ci: a pinned quantus-node dev chain in the gate, and a script to run one locally

`script/dev-node.sh` fetches the v1.0.1 release binary once into `.cache/`,
checks it against the sha256 the release publishes, and runs
`quantus-node --dev` on a throwaway base path. The workflow starts it in
the background, waits for `system_chain` to answer `Quantus DevNet`, and
runs every ignored test whose name says `dev_node`: the send, reverse,
cancel and named-failure path, and the scheme-by-era probe that found the
mortality bug. Public-node tests stay ignored in CI.

Rehearsed locally on a second node on port 9955: both tests pass in 15 s.

Closes #24

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW

.gitea/workflows/ci.yaml

@@ -52,6 +52,32 @@ jobs:
             echo "Tauri IPC imported outside ui/src/api/wallet.ts:"; echo "$hits"; exit 1
           fi
 
+      - name: dev node
+        # The chain adapter's integration tests run against a real
+        # `quantus-node --dev` from the pinned release (script/dev-node.sh).
+        # Started here, in the background, so the next step can use it; the
+        # runner is ephemeral, so nothing is cleaned up.
+        run: |
+          set -euo pipefail
+          script/dev-node.sh > dev-node.log 2>&1 &
+          for _ in $(seq 1 60); do
+            if curl -s -m 2 -H 'content-type: application/json' \
+                 -d '{"jsonrpc":"2.0","id":1,"method":"system_chain","params":[]}' \
+                 http://127.0.0.1:9944 | grep -q DevNet; then
+              echo "dev node up"; exit 0
+            fi
+            sleep 2
+          done
+          echo "dev node did not come up"; tail -50 dev-node.log; exit 1
+
+      - name: chain adapter against the dev node
+        env:
+          WALLET_DEV_NODE: ws://127.0.0.1:9944
+        # Only the tests that need a node; their names all end in
+        # `on_a_dev_node` or `on_dev_node`. Network tests against public
+        # nodes stay ignored here.
+        run: cargo test -p wallet-data -- --ignored dev_node
+
       - name: generated types are current
         # `cargo test` regenerates ui/src/api/generated via ts-rs. A diff here
         # means an entities change was committed without its TypeScript.

.gitignore

@@ -15,3 +15,4 @@ dist
 # A local config for `cargo run`, anchored so `.cargo/config.toml` stays tracked.
 /config.toml
 /dev-config.toml
+/.cache

script/dev-node.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Run a Quantus dev node from the pinned release binary: the same chain the
+# integration tests and CI use. Downloads once into .cache/, verifies the
+# checksum, and runs `quantus-node --dev` in the foreground with a throwaway
+# base path. Ctrl-C stops it and the chain is gone.
+#
+#   script/dev-node.sh            # start on ws://127.0.0.1:9944
+#   script/dev-node.sh --rpc-port 9955
+#
+# Bump VERSION and SHA256 together; the sha256sums file is in the release.
+set -euo pipefail
+
+VERSION="v1.0.1"
+SHA256="5880937c2a933b97d9916c5c9e78425d9918c6d7b68abe69de43680f62c13c93"
+ARCH="x86_64-unknown-linux-gnu"
+URL="https://github.com/Quantus-Network/chain/releases/download/${VERSION}/quantus-node-${VERSION}-${ARCH}.tar.gz"
+
+here="$(cd "$(dirname "$0")/.." && pwd)"
+cache="${here}/.cache/quantus-node/${VERSION}"
+bin="${cache}/quantus-node"
+
+if [ ! -x "${bin}" ]; then
+  mkdir -p "${cache}"
+  echo "fetching quantus-node ${VERSION}" >&2
+  curl -sSL --fail -o "${cache}/node.tgz" "${URL}"
+  echo "${SHA256}  ${cache}/node.tgz" | sha256sum -c - >&2
+  tar -xzf "${cache}/node.tgz" -C "${cache}"
+  rm -f "${cache}/node.tgz"
+  chmod +x "${bin}"
+fi
+
+base="$(mktemp -d -t quantus-dev-XXXXXX)"
+trap 'rm -rf "${base}"' EXIT
+exec "${bin}" --dev --base-path "${base}" --rpc-methods unsafe "$@"