wallet/.gitea/workflows/ci.yaml

name: ci

# The quality gate (architecture/generic.md §12): format, lint as error, tests,
# and a frontend that typechecks and builds. Packaging and release live in
# their own workflow once the packaging epic lands.

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  gate:
    # `rust-gtk3`, not `rust`: tauri-build links against GTK and WebKitGTK dev
    # libraries, which only that image carries (gitea-runners.md §3).
    runs-on: rust-gtk3
    steps:
      - uses: actions/checkout@v4

      - name: webview dependencies
        working-directory: ui
        run: pnpm install --frozen-lockfile

      - name: webview gate
        working-directory: ui
        run: |
          set -euo pipefail
          pnpm typecheck
          pnpm lint
          pnpm format:check
          pnpm build

      - name: rust gate
        # --locked: a build that would change Cargo.lock fails rather than
        # quietly resolving something new (#49).
        run: |
          set -euo pipefail
          cargo fmt --check --all
          cargo clippy --locked --workspace --all-targets -- -D warnings
          cargo test --locked --workspace

      - name: dependency policy
        # deny.toml: licenses, advisories, bans and sources; machete: crates
        # declared and never used. Both ship in the runner image (gongfoo
        # runner-rust). The daily run in deps.yaml catches an advisory
        # published against an unchanged lockfile (#49).
        run: |
          set -euo pipefail
          cargo deny --version
          cargo deny check
          cargo machete

      - name: rust talks to the webview through one file
        # `ui/src/api/wallet.ts` is the only module allowed to import Tauri's
        # IPC. A screen that reaches for `invoke` itself bypasses the typed
        # client and its error mapping, and this is where that is caught.
        run: |
          set -euo pipefail
          hits=$(grep -rl "@tauri-apps/api/core" ui/src || true)
          if [ "$hits" != "ui/src/api/wallet.ts" ]; then
            echo "Tauri IPC imported outside ui/src/api/wallet.ts:"; echo "$hits"; exit 1
          fi

      - name: dev node
        # The chain adapter's integration tests run against a real
        # `quantus-node --dev` from the pinned release (script/dev-node.sh).
        # Started here, in the background, so the next step can use it; the
        # runner is ephemeral, so nothing is cleaned up.
        run: |
          set -euo pipefail
          script/dev-node.sh > dev-node.log 2>&1 &
          for _ in $(seq 1 60); do
            if curl -s -m 2 -H 'content-type: application/json' \
                 -d '{"jsonrpc":"2.0","id":1,"method":"system_chain","params":[]}' \
                 http://127.0.0.1:9944 | grep -q DevNet; then
              echo "dev node up"; exit 0
            fi
            sleep 2
          done
          echo "dev node did not come up"; tail -50 dev-node.log; exit 1

      - name: chain adapter against the dev node
        env:
          WALLET_DEV_NODE: ws://127.0.0.1:9944
        # Only the tests that need a node; their names all end in
        # `on_a_dev_node` or `on_dev_node`. Network tests against public
        # nodes stay ignored here.
        run: cargo test -p wallet-data -- --ignored dev_node

      - name: generated types are current
        # `cargo test` regenerates ui/src/api/generated via ts-rs. A diff here
        # means an entities change was committed without its TypeScript.
        run: git diff --exit-code -- ui/src/api/generated

      - name: debug binary
        # The app as a bare binary, so a change can be tried on a machine
        # before any release is cut (#87). The dev profile, which reuses
        # everything `cargo test` just compiled, so this costs seconds, not
        # the release profile's minutes; `tauri build` (not plain `cargo
        # build`) so the webview the gate built is embedded rather than
        # loaded from a dev server. It wants the GTK/WebKitGTK libraries the
        # rpm depends on. Last, so a red gate uploads nothing to mistake for
        # tested.
        working-directory: crates/wallet-app
        run: |
          set -euo pipefail
          pnpm dlx @tauri-apps/cli@2.11.4 build --debug --no-bundle
          mkdir -p ../../artifact
          install -m 0755 ../../target/debug/blackbeard-wallet \
            "../../artifact/blackbeard-wallet-${GITHUB_SHA::7}-x86_64-linux-gnu-debug"
          # Debug info is four fifths of the file (498 MB against 93 MB
          # stripped) and nothing a test on another machine uses.
          strip --strip-debug ../../artifact/blackbeard-wallet-*
          (cd ../../artifact && sha256sum * > SHA256SUMS)
          ls -l ../../artifact

      - name: upload the binary
        uses: actions/upload-artifact@v3
        with:
          name: blackbeard-wallet-${{ github.sha }}-x86_64-linux-gnu-debug
          path: artifact/
          retention-days: 7