on:
  push:
    branches:
      - main
    paths-ignore:
      - "**.md"
      - "!.github/workflows/*.yml"

  pull_request:
    paths-ignore:
      - "**.md"
      - "!.github/workflows/*.yml"

permissions:
  contents: read
  pull-requests: read

name: General

jobs:
  fmt-rs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - name: Install nightly toolchain for rustfmt
        run: rustup install nightly --profile minimal --component rustfmt

      - name: Check Rust files are formatted
        run: cargo +nightly fmt --check

  fmt-toml:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - name: Install taplo-cli
        run: cargo install --locked taplo-cli

      - name: Check TOML files are formatted
        run: taplo fmt --check .

  machete:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - name: Install active toolchain
        run: rustup install

      - name: Install cargo-machete
        run: cargo install cargo-machete

      - name: Check for unused dependencies
        run: cargo machete

  deny:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - name: Install cargo-deny
        run: cargo install --locked cargo-deny

      - name: Check licenses and advisories
        run: cargo deny check

  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 60

    name: lint
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - uses: ./.github/actions/install-system-deps

      - uses: ./.github/actions/install-risc0

      - uses: ./.github/actions/install-logos-blockchain-circuits
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install active toolchain
        run: rustup install

      - name: Restore Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-rust-cache
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Lint workspace
        env:
          RISC0_SKIP_BUILD: "1"
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings

      - name: Lint programs
        env:
          RISC0_SKIP_BUILD: "1"
        run: cargo clippy -p "*programs" -- -D warnings

  unit-tests:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - uses: ./.github/actions/install-system-deps

      - uses: ./.github/actions/install-risc0

      - uses: ./.github/actions/install-logos-blockchain-circuits
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install active toolchain
        run: rustup install

      - name: Restore Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-rust-cache
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install nextest
        run: cargo install --locked cargo-nextest

      - name: Run tests
        env:
          RISC0_DEV_MODE: "1"
          RUST_LOG: "info"
        run: cargo nextest run --workspace --exclude integration_tests --all-features

  integration-tests-prebuild:
    runs-on: ubuntu-latest
    outputs:
      targets: ${{ steps.discover-targets.outputs.targets }}
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - uses: ./.github/actions/install-system-deps

      - uses: ./.github/actions/install-risc0

      - uses: ./.github/actions/install-logos-blockchain-circuits
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install active toolchain
        run: rustup install

      - name: Restore Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-rust-cache
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install nextest
        run: cargo install --locked cargo-nextest

      - name: Build integration test archive
        env:
          RISC0_DEV_MODE: "1"
        run: cargo nextest archive -p integration_tests --archive-file integration-tests.tar.zst --no-pager

      - name: Upload integration test archive
        uses: actions/upload-artifact@v4
        with:
          name: integration-tests-archive
          path: integration-tests.tar.zst

      - name: Discover integration test targets from archive
        id: discover-targets
        run: |
          cargo nextest list \
            --archive-file integration-tests.tar.zst \
            --list-type binaries-only \
            --message-format json \
            --no-pager > integration-tests-binaries.json

          targets_json="$(jq -c '[."rust-binaries" | to_entries[] | select(.value.kind == "test" and .value."binary-name" != "tps") | .value."binary-name"] | sort | unique' integration-tests-binaries.json)"

          if [[ "$targets_json" == "[]" ]]; then
            echo "No integration test targets were discovered." >&2
            exit 1
          fi

          echo "targets=$targets_json" >> "$GITHUB_OUTPUT"
          echo "Discovered integration targets: $targets_json"

  integration-tests:
    needs: integration-tests-prebuild
    runs-on: ubuntu-latest
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        target: ${{ fromJson(needs.integration-tests-prebuild.outputs.targets) }}
    name: integration-tests (${{ matrix.target }})
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - uses: ./.github/actions/install-system-deps

      - uses: ./.github/actions/install-risc0

      - uses: ./.github/actions/install-logos-blockchain-circuits
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install active toolchain
        run: rustup install

      - name: Download integration test archive
        uses: actions/download-artifact@v4
        with:
          name: integration-tests-archive

      - name: Install nextest
        run: cargo install --locked cargo-nextest

      - name: Run tests
        env:
          RISC0_DEV_MODE: "1"
          RUST_LOG: "info"
        run: cargo nextest run --archive-file integration-tests.tar.zst -E "binary(${{ matrix.target }})"

  valid-proof-test:
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - uses: ./.github/actions/install-system-deps

      - uses: ./.github/actions/install-risc0

      - uses: ./.github/actions/install-logos-blockchain-circuits
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install active toolchain
        run: rustup install

      - name: Restore Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-rust-cache
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Test valid proof
        env:
          RUST_LOG: "info"
        run: cargo test -p integration_tests -- --exact private::private_transfer_to_owned_account

  artifacts:
    runs-on: ubuntu-latest
    timeout-minutes: 60

    name: artifacts
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - uses: ./.github/actions/install-risc0

      - name: Restore Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-rust-cache
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install just
        run: cargo install --locked just

      - name: Build artifacts
        run: just build-artifacts

      - name: Check if artifacts match repository
        run: |
          if ! git diff --exit-code artifacts/; then
            echo "❌ Artifacts in the repository are out of date!"
            echo "Please run 'just build-artifacts' and commit the changes."
            exit 1
          fi
          echo "✅ Artifacts are up to date"