main.yml

name: main

on:
    push:
        branches: [main]
    pull_request:

concurrency:
    group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
    cancel-in-progress: true

jobs:
    deps:
        runs-on: ubuntu-latest
        outputs:
            cache-key: ${{ steps.cache-env.outputs.cache-key }}
        steps:
            - uses: actions/checkout@v4
            - uses: actions/setup-node@v4
              with:
                  node-version: 20

            - name: Output cache key
              id: cache-env
              run: echo "cache-key=${{ runner.os }}-node_modules-${{ hashFiles('**/yarn.lock') }}" >> $GITHUB_OUTPUT

            - uses: actions/cache@v4
              id: cache
              with:
                  path: node_modules
                  key: ${{ steps.cache-env.outputs.cache-key }}
                  restore-keys: ${{ runner.os }}-node_modules-

            - if: steps.cache.outputs.cache-hit != 'true'
              run: yarn

    changed-files:
        runs-on: ubuntu-latest
        outputs:
            any_sol_changed: ${{ steps.changed-files.outputs.any_changed }}
            changed_files: ${{ steps.changed-files.outputs.all_changed_and_modified_files }}
        steps:
            - uses: actions/checkout@v4
            - name: Get changed files
              id: changed-files
              uses: tj-actions/changed-files@v44
              with:
                  files: packages/**/*.sol

    compile:
        if: needs.changed-files.outputs.any_sol_changed == 'true'
        needs: [changed-files, deps]
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
            - uses: actions/setup-node@v4
              with:
                  node-version: 20
            # forge needs some deps coming from node_modules, so we need to restore it
            - uses: actions/cache/restore@v4
              with:
                  path: node_modules
                  key: ${{ needs.deps.outputs.cache-key }}
            - uses: foundry-rs/foundry-toolchain@v1
              with:
                  version: nightly
            - run: forge compile
            - name: Upload compilation results
              uses: actions/upload-artifact@v4
              with:
                  name: out
                  path: out/**

    style:
        needs: deps
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
            - uses: actions/setup-node@v4
              with:
                  node-version: 20
            - uses: foundry-rs/foundry-toolchain@v1
              with:
                  version: nightly
            - uses: actions/cache/restore@v4
              with:
                  path: node_modules
                  key: ${{ needs.deps.outputs.cache-key }}

            - run: yarn format
    tests:
        if: needs.changed-files.outputs.any_sol_changed == 'true'
        needs: [changed-files, deps, compile]
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
            - uses: actions/download-artifact@v4
              with:
                  name: out
                  path: out/
            # forge needs some deps coming from node_modules, so we need to restore it
            - uses: actions/cache/restore@v4
              with:
                  path: node_modules
                  key: ${{ needs.deps.outputs.cache-key }}
            - uses: foundry-rs/foundry-toolchain@v1
              with:
                  version: nightly

            - run: forge coverage --report lcov

            - if: github.event_name == 'pull_request' && github.ref == 'refs/pull/32/merge' # TODO: switch back to push & refs/heads/main checks
              name: Coveralls
              uses: coverallsapp/github-action@v2
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  file: lcov.info

    set-matrix:
        if: needs.changed-files.outputs.any_sol_changed == 'true'
        needs: changed-files
        runs-on: ubuntu-latest
        outputs:
            matrix: ${{ steps.set-matrix.outputs.matrix }}
        steps:
            - uses: actions/checkout@v4
            - name: Set matrix
              id: set-matrix
              run: |
                  matrix=$(ls -1 packages | jq -Rsc 'split("\n") | map(select(length > 0))')
                  echo "matrix=$matrix" >> $GITHUB_OUTPUT

    slither:
        if: needs.changed-files.outputs.any_sol_changed == 'true'
        needs: [changed-files, compile, set-matrix]
        runs-on: ubuntu-latest
        permissions:
            contents: read
            security-events: write
        strategy:
            matrix:
                dir: ${{ fromJson(needs.set-matrix.outputs.matrix) }}
        steps:
            - uses: actions/checkout@v4
            - uses: actions/download-artifact@v4
              with:
                  name: out
                  path: out/

            - if: contains(needs.changed-files.outputs.changed_files, matrix.dir)
              name: Run slither
              uses: crytic/slither-action@v0.4.0
              id: slither
              with:
                  ignore-compile: true
                  node-version: 20
                  fail-on: none
                  sarif: results.sarif
                  slither-args: --filter-paths "test" --exclude-dependencies --markdown-root ${{ github.server_url }}/${{ github.repository }}/blob/${{ github.sha }}/
                  target: packages/${{ matrix.dir }}

            - if: contains(needs.changed-files.outputs.changed_files, matrix.dir)
              name: Upload SARIF files
              uses: github/codeql-action/upload-sarif@v3
              with:
                  sarif_file: ${{ steps.slither.outputs.sarif }}

            - name: Create/update checklist as PR comment
              uses: actions/github-script@v7
              if: github.even_name == 'pull_request'
              env:
                  REPORT: ${{ steps.slither.stdout }}
              with:
                  script: |
                      const script = require('.github/scripts/slither-comment')
                      const header = '# Slither report'
                      const body = process.env.REPORT
                      await script({ github, context, header, body })