pull_request.yml

name: "[Checks] Pull Request"
on:
  pull_request:
    types: [opened, synchronize, reopened, edited]
    branches-ignore:
      - main

env:
  FORCE_COLOR: "1"

permissions:
  contents: read
  issues: write
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name != 'develop' && github.ref || github.run_id }}
  cancel-in-progress: true

jobs:
  auto-assign:
    name: Auto assign
    runs-on: ubuntu-22.04
    permissions:
      pull-requests: write
    steps:
      - uses: toshimaru/auto-author-assign@3e19bfc990cb1cf0589dce95e9f75289bb1e22de # v3.0.3

  detect-changes:
    name: Detect changed packages
    runs-on: ubuntu-22.04
    outputs:
      cs-scenarios: ${{ steps.select.outputs.scenarios }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
        id: filter
        with:
          filters: |
            context-module:
              - 'packages/signer/context-module/**'
            signer-eth:
              - 'packages/signer/signer-eth/**'
            signer-solana:
              - 'packages/signer/signer-solana/**'
            signer-trx:
              - 'packages/signer/signer-trx/**'
            signer-utils:
              - 'packages/signer/signer-utils/**'
            solana-tools:
              - 'packages/tools/solana-tools/**'
            contacts-kit:
              - 'packages/device-contacts-kit/**'
            cs-tester:
              - 'apps/clear-signing-tester/**'
              - '.github/**'

      - name: Select clear-signing groups
        id: select
        env:
          # The tester, CI, and the packages every signer shares can affect any
          # group.
          ALL: ${{ steps.filter.outputs.cs-tester == 'true' || steps.filter.outputs.context-module == 'true' || steps.filter.outputs.signer-utils == 'true' }}
          # Contacts sign through the eth signer, and a stored contact changes
          # what the eth review screens display, so the two move together.
          ETH_SIDE: ${{ steps.filter.outputs.signer-eth == 'true' || steps.filter.outputs.contacts-kit == 'true' }}
          SOLANA_SIDE: ${{ steps.filter.outputs.signer-solana == 'true' || steps.filter.outputs.solana-tools == 'true' }}
          # Tron signs contacts too, so the kit moves the Tron group as well.
          TRON_SIDE: ${{ steps.filter.outputs.signer-trx == 'true' || steps.filter.outputs.contacts-kit == 'true' }}
        run: |
          if [ "$ALL" = "true" ]; then
            scenarios="core contacts solana solana-general-clear-sign tron"
          else
            scenarios=""
            if [ "$ETH_SIDE" = "true" ]; then
              scenarios="$scenarios core contacts"
            fi
            if [ "$SOLANA_SIDE" = "true" ]; then
              scenarios="$scenarios solana solana-general-clear-sign"
            fi
            if [ "$TRON_SIDE" = "true" ]; then
              scenarios="$scenarios tron"
            fi
            scenarios="${scenarios# }"
          fi

          echo "scenarios=$scenarios" >> "$GITHUB_OUTPUT"
          echo "clear-signing groups: ${scenarios:-<none>}"

  setup:
    name: Setup toolchain and dependencies
    runs-on: ${{ !github.event.pull_request.head.repo.fork && 'ledgerhq-device-sdk' || 'ubuntu-22.04' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - uses: LedgerHQ/device-sdk-ts/.github/actions/setup-with-cache-composite@69b58c7fd3370397e82e73047b1441667bd46386

  danger:
    name: Run Danger check
    needs: [setup]
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - uses: LedgerHQ/device-sdk-ts/.github/actions/setup-with-cache-composite@69b58c7fd3370397e82e73047b1441667bd46386

      - name: Danger
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Workaround when using custom runners
          # https://github.com/danger/danger-js/issues/1374
          DANGER_GITHUB_API_BASE_URL: "https://api.github.com"
        run: pnpm danger:ci

  checks:
    name: Checks (build, prettier, lint, typecheck, test)
    # Single job running each Turbo task as its own step. Because everything
    # runs on one runner, build output stays on disk between steps, so there is
    # no cross-job build-cache upload/download. `--affected` restricts every
    # task to the packages changed versus the PR base branch.
    needs: [setup]
    runs-on: ${{ !github.event.pull_request.head.repo.fork && 'ledgerhq-device-sdk' || 'ubuntu-22.04' }}
    env:
      # Base reference used by `turbo run --affected` to detect changed packages.
      TURBO_SCM_BASE: origin/${{ github.event.pull_request.base.ref }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          # Full history + the base branch are required so Turbo can compute the
          # merge-base for `--affected`.
          fetch-depth: 0

      - name: Fetch base branch for --affected
        run: git fetch origin ${{ github.event.pull_request.base.ref }}

      - uses: LedgerHQ/device-sdk-ts/.github/actions/setup-with-cache-composite@69b58c7fd3370397e82e73047b1441667bd46386

      - name: Build
        id: build
        run: pnpm turbo run build --affected

      - name: Prettier
        id: prettier
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: pnpm turbo run prettier --affected

      - name: Lint
        id: lint
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: pnpm turbo run lint --affected

      - name: Typecheck
        id: typecheck
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: pnpm turbo run typecheck --affected

      - name: Test
        id: test
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: pnpm turbo run test:coverage --affected

      - uses: sonarsource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8
        if: ${{ steps.test.outcome == 'success' && github.actor != 'dependabot[bot]' && !github.event.pull_request.head.repo.fork }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      # Only run the (heavy) Playwright E2E when the sample app or one of its
      # dependencies is in the affected set; skip it otherwise.
      - name: Detect if sample app is affected
        id: sample-affected
        if: ${{ !cancelled() }}
        run: |
          affected=$(pnpm turbo run build --affected --dry=json 2>/dev/null \
            | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const j=JSON.parse(d);console.log((j.packages||[]).includes("@ledgerhq/device-management-kit-sample")?"true":"false")}catch(e){console.log("true")}})')
          echo "affected=$affected" >> "$GITHUB_OUTPUT"
          echo "sample app affected: $affected"

      - name: Install Playwright browsers
        if: ${{ !cancelled() && steps.sample-affected.outputs.affected == 'true' }}
        run: pnpm --filter @ledgerhq/device-management-kit-sample exec playwright install --with-deps chromium

      - name: Run sample Playwright tests
        id: playwright
        # The Playwright webServer (start-servers.sh) starts the sample app.
        # Tests connect to the hosted mock server; no local mock server is needed.
        if: ${{ !cancelled() && steps.sample-affected.outputs.affected == 'true' }}
        continue-on-error: true
        run: pnpm --filter @ledgerhq/device-management-kit-sample test:playwright

      # Playwright exits 0 once a retry passes, so uploading only on failure
      # loses the traces of flaky tests, which are the ones worth reading.
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: ${{ !cancelled() && steps.playwright.outcome != 'skipped' }}
        with:
          name: sample-playwright-traces
          path: apps/sample/test-results
          if-no-files-found: ignore
          retention-days: 7

      - name: Report
        if: ${{ !cancelled() }}
        env:
          BUILD_OUTCOME: ${{ steps.build.outcome }}
          PRETTIER_OUTCOME: ${{ steps.prettier.outcome }}
          LINT_OUTCOME: ${{ steps.lint.outcome }}
          TYPECHECK_OUTCOME: ${{ steps.typecheck.outcome }}
          TEST_OUTCOME: ${{ steps.test.outcome }}
          PLAYWRIGHT_OUTCOME: ${{ steps.playwright.outcome }}
        run: |
          icon() {
            case "$1" in
              success) echo "✅ Passed" ;;
              failure) echo "❌ Failed" ;;
              skipped) echo "⏭️ Skipped" ;;
              *)       echo "➖ ${1:-not run}" ;;
            esac
          }

          {
            echo "## Checks summary"
            echo ""
            echo "| Step | Result |"
            echo "| --- | --- |"
            echo "| Build | $(icon "$BUILD_OUTCOME") |"
            echo "| Prettier | $(icon "$PRETTIER_OUTCOME") |"
            echo "| Lint | $(icon "$LINT_OUTCOME") |"
            echo "| Typecheck | $(icon "$TYPECHECK_OUTCOME") |"
            echo "| Test | $(icon "$TEST_OUTCOME") |"
            echo "| Playwright (sample) | $(icon "$PLAYWRIGHT_OUTCOME") |"
          } >> "$GITHUB_STEP_SUMMARY"

          failed=0
          for outcome in "$BUILD_OUTCOME" "$PRETTIER_OUTCOME" "$LINT_OUTCOME" "$TYPECHECK_OUTCOME" "$TEST_OUTCOME" "$PLAYWRIGHT_OUTCOME"; do
            if [ "$outcome" = "failure" ]; then
              failed=1
            fi
          done

          if [ "$failed" -eq 1 ]; then
            echo "One or more checks failed. See the summary above."
            exit 1
          fi
          echo "All checks passed."

  health-check:
    name: Run health check
    # Aggregates the checks into a single required status so branch protection
    # only needs to require "Run health check". `!cancelled()` is what lets a
    # skipped cs-tester through instead of skipping this too.
    needs: [checks, cs-tester]
    if: ${{ !cancelled() }}
    runs-on: ubuntu-22.04
    steps:
      - name: Check results
        run: |
          if ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}; then
            echo "One or more required checks failed."
            exit 1
          fi
          echo "All required checks passed."

  cs-tester:
    # Runs alongside `checks`, not after it: the composite builds its own
    # dependency chain, so it never consumed anything `checks` produced.
    needs: [setup, detect-changes]
    if: needs.detect-changes.outputs.cs-scenarios != ''
    name: Clear Signing Test (${{ matrix.device }})
    runs-on: ${{ !github.event.pull_request.head.repo.fork && 'ledgerhq-device-sdk' || 'ubuntu-22.04' }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        device: [stax, nanox, flex]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      # A scenario that does not support the device is skipped by name, so one
      # selection serves all three: contacts is flex-only, core is Nano and Stax.
      - uses: ./.github/actions/cs-tester-composite
        with:
          scenarios: ${{ needs.detect-changes.outputs.cs-scenarios }}
          device: ${{ matrix.device }}
          # One job now carries what three did, so it holds more emulators at
          # once to keep the wall clock where it was.
          concurrency: "10"
          artifact-prefix: cs-tester-logs
          summary-prefix: "Clear Signing Test"
          # A device registration flow is hard to diagnose from a bare log.
          enable-file-logging: "true"
          gating-token: ${{ secrets.GATING_TOKEN }}