Smoke test

.github/workflows/smoke-test.yml

@@ -0,0 +1,150 @@
+name: Smoke Test
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  smoke-test:
+    runs-on: ubuntu-latest
+
+    # Run for pull requests targeting main branch
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          submodules: recursive
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y make zsh curl libclang-dev git build-essential
+
+      - name: Install asdf and toolchain from .tool-versions
+        run: |
+          # Install asdf with specific version and verification
+          ASDF_VERSION="v0.14.0"
+          git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch "$ASDF_VERSION" --depth 1
+
+          # Make asdf available to subsequent steps without re-sourcing
+          echo "$HOME/.asdf/bin" >> $GITHUB_PATH
+          echo "$HOME/.asdf/shims" >> $GITHUB_PATH
+
+          # Init asdf
+          source ~/.asdf/asdf.sh
+
+          # Add plugins required for the project with verification
+          asdf plugin add bun || echo "bun plugin already exists"
+          asdf plugin add golang || echo "golang plugin already exists"
+          asdf plugin add rust || echo "rust plugin already exists"
+          asdf plugin add nodejs || echo "nodejs plugin already exists"
+
+          # Install all versions pinned in .tool-versions
+          asdf install
+          asdf reshim
+
+          # Add Rust target for WASM (asdf-rust uses rustup under the hood)
+          rustup target add wasm32-wasip1
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Run full checks
+        run: bun full-checks
+
+      - name: Download and install cre-cli (ubuntu-latest)
+        env:
+          CRE_CLI_TAG: v0.6.1-alpha.0
+        run: |
+          set -euo pipefail
+
+          # Validate tag format to prevent injection
+          if [[ ! "$CRE_CLI_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
+            echo "Invalid tag format: $CRE_CLI_TAG"; exit 1
+          fi
+
+          # Map runner arch to release naming
+          case "$(uname -m)" in
+            x86_64|amd64)  ARCH=amd64 ;;
+            aarch64|arm64) ARCH=arm64 ;;
+            *) echo "Unsupported arch: $(uname -m)"; exit 1 ;;
+          esac
+
+          ASSET="cre_linux_${ARCH}.tar.gz"
+          BASE_URL="https://github.com/smartcontractkit/cre-cli/releases/download/${CRE_CLI_TAG}"
+
+          echo "Downloading ${ASSET} and checksums.txt from ${CRE_CLI_TAG}..."
+          # Use more secure curl options
+          curl -fsSL --retry 3 --retry-delay 2 --max-time 300 \
+               --proto '=https' --tlsv1.2 \
+               -o "${ASSET}" "${BASE_URL}/${ASSET}"
+          curl -fsSL --retry 3 --retry-delay 2 --max-time 300 \
+               --proto '=https' --tlsv1.2 \
+               -o checksums.txt "${BASE_URL}/checksums.txt"
+
+          echo "Verifying checksum..."
+          # checksums.txt contains lines like: "<sha256>  <filename>"
+          grep "  ${ASSET}$" checksums.txt > sha_line.txt
+          if [ ! -s sha_line.txt ]; then
+            echo "No checksum entry for ${ASSET}"; exit 1
+          fi
+          sha256sum -c sha_line.txt
+
+          echo "Extracting..."
+          # Extract with restricted permissions
+          tar -xzf "${ASSET}" --no-same-owner --no-same-permissions
+
+          # Find the 'cre' binary (tarball is expected to contain it at top-level)
+          BIN="./cre"
+          if [ ! -f "$BIN" ]; then
+            BIN="$(tar -tzf "${ASSET}" | grep -E '/?cre$' | head -n1 || true)"
+            [ -z "$BIN" ] && { echo "Could not locate 'cre' in archive"; exit 1; }
+            tar -xzf "${ASSET}" "$BIN" --no-same-owner --no-same-permissions
+          fi
+
+          # Validate binary before installation
+          if [ ! -x "$BIN" ]; then
+            chmod +x "$BIN"
+          fi
+
+          echo "Installing to /usr/local/bin..."
+          sudo mv "${BIN:-./cre}" /usr/local/bin/cre
+          sudo chmod 755 /usr/local/bin/cre
+
+          echo "Installed version:"
+          cre --version
+
+      - name: Setup CRE SDK examples
+        run: |
+          cd packages/cre-sdk-examples
+          bunx cre-setup
+
+      - name: Simulate Hello World workflow
+        run: |
+          cd packages/cre-sdk-examples
+          cre workflow simulate ./src/workflows/hello-world --target local-simulation
+
+      - name: Simulate Http Fetch workflow
+        run: |
+          cd packages/cre-sdk-examples
+          cre workflow simulate ./src/workflows/http-fetch --target local-simulation
+
+      - name: Simulate On Chain Read workflow
+        run: |
+          cd packages/cre-sdk-examples
+          cre workflow simulate ./src/workflows/on-chain --target local-simulation
+
+      - name: Simulate On Chain Write workflow
+        run: |
+          cd packages/cre-sdk-examples
+          cre workflow simulate ./src/workflows/on-chain-write --target local-simulation
+
+      - name: Simulate Proof of Reserve workflow
+        run: |
+          cd packages/cre-sdk-examples
+          cre workflow simulate ./src/workflows/proof-of-reserve --target local-simulation --secrets ../../../secrets.yaml

packages/cre-sdk-examples/README.md

@@ -49,13 +49,13 @@ cre workflow simulate ./src/workflows/on-chain --target local-simulation
 [On Chain Write workflow](https://github.com/smartcontractkit/cre-sdk-typescript/blob/main/packages/cre-sdk-examples/src/workflows/on-chain-write/index.ts):
 
 ```zsh
-cre workflow simulate ./src/workflows/on-chain-write --target local-simulation --broadcast
+cre workflow simulate ./src/workflows/on-chain-write --target local-simulation
 ```
 
 [Proof of Reserve workflow](https://github.com/smartcontractkit/cre-sdk-typescript/blob/main/packages/cre-sdk-examples/src/workflows/proof-of-reserve/index.ts):
 
 ```zsh
-cre workflow simulate ./src/workflows/proof-of-reserve --target local-simulation --broadcast --secrets ../../../secrets.yaml
+cre workflow simulate ./src/workflows/proof-of-reserve --target local-simulation --secrets ../../../secrets.yaml
 ```
 
 ## Testing workflow compilation only