xchain-decoder/.github/workflows/ci.yml at master · XChain-Platform/xchain-decoder · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
# Delegates to the shared reusable workflow, pinned to a commit SHA rather than
# @master so a change to the shared definition only reaches this repo when the
# SHA is bumped deliberately.
name: CI

# Least privilege for the default GITHUB_TOKEN: every job here only reads the repo.
permissions:
  contents: read

on:
  push:
    # develop is where all work lands; master only ever receives release PRs.
    # Both run the gate: develop so a lane push is verified as it lands, master
    # so the merge commit a release tag points at has its own green run.
    branches: [master, develop]
  pull_request:
    branches: [master, develop]

jobs:
  ci:
    uses: XChain-Platform/.github/.github/workflows/ci-reusable.yml@6f4d39ae85787fc31e90a31588d87610a2c33103 # pin: XChain-Platform/.github @ master 2026-08-14; bump deliberately
    with:
      # The fleet's consensus runtime; a floating "22" now resolves 22.23.3, which the VM runtime gate refuses.
      node-version: "22.22.3"
      # On a release or hotfix PR, check the siblings out at the PR's own
      # branch so a release-branch-only change to a file a cross-repo guard
      # reads is tested against the train, not against develop. The shared
      # workflow otherwise pins siblings at develop for any pull request,
      # which is what let this repo's release PRs go red on commits that
      # touch neither the guard nor the file it reads. Empty everywhere
      # else, which keeps the existing behaviour. Same expression as
      # xchain-indexer and xchain-explorer.
      siblings-ref: ${{ (startsWith(github.head_ref, 'release/') || startsWith(github.head_ref, 'hotfix/')) && github.head_ref || github.base_ref || '' }}

  # Cross-repo drift guards: this repo vendors the canonical coin registry from
  # xchain-hub, and per-repo CI cannot see sibling repos, so a drifted vendored
  # copy would otherwise ship green. This job recreates the sibling layout (self
  # and canonical side by side) and runs the byte-identity checks. The canonical
  # repo is private pre-launch, so its checkout uses a read-only deploy key; drop
  # the ssh-key line when the repos flip public.
  drift-guards:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          path: xchain-decoder

      - name: Check out the canonical coin registry (xchain-hub)
        uses: actions/checkout@v4
        with:
          repository: XChain-Platform/xchain-hub
          ref: ${{ github.base_ref || (github.ref == 'refs/heads/master' && 'master' || 'develop') }}
          ssh-key: ${{ secrets.XCHAIN_HUB_DEPLOY_KEY }}
          path: xchain-hub

      - name: Use Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: "22.22.3"

      - name: Coin-registry byte-identity vs canonical
        run: xchain-hub/bin/sync-coins.sh --check --only xchain-decoder

      - name: Coin consensus-pin conformance (own vendored bundle)
        working-directory: xchain-decoder
        run: |
          node -e '
            const coins = require("./src/coins");
            for (const net of ["testnet", "regtest"]) {
              const res = coins.verifyConsensusPin(net);
              if (res && res.skipped) throw new Error("consensus pin unexpectedly unarmed for " + net);
            }
            console.log("consensus pin conformance OK (testnet, regtest)");
          '

      # Identity pin: bin/pins/identity.json records the sha256 of the vendored
      # coin files and the two twin fixtures. Re-hash the tree against it and
      # fail on any moved, missing or unreadable file, so a stale pin cannot
      # reach develop or master green through a direct push or a release pull
      # request. bin/ci-full.sh runs the same command before a push; the tool
      # uses only node builtins, so this job needs no install.
      - name: Identity pin (vendored coins, twin fixtures)
        working-directory: xchain-decoder
        run: node bin/pin-identity.js --check

  # Docker-gated tiers: the integration and e2e suites each bring up their own
  # throwaway regtest node and MariaDB with docker compose, so they cannot run
  # inside `npm run ci`. They get their own job on a runner that has docker, so a
  # slow or flaky venue cannot hold up the fast tier's signal. The map of which
  # tier is gated where lives in test/tier-manifest.json and is enforced by
  # test/unit/tier_manifest.test.js.
  docker-suites:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: "22.22.3"
          cache: npm

      - name: Install dependencies
        run: if [ -f package-lock.json ]; then npm ci; else npm install; fi

      # Each script owns its venue lifecycle (up --wait, run, down -v on any exit),
      # so no compose teardown step is needed here.
      - name: Integration tier
        run: npm run test:integration

      - name: End-to-end tier
        run: npm run test:e2e

  # Coverage ratchet: re-run the unit suite under c8 and fail if line or branch
  # coverage drops below this repo's floor in bin/coverage-thresholds.json
  # (mirrored into the `coverage:check` npm script). Catches the silent coverage
  # regression the pass/fail gate cannot see, where a change keeps every test
  # green while deleting the only test that reached a file. The floors sit about
  # a point below measured; raise them as coverage climbs.
  coverage:
    needs: ci
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      # The ratchet re-runs the unit suite, so it needs the same siblings the gate
      # gets. Without them the guards that read a sibling skip silently, so the
      # ratchet measures a suite the gate never ran: 1248 of 1289 unit tests ran without them.
      # Same roster (.ci-siblings) and same layout the shared workflow uses.
      - name: Check out declared sibling repositories
        uses: XChain-Platform/.github/actions/checkout-siblings@master # one definition for every call site; see the action for why this tracks master
        # The ratchet re-runs the unit suite, so it needs the same release/hotfix
        # awareness as the gate's own siblings-ref above, or it measures a suite
        # whose cross-repo guards disagree with the gate for a reason that exists
        # nowhere but in CI.
        with:
          ref: ${{ (startsWith(github.head_ref, 'release/') || startsWith(github.head_ref, 'hotfix/')) && github.head_ref || github.base_ref || '' }}

      - name: Use Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: "22.22.3"
          cache: npm

      - name: Install dependencies
        run: if [ -f package-lock.json ]; then npm ci; else npm install; fi

      - name: Coverage thresholds (c8 --check-coverage)
        run: npm run coverage:check