashFiles('tooling/sanctifier-wasm/Cargo.lock', 'tooling/sanctifier-core/Cargo.toml') }}
          restore-keys: |
            ${{ runner.os }}-wasm-

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - name: Build WASM package
        run: |
          cd tooling/sanctifier-wasm
          wasm-pack build --target web --out-dir pkg --out-name sanctifier_wasm
          # Inject the npm package name expected by the frontend
          node -e "
            const fs = require('fs');
            const pkg = JSON.parse(fs.readFileSync('pkg/package.json', 'utf8'));
            pkg.name = '@sanctifier/wasm';
            fs.writeFileSync('pkg/package.json', JSON.stringify(pkg, null, 2));
          "
      - name: Verify CSP Compliance
        run: |
          cd tooling/sanctifier-wasm
          node scripts/verify-csp-compliance.js

      - name: Upload WASM artifact
        uses: actions/upload-artifact@v6
        with:
          name: sanctifier-wasm-pkg
          path: tooling/sanctifier-wasm/pkg/
          retention-days: 7