test.yml

name: Lint and Test

on:
  push:
    branches: [main, release-v*]
  pull_request:
    branches: [main, release-v*]

# Cancel in-progress runs on new pushes to the same PR/branch
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write

env:
  SUI_VERSION: "1.75.2"

jobs:
  setup:
    name: Setup
    runs-on: ubuntu-latest
    timeout-minutes: 10
    outputs:
      packages: ${{ steps.set-matrix.outputs.packages }}
    steps:
      - name: Set package matrix
        id: set-matrix
        run: |
          PACKAGES='["contracts/access", "contracts/allowance", "contracts/finance", "contracts/sale", "contracts/timelock", "contracts/utils", "math/core", "math/fixed_point", "collections"]'
          echo "packages=$PACKAGES" >> $GITHUB_OUTPUT

      - name: Cache Sui binary
        id: cache-sui
        uses: actions/cache@v4
        with:
          path: ~/.local/bin/sui
          key: sui-${{ runner.os }}-${{ env.SUI_VERSION }}

      - name: Install Sui CLI from binary
        if: steps.cache-sui.outputs.cache-hit != 'true'
        run: |
          mkdir -p ~/.local/bin
          curl -fLJ https://github.com/MystenLabs/sui/releases/download/mainnet-v${{ env.SUI_VERSION }}/sui-mainnet-v${{ env.SUI_VERSION }}-ubuntu-x86_64.tgz -o sui.tgz
          tar -xzf sui.tgz
          chmod +x sui
          mv sui ~/.local/bin/

      - name: Verify Sui installation
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          sui --version

  check-move-formatting:
    name: Move Formatter Check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Check Move formatting
        uses: MystenLabs/move-formatter-action@v1
        with:
          prettier-plugin-move-version: "latest"
          working-directory: "."
          pattern: "**/*.move"
          write-changes: false

  lint:
    name: Lint ${{ matrix.package }}
    needs: setup
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: true
      matrix:
        package: ${{ fromJson(needs.setup.outputs.packages) }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Restore Sui CLI
        uses: ./.github/actions/restore-sui
        with:
          version: ${{ env.SUI_VERSION }}

      - name: Lint
        run: sui move build --lint --warnings-are-errors
        working-directory: ./${{ matrix.package }}

      - name: Lint tests
        run: sui move build --test --lint --warnings-are-errors
        working-directory: ./${{ matrix.package }}

      - name: Docgen clean
        run: sui move build --doc
        working-directory: ./${{ matrix.package }}

  # Fast, untraced run: the primary regression gate. Finishes in seconds even
  # for the heaviest suites, so a failing test is reported quickly.
  test:
    name: Test ${{ matrix.package }}
    needs: [setup, lint]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: true
      matrix:
        package: ${{ fromJson(needs.setup.outputs.packages) }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Restore Sui CLI
        uses: ./.github/actions/restore-sui
        with:
          version: ${{ env.SUI_VERSION }}

      - name: Run tests
        run: sui move test
        working-directory: ./${{ matrix.package }}

  # Coverage runs separately because `sui move test --trace` (required by
  # `sui move coverage lcov`) traces every VM instruction and is orders of
  # magnitude slower than a plain test run - the randomized sort/median tests in
  # `math/core` alone emit multi-gigabyte traces. Keeping it out of the gate
  # means regressions surface fast in `test`, and a slow trace never blocks a
  # merge (`continue-on-error`). It only runs once `test` is green.
  coverage:
    name: Coverage ${{ matrix.package }}
    # `setup` is needed for the package matrix below; `test` gates this on a
    # green fast run so we never trace a broken build.
    needs: [setup, test]
    runs-on: ubuntu-latest
    timeout-minutes: 40
    continue-on-error: true
    permissions:
      contents: read
      pull-requests: write
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.setup.outputs.packages) }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Restore Sui CLI
        uses: ./.github/actions/restore-sui
        with:
          version: ${{ env.SUI_VERSION }}

      - name: Run tests with tracing
        # `--rand-num-iters 1`: coverage only needs each line executed once; the
        # full randomized property iterations run in the `test` job above.
        #
        # Some suites build large collections whose traces run into multiple GB -
        # the heaviest never finish under `--trace` (>40 min) - and `sui move
        # test` has no exclude flag, so we disable them at the source level for
        # the traced run and restore via git. They still run untraced in the
        # `test` job above. Two scopes:
        #   * `collections`: the whole `*_differential_tests` modules.
        #   * others: individually named heavy tests (any test attribute).
        shell: bash
        run: |
          set -euo pipefail
          diff_files=$(grep -rlE --include='*.move' 'module .*_differential_tests;' tests 2>/dev/null || true)
          heavy_tests='quick_sort_random_is_sorted_and_preserves_elements'
          heavy_files=$(grep -rlE --include='*.move' "fun ($heavy_tests)" tests 2>/dev/null || true)
          disabled=()
          [ -n "$diff_files" ] && disabled+=($diff_files)
          [ -n "$heavy_files" ] && disabled+=($heavy_files)
          if [ ${#disabled[@]} -gt 0 ]; then
            trap 'git checkout -- "${disabled[@]}"' EXIT
            [ -n "$diff_files" ] && perl -0pi -e 's/#\[test\]/#[allow(unused_function)]/g' $diff_files
            [ -n "$heavy_files" ] && perl -0pi -e "s/#\[(test|random_test)\]\n(fun ($heavy_tests))/#[allow(unused_function)]\n\$2/g" $heavy_files
            # Fail loudly if the disable didn't happen (e.g. after a reformat),
            # otherwise the traced run silently hangs again. Capture the list
            # first so `sui move test` can't die from SIGPIPE (which under
            # pipefail would mask a match and skip this guard).
            if ! test_list=$(sui move test --list 2>&1); then
              echo "::error::failed to enumerate Move tests before tracing" >&2
              printf '%s\n' "$test_list" >&2
              exit 1
            fi
            if grep -qE "_differential_tests::|::($heavy_tests)" <<<"$test_list"; then
              echo "::error::failed to disable heavy tests before tracing" >&2
              exit 1
            fi
          fi
          sui move test --trace --rand-num-iters 1
        working-directory: ./${{ matrix.package }}

      - name: Generate Codecov report
        run: sui move coverage lcov > lcov.info
        working-directory: ./${{ matrix.package }}

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          file: ./${{ matrix.package }}/lcov.info
          flags: ${{ matrix.package }}
          name: ${{ matrix.package }}
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}

  codegen:
    name: Codegen (validate + drift + tests)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install the Move formatter (prettier plugin)
        run: npm ci

      - name: Install codegen
        run: pip install -e "scripts/gaussian_codegen[dev]"

      - name: Validate committed CDF coefficients
        run: python -m gaussian_codegen.cdf.validate

      - name: Check CDF coefficients are in sync with the generator
        run: python -m gaussian_codegen.cdf.emit_coefficients --check

      - name: Check CDF test vectors are in sync with the generator
        run: python -m gaussian_codegen.cdf.emit_test_vectors --check

      - name: Validate committed PDF coefficients
        run: python -m gaussian_codegen.pdf.validate

      - name: Check PDF coefficients are in sync with the generator
        run: python -m gaussian_codegen.pdf.emit_coefficients --check

      - name: Check PDF test vectors are in sync with the generator
        run: python -m gaussian_codegen.pdf.emit_test_vectors --check

      - name: Validate committed Inverse-CDF coefficients
        run: python -m gaussian_codegen.inverse_cdf.validate

      - name: Check Inverse-CDF coefficients are in sync with the generator
        run: python -m gaussian_codegen.inverse_cdf.emit_coefficients --check

      - name: Check Inverse-CDF test vectors are in sync with the generator
        run: python -m gaussian_codegen.inverse_cdf.emit_test_vectors --check

      - name: Run codegen unit tests
        run: pytest scripts/gaussian_codegen/tests -q