pull-request-main.yml

name: pull-request-main

on:
  merge_group:
  pull_request:
    branches:
      - main

jobs:
  changes:
    name: Detect changed files
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      operations_gen: ${{ steps.filter.outputs.operations_gen }}
    steps:
      - uses: actions/checkout@v7
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
            operations_gen:
              - 'tools/operations-gen/**'

  ci-lint:
    name: Lint
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Linting Go
        uses: smartcontractkit/.github/actions/ci-lint-go@ci-lint-go/v2 # ci-lint-go@2.0.0
        with:
          only-new-issues: "false"
          golangci-lint-version: v2.13.2

  ci-lint-operations-gen:
    name: Lint operations-gen
    needs: [changes]
    if: needs.changes.outputs.operations_gen == 'true'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Linting operations-gen
        uses: smartcontractkit/.github/actions/ci-lint-go@ci-lint-go/v2 # ci-lint-go@2.0.0
        with:
          only-new-issues: "false"
          golangci-lint-version: v2.13.2
          go-directory: tools/operations-gen

  ci-lint-misc:
    name: Lint GH Actions and scripts
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Linting Misc (yaml + sh files)
        uses: smartcontractkit/.github/actions/ci-lint-misc@eeb76b5870e3c17856d5a60fd064a053c023b5f5 # ci-lint-misc@1.0.0

  ci-test-operations-gen:
    name: Tests operations-gen
    needs: [changes]
    if: needs.changes.outputs.operations_gen == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Build and test operations-gen
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          go-test-cmd: cd tools/operations-gen && go test -race ./...
          use-go-cache: true
          artifact-name: unit-tests-operations-gen

  ci-test:
    name: Tests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Build and test
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          # disable the checkptr runtime check due a false positive in github.com/xssnick/tonutils-go
          # causing tests in ci to fail "fatal error: checkptr: pointer arithmetic result points to invalid allocation"
          # https://github.com/xssnick/tonutils-go/issues/310
          # Exclude provider packages which use Docker containers and remote catalog tests
          go-test-cmd: go test -race -gcflags=all=-d=checkptr=0 -coverprofile=coverage.txt $( go list ./... | grep -vE '/chainlink-deployments-framework(/chain\>|/datastore/catalog/remote\>)' )
          use-go-cache: true
          artifact-name: unit-tests

  ci-test-provider-evm:
    name: Chain Tests - EVM
    runs-on: ubuntu-latest
    timeout-minutes: 8
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Build and test evm provider packages
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          go-test-cmd: go test -race -coverprofile=coverage.txt ./chain/evm/...
          use-go-cache: true
          artifact-name: provider-tests-evm

  ci-test-provider-solana:
    name: Chain Tests - Solana
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Build and test solana provider packages
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          go-test-cmd: go test -race -coverprofile=coverage.txt ./chain/solana/...
          use-go-cache: true
          artifact-name: provider-tests-solana

  ci-test-provider-aptos:
    name: Chain Tests - Aptos
    runs-on: ubuntu-latest
    timeout-minutes: 8
    permissions:
      id-token: write
      contents: read
      actions: read
    env:
      # Tests shells out to the Aptos CLI to compile a Move package, which is
      # CPU-bound and can run for 90-100s. On the 2-vCPU runner this starves the test
      # process's Ryuk keep-alive goroutine long enough to blow Ryuk's default 10s
      # reconnection timeout, causing it to reap the Aptos node container mid-test
      # ("connection refused" on the next API call). Raise the timeouts so Ryuk tolerates
      # the compile step and parallel package teardown (chain/aptos/provider often
      # finishes ~60-70s before chain/aptos) instead of killing the container mid-test.
      RYUK_RECONNECTION_TIMEOUT: 5m
      RYUK_CONNECTION_TIMEOUT: 5m
    steps:
      - name: Install Aptos CLI
        uses: aptos-labs/actions/install-aptos-cli@528ef7ad9427a8c0720ea3eea790a9190d6e377d # v0.1
        with:
          CLI_VERSION: 9.2.0

      - name: Build and test aptos provider packages
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          go-test-cmd: go test -race -coverprofile=coverage.txt ./chain/aptos/...
          use-go-cache: true
          artifact-name: provider-tests-aptos

  ci-test-provider-sui:
    name: Chain Tests - Sui
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Install Sui CLI
        shell: bash
        env:
          VERSION: 1.72.2
        run: |
          echo "Installing Sui CLI v$VERSION"
          curl -L "https://github.com/MystenLabs/sui/releases/download/mainnet-v${VERSION}/sui-mainnet-v${VERSION}-ubuntu-x86_64.tgz" -o sui.tgz
          tar -xzf sui.tgz
          sudo mv -f sui /usr/local/bin/
          sudo chmod 755 /usr/local/bin/sui
          rm -f sui.tgz

      - name: Build and test sui provider packages
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          go-test-cmd: go test -race -coverprofile=coverage.txt ./chain/sui/...
          use-go-cache: true
          artifact-name: provider-tests-sui

  ci-test-provider-canton:
    name: Chain Tests - Canton
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Build and test canton provider packages
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          go-test-cmd: go test -race -coverprofile=coverage.txt ./chain/canton/...
          use-go-cache: true
          artifact-name: provider-tests-canton

  ci-test-provider-ton:
    name: Chain Tests - TON
    runs-on: ubuntu-latest
    timeout-minutes: 8
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Build and test ton provider packages
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          # disable the checkptr runtime check due a false positive in github.com/xssnick/tonutils-go
          # causing tests in ci to fail "fatal error: checkptr: pointer arithmetic result points to invalid allocation"
          # https://github.com/xssnick/tonutils-go/issues/310
          go-test-cmd: go test -race -gcflags=all=-d=checkptr=0 -coverprofile=coverage.txt ./chain/ton/...
          use-go-cache: true
          artifact-name: provider-tests-ton

  ci-test-provider-tron:
    name: Chain Tests - TRON
    runs-on: ubuntu-latest
    timeout-minutes: 8
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Build and test tron provider packages
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          go-test-cmd: go test -race -coverprofile=coverage.txt ./chain/tron/...
          use-go-cache: true
          artifact-name: provider-tests-tron

  ci-test-provider-stellar:
    name: Chain Tests - Stellar
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Build and test stellar provider packages
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          go-test-cmd: go test -race -coverprofile=coverage.txt ./chain/stellar/...
          use-go-cache: true
          artifact-name: provider-tests-stellar

  ci-test-provider-fast:
    name: Chain Tests - Others
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Build and test provider packages
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          # -p 2 -parallel 3 = 2 packages, 3 tests max = 6 containers max
          # Run all provider tests EXCEPT slow ones (evm, solana, aptos, sui, canton, ton, tron, stellar) which have dedicated jobs
          go-test-cmd: go test -race -p 2 -parallel 3 -coverprofile=coverage.txt $( go list ./... | grep '/chainlink-deployments-framework/chain/' | grep -vE '/chainlink-deployments-framework/chain/(evm|solana|aptos|sui|canton|ton|tron|stellar)' )
          use-go-cache: true
          artifact-name: provider-tests-others

  ci-test-catalog-remote:
    name: Catalog Remote Tests
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      id-token: write
      contents: read
      actions: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Configure AWS credentials for ECR
        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: ${{ secrets.ECR_READ_ROLE_ARN }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Get latest catalog service tag from ECR
        id: get-catalog-tag
        run: |
          # Fetch the latest semantic version tag from ECR
          # Sort images by push date (latest first) and find the first semver tag
          LATEST_TAG=$(aws ecr describe-images \
            --repository-name op-catalog-service \
            --region ${{ secrets.AWS_REGION }} \
            --registry-id ${{ secrets.AWS_ACCOUNT_NUMBER_PROD }} \
            --query 'reverse(sort_by(imageDetails,& imagePushedAt))' \
            --output json | \
            jq -r '
              [.[] |
               select(.imageTags != null) |
               .imageTags[] |
               select(test("^v[0-9]+\\.[0-9]+\\.[0-9]+$"))
              ] | first
            ')

          if [[ -z "${LATEST_TAG}" ]] || [[ "${LATEST_TAG}" == "null" ]]; then
            echo "::error::Could not find a valid semantic version tag in ECR"
            exit 1
          fi

          echo "Latest catalog service tag from ECR: ${LATEST_TAG}"
          echo "tag=${LATEST_TAG}" >> "${GITHUB_OUTPUT}"

      - name: Pull Catalog Service ECR Image
        uses: smartcontractkit/.github/actions/pull-private-ecr-image@2f8f0baf38e46140c6a119eb551a56eaaabcc09e # pull-private-ecr-image@1.0.0
        with:
          aws-account-number: ${{ secrets.AWS_ACCOUNT_NUMBER_PROD }}
          aws-region: ${{ secrets.AWS_REGION }}
          aws-role-arn: ${{ secrets.ECR_READ_ROLE_ARN }}
          ecr-repository: "op-catalog-service"
          image-tag: ${{ steps.get-catalog-tag.outputs.tag }}

      - name: Run Catalog Remote Integration Tests
        uses: smartcontractkit/.github/actions/ci-test-go@dfcba48f05933158428bce867d790e3d5a9baa6b # ci-test-go@1.1.0
        with:
          # Must cd into datastore/catalog/remote because TestMain only runs from package directory
          go-test-cmd: cd datastore/catalog/remote && go test -v -race -timeout 10m -gcflags=all=-d=checkptr=0 -coverprofile=../../../coverage.txt
          use-go-cache: true
          artifact-name: catalog-remote-tests
        env:
          CATALOG_SERVICE_IMAGE: ${{ secrets.AWS_ACCOUNT_NUMBER_PROD }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/op-catalog-service:${{ steps.get-catalog-tag.outputs.tag }}

  sonarqube:
    name: Sonar Scan
    if: |
      always() &&
      github.event_name == 'pull_request' &&
      !contains(needs.*.result, 'failure') &&
      !contains(needs.*.result, 'cancelled')
    runs-on: ubuntu-24.04
    needs: [ci-test, ci-test-operations-gen, ci-test-provider-evm, ci-test-provider-solana, ci-test-provider-aptos, ci-test-provider-sui, ci-test-provider-canton, ci-test-provider-ton, ci-test-provider-tron, ci-test-provider-stellar, ci-test-provider-fast, ci-test-catalog-remote, ci-lint-misc, ci-lint, ci-lint-operations-gen]
    permissions:
      contents: read
      actions: read
    steps:
      - name: Scan with Sonarqube
        uses: smartcontractkit/.github/actions/ci-sonarqube-go@01d931b0455a754d12e7143cc54a5a3521a8f6f6 # ci-sonarqube-go@0.3.1
        with:
          sonar-token: ${{ secrets.SONAR_TOKEN }}
          sonar-host-url: ${{ secrets.SONAR_HOST_URL }}