Continuous integration
The repository has one workflow, .github/workflows/ci.yml (name CI). It runs on every push to any branch and on every pull request, with read-only repository permissions. A newer push to the same ref cancels a run in progress (concurrency: ci-<ref>, cancel-in-progress: true). Every job uses Node 22 on ubuntu-latest and installs with npm ci from the committed lock files.
GitHub Actions jobs on this repository are not starting because of a billing hold on the account. Until it is lifted, the same checks are run locally before merging, and the session logs record the results (for example 3,369 unit tests, the build and 38 E2E journeys passing on 2026-10-24). A green CI badge or a missing CI run does not, on its own, say anything about the current code.
Jobs
Slither waits for Contracts; E2E waits for Contracts and Frontend. The other jobs run in parallel.
Contracts
Runs in blockchain/, after installing both the root and the blockchain/ dependencies (the contract tests import shared code from src/lib).
| Step | Command | Fails when |
|---|---|---|
| Proof system pins and scans | npm run check:zk-pins, check:no-mock-verifier, check:no-dev-keys | The proof-system entries of the blockchain/ or root lock file differ from their reviewed snapshots, a mock verifier is present in the source, or a stray key file is present |
| Compile | npm run compile | Compilation fails |
| Compiled scan | npm run check:no-mock-verifier | A mock verifier appears in the compiled contracts |
| Circuit files | npm run zk:artifacts (cached under blockchain/.zk-artifacts, keyed by test/zk/fixtures/artifact-hashes.json) | A fetched circuit file does not match its recorded hash |
| Proving keys | npm run check:zk-keys | A proving key's verification key does not match the pinned verifier (depths 1 to 32) |
| Sizes | npm run sizes | A v0.2 contract exceeds the EIP-170 limit, or a v0.3 or access gate contract exceeds the project's tighter budget |
| Gas regression | npm run gas:check | An operation costs more than 10% above gas-snapshot.json |
| Invariants | npm run invariants | A property fails in any of 500 random sequences |
| Gas report | npm run gas | Any contract test fails (the whole suite runs with the gas reporter) |
| Coverage | npm run coverage | Any test fails, or coverage is below 95% lines or 90% branches |
Artifacts: contract-coverage (the blockchain/coverage folder) and gas-report (blockchain/gas-report.txt, required). Details: Contract tests, Invariants and gas, Zero-knowledge tests.
Slither
Runs crytic/slither-action@v0.4.0 on blockchain/ with blockchain/slither.config.json and fail-on: high, so any High finding fails the job.
Frontend
Sets NEXT_TELEMETRY_DISABLED, a placeholder NEXT_PUBLIC_PINATA_GATEWAY_URL and a placeholder NEXT_PUBLIC_CONTRACT_ADDRESS, so the build needs no secrets.
| Step | Command |
|---|---|
| Lint | npm run lint |
| Types | npm run typecheck (tsc --noEmit) |
| Circuit files for the browser prover | npm run zk:public |
| Unit and rendered tests with the 80% coverage gate | npm run test:coverage |
| Production build | npm run build |
Details: Unit and rendered tests.
Interop
Installs the root and interop/ dependencies, regenerates the fixtures with npm run interop:generate, fails if they differ from the committed ones (git diff --exit-code -- interop/fixtures), then runs npm run interop. Details: Interop and SDK tests.
SDK
Installs the root and packages/sdk/ dependencies, builds the SDK (npm run sdk:build) and runs its tests (npm run sdk:test).
E2E
Installs the root and blockchain/ dependencies, restores a cache of the Playwright browsers and the Hardhat compiler (keyed by package-lock.json and blockchain/hardhat.config.ts), installs Chromium with its system dependencies, and runs npm run test:e2e. With CI set, Playwright uses the GitHub reporter plus an HTML report and refuses .only. Artifacts: playwright-report (unless cancelled) and playwright-traces (test-results/, on failure). Details: End-to-end journeys.
What CI does not do
- It never deploys, never sends a transaction to a public network and holds no secrets.
- It does not push, tag or release.
- It does not run the manual checks; see Manual checks.
Running the CI checks locally
The command sequence in Testing mirrors the jobs. Run it from a clean working tree; the E2E step needs ports 8545 and 3100 free.
Source files
.github/workflows/ci.ymlpackage.json,blockchain/package.json,interop/package.json,packages/sdk/package.json(scripts)blockchain/slither.config.json,blockchain/gas-snapshot.json,blockchain/test/zk/fixtures/artifact-hashes.jsonplaywright.config.ts,vitest.config.ts