parachain-ci.yml

name: Parachain CI

on:
  push:
    branches:
      - dev
    paths-ignore:
      - "**/dependabot.yml"
      - "**/README.md"
  pull_request:
    branches:
      - dev
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  DOCKER_BUILDKIT: 1
  # the branch or tag on which this workflow is triggered
  # `head_ref` will only be set if the triggering event is `pull_request`
  REF_VERSION: ${{ github.head_ref || github.ref_name }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check-file-change:
    runs-on: ubuntu-latest
    # see https://github.com/orgs/community/discussions/25722
    if: ${{ github.event_name == 'push' || !github.event.pull_request.draft }}
    outputs:
      src: ${{ steps.filter.outputs.src }}
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      # Checks to see if any files in the PR/commit match one of the listed file types.
      # We can use this filter to decide whether or not to build docker images
      - uses: dorny/paths-filter@v2
        id: filter
        with:
          filters: |
            src:
              - 'node/**'
              - 'pallets/**'
              - 'primitives/**'
              - 'runtime/**'
              - 'mock-tee-primitives/**'
              - 'docker/Dockerfile'
              - '**/Cargo.lock'
              - '**/Cargo.toml'
              - '**/rust-toolchain.toml'

  check-cargo-fmt:
    runs-on: ubuntu-latest
    # so that the if condition on `check-file-change` propagates here
    needs: check-file-change
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Install toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: nightly
          components: rustfmt
          target: wasm32-unknown-unknown
          default: true

      - name: Run cargo fmt check
        run: make fmtcheck

      - name: Install pre-built taplo
        run: |
          mkdir -p $HOME/.local/bin
          wget -q https://github.com/tamasfe/taplo/releases/latest/download/taplo-linux-x86_64.gz
          gzip -d taplo-linux-x86_64.gz
          cp taplo-linux-x86_64 $HOME/.local/bin/taplo
          chmod a+x $HOME/.local/bin/taplo
          echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: Run taplo fmt check
        run: make taplocheck

  check-cargo-clippy:
    runs-on: ubuntu-latest
    needs: [check-cargo-fmt, check-file-change]
    if: needs.check-file-change.outputs.src == 'true'
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Install toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: nightly
          components: clippy
          target: wasm32-unknown-unknown
          default: true

      - name: Install dependencies
        run: |
          sudo apt-get update && \
          sudo apt-get install -yq openssl clang libclang-dev cmake protobuf-compiler
          
      - name: Run cargo clippy check
        run: make clippy

      - name: Fail-fast; cancel other jobs
        if: failure()
        uses: andymckay/cancel-action@0.2

  build-docker:
    # run the docker build on our self-hosted runner, which takes
    # - 25min without cache, or
    # - 15 min with cache
    # on a standard github runner it takes 1 hour+
    # see also https://github.com/litentry/litentry-parachain/issues/259
    runs-on: self-hosted
    needs: [check-cargo-fmt, check-file-change]
    steps:
      - name: Checkout codes
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Build docker image
        timeout-minutes: 60
        if: needs.check-file-change.outputs.src == 'true'
        run: |
          ./scripts/build-docker.sh release
          echo "============================="
          docker images

      - name: Pull docker image optinally
        if: needs.check-file-change.outputs.src == 'false'
        run: |
          docker pull litentry/litentry-parachain:latest

      - name: Save docker image
        run: |
          docker save litentry/litentry-parachain:latest -o litentry-parachain.tar

      - name: Upload docker image
        uses: actions/upload-artifact@v3
        with:
          name: docker-artifact
          path: litentry-parachain.tar

      - name: Remove dangling docker images if any
        run: |
          [ -z "$(docker images --filter=dangling=true -q)" ] || docker rmi -f $(docker images --filter=dangling=true -q)

      - name: Fail-fast; cancel other jobs
        if: failure()
        uses: andymckay/cancel-action@0.2

  run-ts-tests:
    runs-on: ubuntu-latest
    needs: build-docker
    strategy:
      matrix:
        chain:
          - litmus
          - litentry
          - rococo
    steps:
      - name: Checkout codes
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/download-artifact@v3
        with:
          name: docker-artifact

      - name: Load docker image
        run: |
          docker load -i litentry-parachain.tar

      - name: Run ts tests for ${{ matrix.chain }}
        timeout-minutes: 20
        run: |
          make test-ts-docker-${{ matrix.chain }}

      - name: Archive logs if test fails
        uses: actions/upload-artifact@v3
        if: ${{ failure() }}
        with:
          name: ${{ matrix.chain }}-ts-tests-artifacts
          path: /tmp/parachain_dev/
          retention-days: 3

      - name: Clean up for ${{ matrix.chain }}
        if: ${{ always() }}
        run: |
          make clean-docker-${{ matrix.chain }}

  run-cargo-unit-tests:
    runs-on: ubuntu-latest
    needs: [check-cargo-fmt, check-file-change]
    if: needs.check-file-change.outputs.src == 'true'
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Install toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: nightly
          target: wasm32-unknown-unknown
          default: true

      - name: Run unittests
        run: cargo test --locked --release -p pallet-* --lib

      - name: Fail-fast; cancel other jobs
        if: failure()
        uses: andymckay/cancel-action@0.2

  run-cargo-benchmarks:
    runs-on: ubuntu-latest
    needs: [check-cargo-fmt, check-file-change]
    if: needs.check-file-change.outputs.src == 'true'
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Install toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: nightly
          target: wasm32-unknown-unknown
          default: true

      - name: Run benchmarks
        run: cargo test --locked --release -p pallet-* --lib --features runtime-benchmarks

      - name: Fail-fast; cancel other jobs
        if: failure()
        uses: andymckay/cancel-action@0.2


  # The reason why not to put the if-check on the job level is to make sure the
  # *matrix* job is run, although it can be skipped in the end.
  #
  # This is required when setting github merge rules to protected branch,
  # where you can only select one of `run-cargo-runtime-tests` and `run-cargo-runtime-tests(litmus)`.
  # If you put if-check on the job level, it can't fit every possible case.
  #
  # Tried https://github.com/Swatinem/rust-cache too but it didn't work so well
  run-cargo-runtime-tests:
    runs-on: ubuntu-latest
    needs: [check-cargo-fmt, check-file-change]
    env:
      RUSTC_WRAPPER: sccache
      SCCACHE_CACHE_SIZE: 10G
      SCCACHE_DIR: /home/runner/.cache/sccache
    strategy:
      fail-fast: true
      matrix:
        chain:
          - litmus
          - litentry
          - rococo
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Install toolchain
        if: needs.check-file-change.outputs.src == 'true'
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: nightly
          target: wasm32-unknown-unknown
          default: true

      # use sccache to accelerate binary compilation
      # see https://www.infinyon.com/blog/2021/04/github-actions-best-practices/
      - name: Install sccache
        env:
          LINK: https://github.com/mozilla/sccache/releases/download
          SCCACHE_VERSION: v0.3.0
        run: |
          SCCACHE_FILE=sccache-$SCCACHE_VERSION-x86_64-unknown-linux-musl
          mkdir -p $HOME/.local/bin
          curl -L "$LINK/$SCCACHE_VERSION/$SCCACHE_FILE.tar.gz" | tar xz
          mv -f $SCCACHE_FILE/sccache $HOME/.local/bin/sccache
          chmod +x $HOME/.local/bin/sccache
          echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: Install dependencies
        run: |
         sudo apt-get update && \
         sudo apt-get install -yq openssl clang libclang-dev cmake protobuf-compiler

      - name: Cache cargo registry
        if: needs.check-file-change.outputs.src == 'true'
        uses: actions/cache@v3
        continue-on-error: false
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: cargo-${{ env.REF_VERSION }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            cargo-${{ env.REF_VERSION }}-
            cargo-

      - name: Cache sccache
        if: needs.check-file-change.outputs.src == 'true'
        uses: actions/cache@v3
        continue-on-error: false
        with:
          path: /home/runner/.cache/sccache
          key: sccache-${{ env.REF_VERSION }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            sccache-${{ env.REF_VERSION }}-
            sccache-

      - name: Run runtime integration tests
        if: needs.check-file-change.outputs.src == 'true'
        run: cargo test --locked --release -p ${{ matrix.chain }}-parachain-runtime --lib

      - name: Print sccache stats
        if: needs.check-file-change.outputs.src == 'true'
        run: sccache --show-stats

      - name: Fail-fast; cancel other jobs
        if: failure()
        uses: andymckay/cancel-action@0.2

  # Secrets are not passed to the runner when a workflow is triggered from a forked repository,
  # see https://docs.github.com/en/actions/security-guides/encrypted-secrets#using-encrypted-secrets-in-a-workflow
  # Only push docker image when tests are passed on dev branch
  push-docker-image:
    runs-on: ubuntu-latest
    needs:
      [
        "check-cargo-clippy",
        "run-cargo-unit-tests",
        "run-cargo-benchmarks",
        "run-cargo-runtime-tests",
        "run-ts-tests",
      ]
    if: ${{ success() && (github.event_name == 'push') && (github.ref == 'refs/heads/dev') }}
    steps:
      - uses: actions/download-artifact@v3
        with:
          name: docker-artifact

      - name: Load docker image
        run: |
          docker load -i litentry-parachain.tar

      - name: Dockerhub login
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Push docker image
        run: docker push litentry/litentry-parachain:latest