feat: Confidential Transfer for MPT [XLS-0096] (#810) #2750
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: xrpl4j-CI | |
| on: | |
| push: | |
| pull_request: | |
| types: [ assigned ] | |
| jobs: | |
| resolve_xrpld_image: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 2 | |
| permissions: | |
| contents: read | |
| outputs: | |
| image: ${{ steps.resolve.outputs.image }} | |
| is_private: ${{ steps.resolve.outputs.is_private }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Resolve xrpld image | |
| id: resolve | |
| env: | |
| IMAGE_CONFIG_FILE: .github/xrpld-image.env | |
| DEFAULT_IMAGE: rippleci/xrpld:develop | |
| PRIVATE_IMAGE_REPO: registry.gitlab.com/ripple/xrpledger/xrpld_package_deploy/xrpld-private | |
| GITLAB_REGISTRY_USERNAME: ${{ vars.GITLAB_REGISTRY_USERNAME }} | |
| GITLAB_REGISTRY_TOKEN: ${{ secrets.GITLAB_REGISTRY_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| # Read the requested private version from the committed config file. | |
| # The file is never sourced: on fork pull requests its contents are | |
| # untrusted, so we only extract the value and validate it strictly. | |
| PRIVATE_VERSION="" | |
| if [[ -f "${IMAGE_CONFIG_FILE}" ]]; then | |
| RAW_LINE="$(grep -E '^[[:space:]]*XRPLD_PRIVATE_VERSION[[:space:]]*=' "${IMAGE_CONFIG_FILE}" | tail -n1 || true)" | |
| PRIVATE_VERSION="$(printf '%s' "${RAW_LINE#*=}" | tr -d "[:space:]\"'")" | |
| fi | |
| if [[ -z "${PRIVATE_VERSION}" ]]; then | |
| echo "No private xrpld version configured in ${IMAGE_CONFIG_FILE}; using default image ${DEFAULT_IMAGE}." | |
| { | |
| echo "image=${DEFAULT_IMAGE}" | |
| echo "is_private=false" | |
| } >> "${GITHUB_OUTPUT}" | |
| exit 0 | |
| fi | |
| if ! [[ "${PRIVATE_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-(b|rc)[0-9]+)?$ ]]; then | |
| echo "XRPLD_PRIVATE_VERSION in ${IMAGE_CONFIG_FILE} must use X.Y.Z, X.Y.Z-bN, or X.Y.Z-rcN format (got '${PRIVATE_VERSION}')." >&2 | |
| exit 1 | |
| fi | |
| if [[ -z "${GITLAB_REGISTRY_USERNAME}" || -z "${GITLAB_REGISTRY_TOKEN}" ]]; then | |
| echo "A private xrpld version (${PRIVATE_VERSION}) is configured but the GITLAB_REGISTRY_USERNAME variable and GITLAB_REGISTRY_TOKEN secret are unavailable. These are not exposed to fork pull requests; run the private build from a branch in this repository, or clear XRPLD_PRIVATE_VERSION to use the default image." >&2 | |
| exit 1 | |
| fi | |
| echo "Using private xrpld image for version ${PRIVATE_VERSION}." | |
| { | |
| echo "image=${PRIVATE_IMAGE_REPO}:private-${PRIVATE_VERSION}" | |
| echo "is_private=true" | |
| } >> "${GITHUB_OUTPUT}" | |
| build_jdk_temurin_8: | |
| needs: resolve_xrpld_image | |
| runs-on: ubuntu-latest | |
| env: | |
| XRPLD_DOCKER_IMAGE: ${{ needs.resolve_xrpld_image.outputs.image }} | |
| steps: | |
| # Checks-out the repository under $GITHUB_WORKSPACE | |
| - uses: actions/checkout@v6 | |
| # Set up Java 8 | |
| - name: Set up JDK 8 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '8' | |
| cache: 'maven' | |
| - name: Log in to private registry | |
| uses: ./.github/actions/xrpld-login | |
| with: | |
| is_private: ${{ needs.resolve_xrpld_image.outputs.is_private }} | |
| username: ${{ vars.GITLAB_REGISTRY_USERNAME }} | |
| token: ${{ secrets.GITLAB_REGISTRY_TOKEN }} | |
| - name: Build | |
| run: mvn clean install | |
| - name: Upload to Codecov | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| fail_ci_if_error: true | |
| build_jdk_semeru_8: | |
| needs: resolve_xrpld_image | |
| runs-on: ubuntu-latest | |
| env: | |
| XRPLD_DOCKER_IMAGE: ${{ needs.resolve_xrpld_image.outputs.image }} | |
| steps: | |
| # Checks-out the repository under $GITHUB_WORKSPACE | |
| - uses: actions/checkout@v6 | |
| # Set up Java 8 | |
| - name: Set up JDK 8 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'semeru' | |
| java-version: '8' | |
| cache: 'maven' | |
| - name: Log in to private registry | |
| uses: ./.github/actions/xrpld-login | |
| with: | |
| is_private: ${{ needs.resolve_xrpld_image.outputs.is_private }} | |
| username: ${{ vars.GITLAB_REGISTRY_USERNAME }} | |
| token: ${{ secrets.GITLAB_REGISTRY_TOKEN }} | |
| - name: Build | |
| run: mvn clean install | |
| build_jdk_zulu_8: | |
| needs: resolve_xrpld_image | |
| runs-on: ubuntu-latest | |
| env: | |
| XRPLD_DOCKER_IMAGE: ${{ needs.resolve_xrpld_image.outputs.image }} | |
| steps: | |
| # Checks-out the repository under $GITHUB_WORKSPACE | |
| - uses: actions/checkout@v6 | |
| # Set up Java 8 | |
| - name: Set up JDK 8 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'zulu' | |
| java-version: '8' | |
| cache: 'maven' | |
| - name: Log in to private registry | |
| uses: ./.github/actions/xrpld-login | |
| with: | |
| is_private: ${{ needs.resolve_xrpld_image.outputs.is_private }} | |
| username: ${{ vars.GITLAB_REGISTRY_USERNAME }} | |
| token: ${{ secrets.GITLAB_REGISTRY_TOKEN }} | |
| - name: Build | |
| run: mvn clean install | |
| build_jdk_temurin_other: | |
| needs: resolve_xrpld_image | |
| runs-on: ubuntu-latest | |
| env: | |
| XRPLD_DOCKER_IMAGE: ${{ needs.resolve_xrpld_image.outputs.image }} | |
| strategy: | |
| matrix: | |
| # test against each major Java version (Java 8 built separately above for codecov upload) | |
| java: [ 11, 17, 21 ] | |
| steps: | |
| # Checks-out the repository under $GITHUB_WORKSPACE | |
| - uses: actions/checkout@v6 | |
| # Set up Java version | |
| - name: Set up JDK ${{ matrix.java }} | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: ${{ matrix.java }} | |
| cache: 'maven' | |
| - name: Log in to private registry | |
| uses: ./.github/actions/xrpld-login | |
| with: | |
| is_private: ${{ needs.resolve_xrpld_image.outputs.is_private }} | |
| username: ${{ vars.GITLAB_REGISTRY_USERNAME }} | |
| token: ${{ secrets.GITLAB_REGISTRY_TOKEN }} | |
| - name: Build | |
| run: mvn clean install -Dmaven.javadoc.skip=true | |
| build_jdk_temurin_non_us: | |
| needs: resolve_xrpld_image | |
| runs-on: ubuntu-latest | |
| env: | |
| XRPLD_DOCKER_IMAGE: ${{ needs.resolve_xrpld_image.outputs.image }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| # Set up Temurin 21 | |
| - name: Set up Temurin v21 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: 21 | |
| cache: 'maven' | |
| - name: Log in to private registry | |
| uses: ./.github/actions/xrpld-login | |
| with: | |
| is_private: ${{ needs.resolve_xrpld_image.outputs.is_private }} | |
| username: ${{ vars.GITLAB_REGISTRY_USERNAME }} | |
| token: ${{ secrets.GITLAB_REGISTRY_TOKEN }} | |
| # Maven install with JVM locale = de_DE | |
| - name: Build | |
| run: mvn clean install -Dmaven.javadoc.skip=true -DargLine="-Duser.language=de -Duser.country=DE" | |
| build_android: | |
| needs: resolve_xrpld_image | |
| runs-on: ubuntu-latest | |
| env: | |
| XRPLD_DOCKER_IMAGE: ${{ needs.resolve_xrpld_image.outputs.image }} | |
| steps: | |
| # Checks-out the repository under $GITHUB_WORKSPACE | |
| - uses: actions/checkout@v6 | |
| # Set up Java 17 | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '21' | |
| cache: 'maven' | |
| # Set up Android | |
| - name: Setup Android SDK | |
| uses: android-actions/setup-android@v4 | |
| - name: Log in to private registry | |
| uses: ./.github/actions/xrpld-login | |
| with: | |
| is_private: ${{ needs.resolve_xrpld_image.outputs.is_private }} | |
| username: ${{ vars.GITLAB_REGISTRY_USERNAME }} | |
| token: ${{ secrets.GITLAB_REGISTRY_TOKEN }} | |
| - name: Build | |
| run: mvn clean install -Dmaven.javadoc.skip=true -Pandroid | |
| # Verifies the mpt-crypto native libraries (loaded via JNA) on each platform we ship binaries for. | |
| build_confidential_native_its: | |
| name: confidential_native_${{ matrix.platform }}_${{ matrix.network }} | |
| needs: resolve_xrpld_image | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Linux x86-64 runners have Docker, so the confidential MPT ITs run against the local | |
| # rippled Testcontainer and exercise the real native library end-to-end. | |
| - os: ubuntu-latest | |
| platform: linux-x86-64 | |
| java: '8' | |
| network: local-rippled | |
| it_flags: '' | |
| # The rippleci/xrpld image is published for linux/amd64 only, so the ARM Linux runner | |
| # registers QEMU binfmt handlers to run the amd64 rippled container under emulation. | |
| - os: ubuntu-24.04-arm | |
| platform: linux-aarch64 | |
| java: '8' | |
| network: local-rippled | |
| it_flags: '' | |
| setup_qemu: true | |
| # Intel macOS runners have no Docker preinstalled, but support virtualization, so | |
| # Colima provides a Docker engine for the rippled Testcontainer. | |
| - os: macos-15-intel | |
| platform: darwin-x86-64 | |
| java: '8' | |
| network: local-rippled | |
| it_flags: '' | |
| setup_docker_via_colima: true | |
| # ARM macOS runners cannot run Docker at all (Apple's Virtualization Framework does not | |
| # support nested virtualization), and Windows runners cannot run Linux containers, so | |
| # these platforms run the confidential MPT ITs against Devnet instead of a local rippled. | |
| # Temurin doesn't ship JDK 8 for macOS ARM64, so we use JDK 11 there. | |
| - os: macos-14 | |
| platform: darwin-aarch64 | |
| java: '11' | |
| network: devnet | |
| it_flags: '-DuseDevnet' | |
| - os: windows-latest | |
| platform: win32-x86-64 | |
| java: '8' | |
| network: devnet | |
| it_flags: '-DuseDevnet' | |
| runs-on: ${{ matrix.os }} | |
| env: | |
| XRPLD_DOCKER_IMAGE: ${{ needs.resolve_xrpld_image.outputs.image }} | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| # Checks-out the repository under $GITHUB_WORKSPACE | |
| - uses: actions/checkout@v6 | |
| - name: Set up JDK ${{ matrix.java }} | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: ${{ matrix.java }} | |
| cache: 'maven' | |
| - name: Set up QEMU for amd64 emulation | |
| if: matrix.setup_qemu | |
| uses: docker/setup-qemu-action@v3 | |
| with: | |
| platforms: amd64 | |
| - name: Set up Docker via Colima | |
| if: matrix.setup_docker_via_colima | |
| run: | | |
| brew install colima docker | |
| colima start --cpus 3 --memory 8 | |
| echo "DOCKER_HOST=unix://$HOME/.colima/default/docker.sock" >> "$GITHUB_ENV" | |
| echo "TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE=/var/run/docker.sock" >> "$GITHUB_ENV" | |
| # Only the local-rippled rows pull an xrpld image, so only they need the registry login. This step must follow | |
| # the Colima setup above, which is what provides the Docker daemon on the macOS Intel runner. | |
| - name: Log in to private registry | |
| if: matrix.network == 'local-rippled' | |
| uses: ./.github/actions/xrpld-login | |
| with: | |
| is_private: ${{ needs.resolve_xrpld_image.outputs.is_private }} | |
| username: ${{ vars.GITLAB_REGISTRY_USERNAME }} | |
| token: ${{ secrets.GITLAB_REGISTRY_TOKEN }} | |
| - name: Build and run unit tests | |
| run: mvn clean install -DskipITs -Dmaven.javadoc.skip=true | |
| - name: Run Confidential MPT ITs | |
| run: mvn -pl xrpl4j-integration-tests verify -Dit.test='Confidential*IT' -Dfailsafe.failIfNoSpecifiedTests=true ${{ matrix.it_flags }} -Dmaven.javadoc.skip=true | |
| build_devnet_its: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Checks-out the repository under $GITHUB_WORKSPACE | |
| - uses: actions/checkout@v6 | |
| # Set up Java 8 | |
| - name: Set up JDK 8 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '8' | |
| cache: 'maven' | |
| - name: Build | |
| run: mvn clean install -Dmaven.javadoc.skip=true -DuseDevnet | |
| build_testnet_reporting_its: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Checks-out the repository under $GITHUB_WORKSPACE | |
| - uses: actions/checkout@v6 | |
| # Set up Java 8 | |
| - name: Set up JDK 8 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '8' | |
| cache: 'maven' # setup-java v4 includes maven caching | |
| - name: Build | |
| run: mvn clean install -Dmaven.javadoc.skip=true -DuseTestnet | |
| build_testnet_clio_its: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Checks-out the repository under $GITHUB_WORKSPACE | |
| - uses: actions/checkout@v6 | |
| # Set up Java 26; required for Clio's TLS certificates to be honored by ITs | |
| - name: Set up JDK 26 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '26' | |
| cache: 'maven' | |
| - name: Build | |
| # -DuseClioTestnet routes the main IT suite (via AbstractIT) to the Clio testnet node. | |
| # -DuseClioMainnet is independent: it routes mainnet-specific tests (AccountTransactionsIT, | |
| # LedgerResultIT) to the Clio mainnet node. The two flags are evaluated by separate factory | |
| # methods and do not conflict. See https://github.com/XRPLF/xrpl4j/issues/789 for a ticket | |
| # that detangles this. | |
| run: mvn clean install -Dmaven.javadoc.skip=true -DuseClioTestnet -DuseClioMainnet |