ci.yml

name: CI
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  schedule:
    # Nightly property tests
    - cron: '23 4 * * *'
    # Weekly gas baseline rotation (Mondays 05:17 UTC)
    - cron: '17 5 * * 1'

# Reviewed toolchain pins. Bump them only through the process in SUPPLY_CHAIN.md.
env:
  RUST_TOOLCHAIN: '1.98.1'
  RUST_NIGHTLY_TOOLCHAIN: 'nightly-2026-09-01'
  NODE_VERSION: '22.23.2'
  PNPM_VERSION: '10.28.2'
  STELLAR_CLI_VERSION: '26.1.0'
  # sha256 of stellar-cli-${STELLAR_CLI_VERSION}-x86_64-unknown-linux-gnu.tar.gz,
  # as published by the upstream release.
  STELLAR_CLI_SHA256: 'e18d5a7629102e1ccc07241acbcbebfc05b1c02476ce7d3204ba2d7418be5c0c'
  FOUNDRY_VERSION: 'v1.8.3'
  SLITHER_VERSION: '0.11.4'
  KANI_VERSION: '0.68.0'

jobs:
  changes:
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    permissions:
      pull-requests: read
    outputs:
      evm: ${{ steps.filter.outputs.evm }}
      stellar: ${{ steps.filter.outputs.stellar }}
      solana: ${{ steps.filter.outputs.solana }}
      ckb: ${{ steps.filter.outputs.ckb }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: filter
        with:
          filters: |
            evm:
              - 'evm/**'
            stellar:
              - 'stellar/**'
            solana:
              - 'solana/**'
            ckb:
              - 'ckb/**'

  evm:
    needs: changes
    if: needs.changes.outputs.evm == 'true'
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: evm
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # forge-std is a pinned submodule (v1.16.2); openzeppelin and
          # wraith-contracts are symlinks into evm/node_modules and evm/contracts.
          submodules: recursive
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: npm ci
      - run: npx prettier --check --ignore-path ../.prettierignore .
      - run: npx hardhat compile
      - run: npx hardhat test
      - run: npm run validate-subgraph

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
        with:
          version: ${{ env.FOUNDRY_VERSION }}

      - name: Run Foundry invariant tests
        working-directory: evm/foundry
        run: |
          forge test --match-path 'test/invariant/*'

      - name: Check gas snapshot (diff gate, +5% tolerance)
        working-directory: evm/foundry
        run: |
          # Invariant suites carry run-to-run `reverts:` counters, so gate only
          # the deterministic gas tests. Any regression >5% fails the PR.
          forge snapshot --no-match-path 'test/invariant/*' --check --tolerance 5

      - name: Run Slither
        uses: crytic/slither-action@b52cc1cbfee9ca3e8722dd5224299d16c9a6b80f # v0.4.2
        continue-on-error: false
        with:
          target: evm
          slither-config: evm/slither.config.json
          fail-on: medium
          solc-version: 0.8.28
          slither-version: ${{ env.SLITHER_VERSION }}
          sarif: evm/results.sarif

      - name: Upload Slither SARIF
        if: always() && hashFiles('evm/results.sarif') != ''
        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          sarif_file: evm/results.sarif
          category: slither

      - name: Build and test subgraph
        working-directory: evm/subgraph
        run: |
          npm ci
          npm run codegen
          npm run build
          # Fixture tests for every mapping and call handler. The Matchstick
          # rust binary version is pinned in the package.json test script so
          # CI does not track LimeChain/matchstick's `latest` release.
          npm test

  stellar:
    needs: changes
    if: needs.changes.outputs.stellar == 'true'
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: stellar
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Enable corepack (pins pnpm from packageManager field)
        run: |
          corepack enable
          corepack prepare "pnpm@${PNPM_VERSION}" --activate
          pnpm --version

      - name: Install Node dependencies
        run: pnpm install --frozen-lockfile
        working-directory: .

      - name: Smoke test generated Stellar bindings
        run: pnpm test:stellar-bindings
        working-directory: .

      # The metrics indexer is a standalone Node package with its own lockfile
      # (like evm/ and solana/). Install and test it so its RPC/health
      # guarantees stay enforced; the root pnpm install does not cover it.
      - name: Install metrics indexer dependencies
        working-directory: stellar/scripts/metrics-indexer
        run: npm ci

      - name: Test metrics indexer
        working-directory: stellar/scripts/metrics-indexer
        run: npm test

      - name: Setup Stellar CLI
        run: |
          curl -sSfL -o stellar-cli.tar.gz \
            "https://github.com/stellar/stellar-cli/releases/download/v${STELLAR_CLI_VERSION}/stellar-cli-${STELLAR_CLI_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
          echo "${STELLAR_CLI_SHA256}  stellar-cli.tar.gz" | sha256sum -c -
          tar xzf stellar-cli.tar.gz stellar
          rm stellar-cli.tar.gz
          sudo mv stellar /usr/local/bin/stellar
          sudo ln -sf /usr/local/bin/stellar /usr/local/bin/soroban
          stellar --version

      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          targets: wasm32-unknown-unknown
          components: rustfmt

      - run: cargo fmt --all --check
      - name: Check Stellar error catalog
        run: |
          python3 - <<'PY'
          from pathlib import Path
          import re
          import sys

          root = Path('.')
          doc = Path('ERRORS.md').read_text(encoding='utf-8')
          missing = []

          for path in sorted(root.glob('**/*.rs')):
              parts = set(path.parts)
              if {'bench', 'bench-crossover', 'fuzz', 'integration-tests'} & parts:
                  continue

              lines = path.read_text(encoding='utf-8').splitlines()
              i = 0
              while i < len(lines):
                  if 'contracterror' not in lines[i]:
                      i += 1
                      continue

                  j = i + 1
                  while j < len(lines) and 'pub enum ' not in lines[j]:
                      j += 1
                  if j == len(lines):
                      i += 1
                      continue

                  match = re.search(r'pub enum\s+([A-Za-z0-9_]+)', lines[j])
                  if not match:
                      i = j + 1
                      continue
                  enum_name = match.group(1)

                  brace_depth = lines[j].count('{') - lines[j].count('}')
                  k = j + 1
                  while k < len(lines) and brace_depth > 0:
                      line = lines[k]
                      variant = re.match(r'\s*([A-Za-z][A-Za-z0-9_]*)\s*=\s*\d+\s*,', line)
                      if variant:
                          token = f'{enum_name}::{variant.group(1)}'
                          if token not in doc:
                              missing.append(f'{path}:{k + 1}: {token}')
                      brace_depth += line.count('{') - line.count('}')
                      k += 1
                  i = k

          if missing:
              print('ERRORS.md is missing contracterror variants:')
              print('\n'.join(missing))
              sys.exit(1)
          PY
      - run: cargo test --workspace
      - name: Run stellar resource benches
        run: |
          cargo bench -p wraith-stellar-bench-crossover --bench crossover
          test -f bench/data/crossover.csv
          test -f bench/data/crossover-chart.md
          echo "---- crossover.csv ----"
          cat bench/data/crossover.csv
      - name: Upload crossover bench data
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: crossover-bench-data
          path: |
            stellar/bench/data/crossover.csv
            stellar/bench/data/crossover-chart.md
      # The 162 errors this step used to produce were not a soroban-sdk/rustc
      # incompatibility: a plain `cargo build` in a virtual workspace selects
      # every member, and bench, bench-crossover and integration-tests enable
      # soroban-sdk/testutils, which the SDK refuses to compile for wasm32.
      # default-members in stellar/Cargo.toml limits the default build to the
      # contract crates. See SUPPLY_CHAIN.md for the pins and upgrade path.
      - name: Build WASM
        run: cargo build --target wasm32-unknown-unknown --release
      - name: Optimize and Check WASM Size
        run: |
          shopt -s nullglob
          artifacts=(target/wasm32-unknown-unknown/release/*.wasm)
          if [ ${#artifacts[@]} -eq 0 ]; then
            echo "Error: the WASM build produced no artifacts."
            exit 1
          fi
          for wasm in "${artifacts[@]}"; do
            stellar contract optimize --wasm "$wasm"
            # `contract optimize` writes "<name>.optimized.wasm" beside the input.
            opt_wasm="${wasm%.wasm}.optimized.wasm"
            SIZE=$(stat -c%s "$opt_wasm")
            echo "$opt_wasm size is $SIZE bytes"
            if [ "$SIZE" -gt 112640 ]; then
              echo "Error: $opt_wasm exceeds 110 KB limit"
              exit 1
            fi
          done

      - name: Run Upgrade Authority Enforcement Tests
        run: cargo test upgrade_auth --workspace

      - name: Generate Stellar TypeScript bindings
        run: pnpm bindings:stellar
        working-directory: .

      # Scoped to the generated artifacts: `cargo test --workspace` earlier in
      # this job rewrites soroban test_snapshots, and that churn must not be
      # attributed to the bindings.
      - name: Check for bindings drift (diff detection)
        working-directory: .
        run: |
          if [ -n "$(git status --porcelain --untracked-files=all -- stellar/bindings)" ]; then
            git --no-pager status --short --untracked-files=all -- stellar/bindings
            git --no-pager diff -- stellar/bindings
            echo "Error: Stellar bindings are out of date. Run pnpm bindings:stellar and commit the result."
            exit 1
          fi

      - name: Extract ABI snapshots
        run: ./abi/update.sh
      - name: Check ABI snapshots
        run: |
          if [ -n "$(git status --porcelain --untracked-files=all -- abi/)" ]; then
            git --no-pager status --short --untracked-files=all -- abi/
            git --no-pager diff --stat -- abi/
            echo "Error: ABI snapshots are out of date. Run stellar/abi/update.sh and commit the result."
            exit 1
          fi

      - name: Test validate-deployment script (mocked CLI)
        run: bash scripts/validate-deployment.test.sh

  stellar-kani:
    needs: changes
    if: needs.changes.outputs.stellar == 'true'
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Verify stealth-registry invariants with Kani
        uses: model-checking/kani-github-action@69d357bade1eb7b32bc3fc3d5c3d173c5bfa5237 # v1
        with:
          kani-version: ${{ env.KANI_VERSION }}
          working-directory: stellar/stealth-registry

      - name: Verify stealth-vault invariants with Kani
        uses: model-checking/kani-github-action@69d357bade1eb7b32bc3fc3d5c3d173c5bfa5237 # v1
        with:
          kani-version: ${{ env.KANI_VERSION }}
          working-directory: stellar/stealth-vault

  stellar-nightly:
    if: github.event_name == 'schedule' && github.event.schedule == '23 4 * * *'
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: stellar
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          targets: wasm32-unknown-unknown
          components: rustfmt
      - run: cargo fmt --all --check
      - run: WRAITH_PROPTEST_CASES=16384 cargo test --workspace --test properties

  stellar-deploy-dryrun:
    if: github.event_name == 'schedule' && github.event.schedule == '23 4 * * *'
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: stellar
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          targets: wasm32-unknown-unknown

      - name: Setup Stellar CLI
        run: |
          curl -sSfL -o stellar-cli.tar.gz \
            "https://github.com/stellar/stellar-cli/releases/download/v${STELLAR_CLI_VERSION}/stellar-cli-${STELLAR_CLI_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
          echo "${STELLAR_CLI_SHA256}  stellar-cli.tar.gz" | sha256sum -c -
          tar xzf stellar-cli.tar.gz stellar
          rm stellar-cli.tar.gz
          sudo mv stellar /usr/local/bin/stellar
          sudo ln -sf /usr/local/bin/stellar /usr/local/bin/soroban
          stellar --version

      - name: Cache Cargo build
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            stellar/target
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-stellar-dryrun-${{ hashFiles('stellar/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-stellar-dryrun-

      - name: Run deploy dry-run
        env:
          STELLAR_ADMIN_SECRET: ${{ secrets.FUTURENET_TEST_SECRET }}
          RPC_URL: https://rpc-futurenet.stellar.org
          IDENTITY_NAME: wraith-dryrun-ci
        run: |
          set -euo pipefail
          ./scripts/deploy-dryrun.sh 2>&1 | tee deploy-dryrun-output.txt
          exit_code=${PIPESTATUS[0]}
          if [ $exit_code -ne 0 ]; then
            echo "::error::Deploy dry-run script failed with exit code $exit_code"
            exit $exit_code
          fi

      - name: Validate deployment output
        run: |
          chmod +x ./scripts/validate-deployment.sh
          ./scripts/validate-deployment.sh deploy-dryrun-output.txt futurenet

      - name: Parse and save contract IDs
        run: |
          cat deploy-dryrun-output.txt | grep -E '(stealth-announcer|stealth-registry|stealth-sender|wraith-names)\s' | \
            awk '{print $1, $2}' > contract-ids.txt
          
          # Verify contract-ids.txt is not empty
          if [ ! -s contract-ids.txt ]; then
            echo "::error::contract-ids.txt is empty - failed to parse contract IDs"
            exit 1
          fi
          
          # Count lines to verify all 4 contracts are present
          contract_count=$(wc -l < contract-ids.txt)
          if [ "$contract_count" -ne 4 ]; then
            echo "::error::Expected 4 contract IDs, found $contract_count"
            cat contract-ids.txt
            exit 1
          fi
          
          echo "### Deploy Dry-Run Results" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          cat deploy-dryrun-output.txt >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Contract Manifest" >> $GITHUB_STEP_SUMMARY
          echo '```json' >> $GITHUB_STEP_SUMMARY
          cat deploy-dryrun-output-manifest.json >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

      - name: Upload dry-run output
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always()
        with:
          name: deploy-dryrun-results
          path: |
            stellar/deploy-dryrun-output.txt
            stellar/deploy-dryrun-output-manifest.json
            stellar/contract-ids.txt

  stellar-chaos-nightly:
    if: github.event_name == 'schedule' && github.event.schedule == '23 4 * * *'
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: stellar
    env:
      WRAITHCHAOS_MODE: "1"
      WRAITHCHAOS_FAILURE_RATE: "0.3"
      WRAITHCHAOS_SEED: "42"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - name: Run chaos integration tests
        # Covers: announcer, registry, sender, names (Wave 6)
        #         vault, splitter, batch-sender, governance (Wave 7)
        run: cargo test --package integration-tests -- --nocapture

  # Run benches on develop, upload results artifact, auto-update PERF.md.
  # Note: cargo bench runs with CWD = package dir (stellar/bench/), so --out
  # paths are relative to stellar/bench/ (e.g. results.json -> stellar/bench/results.json).
  stellar-bench-develop:
    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    defaults:
      run:
        working-directory: stellar
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Run gas bench
        env:
          GITHUB_SHA: ${{ github.sha }}
        run: |
          cargo bench -p wraith-stellar-bench --bench gas -- \
            --format json --out results.json
          test -f bench/results.json

      - name: Upload bench results artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: stellar-bench-results
          path: stellar/bench/results.json
          retention-days: 90

      - name: Update PERF.md current numbers
        run: python3 bench/update_perf_md.py PERF.md bench/results.json

      - name: Commit PERF.md if changed
        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
        with:
          commit_message: 'chore(perf): auto-update Stellar PERF.md bench table'
          file_pattern: stellar/PERF.md
          commit_user_name: github-actions[bot]
          commit_user_email: github-actions[bot]@users.noreply.github.com

  # PR gate: fail when required operations or resource dimensions regress.
  stellar-bench-pr:
    needs: changes
    if: github.event_name == 'pull_request' && needs.changes.outputs.stellar == 'true'
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: stellar
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Test Stellar benchmark comparator
        run: python3 bench/test_compare.py

      - name: Download weekly baseline artifact
        id: download-baseline
        uses: dawidd6/action-download-artifact@eab87c9830c39eff17e5a6eadb20bfb4bc880477 # v27
        continue-on-error: true
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          workflow: ci.yml
          branch: develop
          name: stellar-bench-baseline
          path: stellar/bench/artifact-baseline
          search_artifacts: true
          if_no_artifact_found: warn

      - name: Resolve baseline path
        id: baseline
        run: |
          if [ -f bench/artifact-baseline/baseline.json ]; then
            echo "path=bench/artifact-baseline/baseline.json" >> "$GITHUB_OUTPUT"
            echo "Using weekly-rotated artifact baseline"
          else
            echo "path=bench/baseline.json" >> "$GITHUB_OUTPUT"
            echo "Using committed bench/baseline.json fallback"
          fi

      - name: Run gas bench
        env:
          GITHUB_SHA: ${{ github.sha }}
        run: |
          cargo bench -p wraith-stellar-bench --bench gas -- \
            --format json --out results.json
          test -f bench/results.json

      - name: Compare vs baseline (+5% resource gate)
        run: |
          python3 bench/compare.py \
            "${{ steps.baseline.outputs.path }}" \
            bench/results.json \
            --threshold-pct 5

      - name: Upload PR bench results
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: stellar-bench-pr-${{ github.event.pull_request.number }}
          path: stellar/bench/results.json
          retention-days: 30

  # Weekly baseline rotation to catch slow drift under the 5% PR gate.
  stellar-bench-baseline-rotate:
    if: github.event_name == 'schedule' && github.event.schedule == '17 5 * * 1'
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    defaults:
      run:
        working-directory: stellar
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: develop
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Run gas bench (rotate baseline)
        env:
          GITHUB_SHA: ${{ github.sha }}
        run: |
          cargo bench -p wraith-stellar-bench --bench gas -- \
            --format json --out baseline.json
          test -f bench/baseline.json

      - name: Upload rotated baseline artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: stellar-bench-baseline
          path: stellar/bench/baseline.json
          retention-days: 90

      - name: Commit rotated baseline.json
        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
        with:
          commit_message: 'chore(perf): rotate Stellar gas bench baseline'
          file_pattern: stellar/bench/baseline.json
          commit_user_name: github-actions[bot]
          commit_user_email: github-actions[bot]@users.noreply.github.com

  solana:
    needs: changes
    if: needs.changes.outputs.solana == 'true'
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: solana
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: '1.91.0'
      - uses: heyAyushh/setup-anchor@0dfcdd252cd9716ef398947d2b765369c9f3a6de # v4.999
        with:
          anchor-version: 0.30.1
          solana-cli-version: 1.18.17
          node-version: 20.15.0
      - run: anchor build

  ckb:
    needs: changes
    if: needs.changes.outputs.ckb == 'true'
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: ckb
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          targets: riscv64imac-unknown-none-elf
      - run: sudo apt-get update && sudo apt-get install -y gcc-riscv64-unknown-elf
      - run: CC_riscv64imac_unknown_none_elf=riscv64-unknown-elf-gcc cargo build --target riscv64imac-unknown-none-elf --release -p wraith-stealth-lock
      # Transaction-level tests (#195): run the compiled RISC-V artifact inside
      # ckb-testtool's in-process simulator. Covers signature/argument validation,
      # malformed cells, amount checks, the produced code hash, and writes a
      # CKB-debugger-replayable fixture for every failing transaction.
      - name: Run CKB lock-script integration tests
        run: make test-ci
      - name: Upload CKB transaction fixtures
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ckb-transaction-fixtures
          path: ckb/target/ckb-fixtures/
          if-no-files-found: ignore
          retention-days: 14

  fuzz:
    # Nightly cargo-fuzz run against stealth-sender's batch payload surface.
    # Scheduled/manual only — a 30-minute budget is too heavy for every PR.
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: stellar/stealth-sender/fuzz
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_NIGHTLY_TOOLCHAIN }}
      - name: Install cargo-fuzz
        run: cargo install cargo-fuzz --version "=0.12.0" --locked
      # 30-minute total budget, split evenly across the two targets (900s each).
      - name: Fuzz batch_decode
        run: cargo fuzz run batch_decode -- -max_total_time=900
      - name: Fuzz batch_execute
        run: cargo fuzz run batch_execute -- -max_total_time=900
      - name: Upload crash artifacts
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: fuzz-artifacts
          path: stellar/stealth-sender/fuzz/artifacts/

  conformance:
    needs: changes
    if: needs.changes.outputs.evm == 'true' || needs.changes.outputs.stellar == 'true'
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: npm ci
        working-directory: evm
      - run: npx hardhat test test/conformance.test.ts
        working-directory: evm
      - run: npm ci
        working-directory: evm/subgraph
      - run: npm run codegen
        working-directory: evm/subgraph
      - run: npm run test -- conformance
        working-directory: evm/subgraph
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - run: cargo test --package integration-tests --test conformance
        working-directory: stellar