ci.yml

name: CI

on:
  push:
    branches:
      - master
      - develop
      - beta
      - next
    tags-ignore:
      - "**"
    paths-ignore:
      - "**/CHANGELOG.md"
      - "**/package.json"
  pull_request:
  workflow_dispatch:

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Use Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: ".nvmrc"

      # https://github.com/actions/cache/blob/main/examples.md#node---npm
      - name: Get npm cache directory
        id: npm-cache-dir
        shell: bash
        run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}

      - name: Cache node modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: npm-cache # use this to check for `cache-hit` ==> if: steps.npm-cache.outputs.cache-hit != 'true'
        with:
          path: ${{ steps.npm-cache-dir.outputs.dir }}
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install deps
        run: npm ci --audit=false

      - name: Lint ESLint
        run: npm run lint:eslint

      - name: Lint Prettier
        run: npm run lint:prettier

  test:
    strategy:
      fail-fast: false
      matrix:
        suite:
          [
            api:blocks,
            api:bns,
            api:cache,
            api:datastore,
            api:event-replay,
            api:event-server,
            api:mempool,
            api:microblocks,
            api:principal,
            api:redis,
            api:smart-contracts,
            api:sockets,
            api:synthetic-txs,
            api:transactions,
            api:v2-proxy,
            api:v3,
            api:pox5,
            # krypton:bns-e2e,
            # krypton:faucet-btc,
            # krypton:faucet-sbtc,
            # krypton:faucet-stx,
            # krypton:pox-4-btc-address-formats,
            # krypton:pox-4-burnchain-delegate-stx,
            # krypton:pox-4-burnchain-stack-stx,
            # krypton:pox-4-delegate-aggregation,
            # krypton:pox-4-delegate-revoked-stacking,
            # krypton:pox-4-delegate-stacking,
            # krypton:pox-4-stack-extend-increase,
            # krypton:rpc,
            snp,
          ]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Use Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: ".nvmrc"

      # https://github.com/actions/cache/blob/main/examples.md#node---npm
      - name: Get npm cache directory
        id: npm-cache-dir
        shell: bash
        run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}

      - name: Cache node modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: npm-cache # use this to check for `cache-hit` ==> if: steps.npm-cache.outputs.cache-hit != 'true'
        with:
          path: ${{ steps.npm-cache-dir.outputs.dir }}
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install deps
        run: npm ci --audit=false

      - name: Install client deps
        working-directory: client
        run: npm ci --audit=false

      - name: Setup replay directory permissions
        if: matrix.suite == 'api:event-replay'
        run: |
          mkdir -p tests/api/event-replay/.tmp/local/
          sudo chown 999:999 tests/api/event-replay/.tmp/local/
          sudo chmod -R 777 tests/api/event-replay/.tmp/local/

      - name: Run tests
        run: npx c8 --reporter=lcov npm run test:${{ matrix.suite }}

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@e53489f4d376d79066609109e7a95a29eb3740b1 # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
        if: always()

  build-publish:
    runs-on: ubuntu-latest
    needs: [lint, test]
    environment: Production
    permissions:
      id-token: write
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Configure AWS Credentials via OIDC
        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION || 'us-east-2' }}

      - name: Login to Amazon ECR
        id: ecr_login
        uses: aws-actions/amazon-ecr-login@b040164c4934333d597f3f9c67502ff28f814e9c # v2.1.6

      - name: Docker Meta
        id: docker_meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ghcr.io/${{ github.repository }}
            hirosystems/${{ github.event.repository.name }}
            ${{ steps.ecr_login.outputs.registry }}/${{ vars.AWS_ECR_REPOSITORY }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to DockerHub
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.HIROSYSTEMS_DOCKERHUB_USERNAME }}
          password: ${{ secrets.HIROSYSTEMS_DOCKERHUB_TOKEN }}

      - name: Build/Tag/Push Image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: ${{ github.ref == 'refs/heads/master' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
          tags: ${{ steps.docker_meta.outputs.tags }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          # Only push on non-PR events, or PRs that aren't from forks
          push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}