solidity.yml

name: Solidity

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
    tags:
      - "v*"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  actions: write
  checks: write
  contents: write
  deployments: write
  id-token: write
  issues: write
  discussions: write
  packages: write
  pages: write
  pull-requests: write
  repository-projects: write
  security-events: write
  statuses: write

jobs:
  codescanning:
    name: Code Scanning
    #runs-on: ubuntu-latest
    runs-on: namespace-profile-btp-scs
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install canvas dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev

      - uses: crytic/slither-action@v0.4.0
        id: slither
        with:
          sarif: slither.sarif
          slither-args: --filter-paths "lib/" --filter-paths "node_modules/"
          solc-version: ${{ vars.SOL_VERSION || '0.8.27' }}
          fail-on: none

      - name: Upload findings to GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.slither.outputs.sarif }}
        if: always()

  test:
    services:
      foundry:
        image: ghcr.io/settlemint/btp-anvil-test-node:latest
        ports:
          - '8545:8545'
    name: Build Set
    #runs-on: ubuntu-latest
    runs-on: namespace-profile-btp-scs
    steps:
      - name: Setup 1Password
        uses: 1password/load-secrets-action/configure@v2
        with:
          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

      - name: Load secrets
        uses: 1password/load-secrets-action@v2
        env:
          NPM_TOKEN: op://platform/npmjs/credential
          PAT_TOKEN: op://platform/github-commit-pat/credential

      - name: Checkout
        uses: namespacelabs/nscloud-checkout-action@v5
        with:
          token: ${{ env.PAT_TOKEN }}

      - name: Setup caches
        uses: namespacelabs/nscloud-cache-action@v1
        with:
          path: |
            ./node_modules
            ~/.npm
            ~/.bun/install/cache

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@v1
        with:
          version: nightly

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: oven-sh/setup-bun@v2

      - name: Install Node dependencies
        run: bun install

      - name: Run Forge build
        run: |
          forge --version
          forge build --sizes

      - name: Run Hardhat build
        run: |
          npx hardhat compile

      - name: Run Forge tests
        run: |
          forge test -vvv

      - name: Run Hardhat test
        run: |
          npx hardhat test

      - name: Setup LCOV
        if: github.ref_name != 'main'
        uses: hrishikesh-kadam/setup-lcov@v1

      - name: Run Forge Coverage
        if: github.ref_name != 'main'
        run: |
          forge coverage --report lcov --report summary
        id: coverage

      - name: Deploy to the local node
        run: |
          npx hardhat ignition deploy --network localhost ignition/modules/main.ts

      - name: Install YQ
        uses: alexellis/arkade-get@master
        with:
          print-summary: false
          yq: latest

      - name: Build the subgraph
        run: |
          if [ ! -d "subgraph" ] || [ -z "$(ls -A subgraph)" ]; then
            echo "Subgraph directory is missing or empty"
            exit 0
          fi
          if [ -f "subgraph/subgraph.config.json" ]; then
            npx graph-compiler --config subgraph/subgraph.config.json --include node_modules/@openzeppelin/subgraphs/src/datasources subgraph/datasources --export-schema --export-subgraph
            yq -i e '.specVersion = "1.2.0"' generated/scs.subgraph.yaml
            yq -i e '.features = ["nonFatalErrors", "fullTextSearch", "ipfsOnEthereumContracts"]' generated/scs.subgraph.yaml
            yq -i e '.dataSources[].mapping.apiVersion = "0.0.7"' generated/scs.subgraph.yaml
            yq -i e '.dataSources[].network = "localhost"' generated/scs.subgraph.yaml
            yq -i e '.templates[].mapping.apiVersion = "0.0.7"' generated/scs.subgraph.yaml
            yq -i e '.templates[].network = "localhost"' generated/scs.subgraph.yaml
            npx graph codegen generated/scs.subgraph.yaml
            npx graph build --ipfs=https://ipfs.network.thegraph.com generated/scs.subgraph.yaml | tee build_output.txt
          else
            cd subgraph
            npx graph codegen subgraph.yaml
            npx graph build --ipfs=https://ipfs.network.thegraph.com subgraph.yaml | tee build_output.txt

            cat build_output.txt

            # Extract and process IPFS hashes from the file
            ipfs_hashes=$(grep -oP 'Qm[a-zA-Z0-9]{44}' build_output.txt)

            echo "IPFS hashes: $ipfs_hashes"

            # Write IPFS hashes to a file
            echo "$ipfs_hashes" | sed 's/^/"/;s/$/"/' | paste -sd ',' > ipfs_hashes.txt
          fi


      - name: Report code coverage
        if: github.event_name == 'pull_request'
        uses: zgosalvez/github-actions-report-lcov@4.1.20
        continue-on-error: true
        with:
          coverage-files: lcov.info
          github-token: ${{ secrets.GITHUB_TOKEN }}
          update-comment: true

      - name: Inject slug/short variables
        uses: rlespinasse/github-slug-action@v5

      - name: Package version
        id: package-version
        run: |
          OLD_VERSION=$(jq -r '.version' package.json)
          echo "Old version: $OLD_VERSION"
          if [[ $GITHUB_REF_SLUG =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            VERSION=$(echo $GITHUB_REF_SLUG | sed 's/^v//')
            echo "TAG=latest" >> $GITHUB_ENV
          elif [[ $GITHUB_REF_NAME == "main" ]]; then
            VERSION="${OLD_VERSION}-main$(echo $GITHUB_SHA_SHORT | sed 's/^v//')"
            echo "TAG=main" >> $GITHUB_ENV
          else
            VERSION="${OLD_VERSION}-pr$(echo $GITHUB_SHA_SHORT | sed 's/^v//')"
            echo "TAG=pr" >> $GITHUB_ENV
          fi
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "Updating version to $VERSION"
          jq --arg version "$VERSION" '.version = $version' package.json > package.json.tmp && mv package.json.tmp package.json

          echo "Updated version to $VERSION"

      - name: Install zsh
        run: |
          sudo apt-get update
          sudo apt-get install -y zsh

      - name: Verify zsh installation
        run: |
          zsh --version
          which zsh

      - name: Generate README.md
        if: github.repository == 'settlemint/solidity-predeployed'
        run: |
          rm -Rf README.md
          cp .github/BASE.md README.md
          ./genesis-output
          echo "" >> README.md
          echo "\`\`\`json" >> README.md
          cat all_allocations.json >> README.md
          echo "\`\`\`" >> README.md
          cat all_allocations.json

      - name: Add IPFS hashes to README if exists
        run: |
          if [ -f ipfs_hashes.txt ]; then
            echo "" >> README.md
            echo "## IPFS Hashes" >> README.md
            echo "\`\`\`" >> README.md
            cat ipfs_hashes.txt >> README.md
            echo "\`\`\`" >> README.md
          fi

      - uses: JS-DevTools/npm-publish@v3
        with:
          token: ${{ env.NPM_TOKEN }}
          package: ./package.json
          access: public
          provenance: false
          strategy: all
          tag: ${{ env.TAG }}

      - name: Create or update a comment
        if: ${{ github.event_name == 'pull_request' }}
        uses: taoliujun/action-unique-comment@v1
        with:
            uniqueIdentifier: ${{ github.workflow }}
            body: |
                # 📦 Packages
                | Package | Install |
                | ------- | -------------------- |
                | React | `bun add @${{ github.repository_owner }}/${{ github.repository }}@${{ env.VERSION }}` |

      - uses: stefanzweifel/git-auto-commit-action@v5
        if: env.TAG == 'latest' && github.repository != 'settlemint/solidity-predeployed'
        with:
          commit_message: "chore: update package versions [skip ci]"
          branch: main
          file_pattern: 'package.json README.md'

      - uses: stefanzweifel/git-auto-commit-action@v5
        if: env.TAG == 'latest' && github.repository == 'settlemint/solidity-predeployed'
        with:
          commit_message: "chore: update package versions [skip ci]"
          branch: main
          file_pattern: 'package.json README.md all_allocations.json'

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: docker_meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ github.repository }}
          tags: |
            type=schedule
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha

      - name: Build and push
        uses: docker/build-push-action@v6
        id: build-and-push
        with:
          platforms: linux/amd64,linux/arm64
          provenance: true
          sbom: true
          push: true
          load: false
          tags: ${{ steps.docker_meta.outputs.tags }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          no-cache: true


      - name: Sign the images with GitHub OIDC Token
        env:
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
          TAGS: ${{ steps.docker_meta.outputs.tags }}
        run: |
          images=""
          for tag in ${TAGS}; do
            images+="${tag}@${DIGEST} "
          done
          cosign sign --yes ${images}