ci-cd.yml

name: CI/CD Pipeline

on:
  push:
    branches: ["main", "dev"]
  pull_request:
    branches: ["main", "dev"]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ─────────────────────────────────────────────
  # Smart Contracts (Rust / Soroban)
  # ─────────────────────────────────────────────
  contracts:
    name: Contracts — Lint, Build, Test
    runs-on: ubuntu-latest
    env:
      CARGO_TERM_COLOR: always
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          components: rustfmt, clippy

      - name: Install sccache
        uses: mozilla-actions/sccache-action@v0.0.4

      - name: Configure sccache
        run: |
          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV

      - name: Cache cargo registry & build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-${{ hashFiles('stellar-lend/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Check formatting
        run: |
          cd stellar-lend
          cargo fmt --all -- --check

      - name: Run clippy
        run: |
          cd stellar-lend
          cargo clippy --all-targets --all-features -- -D warnings

      - name: Build
        run: |
          cd stellar-lend
          cargo build --verbose

      - name: Run tests
        run: |
          cd stellar-lend
          cargo test --verbose

      - name: Run gas benchmark suite
        run: |
          cd stellar-lend
          GAS_BENCHMARK_OUTPUT=benchmarks/gas-current.json cargo test --package hello-world gas_benchmark -- --nocapture

      - name: Compare gas benchmarks against baseline
        run: |
          cd stellar-lend
          python3 scripts/check_gas_benchmarks.py \
            --baseline benchmarks/gas-baseline.json \
            --current benchmarks/gas-current.json \
            --max-regression-pct 10

      - name: Upload gas benchmark report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gas-benchmark-report
          path: stellar-lend/benchmarks/gas-current.json

      - name: Run cross-contract tests
        run: |
          cd stellar-lend
          cargo test --package hello-world --lib cross_contract_test 2>&1 | tee cross-contract-test-report.txt
          grep "test result:" cross-contract-test-report.txt

      - name: Upload cross-contract test report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cross-contract-test-report
          path: stellar-lend/cross-contract-test-report.txt

      - name: Run differential tests
        run: |
          cd stellar-lend
          cargo test --package hello-world --lib tests::differential_test -- --nocapture 2>&1 | tee differential-test-report.txt
          cargo test --package hello-world --lib tests::migration_verification_test -- --nocapture 2>&1 | tee -a differential-test-report.txt
          grep "test result:" differential-test-report.txt

      - name: Upload differential test report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: differential-test-report
          path: stellar-lend/differential-test-report.txt

      - name: Cache cargo-audit binary
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/cargo-audit
          key: ${{ runner.os }}-cargo-audit-${{ hashFiles('stellar-lend/.cargo/audit.toml') }}

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run security audit
        run: |
          cd stellar-lend
          cargo audit

  fuzzing:
    name: Contracts — Fuzz (Smoke)
    runs-on: ubuntu-latest
    env:
      CARGO_TERM_COLOR: always
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install clang (libFuzzer toolchain)
        run: |
          sudo apt-get update
          sudo apt-get install -y clang llvm

      - name: Install Rust toolchain (nightly for sanitizers)
        uses: dtolnay/rust-toolchain@nightly
        with:
          toolchain: nightly

      - name: Cache cargo registry & build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            stellar-lend/target
          key: ${{ runner.os }}-cargo-fuzz-${{ hashFiles('stellar-lend/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-fuzz-

      - name: Cache cargo-fuzz binary
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/cargo-fuzz
          key: ${{ runner.os }}-cargo-fuzz-nightly-${{ hashFiles('stellar-lend/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-fuzz-nightly-

      - name: Install cargo-fuzz
        run: cargo +nightly install cargo-fuzz --locked

      - name: Corpus sanity check
        run: bash scripts/fuzz/check_corpus.sh

      - name: Run fuzz smoke suite
        env:
          FUZZ_RUNS: "3000"
          FUZZ_TIMEOUT_SEC: "5"
        run: bash scripts/fuzz/run_ci_smoke.sh

# ──────────────────────────────────────────
  # Invariant Testing — protocol correctness
  # ──────────────────────────────────────────
  invariant-testing:
    name: Contracts — Invariant Testing
    runs-on: ubuntu-latest
    needs: contracts
    env:
      CARGO_TERM_COLOR: always
      INVARIANT_RUNS: "500"
      INVARIANT_SEED: "42"
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Rust toolchain (nightly for cargo-fuzz)
        uses: dtolnay/rust-toolchain@nightly
        with:
          toolchain: nightly

      - name: Cache cargo registry & build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            stellar-lend/target
          key: ${{ runner.os }}-cargo-invariant-${{ hashFiles('stellar-lend/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-invariant-

      - name: Cache cargo-fuzz binary
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/cargo-fuzz
          key: ${{ runner.os }}-cargo-fuzz-nightly-${{ hashFiles('stellar-lend/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-fuzz-nightly-

      - name: Install cargo-fuzz
        run: cargo +nightly install cargo-fuzz --locked

      - name: Run lending invariant fuzzer
        working-directory: stellar-lend
        run: |
          cargo +nightly fuzz run lending_actions \
            -- \
            -runs=${{ env.INVARIANT_RUNS }} \
            -seed=${{ env.INVARIANT_SEED }} \
            -max_len=2048 \
            2>&1 | tee invariant-report.txt

      - name: Fail on any invariant violation
        run: |
          if grep -q "INVARIANT VIOLATION" stellar-lend/invariant-report.txt; then
            echo "::error::Invariant violation detected — see uploaded report"
            exit 1
          fi

      - name: Upload invariant report (always)
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: invariant-report-${{ github.sha }}
          path: stellar-lend/invariant-report.txt
          retention-days: 30

      - name: Upload violation corpus (on failure only)
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: invariant-violations-${{ github.sha }}
          path: stellar-lend/fuzz/artifacts/lending_actions/
          retention-days: 30

          
  # ─────────────────────────────────────────────
  # Workspace — validate root monorepo scripts
  # ─────────────────────────────────────────────
  workspace:
    name: Workspace — Root install & script validation
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js 20
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install all workspace dependencies from root
        run: npm install --workspaces

      - name: Verify workspace scripts are resolvable
        run: |
          echo "Checking root workspace scripts..."
          node -e "
            const p = require('./package.json');
            const required = ['test:all','lint:all','build:all','install:all'];
            required.forEach(s => {
              if (!p.scripts[s]) { console.error('Missing script: ' + s); process.exit(1); }
              console.log('OK: ' + s + ' => ' + p.scripts[s]);
            });
          "

  # ─────────────────────────────────────────────
  # API (TypeScript / Express / Jest)
  # ─────────────────────────────────────────────
  api:
    name: API — Lint, Test, Build
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18, 20]
    defaults:
      run:
        working-directory: api
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Format check
        run: npx prettier --check "src/**/*.ts"

      - name: Type check
        run: npx tsc --noEmit

      - name: Run tests
        run: npm test

      - name: Build
        run: npm run build

      - name: Upload coverage
        if: always() && matrix.node-version == 20
        uses: actions/upload-artifact@v4
        with:
          name: api-coverage
          path: api/coverage/

  # ─────────────────────────────────────────────
  # Oracle (TypeScript / Vitest)
  # ─────────────────────────────────────────────
  oracle:
    name: Oracle — Lint, Test, Build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: oracle
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js 20
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Format check
        run: npx prettier --check "src/**/*.ts" "tests/**/*.ts"

      - name: Type check
        run: npx tsc --noEmit

      - name: Run tests
        run: npm test

      - name: Run tests with coverage
        run: npm run test:coverage

      - name: Build
        run: npm run build

      - name: Upload coverage
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: oracle-coverage
          path: oracle/coverage/

  # ─────────────────────────────────────────────
  # Quality Gate — all jobs must pass
  # ─────────────────────────────────────────────
  quality-gate:
    name: Quality Gate
    runs-on: ubuntu-latest
    needs: [contracts, fuzzing, api, oracle, workspace]
    if: always()
    steps:
      - name: Check all jobs passed
        run: |
          echo "Contracts: ${{ needs.contracts.result }} (non-blocking — pre-existing issues)"
          echo "Fuzzing:   ${{ needs.fuzzing.result }}"
          echo "API:       ${{ needs.api.result }}"
          echo "Oracle:    ${{ needs.oracle.result }}"
          echo "Workspace: ${{ needs.workspace.result }}"

          if [[ "${{ needs.api.result }}" != "success" ]] || \
             [[ "${{ needs.oracle.result }}" != "success" ]] || \
             [[ "${{ needs.contracts.result }}" != "success" ]] || \
             [[ "${{ needs.fuzzing.result }}" != "success" ]] || \
             [[ "${{ needs.workspace.result }}" != "success" ]]; then
            echo "::error::One or more quality checks failed. PR cannot be merged."
            exit 1
          fi

          echo "All required quality checks passed!"