ci.yml

# Continuous integration jobs.
# These get run on every pull-request, with Warp caches updated on push into `main` or `next`.
name: CI

permissions:
  contents: read

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - next
    paths-ignore:
      - "**.txt"
  pull_request:
    paths-ignore:
      - "**.txt"

env:
  # Shared prefix key for the Rust caches.
  #
  # Cache is trunk specific (next|main).
  CACHE_PREFIX: rust-cache-${{ github.base_ref || github.ref_name }}
  # Only trusted branch pushes should update caches; PRs restore from the target branch cache.
  SAVE_CACHE: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/next') }}
  # Reduce cache usage by removing debug information.
  CARGO_PROFILE_DEV_DEBUG: 0

# Limits workflow concurrency to only the latest commit in the PR.
concurrency:
  group: "${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
  cancel-in-progress: true

jobs:
  # ===============================================================================================
  # Conventional builds, lints and tests
  # ===============================================================================================

  # Normal cargo build that verifies the workspace compiles.
  build:
    runs-on: warp-ubuntu-latest-x64-8x
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/install-rocksdb
      - uses: ./.github/actions/install-protobuf-compiler
      - name: Rustup
        run: rustup toolchain install --no-self-update
      - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
        with:
          shared-key: ${{ github.job }}
          prefix-key: ${{ env.CACHE_PREFIX }}
          cache-provider: warpbuild
          save-if: ${{ env.SAVE_CACHE }}
      - name: cargo build
        run: cargo build --workspace --all-targets --locked
      - name: Check static linkage
        run: |
          # Ensure database libraries are statically linked to avoid system library dependencies
          #
          # It explodes our possible dependency matrix when debugging, particularly
          # in the case of sqlite and rocksdb as embedded databases, we want them
          # shipped in identical versions we test with. Those are notoriously difficult
          # to compile time configure and OSes make very opinionated choices.
          metadata=$(cargo metadata --no-deps --format-version 1)
          mapfile -t bin_targets < <(
            echo "${metadata}" | jq -r '.packages[].targets[] | select(.kind[] == "bin") | .name' | sort -u
          )
          if [[ ${#bin_targets[@]} -eq 0 ]]; then
            echo "error: No binary targets found in cargo manifest."
            exit 1
          fi
          for bin_target in "${bin_targets[@]}"; do
            # Ensure the binary was built by the previous step.
            binary_path="target/debug/${bin_target}"
            if ! [[ -x "${binary_path}" ]]; then
              echo "error: Missing binary or missing executable bit: ${binary_path}";
              exit 2;
            fi
            # ldd exits non-zero for static binaries, so we inspect its output instead.
            # if ldd fails we use an empty string instead
            ldd_output="$(ldd "${binary_path}" 2>&1 || true)"
            if echo "${ldd_output}" | grep -E -q 'not a dynamic executable'; then
              continue
            fi
            # librocksdb/libsqlite entries indicate dynamic linkage (bad).
            if echo "${ldd_output}" | grep -E -q 'librocksdb|libsqlite'; then
              echo "error: Dynamic linkage detected for ${bin_target}."
              echo "${ldd_output}"
              exit 3
            fi
          done
          printf "Static linkage check passed for all of %s\n" "${bin_targets[*]}"

  clippy:
    name: lint - clippy
    runs-on: warp-ubuntu-latest-x64-8x
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Rustup
        run: rustup toolchain install --no-self-update
      - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
        with:
          shared-key: ${{ github.job }}
          prefix-key: ${{ env.CACHE_PREFIX }}
          cache-provider: warpbuild
          save-if: ${{ env.SAVE_CACHE }}
      - name: clippy
        run: cargo clippy --locked --all-targets --all-features --workspace -- -D warnings

  tests:
    runs-on: warp-ubuntu-latest-x64-8x
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Rustup
        run: rustup toolchain install --no-self-update
      - uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
        with:
          tool: nextest@0.9.122
      - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
        with:
          shared-key: ${{ github.job }}
          prefix-key: ${{ env.CACHE_PREFIX }}
          cache-provider: warpbuild
          save-if: ${{ env.SAVE_CACHE }}
      - name: Build tests
        run: cargo nextest run --all-features --workspace --no-run
      - name: Run tests
        run: cargo nextest run --all-features --workspace
      - name: Doc tests
        run: cargo test --doc --workspace --all-features

  # Temporary Diesel schema drift checks. Delete this job once Diesel is removed.
  diesel-schema:
    name: diesel schema
    runs-on: warp-ubuntu-latest-x64-8x
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Rustup
        run: rustup toolchain install --no-self-update
      - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
        with:
          shared-key: ${{ github.job }}
          prefix-key: ${{ env.CACHE_PREFIX }}
          cache-provider: warpbuild
          save-if: ${{ env.SAVE_CACHE }}
      - uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
        with:
          tool: diesel_cli@2.3.9
      - name: Check Diesel schemas
        run: |
          cargo test --locked --workspace --all-features \
            diesel_schema_is_in_sync_with_migrations -- --ignored

  doc:
    runs-on: warp-ubuntu-latest-x64-8x
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Rustup
        run: rustup toolchain install --no-self-update
      - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
        with:
          shared-key: ${{ github.job }}
          prefix-key: ${{ env.CACHE_PREFIX }}
          cache-provider: warpbuild
          save-if: ${{ env.SAVE_CACHE }}
      - name: Build docs
        run: cargo doc --no-deps --workspace --all-features --locked

  external-docs:
    name: docs - external
    runs-on: ubuntu-24.04
    env:
      # Docusaurus checks for package updates during builds and may try to write to a user config
      # directory. Disable that notifier in CI so docs output is limited to build/link failures.
      NO_UPDATE_NOTIFIER: "1"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup Node.js
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: "22.18.0"
          cache: "npm"
          cache-dependency-path: docs/external/package-lock.json
      - name: Install dependencies
        working-directory: ./docs/external
        run: npm ci
      - name: Build documentation and check links
        working-directory: ./docs/external
        run: npm run build:dev

  # Ensure the stress-test still functions by running some cheap benchmarks.
  stress-test:
    name: stress test
    runs-on: warp-ubuntu-latest-x64-8x
    timeout-minutes: 20
    env:
      DATA_DIR: /tmp/store
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Rustup
        run: rustup toolchain install --no-self-update
      - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
        with:
          shared-key: ${{ github.job }}
          prefix-key: ${{ env.CACHE_PREFIX }}
          cache-provider: warpbuild
          save-if: ${{ env.SAVE_CACHE }}
      - uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
        with:
          tool: nextest@0.9.122
      - name: Build
        run: cargo build --bin miden-node-stress-test --locked
      - name: Create store directory
        run: mkdir -p ${{ env.DATA_DIR }}
      - name: Seed the store
        run: |
          cargo run --bin miden-node-stress-test seed-store \
            --data-directory ${{ env.DATA_DIR }} \
            --num-accounts 500 --public-accounts-percentage 50
  # TODO re-introduce
      # - name: Benchmark state sync
        # run: |
          # cargo run --bin miden-node-stress-test benchmark-store \
            # --data-directory ${{ env.DATA_DIR }} \
            # --iterations 10 --concurrency 1 sync-state
      - name: Benchmark notes sync
        run: |
          cargo run --bin miden-node-stress-test benchmark-store \
            --data-directory ${{ env.DATA_DIR }} \
            --iterations 10 --concurrency 1 sync-notes
      - name: Benchmakr nullifiers sync
        run: |
          cargo run --bin miden-node-stress-test benchmark-store \
            --data-directory ${{ env.DATA_DIR }} \
            --iterations 10 --concurrency 1 sync-nullifiers --prefixes 10

  # ===============================================================================================
  # WASM related jobs
  # ===============================================================================================

  # Tests the miden-remote-prover-client WASM support.
  #
  # The WASM build is incompatible with native build caches, so it uses a dedicated cache.
  client-wasm:
    name: wasm targets
    runs-on: warp-ubuntu-latest-x64-8x
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Rustup
        run: rustup toolchain install --no-self-update
      - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
        with:
          shared-key: ${{ github.job }}
          prefix-key: ${{ env.CACHE_PREFIX }}
          cache-provider: warpbuild
          save-if: ${{ env.SAVE_CACHE }}
      - name: cargo build
        run: |
          cargo build --locked -p miden-remote-prover-client \
            --target wasm32-unknown-unknown --no-default-features \
            --features batch-prover,block-prover,tx-prover # no-std compatible build
      - name: clippy
        run: |
          cargo clippy --locked -p miden-remote-prover-client \
            --target wasm32-unknown-unknown --no-default-features \
            --features batch-prover,block-prover,tx-prover -- -D warnings

  # ===============================================================================================
  # Jobs that don't require caching to be efficient
  # ===============================================================================================

  typos:
    name: lint - spelling
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup Node.js
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: "22.18.0"
          package-manager-cache: false
      - uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
        with:
          tool: typos@1.42.0
      - name: Install CSpell
        run: npm install --global cspell@10.0.1
      - run: make typos-check
      - run: make markdown-spellcheck

  fmt:
    name: lint - formatting
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Rustup
        run: rustup toolchain install --no-self-update
      - name: Rustup +nightly
        run: rustup toolchain install --no-self-update nightly --component rustfmt
      - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
        with:
          shared-key: ${{ github.job }}
          prefix-key: ${{ env.CACHE_PREFIX }}
          cache-provider: github
          save-if: ${{ env.SAVE_CACHE }}
      - name: Install Markdown tools
        run: npm install --global prettier@3.8.3 markdownlint-cli2@0.22.1
      - name: Fmt
        run: make format-check
      - name: Markdown lint
        run: make markdown-lint

  toml:
    name: lint - toml fmt
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
        with:
          tool: taplo-cli@0.10.0
      - run: make toml-check

  workspace-lints:
    name: lint - workspace toml
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
        with:
          tool: cargo-workspace-lints@0.1.4
      - run: make workspace-check

  workspace-inheritance:
    name: lint - workspace inheritance
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install cargo-binstall
        uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
        with:
          tool: cargo-binstall
      - name: Install workspace inheritance checker
        run: cargo binstall --no-confirm cargo-workspace-inheritance-check@1.2.0
      - name: Check workspace inheritance
        run: cargo workspace-inheritance-check --promotion-threshold 2 --promotion-failure

  unused_deps:
    name: lint - unused deps
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install cargo-shear
        uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
        with:
          tool: cargo-shear@1.12.4
      - name: Check for unused dependencies
        run: make shear