name: CI

on:
  push:
    branches: [ main ]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 20

    strategy:
      fail-fast: false
      matrix:
        node: [20]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npx hardhat test

  slither:
    name: Slither static analysis
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Install Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Slither
        run: |
          python -m pip install --upgrade pip
          pip install slither-analyzer solc-select

      - name: Install solc
        run: |
          solc-select install 0.8.25
          solc-select use 0.8.25
          solc --version

      - name: Run Slither
        # Slither can be noisy on large repos; use config + fail on high severity.
        run: |
          slither ./contracts --config-file slither.config.json --fail-high

  values-guardrails:
    name: Values guardrails (no KYC / no surveillance)
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run guardrails
        run: |
          npm run lint:guardrails
          npm run lint:values
          npm run lint:privileged-surface
          npm run lint:events-surface
          npm run lint:external-calls
          npm run lint:storage-growth

  npm-audit:
    name: NPM audit (high)
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Audit
        # Keep this at "high" so moderate ecosystem issues don't block dev.
        # continue-on-error handles transient npm registry Cloudflare blocks.
        continue-on-error: true
        run: npm audit --audit-level=high --omit=dev

