verify.yml

name: Formal Verification

on:
  push:
    branches: [master, main]
    paths:
      - '**.rs'
      - '**.wasm'
      - 'Cargo.toml'
      - 'Cargo.lock'
  pull_request:
    paths:
      - '**.rs'
      - '**.wasm'
      - 'Cargo.toml'
      - 'Cargo.lock'

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y libudev-dev

      - name: Build starforge
        run: cargo build --locked

      - name: Run formal verification (if WASM artifact exists)
        run: |
          WASM="target/wasm32-unknown-unknown/release/contract.wasm"
          if [ -f "$WASM" ]; then
            cargo run -- verify run \
              --wasm "$WASM" \
              --contract my-contract \
              --network testnet \
              --fail-on-critical true
            cargo run -- verify report --contract my-contract
          else
            echo "No WASM artifact found — skipping on-chain verification run"
            cargo run -- verify ci --platform github --contract my-contract
          fi