ci.yml

name: ci

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  workflow_dispatch:
  pull_request:
    branches:
      - main
      - dev
env:
  SUPPORT_DOCKERFILE_PATH: crates/support/Dockerfile
  CIPHERNODE_DOCKERFILE_PATH: crates/Dockerfile
  SUPPORT_IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/e3-support
  CIPHERNODE_IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/ciphernode
  NODE_VERSION: 22
  RUST_TOOLCHAIN: 1.91.1
  NOIR_TOOLCHAIN: v1.0.0-beta.26
  BB_VERSION: 5.1.0
  HARDHAT_VAR_MNEMONIC: 'test test test test test test test test test test test junk'
  HARDHAT_VAR_INFURA_API_KEY: 'zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz'
  PRIVATE_KEY: '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'
  RUST_BACKTRACE: 1

permissions:
  contents: read
  packages: write

jobs:
  detect_changes:
    timeout-minutes: 5
    runs-on: 'ubuntu-latest'
    outputs:
      rust_unit_tests: ${{ steps.jobs.outputs.rust_unit_tests }}
      rust_integration_tests: ${{ steps.jobs.outputs.rust_integration_tests }}
      ciphernode_e2e: ${{ steps.jobs.outputs.ciphernode_e2e }}
      crisp: ${{ steps.jobs.outputs.crisp }}
      templates: ${{ steps.jobs.outputs.templates }}
      zk: ${{ steps.jobs.outputs.zk }}
      contracts: ${{ steps.jobs.outputs.contracts }}
      docker_support: ${{ steps.jobs.outputs.docker_support }}
      docker_ciphernode: ${{ steps.jobs.outputs.docker_ciphernode }}
      net: ${{ steps.jobs.outputs.net }}
      init: ${{ steps.jobs.outputs.init }}
      build_sdk: ${{ steps.jobs.outputs.build_sdk }}
      build_e3_support_dev: ${{ steps.jobs.outputs.build_e3_support_dev }}
      build_circuits: ${{ steps.jobs.outputs.build_circuits }}
      integration_prebuild: ${{ steps.jobs.outputs.integration_prebuild }}
      zk_prover_integration: ${{ steps.jobs.outputs.zk_prover_integration }}
      build_interfold_cli: ${{ steps.jobs.outputs.build_interfold_cli }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - uses: dorny/paths-filter@6852f92c20ea7fd3b0c25de3b5112db3a98da050 # v3
        id: filter
        with:
          filters: |
            rust:
              - 'crates/**'
              - 'Cargo.toml'
              - 'Cargo.lock'
              - 'rust-toolchain.toml'
            contracts:
              - 'packages/interfold-contracts/**'
              # The manifest is generated from deployed_contracts.json and
              # verified by `gen:manifest:check` in test_contracts. Without this
              # path a hand-edited manifest never runs the drift check and
              # reaches the release assets stale.
              - 'deployments/**'
            circuits:
              - 'circuits/**'
              - 'scripts/*-circuits.sh'
            crisp:
              - 'examples/CRISP/**'
            templates:
              - 'templates/**'
            sdk:
              - 'packages/interfold-sdk/**'
              - 'packages/interfold-react/**'
              - 'packages/interfold-config/**'
              - 'crates/wasm/**'
            integration_tests:
              - 'tests/integration/**'
            docker:
              - 'crates/Dockerfile'
              - 'crates/support/Dockerfile'
              - 'crates/support/**'
            ci:
              - '.github/**'
      - name: Compute job filters
        id: jobs
        run: |
          RUST="${{ steps.filter.outputs.rust }}"
          CONTRACTS="${{ steps.filter.outputs.contracts }}"
          CIRCUITS="${{ steps.filter.outputs.circuits }}"
          CRISP="${{ steps.filter.outputs.crisp }}"
          TEMPLATES="${{ steps.filter.outputs.templates }}"
          SDK="${{ steps.filter.outputs.sdk }}"
          INTEGRATION="${{ steps.filter.outputs.integration_tests }}"
          DOCKER="${{ steps.filter.outputs.docker }}"
          CI="${{ steps.filter.outputs.ci }}"
          FORCE="${{ github.event_name == 'workflow_dispatch' }}"

          any() { for v in "$@"; do [ "$v" = "true" ] && echo "true" && return; done; echo "false"; }

          echo "rust_unit_tests=$(any $FORCE $RUST $CONTRACTS $CIRCUITS $CI)" >> $GITHUB_OUTPUT
          echo "rust_integration_tests=$(any $FORCE $RUST $CONTRACTS $CIRCUITS $CI)" >> $GITHUB_OUTPUT
          echo "ciphernode_e2e=$(any $FORCE $RUST $CONTRACTS $CIRCUITS $INTEGRATION $CI)" >> $GITHUB_OUTPUT
          echo "build_sdk=$(any $FORCE $RUST $CONTRACTS $SDK $INTEGRATION $CIRCUITS $CI $TEMPLATES)" >> $GITHUB_OUTPUT
          echo "crisp=$(any $FORCE $CRISP $CONTRACTS $CIRCUITS $RUST $CI)" >> $GITHUB_OUTPUT
          echo "templates=$(any $FORCE $TEMPLATES $CI)" >> $GITHUB_OUTPUT
          echo "zk=$(any $FORCE $RUST $CIRCUITS $CI)" >> $GITHUB_OUTPUT
          echo "contracts=$(any $FORCE $CONTRACTS $CI)" >> $GITHUB_OUTPUT
          echo "docker_support=$(any $FORCE $DOCKER $CI)" >> $GITHUB_OUTPUT
          echo "docker_ciphernode=$(any $FORCE $RUST $DOCKER $CI $CONTRACTS)" >> $GITHUB_OUTPUT
          echo "net=$(any $FORCE $INTEGRATION $CI)" >> $GITHUB_OUTPUT
          echo "init=$(any $FORCE $TEMPLATES $RUST $CONTRACTS $CI)" >> $GITHUB_OUTPUT
          echo "build_e3_support_dev=$(any $FORCE $TEMPLATES $RUST $CONTRACTS $SDK $CI)" >> $GITHUB_OUTPUT
          echo "build_circuits=$(any $FORCE $RUST $CIRCUITS $CI)" >> $GITHUB_OUTPUT
          echo "integration_prebuild=$(any $FORCE $RUST $CONTRACTS $CIRCUITS $INTEGRATION $CI)" >> $GITHUB_OUTPUT
          echo "zk_prover_integration=$(any $FORCE $RUST $CIRCUITS $CI)" >> $GITHUB_OUTPUT
          echo "build_interfold_cli=$(any $FORCE $RUST $CONTRACTS $CIRCUITS $INTEGRATION $TEMPLATES $CRISP $CI)" >> $GITHUB_OUTPUT

  rust_unit_tests:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.rust_unit_tests == 'true'
    timeout-minutes: 20
    runs-on: 'ubuntu-latest'
    permissions:
      contents: read
      actions: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Cache Rust dependencies
        uses: ./.github/actions/cache-dependencies

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # v1

      - name: Install solc
        run: |
          sudo add-apt-repository ppa:ethereum/ethereum \
          && sudo apt-get update -y \
          && sudo apt-get install -y solc protobuf-compiler

      - name: pnpm-setup
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

        # We need to setup node in order to compile the hardhat contracts to get the artifacts
      - name: 'Setup node'
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: 'Install the dependencies'
        run: 'pnpm install --frozen-lockfile'

      - name: Checking code format rust
        run: pnpm rust:lint

      - name: Compile contracts for ABI catalog tests
        run: pnpm evm:build

      - name: Run Unit Tests
        run: 'cargo test --lib && cargo test --doc'

      - name: Cancel workflow on failure
        if: failure()
        run: gh run cancel ${{ github.run_id }}
        env:
          GH_TOKEN: ${{ github.token }}

  rust_integration_tests:
    needs: [detect_changes, integration_prebuild]
    if: needs.detect_changes.outputs.rust_integration_tests == 'true'
    timeout-minutes: 45
    runs-on:
      group: enclave-ci
      labels: [enclave-ci-runner]
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Cache Rust dependencies
        uses: ./.github/actions/cache-dependencies

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # v1

      - name: Install solc
        run: |
          sudo add-apt-repository ppa:ethereum/ethereum \
          && sudo apt-get update -y \
          && sudo apt-get install -y solc protobuf-compiler

      - name: pnpm-setup
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: 'Setup node'
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: 'Install the dependencies'
        run: 'pnpm install --frozen-lockfile'

      - name: Download source-aligned ZK fixtures
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: integration-noir-artifacts
          path: .ci-noir/

      - name: Stage source-aligned circuit fixtures
        run: |
          chmod +x .ci-noir/bin/bb
          mkdir -p dist/circuits/insecure-512
          cp -R .ci-noir/circuits/insecure-512/minimum dist/circuits/insecure-512/

      - name: Run Integration Tests
        env:
          CIPHERNODE_SKIP_PROOF_AGGREGATION: 'true'
          E3_CUSTOM_BB: ${{ github.workspace }}/.ci-noir/bin/bb
        run: 'cargo test --test integration -- --nocapture'

  zk_prover_integration:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.zk_prover_integration == 'true'
    timeout-minutes: 30
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Cache Rust dependencies
        uses: ./.github/actions/cache-dependencies

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Install solc
        run: |
          sudo add-apt-repository ppa:ethereum/ethereum \
          && sudo apt-get update -y \
          && sudo apt-get install -y solc protobuf-compiler

      - name: pnpm-setup
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: 'Setup node'
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: 'Install the dependencies'
        run: 'pnpm install --frozen-lockfile'

      - name: Cache Barretenberg binary
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.bb
          key: bb-${{ env.BB_VERSION }}-${{ runner.arch }}

      - name: Run ZK Prover Integration Tests (with network downloads)
        run: 'cargo test -p e3-zk-prover --features integration-tests --test integration_tests -- --nocapture'

  build_e3_support_risc0:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.docker_support == 'true'
    timeout-minutes: 30
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - name: Generate tags
        id: tags
        run: |
          SHORT_SHA=$(git rev-parse --short=9 HEAD)
          TAGS="${SUPPORT_IMAGE_NAME}:${SHORT_SHA}"

          if [ "${GITHUB_REF}" = "refs/heads/main" ]; then
            TAGS="$TAGS,${SUPPORT_IMAGE_NAME}:main"
          fi

          echo "tags=$TAGS" >> $GITHUB_OUTPUT
      - name: Set up BuildKit
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build image
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
        with:
          context: ./crates/support
          file: ${{ env.SUPPORT_DOCKERFILE_PATH }}
          push: ${{ github.ref == 'refs/heads/main' }}
          tags: ${{ steps.tags.outputs.tags }}
          cache-from: |
            type=gha,scope=e3-support
          cache-to: |
            type=gha,mode=max,scope=e3-support

  build_ciphernode_image:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.docker_ciphernode == 'true'
    timeout-minutes: 60
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Generate tags
        id: tags
        run: |
          SHORT_SHA=$(git rev-parse --short=9 HEAD)
          TAGS="${CIPHERNODE_IMAGE_NAME}:${SHORT_SHA}"

          if [ "${GITHUB_REF}" = "refs/heads/main" ]; then
            TAGS="$TAGS,${CIPHERNODE_IMAGE_NAME}:main"
          fi

          echo "tags=$TAGS" >> $GITHUB_OUTPUT

      - name: Set up Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Log in to GitHub Container Registry
        if: github.ref == 'refs/heads/main'
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build ciphernode image
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
        with:
          context: .
          file: ${{ env.CIPHERNODE_DOCKERFILE_PATH }}
          push: ${{ github.ref == 'refs/heads/main' }}
          tags: ${{ steps.tags.outputs.tags }}
          cache-from: |
            type=gha,scope=ciphernode
          cache-to: |
            type=gha,mode=max,scope=ciphernode

  test_contracts:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.contracts == 'true'
    timeout-minutes: 15
    runs-on: 'ubuntu-latest'
    permissions:
      contents: read
      actions: write
    steps:
      - name: 'Check out the repo'
        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6

      - name: pnpm-setup
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: 'Setup node'
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: 'Install the dependencies'
        run: 'pnpm install --frozen-lockfile'

      - name: 'Lint the code'
        run: 'pnpm evm:lint'

      - name: 'Add lint summary'
        run: |
          echo "## Lint results" >> $GITHUB_STEP_SUMMARY
          echo "✅ Passed" >> $GITHUB_STEP_SUMMARY

      - name: 'Enforce production contract size budget'
        run: 'pnpm --filter @interfold/contracts size:check'

      - name: 'Validate upgrade storage layouts'
        run: 'pnpm --filter @interfold/contracts validate:upgrade'

      # The manifest is what operators fetch to detect a redeploy, so it must
      # never lag deployed_contracts.json.
      - name: 'Check the deployment manifest is up to date'
        run: 'pnpm --filter @interfold/contracts gen:manifest:check'

      - name: 'Test the contracts and generate the coverage report'
        run: 'pnpm coverage'

      - name: 'Add test summary'
        run: |
          echo "## Test results" >> $GITHUB_STEP_SUMMARY
          echo "✅ Passed" >> $GITHUB_STEP_SUMMARY

      - name: Cancel workflow on failure
        if: failure()
        run: gh run cancel ${{ github.run_id }}
        env:
          GH_TOKEN: ${{ github.token }}

  test_net:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.net == 'true'
    timeout-minutes: 15
    runs-on: 'ubuntu-latest'
    steps:
      - name: 'Check out the repo'
        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6
      - name: 'Run network tests'
        working-directory: tests/integration
        run: './test.sh net --no-prebuild'
      - name: 'Add test summary'
        run: |
          echo "## Network test results" >> $GITHUB_STEP_SUMMARY
          echo "✅ Passed" >> $GITHUB_STEP_SUMMARY

  integration_prebuild:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.integration_prebuild == 'true'
    timeout-minutes: 30
    runs-on: 'ubuntu-latest'
    steps:
      - name: 'Check out the repo'
        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6

      - name: Cache Rust dependencies
        uses: ./.github/actions/cache-dependencies

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: pnpm-setup
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: 'Setup node'
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: Install Nargo
        uses: noir-lang/noirup@7dbe69ccc78877f0200ffa5a40836c953d2cfd8f # v0.1.4
        with:
          toolchain: ${{ env.NOIR_TOOLCHAIN }}

      - name: Cache Barretenberg binary
        id: cache-integration-bb
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: /usr/local/bin/bb
          key: bb-bin-${{ env.BB_VERSION }}-amd64-linux

      - name: Install Barretenberg (bb)
        if: steps.cache-integration-bb.outputs.cache-hit != 'true'
        run: |
          curl -fsSL "https://github.com/AztecProtocol/aztec-packages/releases/download/v${{ env.BB_VERSION }}/barretenberg-amd64-linux.tar.gz" -o bb.tar.gz
          mkdir -p bb_extract && tar -xzf bb.tar.gz -C bb_extract
          BB_BIN=$(find bb_extract -name bb -type f | head -n 1)
          sudo mv "$BB_BIN" /usr/local/bin/bb
          chmod +x /usr/local/bin/bb

      - name: Install solc
        run: |
          sudo add-apt-repository ppa:ethereum/ethereum \
          && sudo apt-get update -y \
          && sudo apt-get install -y solc protobuf-compiler

      - name: 'Install the dependencies'
        run: 'pnpm install --frozen-lockfile'

      - name: 'Run prebuild'
        run: 'pnpm test:integration prebuild'

      - name: 'Verify build artifacts exist'
        run: |
          echo "Checking for build artifacts:"
          ls -la target/debug/fake_encrypt || echo "fake_encrypt not found"
          ls -la target/debug/pack_e3_params || echo "pack_e3_params not found"

      - name: 'Upload build artifacts'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: build-artifacts
          path: |
            target/debug/fake_encrypt
            target/debug/pack_e3_params
          if-no-files-found: error

      - name: Upload source-aligned ZK fixtures
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: integration-noir-artifacts
          include-hidden-files: true
          path: tests/integration/.interfold/noir/
          retention-days: 1
          if-no-files-found: error

  check-nix-flake:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes
        # if the following fails it means some of our git dependencies or bb has updated
        # to fix this basically what you need to do here is copy the actual hashes
        # into the flake.nix where those hashes are expected. if you want to do this locally
        # install the nix package manager and try running the scripts below.
      - run: bash ./scripts/nix-versions.sh # display bad versions when deps change

  ciphernode_integration_test:
    needs: [detect_changes, integration_prebuild, build_interfold_cli, build_sdk]
    if: needs.detect_changes.outputs.ciphernode_e2e == 'true'
    timeout-minutes: 45
    runs-on:
      group: enclave-ci
      labels: [enclave-ci-runner]
    strategy:
      matrix:
        test-suite: [base, persist]
      fail-fast: true
    steps:
      - name: 'Check out the repo'
        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6
      - name: pnpm-setup
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
      - name: 'Setup node'
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # v1
      - name: 'Install the dependencies'
        run: 'pnpm install --frozen-lockfile'
      - name: 'Download build artifacts'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: build-artifacts
          path: target/debug/
      - name: 'Download source-aligned ZK fixtures'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: integration-noir-artifacts
          path: tests/integration/.interfold/noir/
      - name: 'Download interfold binary'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: interfold-binary
          path: ~/.cargo/bin/
      - name: 'Download SDK artifacts'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: sdk-artifacts
          path: ./
      - name: 'Verify downloaded artifacts'
        run: |
          echo "Checking for required artifacts:"
          ls -la target/debug/fake_encrypt || echo "fake_encrypt not found"
          ls -la target/debug/pack_e3_params || echo "pack_e3_params not found"
          ls -la ~/.cargo/bin/interfold || echo "interfold binary not found"
          ls -la packages/interfold-contracts/dist || echo "SDK dist not found"
          ls -la crates/wasm/dist || echo "WASM dist not found"
      - name: 'Set executable permissions'
        run: |
          chmod +x target/debug/fake_encrypt
          chmod +x target/debug/pack_e3_params
          chmod +x ~/.cargo/bin/interfold
          chmod +x tests/integration/.interfold/noir/bin/bb
      - name: 'Run ${{ matrix.test-suite }} tests'
        run: |
          INTERFOLD_BIN="$HOME/.cargo/bin/interfold" \
            pnpm test:integration ${{ matrix.test-suite }} --no-prebuild
      - name: 'Add test summary'
        run: |
          echo "## Test results for ${{ matrix.test-suite }}" >> $GITHUB_STEP_SUMMARY
          echo "✅ Passed" >> $GITHUB_STEP_SUMMARY

  build_interfold_cli:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.build_interfold_cli == 'true'
    timeout-minutes: 20
    runs-on:
      group: enclave-ci
      labels: [enclave-ci-runner]
    permissions:
      contents: read
      actions: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          submodules: recursive

      - name: Cache Rust dependencies
        uses: ./.github/actions/cache-dependencies

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Install solc
        run: |
          sudo add-apt-repository ppa:ethereum/ethereum \
          && sudo apt-get update -y \
          && sudo apt-get install -y solc protobuf-compiler

      - name: Build interfold CLI
        run: cargo install --locked --path crates/cli --bin interfold --features test-only-skip-proof-aggregation

      - name: Upload interfold binary
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: interfold-binary
          path: ~/.cargo/bin/interfold
          retention-days: 1

      - name: Cancel workflow on failure
        if: failure()
        run: gh run cancel ${{ github.run_id }}
        env:
          GH_TOKEN: ${{ github.token }}

  crisp_unit:
    needs: [detect_changes, build_crisp_sdk]
    if: needs.detect_changes.outputs.crisp == 'true'
    timeout-minutes: 30
    runs-on: 'ubuntu-latest'
    strategy:
      matrix:
        include:
          - test-suite: test:circuits
            command: pnpm test:circuits
          - test-suite: test:sdk
            command: pnpm test:sdk
          - test-suite: test:contracts
            command: pnpm test:contracts
          - test-suite: cargo test
            command: cargo test
      fail-fast: false
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          submodules: recursive

      - name: Cache Rust dependencies
        if: matrix.test-suite == 'cargo test'
        uses: ./.github/actions/cache-dependencies
        with:
          cargo-lock-path: examples/CRISP/Cargo.lock
          rust-target-path: examples/CRISP/target/

      - name: Install Rust
        if: matrix.test-suite == 'cargo test'
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Install Foundry
        if: matrix.test-suite == 'cargo test'
        uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # v1

      - name: Install solc
        if: matrix.test-suite == 'cargo test'
        run: |
          sudo add-apt-repository ppa:ethereum/ethereum \
          && sudo apt-get update -y \
          && sudo apt-get install -y solc protobuf-compiler

      - name: Install Nargo
        if: matrix.test-suite == 'test:circuits'
        uses: noir-lang/noirup@7dbe69ccc78877f0200ffa5a40836c953d2cfd8f # v0.1.4
        with:
          toolchain: ${{ env.NOIR_TOOLCHAIN }}

      - name: Setup pnpm
        if: matrix.test-suite != 'cargo test'
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Setup Node.js
        if: matrix.test-suite != 'cargo test'
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: Install dependencies
        if: matrix.test-suite != 'cargo test'
        working-directory: .
        run: pnpm install --frozen-lockfile

      - name: Compile Interfold contracts
        if: matrix.test-suite == 'test:contracts'
        working-directory: .
        run: pnpm evm:build

      - name: Download Crisp SDK artifacts
        if: matrix.test-suite == 'test:sdk' || matrix.test-suite == 'test:contracts'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: crisp-sdk-artifacts
          path: .

      - name: Run ${{ matrix.test-suite }}
        working-directory: ./examples/CRISP
        run: ${{ matrix.command }}

  crisp_e2e:
    needs: [detect_changes, build_interfold_cli, build_crisp_sdk]
    if: needs.detect_changes.outputs.crisp == 'true'
    timeout-minutes: 45
    runs-on:
      group: enclave-ci
      labels: [enclave-ci-runner]
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          submodules: recursive

      - name: Cache Rust dependencies
        uses: ./.github/actions/cache-dependencies
        with:
          cargo-lock-path: examples/CRISP/Cargo.lock
          rust-target-path: examples/CRISP/target/

      - name: Prepare test environment
        run: |
          mkdir -p $GITHUB_WORKSPACE/examples/CRISP/test-results
          sudo chmod -R 777 $GITHUB_WORKSPACE/examples/CRISP/test-results
          mkdir -p $GITHUB_WORKSPACE/examples/CRISP/playwright-report
          sudo chmod -R 777 $GITHUB_WORKSPACE/examples/CRISP/playwright-report
          mkdir -p $GITHUB_WORKSPACE/examples/CRISP/.cache-synpress
          sudo chown -R $USER_UID:$USER_GID $GITHUB_WORKSPACE/examples/CRISP/.cache-synpress
          sudo chmod -R 777 $GITHUB_WORKSPACE/examples/CRISP/.cache-synpress

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # v1

      - name: Setup pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: Install solc
        run: |
          sudo add-apt-repository ppa:ethereum/ethereum \
          && sudo apt-get update -y \
          && sudo apt-get install -y solc protobuf-compiler

      - name: Install yq
        run: |
          sudo wget -qO- https://github.com/mikefarah/yq/releases/download/v4.45.1/yq_linux_amd64.tar.gz | sudo tar xz -C /usr/local/bin --transform='s|yq_linux_amd64|yq|' --no-same-owner

      - name: Install dependencies
        working-directory: .
        run: pnpm install --frozen-lockfile

      - name: Compile Interfold contracts
        working-directory: .
        run: pnpm evm:build

      - name: Compile Crisp contracts
        working-directory: ./examples/CRISP
        run: pnpm compile:contracts

      - name: Copy environment variables
        working-directory: ./examples/CRISP
        run: |
          cp server/.env.example server/.env
          cp client/.env.example client/.env
          cp .env.example .env

      - name: Build Crisp server and CLI binaries
        working-directory: ./examples/CRISP/server
        run: |
          cargo build --locked --bin cli
          cargo build --locked --bin server

      - name: Download Crisp SDK artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: crisp-sdk-artifacts
          path: .

      - name: Install Playwright browsers
        working-directory: ./examples/CRISP
        run: pnpm exec playwright install chromium

      - name: Download interfold binary
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: interfold-binary
          path: ~/.cargo/bin/

      - name: Make binaries executable
        run: |
          chmod +x ~/.cargo/bin/interfold

      - name: Install Nargo
        uses: noir-lang/noirup@7dbe69ccc78877f0200ffa5a40836c953d2cfd8f # v0.1.4
        with:
          toolchain: ${{ env.NOIR_TOOLCHAIN }}

      - name: Cache Barretenberg binary
        id: cache-bb
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: /usr/local/bin/bb
          key: bb-bin-${{ env.BB_VERSION }}-amd64-linux

      - name: Install Barretenberg (bb)
        if: steps.cache-bb.outputs.cache-hit != 'true'
        run: |
          curl -fsSL "https://github.com/AztecProtocol/aztec-packages/releases/download/v${{ env.BB_VERSION }}/barretenberg-amd64-linux.tar.gz" -o bb.tar.gz
          mkdir -p bb_extract && tar -xzf bb.tar.gz -C bb_extract
          BB_BIN=$(find bb_extract -name bb -type f | head -n 1)
          sudo mv "$BB_BIN" /usr/local/bin/bb
          chmod +x /usr/local/bin/bb

      - name: Build interfold circuits
        run: pnpm build:circuits --preset insecure-512 --committee minimum --skip-if-built

      - name: Setup ZK prover
        run: |
          interfold noir setup

      - name: Run Playwright tests
        working-directory: ./examples/CRISP
        env:
          PLAYWRIGHT_WORKERS: 4
          METAMASK_VERSION: 11.8.2
        run: pnpm test:e2e

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: playwright-report
          path: ./examples/CRISP/playwright-report/
          retention-days: 30

  build_circuits:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.build_circuits == 'true'
    timeout-minutes: 30
    runs-on: 'ubuntu-latest'
    permissions:
      contents: read
      actions: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          submodules: recursive

      - name: Install Nargo
        uses: noir-lang/noirup@7dbe69ccc78877f0200ffa5a40836c953d2cfd8f # v0.1.4
        with:
          toolchain: ${{ env.NOIR_TOOLCHAIN }}

      - name: Install protoc
        run: sudo apt-get update -y && sudo apt-get install -y protobuf-compiler

      - name: Cache Barretenberg binary
        id: cache-bb
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: /usr/local/bin/bb
          key: bb-bin-${{ env.BB_VERSION }}-amd64-linux

      - name: Install Barretenberg (bb)
        if: steps.cache-bb.outputs.cache-hit != 'true'
        run: |
          curl -fsSL "https://github.com/AztecProtocol/aztec-packages/releases/download/v${{ env.BB_VERSION }}/barretenberg-amd64-linux.tar.gz" -o bb.tar.gz
          mkdir -p bb_extract && tar -xzf bb.tar.gz -C bb_extract
          BB_BIN=$(find bb_extract -name bb -type f | head -n 1)
          sudo mv "$BB_BIN" /usr/local/bin/bb
          chmod +x /usr/local/bin/bb

      - name: Verify bb
        run: bb --version

      - name: Check formatting
        run: ./scripts/lint-circuits.sh

      - name: Test Noir circuits
        run: ./scripts/test-circuits.sh

      - name: pnpm-setup
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Setup node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build circuits
        run: pnpm build:circuits

      - name: Upload compiled circuit artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: compiled-circuits
          path: |
            circuits/bin/.active-preset.json
            circuits/bin/dkg/target/
            circuits/bin/threshold/target/
            circuits/bin/recursive_aggregation/*/target/
          retention-days: 1
          if-no-files-found: error

      - name: Cancel workflow on failure
        if: failure()
        run: gh run cancel ${{ github.run_id }}
        env:
          GH_TOKEN: ${{ github.token }}

  zk_prover_e2e:
    needs: [detect_changes, build_circuits]
    if: needs.detect_changes.outputs.zk == 'true'
    timeout-minutes: 30
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Cache Rust dependencies
        uses: ./.github/actions/cache-dependencies

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache Barretenberg binary
        id: cache-bb
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: /usr/local/bin/bb
          key: bb-bin-${{ env.BB_VERSION }}-amd64-linux

      - name: Install solc
        run: |
          sudo add-apt-repository ppa:ethereum/ethereum \
          && sudo apt-get update -y \
          && sudo apt-get install -y solc protobuf-compiler

      - name: Install Barretenberg (bb)
        if: steps.cache-bb.outputs.cache-hit != 'true'
        run: |
          curl -fsSL "https://github.com/AztecProtocol/aztec-packages/releases/download/v${{ env.BB_VERSION }}/barretenberg-amd64-linux.tar.gz" -o bb.tar.gz
          mkdir -p bb_extract && tar -xzf bb.tar.gz -C bb_extract
          BB_BIN=$(find bb_extract -name bb -type f | head -n 1)
          sudo mv "$BB_BIN" /usr/local/bin/bb
          chmod +x /usr/local/bin/bb

      - name: Verify bb
        run: bb --version

      - name: Download compiled circuit artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: compiled-circuits
          path: circuits/bin/

      - name: Verify circuit artifacts
        run: |
          echo "DKG circuits:"
          ls -la circuits/bin/dkg/target/*.json \
               circuits/bin/dkg/target/*.vk \
               circuits/bin/dkg/target/*.vk_hash \
               circuits/bin/dkg/target/*.vk_recursive \
               circuits/bin/dkg/target/*.vk_recursive_hash \
               circuits/bin/dkg/target/*.vk_noir \
               circuits/bin/dkg/target/*.vk_noir_hash
          echo "Threshold circuits:"
          ls -la circuits/bin/threshold/target/*.json \
               circuits/bin/threshold/target/*.vk \
               circuits/bin/threshold/target/*.vk_hash \
               circuits/bin/threshold/target/*.vk_recursive \
               circuits/bin/threshold/target/*.vk_recursive_hash \
               circuits/bin/threshold/target/*.vk_noir \
               circuits/bin/threshold/target/*.vk_noir_hash

      - name: Verify variant output directories
        run: |
          echo "Checking recursive aggregation artifacts:"
          # Assert on the artifacts downstream jobs consume. Listing alone let this step
          # pass even when no recursive artifacts had been produced at all.
          for artifact in \
            circuits/bin/recursive_aggregation/dkg_aggregator/target/dkg_aggregator.json \
            circuits/bin/recursive_aggregation/dkg_aggregator/target/dkg_aggregator.vk_recursive \
            circuits/bin/recursive_aggregation/decryption_aggregator/target/decryption_aggregator.json \
            circuits/bin/recursive_aggregation/decryption_aggregator/target/decryption_aggregator.vk_recursive
          do
            test -f "$artifact" || { echo "Missing required artifact: $artifact"; exit 1; }
            echo "  ok $artifact"
          done

      - name: Run ZK prover e2e tests
        run: cargo test -p e3-zk-prover --test local_e2e_tests -- --nocapture --test-threads=1

  build_e3_support_dev:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.build_e3_support_dev == 'true'
    timeout-minutes: 20
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          submodules: recursive
      - name: Cache Rust dependencies
        uses: ./.github/actions/cache-dependencies
        with:
          cargo-lock-path: templates/default/Cargo.lock
          rust-target-path: templates/default/target/
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - name: Install protoc
        run: sudo apt-get update -y && sudo apt-get install -y protobuf-compiler
      - name: Build support scripts
        run: cd templates/default && cargo build --locked --bin e3-support-scripts-dev
      - name: Verify build artifacts
        run: |
          echo "Checking for support scripts binary:"
          find templates/default/target/ -name "e3-support-scripts-dev" -type f -ls || echo "Binary not found"
      - name: Upload support scripts artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: support-scripts-artifacts
          path: templates/default/target/
          retention-days: 1
          if-no-files-found: error

  build_sdk:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.build_sdk == 'true'
    timeout-minutes: 30
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          submodules: recursive

      - name: Install pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: Install Nargo
        uses: noir-lang/noirup@7dbe69ccc78877f0200ffa5a40836c953d2cfd8f # v0.1.4
        with:
          toolchain: ${{ env.NOIR_TOOLCHAIN }}

      - name: Cache Rust dependencies
        uses: ./.github/actions/cache-dependencies

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          targets: wasm32-unknown-unknown

      - name: Install protoc
        run: sudo apt-get update -y && sudo apt-get install -y protobuf-compiler

      - name: Install node dependencies
        run: pnpm install --frozen-lockfile

      - name: Build the sdk
        run: pnpm sdk:build

      - name: Install Chrome for WASM browser smoke tests
        uses: browser-actions/setup-chrome@19ae4b339ee18925ab85cf12c1041150ea4a44c8 # v1

      - name: WASM browser smoke test (e3-wasm)
        run: |
          cd crates/wasm
          pnpm build
          pnpm test:browser

      - name: Run the tests
        run: pnpm sdk:test

      - name: Upload SDK artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: sdk-artifacts
          include-hidden-files: true
          path: |
            packages/interfold-sdk/dist
            packages/interfold-contracts/dist
            packages/interfold-contracts/artifacts
            packages/interfold-contracts/cache
            packages/interfold-contracts/types
            crates/wasm/dist
            circuits/bin/.active-preset.json
            circuits/bin/recursive_aggregation/*/target
            circuits/bin/threshold/target
          retention-days: 1
          if-no-files-found: error

  build_crisp_sdk:
    needs: [detect_changes]
    if: needs.detect_changes.outputs.crisp == 'true'
    timeout-minutes: 20
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Install pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: Install Nargo
        uses: noir-lang/noirup@7dbe69ccc78877f0200ffa5a40836c953d2cfd8f # v0.1.4
        with:
          toolchain: ${{ env.NOIR_TOOLCHAIN }}

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          targets: wasm32-unknown-unknown

      - name: Install protoc
        run: sudo apt-get update -y && sudo apt-get install -y protobuf-compiler

      - name: Install node dependencies
        run: pnpm install --frozen-lockfile

      - name: Build the sdk
        working-directory: ./examples/CRISP
        run: pnpm build:sdk

      - name: Install Chrome for WASM browser smoke tests
        uses: browser-actions/setup-chrome@19ae4b339ee18925ab85cf12c1041150ea4a44c8 # v1

      - name: WASM browser smoke test (crisp-zk-inputs)
        working-directory: ./examples/CRISP
        run: |
          pnpm -C packages/crisp-zk-inputs build
          pnpm -C packages/crisp-zk-inputs test:browser

      - name: Upload SDK artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: crisp-sdk-artifacts
          path: |
            examples/CRISP/packages/crisp-sdk/dist
            examples/CRISP/packages/crisp-zk-inputs/dist
            examples/CRISP/circuits/bin/crisp/target
            examples/CRISP/circuits/bin/crisp_onchain/target
            examples/CRISP/circuits/bin/fold/target
            examples/CRISP/circuits/bin/fold_onchain/target
            circuits/bin/threshold/target
            circuits/bin/recursive_aggregation/*/target
          retention-days: 1
          if-no-files-found: warn

  template_integration:
    needs: [detect_changes, build_interfold_cli, build_e3_support_dev, build_sdk]
    if: needs.detect_changes.outputs.templates == 'true'
    timeout-minutes: 30
    runs-on:
      group: enclave-ci
      labels: [enclave-ci-runner]
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          submodules: recursive
      - name: Install pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: pnpm-lock.yaml

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Install protoc
        run: sudo apt-get update -y && sudo apt-get install -y protobuf-compiler

      - name: Install node dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # v1

      - name: Download interfold binary
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: interfold-binary
          path: ~/.cargo/bin/

      - name: Download support scripts artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: support-scripts-artifacts
          path: templates/default/target/

      - name: Download SDK artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: sdk-artifacts
          path: ./

      - name: Make binaries executable
        run: |
          chmod +x ~/.cargo/bin/interfold
          chmod +x templates/default/target/debug/e3-support-scripts-dev

      - name: Install Nargo
        uses: noir-lang/noirup@7dbe69ccc78877f0200ffa5a40836c953d2cfd8f # v0.1.4
        with:
          toolchain: ${{ env.NOIR_TOOLCHAIN }}

      - name: Cache Barretenberg binary
        id: cache-bb
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: /usr/local/bin/bb
          key: bb-bin-${{ env.BB_VERSION }}-amd64-linux

      - name: Install Barretenberg (bb)
        if: steps.cache-bb.outputs.cache-hit != 'true'
        run: |
          curl -fsSL "https://github.com/AztecProtocol/aztec-packages/releases/download/v${{ env.BB_VERSION }}/barretenberg-amd64-linux.tar.gz" -o bb.tar.gz
          mkdir -p bb_extract && tar -xzf bb.tar.gz -C bb_extract
          BB_BIN=$(find bb_extract -name bb -type f | head -n 1)
          sudo mv "$BB_BIN" /usr/local/bin/bb
          chmod +x /usr/local/bin/bb

      - name: Build interfold circuits
        run: pnpm build:circuits --preset insecure-512 --committee minimum --skip-if-built

      - name: Setup ZK prover
        run: |
          interfold noir setup

      - name: Verify downloaded artifacts
        run: |
          echo "Checking downloaded artifacts:"
          ls -la ~/.cargo/bin/interfold || echo "interfold binary not found"
          ls -la templates/default/target/debug/e3-support-scripts-dev || echo "support scripts not found"
          ls -la packages/interfold-contracts/dist || echo "SDK dist not found"
          ls -la crates/wasm/dist || echo "WASM dist not found"
          test -f circuits/bin/.active-preset.json || (echo "ERROR: circuit preset stamp not found" && exit 1)
          echo "Support scripts permissions:"
          ls -la templates/default/target/debug/e3-support-scripts-dev

      - name: Test Template
        run: |
          cd templates/default
          pnpm compile
          chmod 755 .interfold/generated/contracts tests
          chmod 644 .interfold/generated/contracts/ImageID.sol
          pnpm test:integration

  test_interfold_init:
    needs: [detect_changes, build_interfold_cli, build_e3_support_dev]
    if: needs.detect_changes.outputs.init == 'true'
    timeout-minutes: 10
    runs-on: 'ubuntu-latest'
    steps:
      - name: Install pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
        with:
          version: 10.7.1
      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - name: Download interfold binary
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: interfold-binary
          path: ~/.cargo/bin/
      - name: Make binaries executable
        run: |
          chmod +x ~/.cargo/bin/interfold
      - name: Verify downloaded artifacts
        run: |
          ls -la ~/.cargo/bin/interfold || echo "interfold binary not found"
      - name: Interfold init
        env:
          EVENT_NAME: ${{ github.event_name }}
          HEAD_REF: ${{ github.head_ref }}
          REF_NAME: ${{ github.ref_name }}
          HEAD_REPO_URL: ${{ github.event.pull_request.head.repo.clone_url }}
          UPSTREAM_REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
        run: |
          if [ "$EVENT_NAME" = "pull_request" ]; then
            BRANCH="$HEAD_REF"
            TEMPLATE_REPO="$HEAD_REPO_URL"
          else
            BRANCH="$REF_NAME"
            TEMPLATE_REPO="$UPSTREAM_REPO_URL"
          fi
          interfold init mycitest --verbose --template="${TEMPLATE_REPO}#${BRANCH}:templates/default"

  contrib-readme-job:
    timeout-minutes: 10
    runs-on: 'ubuntu-latest'
    name: Populate Contributors List
    # Only run on main branch to avoid branch conflicts
    if: github.ref == 'refs/heads/main' && !contains(github.event.head_commit.message, 'contrib-readme-action')
    concurrency:
      group: contrib-readme-${{ github.ref }}
      cancel-in-progress: true
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Contribute List
        uses: akhilmhdh/contributors-readme-action@1ff4c56187458b34cd602aee93e897344ce34bfc # v1.4.0
        with:
          image_size: 100
          readme_path: README.md
          use_username: false
          columns_per_row: 6
          collaborators: direct
          commit_message: 'docs(contributor): contrib-readme-action has updated readme'
          committer_username: 'github-actions[bot]'
          committer_email: 'github-actions[bot]@users.noreply.github.com'
          auto_detect_branch_protection: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}