ci.yml

name: CI

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"

jobs:
  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-audit
        run: |
          for i in 1 2 3; do
            cargo install cargo-audit --locked && break
            echo "cargo install attempt $i failed, retrying..." && sleep 15
          done
          cargo audit --version

      - name: Audit dependencies
        run: cargo audit

  # Circuits must run before contracts because contract tests embed circuit
  # artifacts (vk, proof, public_inputs) via include_bytes!.
  circuits:
    name: Circuit Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Nargo
        run: |
          curl -L https://raw.githubusercontent.com/noir-lang/noirup/main/install | bash
          export PATH="$HOME/.nargo/bin:$PATH"
          noirup -v 1.0.0-beta.9
          nargo --version

      - name: Install Barretenberg
        run: |
          curl -L https://raw.githubusercontent.com/AztecProtocol/aztec-packages/master/barretenberg/bbup/install | bash
          export PATH="$HOME/.bb:$PATH"
          bbup -v 0.87.0
          bb --version

      - name: Compile shielded_pool circuit
        run: |
          export PATH="$HOME/.nargo/bin:$HOME/.bb:$PATH"
          cd circuits/shielded_pool && nargo compile

      - name: Compile compliance circuit
        run: |
          export PATH="$HOME/.nargo/bin:$HOME/.bb:$PATH"
          cd circuits/compliance && nargo compile

      - name: Compile hasher circuit
        run: |
          export PATH="$HOME/.nargo/bin:$HOME/.bb:$PATH"
          cd circuits/hasher && nargo compile

      - name: Generate and verify shielded_pool proof
        run: |
          export PATH="$HOME/.nargo/bin:$HOME/.bb:$PATH"
          cd circuits/shielded_pool
          nargo execute
          bb write_vk --scheme ultra_honk --oracle_hash keccak \
            --bytecode_path target/shielded_pool.json \
            --output_path target --output_format bytes_and_fields
          bb prove --scheme ultra_honk --oracle_hash keccak \
            --bytecode_path target/shielded_pool.json \
            --witness_path target/shielded_pool.gz \
            --output_path target --output_format bytes_and_fields
          bb verify -s ultra_honk --oracle_hash keccak \
            -k target/vk -p target/proof -i target/public_inputs

      - name: Generate and verify compliance proof
        run: |
          export PATH="$HOME/.nargo/bin:$HOME/.bb:$PATH"
          cd circuits/compliance
          nargo execute
          bb write_vk --scheme ultra_honk --oracle_hash keccak \
            --bytecode_path target/compliance.json \
            --output_path target --output_format bytes_and_fields
          bb prove --scheme ultra_honk --oracle_hash keccak \
            --bytecode_path target/compliance.json \
            --witness_path target/compliance.gz \
            --output_path target --output_format bytes_and_fields
          bb verify -s ultra_honk --oracle_hash keccak \
            -k target/vk -p target/proof -i target/public_inputs

      - name: Compile disclosure circuit
        run: |
          export PATH="$HOME/.nargo/bin:$HOME/.bb:$PATH"
          cd circuits/disclosure && nargo compile

      - name: Generate and verify disclosure proof
        run: |
          export PATH="$HOME/.nargo/bin:$HOME/.bb:$PATH"
          cd circuits/disclosure
          nargo execute
          bb write_vk --scheme ultra_honk --oracle_hash keccak \
            --bytecode_path target/disclosure.json \
            --output_path target --output_format bytes_and_fields
          bb prove --scheme ultra_honk --oracle_hash keccak \
            --bytecode_path target/disclosure.json \
            --witness_path target/disclosure.gz \
            --output_path target --output_format bytes_and_fields
          bb verify -s ultra_honk --oracle_hash keccak \
            -k target/vk -p target/proof -i target/public_inputs

      - name: Upload circuit artifacts
        uses: actions/upload-artifact@v4
        with:
          name: circuit-artifacts
          retention-days: 1
          path: |
            circuits/shielded_pool/target/vk
            circuits/shielded_pool/target/proof
            circuits/shielded_pool/target/public_inputs
            circuits/compliance/target/vk
            circuits/disclosure/target/vk

  contracts:
    name: Contract Tests
    runs-on: ubuntu-latest
    needs: [circuits]
    steps:
      - uses: actions/checkout@v4

      - name: Download circuit artifacts
        uses: actions/download-artifact@v4
        with:
          name: circuit-artifacts
          path: circuits

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32v1-none

      - name: Cache Cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Run contract tests
        run: cargo test --workspace

      - name: Install Stellar CLI
        run: |
          curl -sSfL "https://github.com/stellar/stellar-cli/releases/download/v27.0.0/stellar-cli-27.0.0-x86_64-unknown-linux-gnu.tar.gz" \
            | sudo tar xz -C /usr/local/bin
          stellar --version

      - name: Build contract WASMs
        run: stellar contract build

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 11

      - name: Install Nargo (for hasher circuit)
        run: |
          curl -L https://raw.githubusercontent.com/noir-lang/noirup/main/install | bash
          export PATH="$HOME/.nargo/bin:$PATH"
          noirup -v 1.0.0-beta.9

      - name: Compile hasher circuit
        run: |
          export PATH="$HOME/.nargo/bin:$PATH"
          cd circuits/hasher && nargo compile
          cp target/hasher.json ../../frontend/src/circuits/

      - name: Install dependencies
        working-directory: frontend
        run: pnpm install

      - name: Lint
        working-directory: frontend
        run: pnpm lint

  frontend:
    name: Frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 11

      - name: Install Nargo (for hasher circuit)
        run: |
          curl -L https://raw.githubusercontent.com/noir-lang/noirup/main/install | bash
          export PATH="$HOME/.nargo/bin:$PATH"
          noirup -v 1.0.0-beta.9

      - name: Compile hasher circuit
        run: |
          export PATH="$HOME/.nargo/bin:$PATH"
          cd circuits/hasher && nargo compile
          cp target/hasher.json ../../frontend/src/circuits/

      - name: Install dependencies
        working-directory: frontend
        run: pnpm install

      # `|| true` previously swallowed every finding unconditionally, so this
      # step never actually gated CI. Known-unfixable transitive advisories
      # (see frontend/pnpm-workspace.yaml overrides) are pinned to patched
      # versions where a fix exists; --audit-level=moderate fails the build
      # on anything moderate+ so new/regressed vulnerabilities are caught,
      # while the one still-unpatched low-severity advisory (elliptic, no
      # upstream fix released yet) doesn't block CI.
      - name: Audit dependencies
        working-directory: frontend
        run: pnpm audit --prod --audit-level=moderate

      - name: Unit tests
        working-directory: frontend
        run: pnpm test

      - name: Type check & build
        working-directory: frontend
        run: pnpm build

  e2e:
    name: E2E Tests
    runs-on: ubuntu-latest
    needs: [contracts, circuits, frontend, lint]
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32v1-none

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 11

      - name: Install Stellar CLI
        run: |
          curl -sSfL "https://github.com/stellar/stellar-cli/releases/download/v27.0.0/stellar-cli-27.0.0-x86_64-unknown-linux-gnu.tar.gz" \
            | sudo tar xz -C /usr/local/bin
          stellar --version

      - name: Install Nargo
        run: |
          curl -L https://raw.githubusercontent.com/noir-lang/noirup/main/install | bash
          export PATH="$HOME/.nargo/bin:$PATH"
          noirup -v 1.0.0-beta.9

      - name: Install Barretenberg
        run: |
          curl -L https://raw.githubusercontent.com/AztecProtocol/aztec-packages/master/barretenberg/bbup/install | bash
          export PATH="$HOME/.bb:$PATH"
          bbup -v 0.87.0

      - name: Cache Cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-e2e-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-e2e-

      - name: Run E2E tests
        run: |
          export PATH="$HOME/.nargo/bin:$HOME/.bb:$PATH"
          ./tests/e2e.sh