deploy-devnet.yml

# Devnet Deploy Pipeline
# Builds, tests, and deploys all Anchor programs to Solana Devnet on merge to main.
#
# Required GitHub secret:
#   SOLANA_DEPLOY_KEYPAIR — JSON array of secret key bytes for the deploy wallet.
#                           Generate with: solana-keygen new --outfile /dev/stdout
#                           Store the full JSON array as the secret value.

name: Deploy to Devnet

on:
  push:
    branches:
      - main
    paths:
      - "contracts/**"
      - ".github/workflows/deploy-devnet.yml"
  workflow_dispatch:

concurrency:
  group: deploy-devnet-${{ github.ref }}
  cancel-in-progress: false

env:
  SOLANA_VERSION: "1.18.0"
  ANCHOR_VERSION: "0.30.0"
  RUST_VERSION: "1.76"
  ANCHOR_WORKSPACE: contracts

jobs:
  # ==================== BUILD ====================
  build:
    name: Anchor Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: rustfmt, clippy

      - name: Cache Cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: cargo-registry-${{ runner.os }}-${{ hashFiles('contracts/**/Cargo.lock') }}
          restore-keys: cargo-registry-${{ runner.os }}-

      - name: Cache Anchor target
        uses: actions/cache@v4
        with:
          path: contracts/target
          key: anchor-target-${{ runner.os }}-${{ hashFiles('contracts/**/Cargo.lock', 'contracts/Anchor.toml') }}
          restore-keys: anchor-target-${{ runner.os }}-

      - name: Install Solana CLI
        run: |
          sh -c "$(curl -sSfL https://release.solana.com/v${{ env.SOLANA_VERSION }}/install)"
          echo "$HOME/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH

      - name: Install Anchor CLI
        run: npm install -g @coral-xyz/anchor-cli@${{ env.ANCHOR_VERSION }}

      - name: Generate ephemeral wallet
        run: solana-keygen new --no-bip39-passphrase -o ~/.config/solana/id.json

      - name: Build
        working-directory: ${{ env.ANCHOR_WORKSPACE }}
        run: anchor build

      - name: Upload IDL and types
        uses: actions/upload-artifact@v4
        with:
          name: anchor-idl-${{ github.sha }}
          path: |
            contracts/target/idl/
            contracts/target/types/
          retention-days: 7

  # ==================== TEST ====================
  test:
    name: Anchor Test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Cache Cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: cargo-registry-${{ runner.os }}-${{ hashFiles('contracts/**/Cargo.lock') }}
          restore-keys: cargo-registry-${{ runner.os }}-

      - name: Cache Anchor target
        uses: actions/cache@v4
        with:
          path: contracts/target
          key: anchor-target-${{ runner.os }}-${{ hashFiles('contracts/**/Cargo.lock', 'contracts/Anchor.toml') }}
          restore-keys: anchor-target-${{ runner.os }}-

      - name: Install Solana CLI
        run: |
          sh -c "$(curl -sSfL https://release.solana.com/v${{ env.SOLANA_VERSION }}/install)"
          echo "$HOME/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH

      - name: Install Anchor CLI
        run: npm install -g @coral-xyz/anchor-cli@${{ env.ANCHOR_VERSION }}

      - name: Generate ephemeral wallet
        run: solana-keygen new --no-bip39-passphrase -o ~/.config/solana/id.json

      - name: Install Node dependencies
        working-directory: ${{ env.ANCHOR_WORKSPACE }}
        run: npm install

      - name: Build and test (local validator)
        working-directory: ${{ env.ANCHOR_WORKSPACE }}
        run: anchor test

  # ==================== DEPLOY ====================
  deploy:
    name: Deploy to Devnet
    runs-on: ubuntu-latest
    needs: [build, test]
    environment: devnet
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Cache Cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: cargo-registry-${{ runner.os }}-${{ hashFiles('contracts/**/Cargo.lock') }}
          restore-keys: cargo-registry-${{ runner.os }}-

      - name: Cache Anchor target
        uses: actions/cache@v4
        with:
          path: contracts/target
          key: anchor-target-${{ runner.os }}-${{ hashFiles('contracts/**/Cargo.lock', 'contracts/Anchor.toml') }}
          restore-keys: anchor-target-${{ runner.os }}-

      - name: Install Solana CLI
        run: |
          sh -c "$(curl -sSfL https://release.solana.com/v${{ env.SOLANA_VERSION }}/install)"
          echo "$HOME/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH

      - name: Install Anchor CLI
        run: npm install -g @coral-xyz/anchor-cli@${{ env.ANCHOR_VERSION }}

      - name: Reconstruct deploy keypair
        env:
          SOLANA_DEPLOY_KEYPAIR: ${{ secrets.SOLANA_DEPLOY_KEYPAIR }}
        run: |
          if [[ -z "${SOLANA_DEPLOY_KEYPAIR}" ]]; then
            echo "::error::SOLANA_DEPLOY_KEYPAIR secret is not set"
            exit 1
          fi
          KEYPAIR_FILE="$(mktemp)"
          printf '%s' "$SOLANA_DEPLOY_KEYPAIR" > "$KEYPAIR_FILE"
          chmod 600 "$KEYPAIR_FILE"
          solana config set --keypair "$KEYPAIR_FILE"
          solana config set --url devnet
          echo "KEYPAIR_FILE=${KEYPAIR_FILE}" >> "$GITHUB_ENV"

      - name: Verify wallet balance
        run: |
          echo "Deploy wallet: $(solana address)"
          solana balance

      - name: Build
        working-directory: ${{ env.ANCHOR_WORKSPACE }}
        run: anchor build

      - name: Deploy to devnet
        working-directory: ${{ env.ANCHOR_WORKSPACE }}
        run: anchor deploy --provider.cluster devnet

      - name: Show deployed program IDs
        working-directory: ${{ env.ANCHOR_WORKSPACE }}
        run: anchor keys list

      - name: Verify programs on-chain
        run: bash scripts/verify-devnet-programs.sh

      - name: Clean up keypair
        if: always()
        run: |
          if [[ -n "${KEYPAIR_FILE:-}" && -f "${KEYPAIR_FILE}" ]]; then
            rm -f "$KEYPAIR_FILE"
          fi

  # ==================== SUMMARY ====================
  summary:
    name: Deploy Summary
    runs-on: ubuntu-latest
    needs: [build, test, deploy]
    if: always()
    steps:
      - name: Write summary
        run: |
          echo "## Devnet Deploy Summary" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "**Commit:** \`${{ github.sha }}\`" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Stage  | Result |" >> "$GITHUB_STEP_SUMMARY"
          echo "|--------|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Build  | ${{ needs.build.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Test   | ${{ needs.test.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Deploy | ${{ needs.deploy.result }} |" >> "$GITHUB_STEP_SUMMARY"

      - name: Fail if any stage failed
        if: contains(needs.*.result, 'failure')
        run: exit 1