hash-wallet/.github/workflows/pr_test_build_linux.yml

name: Cake Wallet Linux

permissions:
  contents: read
  packages: write

on: [pull_request]

defaults:
  run:
    shell: bash

env:
  CW_DOCKER_REGISTRY: ghcr.io/cake-tech/cake_wallet
  CW_DOCKER_USE_CLOUD: "true"

concurrency:
  group: linux-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  guard:
    # Fork PRs don't have access to repository secrets, so the generated
    # lib/.secrets.g.dart would be empty and the build fails to compile.
    # Skip for forks, mirroring the Android workflow's internal-build guard.
    if: github.event.pull_request.head.repo.fork == false
    runs-on: puzl-ubuntu-latest
    steps:
      - run: echo "internal PR"

  base:
    needs: guard
    runs-on: puzl-ubuntu-latest
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v4
        if: ${{ env.ACT != 'true' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Docker sock permissions
        run: sudo chmod 666 /var/run/docker.sock || true
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build base
        run: ./scripts/linux/docker/build.sh --only base

  bitbox:
    needs: base
    runs-on: puzl-ubuntu-latest
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v4
        if: ${{ env.ACT != 'true' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Docker sock permissions
        run: sudo chmod 666 /var/run/docker.sock || true
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build bitbox
        run: ./scripts/linux/docker/build.sh --only bitbox

  mwebd:
    needs: base
    runs-on: puzl-ubuntu-latest
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v4
        if: ${{ env.ACT != 'true' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Docker sock permissions
        run: sudo chmod 666 /var/run/docker.sock || true
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build mwebd
        run: ./scripts/linux/docker/build.sh --only mwebd

  reown:
    needs: base
    runs-on: puzl-ubuntu-latest
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v4
        if: ${{ env.ACT != 'true' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Docker sock permissions
        run: sudo chmod 666 /var/run/docker.sock || true
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build reown
        run: ./scripts/linux/docker/build.sh --only reown

  zcash:
    needs: base
    runs-on: puzl-ubuntu-latest
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v4
        if: ${{ env.ACT != 'true' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Docker sock permissions
        run: sudo chmod 666 /var/run/docker.sock || true
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build zcash
        run: ./scripts/linux/docker/build.sh --only zcash

  torch:
    needs: base
    runs-on: puzl-ubuntu-latest
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v4
        if: ${{ env.ACT != 'true' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Docker sock permissions
        run: sudo chmod 666 /var/run/docker.sock || true
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build torch
        run: ./scripts/linux/docker/build.sh --only torch

  monero:
    needs: base
    runs-on: puzl-ubuntu-latest
    timeout-minutes: 360
    strategy:
      matrix:
        coin: [monero, wownero]
    steps:
      - uses: actions/checkout@v4
        if: ${{ env.ACT != 'true' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Docker sock permissions
        run: sudo chmod 666 /var/run/docker.sock || true
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build monero
        run: ./scripts/linux/docker/build.sh --only monero --coin ${{ matrix.coin }} --target x86_64-linux-gnu

  monero_merge:
    needs: monero
    runs-on: puzl-ubuntu-latest
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v4
        if: ${{ env.ACT != 'true' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Docker sock permissions
        run: sudo chmod 666 /var/run/docker.sock || true
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Merge monero
        run: ./scripts/linux/docker/build.sh --only monero --merge

  final:
    needs: [bitbox, mwebd, reown, zcash, torch, monero_merge]
    runs-on: puzl-ubuntu-latest
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v4
        if: ${{ env.ACT != 'true' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Docker sock permissions
        run: sudo chmod 666 /var/run/docker.sock || true
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build final
        run: ./scripts/linux/docker/build.sh --only final

  app:
    needs: final
    runs-on: puzl-ubuntu-latest
    timeout-minutes: 360
    container:
      image: ghcr.io/cake-tech/cake_wallet:debian13-flutter3.41.9-ndkr28-go1.24.1-ruststablenightly
      env:
        STORE_PASS: test@cake_wallet
        KEY_PASS: test@cake_wallet
        BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
        DESKTOP_FORCE_MOBILE: Y
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
    steps:
      - name: Fix github actions messing up $HOME...
        run: "echo HOME=/root | sudo tee -a $GITHUB_ENV"

      - uses: actions/checkout@v4
        if: ${{ env.ACT != 'true' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Docker sock permissions
        run: sudo chmod 666 /var/run/docker.sock || true

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: configure git
        run: |
          git config --global --add safe.directory '*'
          git config --global user.email "ci@cakewallet.com"
          git config --global user.name "CakeWallet CI"
      - name: Add secrets
        run: |
          touch cw_bitcoin/lib/.secrets.g.dart
          touch cw_evm/lib/.secrets.g.dart
          touch cw_solana/lib/.secrets.g.dart
          touch cw_core/lib/.secrets.g.dart
          touch cw_nano/lib/.secrets.g.dart
          touch cw_tron/lib/.secrets.g.dart

          echo "const polygonScanApiKey = '${{ secrets.POLYGON_SCAN_API_KEY }}';" >> cw_evm/lib/.secrets.g.dart
          echo "const etherScanApiKey = '${{ secrets.ETHER_SCAN_API_KEY }}';" >> cw_evm/lib/.secrets.g.dart
          echo "const moralisApiKey = '${{ secrets.MORALIS_API_KEY }}';" >> cw_evm/lib/.secrets.g.dart
          echo "const nowNodesApiKey = '${{ secrets.EVM_NOWNODES_API_KEY }}';" >> cw_evm/lib/.secrets.g.dart
          echo "const blinkApiKey = '${{ secrets.BLINK_API_KEY }}';" >> cw_evm/lib/.secrets.g.dart
          echo "const ankrApiKey = '${{ secrets.ANKR_API_KEY }}';" >> cw_solana/lib/.secrets.g.dart
          echo "const chainStackApiKey = '${{ secrets.CHAIN_STACK_API_KEY }}';" >> cw_solana/lib/.secrets.g.dart
          echo "const moralisApiKey = '${{ secrets.MORALIS_API_KEY }}';" >> cw_solana/lib/.secrets.g.dart

          echo "const nano2ApiKey = '${{ secrets.NANO2_API_KEY }}';" >> cw_nano/lib/.secrets.g.dart
          echo "const nanoNowNodesApiKey = '${{ secrets.NANO_NOW_NODES_API_KEY }}';" >> cw_nano/lib/.secrets.g.dart

          echo "const tronGridApiKey = '${{ secrets.TRON_GRID_API_KEY }}';" >> cw_tron/lib/.secrets.g.dart
          echo "const tronNowNodesApiKey = '${{ secrets.TRON_NOW_NODES_API_KEY }}';" >> cw_tron/lib/.secrets.g.dart

          echo "const breezApiKey = '${{ secrets.BREEZ_API_KEY }}';" >> cw_bitcoin/lib/.secrets.g.dart

          echo "${{ secrets.MAIN_SECRETS_FILE }}" | base64 --decode > lib/.secrets.g.dart

      - name: Extract native dependencies
        run: ./scripts/linux/docker/build.sh --extract

      - name: Execute Build and Setup Commands
        run: |
          pushd scripts/linux
            source ./app_env.sh cakewallet
            ./app_config.sh
          popd

      - name: Install Flutter dependencies
        run: |
          flutter pub get

      - name: Build generated code
        run: |
          ./model_generator.sh

      - name: Generate localization
        run: |
          dart run tool/generate_localization.dart

      - name: Compile graphics
        run: |
          ./compile_graphics.sh

      - name: Build linux
        run: |
          flutter build linux --dart-define=hasDevOptions=true --release

      - name: Compress release
        run: |
          pushd build/linux/x64/release
          zip -r cakewallet_linux.zip bundle
          popd

      - name: Upload Artifact to github
        uses: actions/upload-artifact@v4
        with:
          path: ${{ github.workspace }}/build/linux/x64/release/cakewallet_linux.zip
          name: cakewallet_linux

      - name: Test [cw_core]
        timeout-minutes: 15
        run: cd cw_core && flutter test

      - name: Test [cw_monero]
        timeout-minutes: 15
        run: cd cw_monero && flutter test