ci.yml

name: CI 

on:
  pull_request:
    types: [opened, synchronize, reopened, closed]
    branches:
      - master
env:
  AWS_REGION: "eu-central-1"
  SSH_AUTH_SOCK: /tmp/ssh_agent.sock

permissions:
  id-token: write
  contents: write

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    if: github.event.action != 'closed' || github.event.pull_request.merged == true
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}
      - name: Setup Earthly
        uses: ./.github/earthly-setup
        with:
          ssh_key: ${{ secrets.SUBSTRATE_REPO_SSH_KEY }}
          config_tar: ${{ secrets.EARTHLY_TAR }}
      - name: Acquire AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_SECRET }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Login to container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ secrets.ECR_REGISTRY_SECRET }}
      - name: Build and Artifacts and Push Image
        env:
          EARTHLY_CI: true
          EARTHLY_OUTPUT: true
          EARTHLY_PUSH: true
        run: |
          earthly -P +ci --image=${{ secrets.ECR_REGISTRY_SECRET }}/substrate-node
      - name: Upload partner-chains-cli artifact
        uses: actions/upload-artifact@v4
        with:
          name: partner-chains-cli-artifact
          path: partner-chains-cli-artifact
      - name: Upload partner-chains-node artifact
        uses: actions/upload-artifact@v4
        with:
          name: partner-chains-node-artifact
          path: partner-chains-node-artifact
      - name: Upload chain spec artifacts
        uses: actions/upload-artifact@v4
        with:
          name: chain-specs
          path: |
            ./devnet_chain_spec.json
            ./staging_preview_chain_spec.json
            ./staging_preprod_chain_spec.json
      - name: Deploy and test against local environment
        uses: ./.github/actions/tests/local-environment-tests
        with:
          tag: CI 
          image: ${{ secrets.ECR_REGISTRY_SECRET }}/substrate-node:${{ github.sha }}
          sha: ${{ github.sha }}
        env:
          SUBSTRATE_REPO_SSH_KEY: ${{ secrets.SUBSTRATE_REPO_SSH_KEY }}
          EARTHLY_TAR: ${{ secrets.EARTHLY_TAR }}
          AWS_ROLE_ARN_SECRET: ${{ secrets.AWS_ROLE_ARN_SECRET }}
          AWS_REGION: ${{ env.AWS_REGION }}
          ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }}
          ECR_REGISTRY_SECRET: ${{ secrets.ECR_REGISTRY_SECRET }}

  test-nix-devshell:
    permissions:
      id-token: write
      contents: write
    strategy:
      matrix:
        os: [nixos, macos]
    runs-on:
      - self-hosted
      - ${{ matrix.os }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Acquire AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_ }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Add signing key for nix
        run: echo "${{ secrets.NIX_SIGNING_KEY }}" > "${{ runner.temp }}/nix-key"
      - name: Run nixci to build/test all outputs
        run: |
          nix run github:srid/nixci -- -v build -- --fallback > /tmp/outputs
      - name: Copy nix scopes to nix cache
        run: |
          nix-store --stdin -q --deriver < /tmp/outputs | nix-store --stdin -qR --include-outputs \
          | nix copy --stdin --to \
          "s3://cache.sc.iog.io?secret-key=${{ runner.temp }}/nix-key&region=$AWS_DEFAULT_REGION" \
          && rm /tmp/outputs

  upload-chain-specs:
    permissions:
      id-token: write
      contents: write
    needs: build-and-test
    if: github.event.pull_request.merged == true
    runs-on: [self-hosted, eks]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Upload chain spec artifacts to Kubernetes
        uses: ./.github/actions/deploy/upload-chain-specs
        with:
          sha: ${{ github.sha }}
        env:
          kubeconfig_base64: ${{ secrets.kubeconfig_base64 }}
          K8S_SERVER: ${{ secrets.K8S_SERVER }}
          K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }}

  deploy-rustdoc:
    permissions:
      id-token: write
      contents: write
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Deploy Rust Docs
        uses: ./.github/actions/deploy/deploy-rustdoc
        with:
          ssh_key: ${{ secrets.SUBSTRATE_REPO_SSH_KEY }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock