feat: initial commit for bizinikiwi-connect with clean CI

.github/workflows/auto-merge.yml

@@ -0,0 +1,37 @@
+name: Dependabot Auto Approve/Merge
+
+on: pull_request_target
+
+permissions:
+  pull-requests: write
+  contents: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    # Checking the actor will prevent your Action run failing on non-Dependabot
+    # PRs but also ensures that it only does work for Dependabot PRs.
+    if: ${{ github.actor == 'dependabot[bot]' }}
+    steps:
+      # This first step will fail if there's no metadata and so the approval
+      # will not occur.
+      - name: Dependabot metadata
+        id: dependabot-metadata
+        uses: dependabot/fetch-metadata@v2.3.0
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      # Here the PR gets approved.
+      - name: Approve a PR
+        if: ${{ !contains(steps.dependabot-metadata.outputs.dependency-names, 'smoldot') && !contains(steps.dependabot-metadata.outputs.dependency-names, '@polkadot-api') && steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' }}
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Finally, this sets the PR to allow auto-merging for patch and minor
+      # updates if all checks pass
+      - name: Enable auto-merge for Dependabot PRs
+        if: ${{ !contains(steps.dependabot-metadata.outputs.dependency-names, 'smoldot') && !contains(steps.dependabot-metadata.outputs.dependency-names, '@polkadot-api') && steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' }}
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+    branches: [ main, master ]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+
+      - name: Install Dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+      - name: Test
+        run: pnpm test

.github/workflows/dependabot-changeset.yml

@@ -0,0 +1,28 @@
+name: Dependabot Changeset
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, labeled]
+
+jobs:
+  renovate:
+    name: Update Dependabot PR
+    runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' }}
+
+    steps:
+      - name: Generate a token
+        id: gen_token
+        uses: actions/create-github-app-token@v2
+        with:
+            app-id: ${{ secrets.SUBSTRATE_CONNECT_PR_APP_ID }}
+            private-key: ${{ secrets.SUBSTRATE_CONNECT_PR_APP_KEY }}
+            owner: ${{ github.repository_owner }}
+      - uses: actions/checkout@v4.1.7
+      - name: Update PR
+        uses: mscharley/dependency-changesets-action@v1.1.9
+        with:
+          token: ${{ steps.gen_token.outputs.token }}
+          use-conventional-commits: false
+          author-name: GitHub Action
+          author-email: action@github.com

.github/workflows/pr-ci.yml

@@ -0,0 +1,13 @@
+name: Pull Request CI
+
+on:
+  pull_request:
+    branches: [ main ]
+
+permissions: read-all
+
+jobs:
+  run-ci:
+    uses: ./.github/workflows/reusable-ci.yml
+    with:
+      upload-artifacts: false

.github/workflows/reusable-ci.yml

@@ -0,0 +1,93 @@
+name: Reusable CI Workflow
+
+on:
+  workflow_call:
+    inputs:
+      upload-artifacts:
+        type: boolean
+        default: false
+        required: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [22.x, 23.x]
+    steps:
+    - uses: actions/checkout@v4.1.7
+    - uses: ./.github/actions/turbo-build 
+      with:
+        node-version: ${{ matrix.node-version }}
+
+  playwright-test-extension:
+    needs: [build]
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4.1.7
+    - uses: ./.github/actions/turbo-build
+    - name: Build extension with Manifest v3 for Chrome
+      run: pnpm build:chrome
+      working-directory: ./projects/extension
+    - run: pnpm playwright:install
+      working-directory: ./projects/extension
+    - name: Test projects/extension
+      run: pnpm playwright:chromium --trace on
+      working-directory: ./projects/extension
+    - uses: actions/upload-artifact@v4
+      if: failure() || inputs.upload-artifacts
+      with:
+        name: playwright-report-substrate-connect-extension-mv3-chrome
+        path: ./projects/extension/playwright-report
+
+  playwright-test-examples:
+    needs: [build]
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4.1.7
+    - uses: ./.github/actions/turbo-build
+    - run: pnpm playwright:install
+      working-directory: ./examples/light-client-extension-helpers-extension
+    - name: Test examples/light-client-extension-helpers-extension
+      run: pnpm playwright:chromium --trace on
+      working-directory: ./examples/light-client-extension-helpers-extension
+    - uses: actions/upload-artifact@v4
+      if: failure() || inputs.upload-artifacts
+      with:
+        name: playwright-report-light-client-extension-helpers-extension-mv3-chrome
+        path: ./examples/light-client-extension-helpers-extension/playwright-report
+
+  playwright-test-wallet-template:
+    needs: [build]
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4.1.7
+    - uses: ./.github/actions/turbo-build
+    - name: Build extension with Manifest v3 for Chrome
+      run: pnpm build:chrome
+      working-directory: ./projects/wallet-template
+    - run: pnpm playwright:install
+      working-directory: ./projects/wallet-template
+    - name: Test projects/wallet-template
+      run: pnpm playwright:chromium --trace on
+      working-directory: ./projects/wallet-template
+    - uses: actions/upload-artifact@v4
+      if: failure() || inputs.upload-artifacts
+      with:
+        name: playwright-report-substrate-connect-wallet-template-mv3-chrome
+        path: ./projects/wallet-template/playwright-report
+
+  all:
+    needs: [build, playwright-test-extension, playwright-test-examples, playwright-test-wallet-template]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Check job status
+        if: contains(needs.*.result, 'failure')
+        run: exit 1
+      - name: All jobs completed successfully
+        if: success()
+        run: echo "All jobs completed successfully!"

.github/workflows/update-chain-specs.yml

@@ -0,0 +1,128 @@
+name: chain-specs-periodic-update
+
+on:
+  schedule:
+    - cron: '0 8 * * *'  # every day at 8am
+  workflow_dispatch: # allow triggering through the UI
+
+jobs:
+  download-spec:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        # This starts one parallel job for each of these addresses.
+        rpc-node-address: [
+          "wss://rpc.polkadot.io",
+          "wss://kusama-rpc.polkadot.io",
+          "wss://westend-rpc.polkadot.io",
+          "wss://rococo-rpc.polkadot.io",
+          "wss://rpc.dotters.network/paseo"
+        ]
+      fail-fast: false   # Don't automatically cancel the jobs of the other RPC nodes if one fails
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+        path: repo
+        ref: main
+    - run: |
+        curl -L -O https://github.com/vi/websocat/releases/download/v1.9.0/websocat_linux64
+        chmod +x websocat_linux64
+    - run: |
+        echo '{"id":1,"jsonrpc":"2.0","method":"sync_state_genSyncSpec","params":[true]}' |
+          ./websocat_linux64 -n1 -B 99999999 ${{ matrix.rpc-node-address }} > rpc_answer.json
+    - run: cat ./rpc_answer.json | jq .result > chain_spec.json
+    - id: get-chain-id  # Reads the `id` field in the newly-downloaded chain spec
+      run: echo "id=`jq -r .id ./chain_spec.json`" >> $GITHUB_OUTPUT
+    - if: ${{ steps.get-chain-id.outputs.id == '' }}
+      uses: actions/upload-artifact@v4
+      with:
+        name: failed-response-${{ github.run_id }}
+        path: |
+          rpc_answer.json
+    - run: |  # Overwrite the `lightSyncState` field of the existing chain spec with the value of spec that's been downloaded.
+        tmp=$(mktemp)
+        output=./repo/packages/connect-known-chains/specs/${{ steps.get-chain-id.outputs.id }}.json
+        jq --slurpfile downloaded ./chain_spec.json '.lightSyncState = $downloaded[0].lightSyncState' "$output" > "$tmp"
+        mv "$tmp" "$output"
+    - run: |  # Do the same as the previous step, but for the chain spec of the extension. This is done separately in case the spec is not the same with the one in `connect`
+        tmp=$(mktemp)
+        output=./repo/projects/extension/assets/chainspecs/${{ steps.get-chain-id.outputs.id }}.json
+        jq --slurpfile downloaded ./chain_spec.json '.lightSyncState = $downloaded[0].lightSyncState' "$output" > "$tmp"
+        mv "$tmp" "$output"
+    - run: |  # Do the same as the previous step, but for the chain spec of the extension. This is done separately in case the spec is not the same with the one in `connect`
+        tmp=$(mktemp)
+        output=./repo/projects/wallet-template/assets/chainspecs/${{ steps.get-chain-id.outputs.id }}.json
+        jq --slurpfile downloaded ./chain_spec.json '.lightSyncState = $downloaded[0].lightSyncState' "$output" > "$tmp"
+        mv "$tmp" "$output"
+    - uses: actions/upload-artifact@v4
+      with:
+        name: chain-spec-${{ steps.get-chain-id.outputs.id }}
+        # Note that passing `repo/**` maintains paths under `repo`. This is a bit of magic by the upload-artifact action.
+        path: |
+          repo/**/${{ steps.get-chain-id.outputs.id }}.json
+
+  create-pr:
+    runs-on: ubuntu-latest
+    if: ${{ always() }} # Run this job even if one of the steps of download-spec has failed
+    needs: download-spec
+    steps:
+    - name: Generate a token
+      id: gen_token
+      uses: actions/create-github-app-token@v2
+      with:
+          app-id: ${{ secrets.SUBSTRATE_CONNECT_PR_APP_ID }}
+          private-key: ${{ secrets.SUBSTRATE_CONNECT_PR_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+    - uses: actions/checkout@v4.1.7
+      with:
+        path: repo
+        ref: main
+    - uses: actions/download-artifact@v4
+      with:
+        # Since we're not passing a name, this automatically downloads *all* artifacts
+        # Unfortunately, this creates intermediary directories.
+        path: .
+    - run: cp -r ./chain-spec-*/* ./repo
+    - uses: peter-evans/create-pull-request@v6
+      id: create-pr
+      with:
+        token: ${{ steps.gen_token.outputs.token }}
+        committer: CICD team <cicd-team@parity.io>
+        author: CICD team <cicd-team@parity.io>
+        path: repo
+        branch: automatic-checkpoints-update
+        base: main
+        title: "chore: update checkpoints in chain specifications"
+        # Note that the `download-spec` job above fails if the downloaded specification doesn't
+        # correspond to an existing file. It is therefore impossible that the pull request
+        # accidentally adds new specifications.
+        body: >
+          This pull request has been automatically generated by downloading chain
+          specifications from various JSON-RPC endpoints and extracting their checkpoints.
+
+          Keep in mind that introducing a malicious checkpoint can redirect users to the wrong
+          chain. If this pull request looks suspicious, please be cautious.
+        labels: "automerge"
+        commit-message: "chore: update checkpoints in chain specifications"
+        delete-branch: true
+    - name: Check PR creation status
+      if: steps.create-pr.outcome != 'success'
+      run: |
+        echo "Failed to create pull request"
+        exit 1
+    - name: Create issue on failure
+      if: failure()
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ steps.gen_token.outputs.token }}
+        script: |
+          github.rest.issues.create({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            title: 'Failed to create pull request for updating chain specifications',
+            body: 'The create-pr step failed in the chain-specs-periodic-update workflow. Please investigate the issue.',
+            labels: ['bug']
+          })