ci.yml

name: CI

on:
  push:
    branches: [dev, main]
  pull_request:
    branches: [dev, main]

# Cancel superseded runs on the same branch/PR so we don't burn CI minutes
# (and queue time for everyone else) compiling a commit nobody cares about
# anymore once a newer push has landed.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ---------------------------------------------------------------------------
  # Rust — format, lint, test, and SQLx prepare
  # ---------------------------------------------------------------------------
  rust:
    name: Rust
    runs-on: ubuntu-latest
    env:
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
    services:
      postgres:
        image: postgres:15-alpine
        env:
          POSTGRES_USER: trident
          POSTGRES_PASSWORD: password
          POSTGRES_DB: trident
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          components: rustfmt, clippy

      # Check formatting first: it needs neither the Postgres service nor a
      # compiled dependency graph, so a formatting mistake (the most common
      # CI failure) is reported in seconds instead of after the DB migration
      # and sqlx-prepare steps below have already run.
      - name: Check formatting
        run: cargo fmt --all -- --check

      # sccache caches compiled objects in the GitHub Actions cache, keyed by
      # crate/flags/rustc version, and is shared with the rust-integration
      # job below (same workspace, same Cargo.lock) via the same GHA cache
      # scope. Cuts recompilation between the two jobs to near-zero on a hit.
      - name: Set up sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Cache Rust build artefacts
        uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # v2.7.3
        with:
          shared-key: rust-workspace

      - name: Install sqlx-cli
        uses: baptiste0928/cargo-install@904927dbe77864e0f2281519fe9d5bd097a220b3 # v3.0.1
        with:
          crate: sqlx-cli
          version: latest
          features: postgres
          args: --no-default-features

      - name: Run migrations
        env:
          DATABASE_URL: postgres://trident:password@localhost:5432/trident
        run: sqlx migrate run --source database/migrations

      - name: Run sqlx prepare
        env:
          DATABASE_URL: postgres://trident:password@localhost:5432/trident
        run: cargo sqlx prepare --workspace

      - name: Clippy (deny warnings)
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Tests
        env:
          DATABASE_URL: postgres://trident:password@localhost:5432/trident
        run: cargo test --all -- --test-threads=1

      - name: Show sccache stats
        if: always()
        run: sccache --show-stats

  # ---------------------------------------------------------------------------
  # Go — vet and lint
  # ---------------------------------------------------------------------------
  go:
    name: Go
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/api

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: "1.25"
          cache-dependency-path: services/api/go.sum

      - name: go vet
        run: go vet ./...

      - name: go test (race)
        run: go test -race ./...

      - name: REST handler coverage
        run: |
          go test ./handlers -coverprofile=handlers.out
          go tool cover -func=handlers.out \
            | awk '
              /handlers\/events.go:.*ListEvents/ || /handlers\/events.go:.*GetEvent/ || /handlers\/health.go:.*Health/ {
                coverage = $NF
                sub(/%$/, "", coverage)
                print
                if ((coverage + 0) < 80) {
                  failed = 1
                }
              }
              END {
                if (failed) {
                  print "REST handler coverage must stay at or above 80% for ListEvents, GetEvent, and Health"
                  exit 1
                }
              }'

      # v8 is the first line of the action that supports golangci-lint v2. v4
      # invokes it with `--out-format`, which v2 removed, so the lint aborted
      # with "unknown flag" before checking anything (issue #371).
      - name: golangci-lint
        uses: golangci/golangci-lint-action@25e2cdc5eb1d7a04fdc45ff538f1a00e960ae128 # v8.0.0
        with:
          version: v2.12.2
          working-directory: services/api

  # ---------------------------------------------------------------------------
  # TypeScript — type check
  # ---------------------------------------------------------------------------
  typescript:
    name: TypeScript
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: sdk/typescript

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: sdk/typescript/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Type check
        run: npm run lint

      - name: Test
        run: npm test

  # ---------------------------------------------------------------------------
  # SDKs — run the per-language client SDK test suites that were previously
  # committed but never executed in CI (go, python, react).
  # ---------------------------------------------------------------------------
  sdk-go:
    name: SDK (Go)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: sdk/go
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set up Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: "1.25"
          cache-dependency-path: sdk/go/go.sum
      - name: Test
        run: go test -race ./...

  sdk-python:
    name: SDK (Python)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: sdk/python
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set up Python
        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
        with:
          python-version: "3.12"
      - name: Install package with test deps
        run: pip install -e ".[dev]"
      - name: Type check (mypy --strict)
        run: mypy
      - name: Test
        run: pytest -q

  sdk-react:
    name: SDK (React)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set up Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: "20"
      # react depends on the TypeScript SDK via `file:../typescript`, which
      # resolves to its built dist/ (gitignored). Build it before installing
      # react so the file: dependency resolves at test time.
      - name: Build the TypeScript SDK
        working-directory: sdk/typescript
        run: npm ci && npm run build
      - name: Install dependencies
        working-directory: sdk/react
        run: npm ci
      - name: Test
        working-directory: sdk/react
        run: npm test

  sdk-rust:
    name: SDK (Rust)
    runs-on: ubuntu-latest
    env:
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
    defaults:
      run:
        working-directory: sdk/rust
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
      - name: Set up sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
      - name: Cache Rust build artefacts
        uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # v2.7.3
        with:
          workspaces: sdk/rust
      - name: Test
        run: cargo test --examples
      - name: Test library and docs
        run: cargo test
      - name: Show sccache stats
        if: always()
        run: sccache --show-stats

  # ---------------------------------------------------------------------------
  # Contracts — reference Soroban contracts (issue #258).
  #
  # A separate Cargo workspace (contracts/), not a member of the root one:
  # contract builds target wasm32v1-none with panic=abort, which is a
  # different profile shape than the native services. Build-only here (no
  # deploy) so the contracts can't silently rot; the e2e-contract-events job
  # below is what actually deploys the token contract.
  # ---------------------------------------------------------------------------
  contracts:
    name: Contracts
    runs-on: ubuntu-latest
    env:
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
    defaults:
      run:
        working-directory: contracts
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          targets: wasm32v1-none

      # Shared with e2e-contract-events below via the same sccache GHA cache
      # scope, so that job's rebuild of the token contract to wasm32v1-none
      # (needed there to get a fresh Soroban deployment) reuses these
      # compiled objects instead of building the same crate twice per CI run.
      - name: Set up sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Cache Rust build artefacts
        uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # v2.7.3
        with:
          workspaces: contracts
          shared-key: contracts-wasm

      - name: Run contract unit tests
        run: cargo test --workspace

      - name: Build contracts to WASM
        run: cargo build --release --target wasm32v1-none --workspace

      - name: Show sccache stats
        if: always()
        run: sccache --show-stats

  # ---------------------------------------------------------------------------
  # OpenAPI specification — Spectral linting
  # ---------------------------------------------------------------------------
  openapi:
    name: OpenAPI Spec
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: "20"

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Spectral
        run: npm install -g @stoplight/spectral-cli

      - name: Install codegen dependencies
        run: pip install PyYAML

      - name: Lint OpenAPI specification
        run: spectral lint api/openapi.yaml

      - name: Regenerate SDK models
        run: python3 scripts/generate_sdk_models.py

      - name: Check for uncommitted changes
        run: |
          if git diff --exit-code             sdk/typescript/src/api-types.gen.ts             sdk/go/openapi/models_gen.go             sdk/python/src/trident_indexer/openapi_models_gen.py             sdk/rust/src/openapi_models_gen.rs; then
            echo "✓ Generated SDK models are up-to-date"
          else
            echo "✗ Generated SDK models are stale. Run 'python3 scripts/generate_sdk_models.py' and commit changes."
            exit 1
          fi

  # ---------------------------------------------------------------------------
  # Rust integration tests — real Postgres + Redis
  # Runs integration tests that are silently skipped when TEST_DATABASE_URL
  # and TEST_REDIS_URL are absent. Scoped to push/PR against main and dev.
  # ---------------------------------------------------------------------------
  rust-integration:
    name: Rust integration tests
    runs-on: ubuntu-latest
    if: >
      github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') ||
      github.event_name == 'pull_request' && (github.base_ref == 'main' || github.base_ref == 'dev')
    env:
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: trident
          POSTGRES_DB: trident_test
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
      redis:
        image: redis:7-alpine
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable

      # Shares the sccache object cache with the rust job (same workspace,
      # same Cargo.lock) so this job's build reuses objects already compiled
      # there instead of recompiling the whole workspace from scratch.
      - name: Set up sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Cache Rust build artefacts
        uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # v2.7.3
        with:
          shared-key: rust-workspace

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.25"
          cache-dependency-path: services/api/go.sum

      # Apply the real migration chain (0001..latest) — the same artifact CI's
      # `rust` job and production apply. This validates the migrations as an
      # ordered, idempotent chain and can never silently depend on a stale
      # database/schema.sql mirror (which had drifted from migrations).
      - name: Apply database migrations
        env:
          PGPASSWORD: trident
        run: |
          set -euo pipefail
          for f in database/migrations/*.sql; do
            echo "Applying $f"
            psql -v ON_ERROR_STOP=1 -h localhost -U postgres -d trident_test -f "$f"
          done

      - name: Run integration tests
        env:
          DATABASE_URL: postgres://postgres:trident@localhost:5432/trident_test
          TEST_DATABASE_URL: postgres://postgres:trident@localhost:5432/trident_test
          TEST_REDIS_URL: redis://localhost:6379
          # Turns a missing TEST_DATABASE_URL/TEST_REDIS_URL into a hard test
          # failure instead of a silent skip, so a misconfigured integration
          # job cannot report green without running the DB/Redis tests.
          REQUIRE_TEST_SERVICES: "1"
          CI: "true"
        run: cargo test --all -- --include-ignored --test-threads=1

      - name: Show sccache stats
        if: always()
        run: sccache --show-stats

  # ---------------------------------------------------------------------------
  # Docker — build images (no push)
  # Both application images are built here so the layer cache is warm when
  # the e2e job runs docker compose build below.
  # ---------------------------------------------------------------------------
  docker:
    name: Docker build
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0

      # Each image gets its own cache scope. Without an explicit `scope`, the
      # gha cache backend defaults every build in the workflow to the same
      # "buildkit" scope, so these three builds were overwriting each other's
      # cache blobs on every run instead of accumulating a per-image cache —
      # the main source of poor Docker cache hit-rate here.
      - name: Build Go API image
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: services/api/Dockerfile
          push: false
          tags: trident-go-api:ci
          cache-from: type=gha,scope=go-api
          cache-to: type=gha,mode=max,scope=go-api

      - name: Build Rust gRPC API image
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: crates/api/Dockerfile
          push: false
          tags: trident-grpc-api:ci
          cache-from: type=gha,scope=grpc-api
          cache-to: type=gha,mode=max,scope=grpc-api

      - name: Build Rust indexer image
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: crates/indexer/Dockerfile
          push: false
          tags: trident-indexer:ci
          cache-from: type=gha,scope=indexer
          cache-to: type=gha,mode=max,scope=indexer

      - name: Build database migration image
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: database/Dockerfile
          push: false
          tags: trident-migrate:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ---------------------------------------------------------------------------
  # E2E smoke test — full-stack Docker Compose + curl assertions
  #
  # Runs after all unit/lint jobs pass. Builds the complete four-service stack
  # (Postgres, Redis, Rust gRPC API, Go REST API), waits for health checks,
  # then asserts:
  #   1. GET /v1/health   → 200 {"status":"ok"}
  #   2. GET /v1/events   → 200 with a valid JSON body
  #
  # A fixed test API key is pre-seeded into Postgres by docker/ci-seed.sql
  # and the corresponding HMAC-SHA256 digest is set in .env.ci as
  # API_KEY_HASHES. The raw key is hardcoded for CI only — it is documented
  # in .env.ci as "do not use outside CI".
  #
  # On any failure the step "Dump service logs" captures all container output
  # so engineers can diagnose failures without re-running the job.
  # ---------------------------------------------------------------------------
  e2e:
    name: E2E smoke test
    runs-on: ubuntu-latest
    needs: [rust, go, typescript, docker]

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0

      # Restore the layer cache written by the docker job above so that
      # `docker compose build` below is a no-op cache hit.
      - name: Restore Go API image cache
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: services/api/Dockerfile
          push: false
          tags: trident-go-api:ci
          cache-from: type=gha,scope=go-api
          cache-to: type=gha,mode=max,scope=go-api

      - name: Restore Rust gRPC API image cache
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: crates/api/Dockerfile
          push: false
          tags: trident-grpc-api:ci
          cache-from: type=gha,scope=grpc-api
          cache-to: type=gha,mode=max,scope=grpc-api

      - name: Restore Rust indexer image cache
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: crates/indexer/Dockerfile
          push: false
          tags: trident-indexer:ci
          cache-from: type=gha,scope=indexer
          cache-to: type=gha,mode=max,scope=indexer

      - name: Build full stack images
        run: |
          docker compose \
            -f docker/docker-compose.yml \
            -f docker/docker-compose.ci.yml \
            --env-file .env.ci \
            build --pull=false

      - name: Start full stack
        run: |
          docker compose \
            -f docker/docker-compose.yml \
            -f docker/docker-compose.ci.yml \
            --env-file .env.ci \
            up -d

      - name: Wait for Go API to become healthy
        # Poll GET /v1/health until it returns 200 or we exhaust retries.
        # --retry-connrefused keeps retrying even when the port is not yet
        # open; --retry-delay 3 gives each service time to initialise.
        run: |
          echo "Waiting for /v1/health to return 200..."
          curl \
            --silent \
            --fail \
            --retry 20 \
            --retry-delay 5 \
            --retry-connrefused \
            --max-time 10 \
            http://localhost:3000/v1/health
          echo ""
          echo "/v1/health returned 200 OK"

      # Without this the job reports only curl's exit code, which says nothing
      # about which service failed to come up. Runs only on failure.
      - name: Dump stack state and logs on failure
        if: failure()
        run: |
          cd docker
          echo "::group::container status"
          docker compose -f docker-compose.yml -f docker-compose.ci.yml --env-file ../.env.ci ps -a
          echo "::endgroup::"
          for svc in postgres redis grpc-api indexer api; do
            echo "::group::${svc} logs"
            docker compose -f docker-compose.yml -f docker-compose.ci.yml --env-file ../.env.ci logs --tail=120 "${svc}" || true
            echo "::endgroup::"
          done

      - name: Assert GET /v1/health returns status ok
        run: |
          RESPONSE=$(curl --silent --fail http://localhost:3000/v1/health)
          echo "Response: $RESPONSE"

          STATUS=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")
          if [ "$STATUS" != "ok" ]; then
            echo "ERROR: expected status=ok, got status=$STATUS"
            exit 1
          fi
          echo "✓ /v1/health returned {\"status\": \"ok\"}"

      - name: Assert GET /v1/events returns 200 with JSON body
        env:
          # This raw key is pre-seeded in Postgres via docker/ci-seed.sql and
          # its HMAC-SHA256 digest is in .env.ci as API_KEY_HASHES.
          # DO NOT use this key outside CI.
          CI_API_KEY: ci-test-api-key-do-not-use-in-production
        run: |
          RESPONSE=$(curl \
            --silent \
            --fail \
            --max-time 10 \
            -H "X-API-Key: ${CI_API_KEY}" \
            "http://localhost:3000/v1/events?limit=1")
          echo "Response: $RESPONSE"

          # Validate the response is valid JSON — python3 will exit non-zero if not.
          echo "$RESPONSE" | python3 -c "import sys,json; data=json.load(sys.stdin); print('✓ /v1/events returned valid JSON')"

      - name: Dump service logs
        # Always run so logs are available for both passing and failing runs.
        if: always()
        run: |
          echo "=== docker compose ps ==="
          docker compose \
            -f docker/docker-compose.yml \
            -f docker/docker-compose.ci.yml \
            --env-file .env.ci \
            ps

          echo "=== Service logs ==="
          docker compose \
            -f docker/docker-compose.yml \
            -f docker/docker-compose.ci.yml \
            --env-file .env.ci \
            logs --no-color --timestamps

      - name: Tear down stack
        # Always run to avoid leaving containers behind if a test step fails.
        if: always()
        run: |
          docker compose \
            -f docker/docker-compose.yml \
            -f docker/docker-compose.ci.yml \
            --env-file .env.ci \
            down -v --remove-orphans

  # ---------------------------------------------------------------------------
  # E2E contract events — deploy a real contract, emit an event, assert it is
  # indexed (issue #268).
  #
  # Unlike the `e2e` smoke test above (which only checks response shape), this
  # job proves the actual pipeline: on-chain event -> indexer -> DB -> API.
  #
  #   1. Start a local Soroban network (stellar/quickstart, standalone mode).
  #   2. Deploy the reference token contract (issue #258), initialize it, and
  #      mint to a second account — mint publishes a decodable SEP-41 event.
  #   3. Start the full stack pointed at the local network instead of testnet.
  #   4. Poll GET /v1/events until the mint event appears, and assert its
  #      decoded topics/data match what was invoked.
  #
  # Runs as its own job (not part of `e2e`) so a slow local-network boot
  # doesn't hold up the fast checks; `needs: [contracts, docker]` because it
  # depends on both the contract WASM and the application images.
  # ---------------------------------------------------------------------------
  e2e-contract-events:
    name: E2E contract events
    runs-on: ubuntu-latest
    needs: [contracts, docker]
    env:
      STELLAR_CLI_VERSION: "25.2.0"
      LOCAL_RPC_URL: http://localhost:8000/rpc
      LOCAL_NETWORK_PASSPHRASE: "Standalone Network ; February 2017"
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          targets: wasm32v1-none

      # needs: [contracts, ...] above guarantees the contracts job (and its
      # sccache writes) has already completed, so this reuses its compiled
      # objects for the same token crate/target instead of rebuilding them.
      - name: Set up sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Cache Rust build artefacts
        uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # v2.7.3
        with:
          workspaces: contracts
          shared-key: contracts-wasm

      - name: Build the reference token contract
        working-directory: contracts
        run: cargo build --release --target wasm32v1-none -p trident-reference-token

      - name: Show sccache stats
        if: always()
        run: sccache --show-stats

      - name: Install the stellar CLI
        run: |
          set -euo pipefail
          curl -sSfL \
            "https://github.com/stellar/stellar-cli/releases/download/v${STELLAR_CLI_VERSION}/stellar-cli-${STELLAR_CLI_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
            | tar xz -C /usr/local/bin stellar
          stellar --version

      - name: Start local Soroban network
        run: |
          docker run -d --name stellar-quickstart -p 8000:8000 \
            stellar/quickstart:testing --local --enable rpc,horizon

      - name: Wait for the local network to become healthy
        run: |
          echo "Waiting for $LOCAL_RPC_URL to report healthy..."
          for i in $(seq 1 60); do
            if curl -sSf -X POST "$LOCAL_RPC_URL" \
                -H 'Content-Type: application/json' \
                -d '{"jsonrpc":"2.0","id":1,"method":"getHealth"}' \
                | grep -q '"status":"healthy"'; then
              echo "Local network is healthy."
              exit 0
            fi
            sleep 2
          done
          echo "Local network did not become healthy in time." >&2
          docker logs stellar-quickstart || true
          exit 1

      - name: Wait for friendbot to become available
        run: |
          echo "Waiting for friendbot to start funding accounts..."
          for i in $(seq 1 60); do
            status=$(curl -sS -o /dev/null -w '%{http_code}' "http://localhost:8000/friendbot?addr=GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF")
            if [ "$status" = "200" ] || [ "$status" = "400" ]; then
              echo "Friendbot is ready (status $status)."
              exit 0
            fi
            sleep 2
          done
          echo "Friendbot did not become ready in time." >&2
          docker logs stellar-quickstart || true
          exit 1

      - name: Deploy and invoke the reference token contract
        id: deploy
        run: |
          set -euo pipefail
          stellar network add local \
            --rpc-url "$LOCAL_RPC_URL" \
            --network-passphrase "$LOCAL_NETWORK_PASSPHRASE" \
            || true

          fund_with_retry() {
            local key_name="$1"
            stellar keys generate "$key_name" --network local
            for i in $(seq 1 30); do
              if stellar keys fund "$key_name" --network local; then
                return 0
              fi
              echo "Funding $key_name failed (attempt $i/30), retrying..." >&2
              sleep 2
            done
            echo "Failed to fund $key_name after retries." >&2
            return 1
          }

          fund_with_retry admin
          fund_with_retry recipient
          ADMIN_ADDR=$(stellar keys address admin)
          RECIPIENT_ADDR=$(stellar keys address recipient)

          CONTRACT_ID=$(stellar contract deploy \
            --wasm contracts/target/wasm32v1-none/release/trident_reference_token.wasm \
            --source admin \
            --network local)
          echo "contract_id=$CONTRACT_ID" >> "$GITHUB_OUTPUT"

          stellar contract invoke \
            --id "$CONTRACT_ID" --source admin --network local \
            -- initialize --admin "$ADMIN_ADDR" --decimal 7 \
                --name "E2E Token" --symbol E2E

          # The mint call is what the E2E assertion below waits for: it
          # publishes a `mint` event with topics (admin, recipient) and an
          # i128 amount body, decoded by
          # crates/indexer/src/parser/token_events.rs.
          stellar contract invoke \
            --id "$CONTRACT_ID" --source admin --network local \
            -- mint --to "$RECIPIENT_ADDR" --amount 4200000

          echo "recipient_addr=$RECIPIENT_ADDR" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0

      - name: Restore Go API image cache
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: services/api/Dockerfile
          push: false
          tags: trident-go-api:ci
          cache-from: type=gha,scope=go-api

      - name: Restore Rust gRPC API image cache
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: crates/api/Dockerfile
          push: false
          tags: trident-grpc-api:ci
          cache-from: type=gha,scope=grpc-api

      - name: Restore Rust indexer image cache
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: crates/indexer/Dockerfile
          push: false
          tags: trident-indexer:ci
          cache-from: type=gha,scope=indexer

      - name: Start the full stack against the local network
        run: |
          docker compose \
            -f docker/docker-compose.yml \
            -f docker/docker-compose.ci.yml \
            -f docker/docker-compose.e2e.yml \
            --env-file .env.ci \
            up -d --build

      - name: Wait for Go API to become healthy
        run: |
          curl --silent --fail --retry 20 --retry-delay 5 --retry-connrefused \
            --max-time 10 http://localhost:3000/v1/health

      # Same rationale as the smoke-test job: curl's exit code alone does not
      # identify which service failed to start.
      - name: Dump stack state and logs on failure
        if: failure()
        run: |
          cd docker
          echo "::group::container status"
          docker compose -f docker-compose.yml -f docker-compose.ci.yml --env-file ../.env.ci ps -a
          echo "::endgroup::"
          for svc in postgres redis grpc-api indexer api; do
            echo "::group::${svc} logs"
            docker compose -f docker-compose.yml -f docker-compose.ci.yml --env-file ../.env.ci logs --tail=120 "${svc}" || true
            echo "::endgroup::"
          done

      - name: Poll /v1/events for the decoded mint event
        env:
          CI_API_KEY: ci-test-api-key-do-not-use-in-production
          CONTRACT_ID: ${{ steps.deploy.outputs.contract_id }}
          RECIPIENT_ADDR: ${{ steps.deploy.outputs.recipient_addr }}
        run: |
          set -euo pipefail
          echo "Waiting for the mint event to be indexed (contract $CONTRACT_ID)..."
          for i in $(seq 1 30); do
            RESPONSE=$(curl -sS --fail \
              -H "X-API-Key: ${CI_API_KEY}" \
              "http://localhost:3000/v1/events?contractId=${CONTRACT_ID}&limit=10") || RESPONSE=""

            if echo "$RESPONSE" | python3 .github/scripts/assert_mint_event.py "$RECIPIENT_ADDR"; then
              echo "✓ mint event indexed and decoded correctly"
              exit 0
            fi
            sleep 2
          done
          echo "Mint event was not indexed within the bounded wait." >&2
          exit 1

      - name: Dump service logs
        if: always()
        run: |
          echo "=== quickstart logs ==="
          docker logs stellar-quickstart || true
          echo "=== docker compose ps ==="
          docker compose \
            -f docker/docker-compose.yml \
            -f docker/docker-compose.ci.yml \
            -f docker/docker-compose.e2e.yml \
            --env-file .env.ci \
            ps
          echo "=== Service logs ==="
          docker compose \
            -f docker/docker-compose.yml \
            -f docker/docker-compose.ci.yml \
            -f docker/docker-compose.e2e.yml \
            --env-file .env.ci \
            logs --no-color --timestamps

      - name: Tear down
        if: always()
        run: |
          docker compose \
            -f docker/docker-compose.yml \
            -f docker/docker-compose.ci.yml \
            -f docker/docker-compose.e2e.yml \
            --env-file .env.ci \
            down -v --remove-orphans
          docker rm -f stellar-quickstart || true

  # ---------------------------------------------------------------------------
  # Environment reference — fails if code reads an env var undocumented in
  # docs/ENVIRONMENT.md (issue #312).
  # ---------------------------------------------------------------------------
  env-reference:
    name: Env reference
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Check every env var the code reads is documented
        run: bash scripts/check-env-reference.sh

      # Catches two migrations sharing a version prefix before it reaches a
      # real database. The rust-integration job applies migrations with a
      # `for f in *.sql` psql loop rather than the sqlx migrator, so it cannot
      # catch this on its own (issue #371).
      - name: Check migration versions are unique
        run: bash scripts/check-migration-versions.sh

      # A fabricated placeholder digest ("...4e4e4e4e4e") sat in
      # database/Dockerfile and only ever surfaced as a Docker build failure,
      # because the tag beside it looked correct and nothing checked the digest
      # itself. Shape check only — no registry calls (issue #371).
      - name: Check base image digests are well-formed
        run: bash scripts/check-image-digests.sh

  # ---------------------------------------------------------------------------
  # Helm — lint, template render, and kind cluster deployment validation
  # ---------------------------------------------------------------------------
  helm:
    name: Helm
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up Helm
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
        with:
          version: "3.14.0"

      - name: Lint chart
        run: helm lint helm/trident

      - name: Render templates
        run: helm template trident helm/trident

      - name: Create kind cluster
        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
        with:
          cluster_name: trident-ci

      - name: Create CI secrets
        run: |
          kubectl create secret generic trident-secrets \
            --from-literal=DATABASE_URL="postgres://trident:trident@postgres:5432/trident" \
            --from-literal=REDIS_URL="redis://redis:6379" \
            --from-literal=ADMIN_API_KEY="ci-admin-key"

      # migrations.enabled=false alongside the busybox image overrides: the
      # migration Job is a pre-install hook, and Helm always waits on hooks
      # regardless of --wait=false. It pulls the real migrate image and runs
      # sqlx against postgres:5432, which does not exist in the kind cluster,
      # so it can only ever burn the full --timeout and fail. This job checks
      # that the chart renders and its resources are created, not that
      # migrations run.
      - name: Install chart (CI values — nginx only, no image pull)
        run: |
          helm install trident helm/trident \
            --set indexer.image.repository=busybox \
            --set indexer.image.tag=latest \
            --set grpcApi.image.repository=busybox \
            --set grpcApi.image.tag=latest \
            --set goApi.image.repository=busybox \
            --set goApi.image.tag=latest \
            --set migrations.enabled=false \
            --wait=false \
            --timeout=60s

      - name: Verify Kubernetes resources are created
        run: |
          kubectl get deployments
          kubectl get services
          kubectl get hpa