self/.github/workflows/circuits-build.yml

name: Circuits Build
on:
  push:
    branches:
      - main
    paths:
      - "circuits/circuits/**"
      - ".github/workflows/artifacts.yml"
  pull_request:
    branches:
      - main
    paths:
      - "circuits/circuits/**"
      - ".github/workflows/artifacts.yml"
  workflow_dispatch:

jobs:
  build:
    runs-on: ["self-hosted", "selfxyz-org", "ubuntu-22-04", "128ram"]
    permissions:
      contents: read
    env:
      CIRCOM_VERSION: "2.1.9"
      CIRCOM_SHA256: "e5575829252d763b7818049df9de2ef9304df834697de77fa63ce7babc23c967"

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Install cpp dependencies
        run: |
          sudo apt-get update
          sudo apt-get install --yes \
            build-essential \
            libgmp-dev \
            libsodium-dev \
            nasm \
            nlohmann-json3-dev \
            wget

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Restore Circom binary
        id: circom-cache
        uses: actions/cache/restore@v4
        with:
          path: ~/.cache/circom
          key: circom-v2.1.9

      - name: Download Circom Binary v2.1.9
        if: steps.circom-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p ~/.cache/circom

          # Download with curl (more reliable than wget in CI environments)
          # Use exponential backoff retry logic
          for attempt in 1 2 3; do
            echo "Download attempt $attempt/3..."

            if curl -L --connect-timeout 30 --max-time 300 \
                --retry 3 --retry-delay 2 --retry-max-time 600 \
                -o ~/.cache/circom/circom \
                "https://github.com/iden3/circom/releases/download/v${{ env.CIRCOM_VERSION }}/circom-linux-amd64"; then
              echo "✅ Download successful!"
              break
            else
              echo "❌ Download failed on attempt $attempt"
              if [ $attempt -eq 3 ]; then
                echo "💥 All download attempts failed"
                exit 1
              fi
              # Exponential backoff: 5s, 10s, 20s
              sleep_time=$((5 * attempt))
              echo "⏳ Waiting ${sleep_time}s before retry..."
              sleep $sleep_time
            fi
          done

          # Verify file exists and has content
          if [ ! -f ~/.cache/circom/circom ]; then
            echo "💥 Error: circom binary file is missing"
            exit 1
          fi

          if [ ! -s ~/.cache/circom/circom ]; then
            echo "💥 Error: circom binary file is empty"
            exit 1
          fi

          echo "📁 File size: $(ls -lh ~/.cache/circom/circom | awk '{print $5}')"
          chmod +x ~/.cache/circom/circom

          # Verify checksum
          echo "🔍 Verifying checksum..."
          echo "${{ env.CIRCOM_SHA256 }}  $HOME/.cache/circom/circom" | sha256sum -c -

      - name: Save Circom cache
        if: steps.circom-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: ~/.cache/circom
          key: circom-v2.1.9

      - name: Verify Circom checksum (cache hit)
        if: steps.circom-cache.outputs.cache-hit == 'true'
        run: |
          echo "${{ env.CIRCOM_SHA256 }}  $HOME/.cache/circom/circom" | sha256sum -c -

      - name: Add Circom to PATH
        run: echo "$HOME/.cache/circom" >> "$GITHUB_PATH"

      - name: Install dependencies
        uses: ./.github/actions/yarn-install
        with:
          working_directory: circuits

      - name: Print Circom version
        run: circom --version

      - name: Restore circuits cache
        id: circuits-cache
        uses: actions/cache/restore@v4
        with:
          path: output
          key: circuits-output-v1-${{ hashFiles('circuits/circuits/**', 'circuits/scripts/**', 'circuits/*.{json,yml,yaml}') }}

      - name: Build cpp circuits
        run: |
          chmod +x circuits/scripts/build/build_cpp.sh && \
          ./circuits/scripts/build/build_cpp.sh register &&
          ./circuits/scripts/build/build_cpp.sh register_id &&
          ./circuits/scripts/build/build_cpp.sh disclose &&
          ./circuits/scripts/build/build_cpp.sh dsc

      - name: Save circuits cache
        if: steps.circuits-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: output
          key: circuits-output-v1-${{ hashFiles('circuits/circuits/**', 'circuits/scripts/**', 'circuits/*.{json,yml,yaml}') }}

      - name: Upload Artifact
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: circuits
          path: output/