Verify the graph-node API schema snapshot in CI

.github/workflows/test-subgraph.yml

@@ -4,3 +4,49 @@ jobs:
   subgraph-test:
     uses: rainlanguage/rainix/.github/workflows/rainix-subgraph-test.yaml@main
     secrets: inherit
+  # `crates/subgraph/schema/raindex.graphql` is the graph-node API schema that
+  # `cynic_codegen` in `crates/subgraph/build.rs` registers as truth for the
+  # generated client, and nothing in this repo produces it. It cannot be
+  # regenerated offline the way `copy-artifacts` regenerates the ABIs, because
+  # deriving it means running graph-node's own schema derivation — so
+  # graph-node runs, here, against a throwaway store and an anvil chain.
+  schema-snapshot:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: rainlanguage/rainix/.github/actions/nix-cachix-setup@main
+        with:
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          gc-max-store-size-linux: 1G
+      # anvil is the only thing this job wants out of a solidity shell: the
+      # ABIs the manifest names are committed under subgraph/abis, so unlike
+      # rainlanguage/rain.metadata#298 there is no soldeer install and no
+      # forge build here.
+      - name: Start anvil
+        run: |
+          nix develop .#sol-shell -c anvil --host 0.0.0.0 --chain-id 11155111 > anvil.log 2>&1 &
+          nix develop .#sol-shell -c bash -c 'for _ in $(seq 60); do cast block-number --rpc-url http://127.0.0.1:8545 && exit 0; sleep 1; done; exit 1'
+      - name: Start graph-node
+        run: |
+          docker compose -f subgraph/docker-compose.graph-node.yml up -d --wait
+          for _ in $(seq 60); do
+            curl -s -o /dev/null http://localhost:8020/ && exit 0
+            sleep 2
+          done
+          exit 1
+      - name: Deploy the subgraph and diff the committed API schema
+        run: nix develop .#subgraph-shell -c bash subgraph/check-api-schema.sh
+      - name: Upload the API schema graph-node derived
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: raindex-api-schema
+          path: raindex.graphql.generated
+          if-no-files-found: warn
+      - name: anvil log
+        if: failure()
+        run: cat anvil.log
+      - name: graph-node logs
+        if: failure()
+        run: docker compose -f subgraph/docker-compose.graph-node.yml logs
+      - name: The subgraph source carries no build residue
+        run: git diff --exit-code -- subgraph/

.gitignore

@@ -28,3 +28,6 @@ dependencies/
 
 # Local pre-commit hook config
 .pre-commit-config.yaml
+
+# The API schema the schema-snapshot job introspects out of graph-node
+raindex.graphql.generated

subgraph/check-api-schema.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+snapshot=crates/subgraph/schema/raindex.graphql
+generated=raindex.graphql.generated
+subgraph_name=rain/raindex
+
+# Deployed in place, from the manifest as committed. Nothing here passes
+# `graph build --network`: subgraph.yaml already carries its network, address
+# and startBlock, and `--network` is what would write a networks.json entry
+# back into it.
+cd "$root/subgraph"
+npm ci
+graph build
+graph create --node http://localhost:8020/ "$subgraph_name"
+graph deploy \
+  --node http://localhost:8020/ \
+  --ipfs http://localhost:5001 \
+  --version-label ci \
+  "$subgraph_name"
+
+# graph-node derives the API schema at deploy time but refuses queries until
+# the deployment has ingested a block, so print-api-schema.js retries. Anvil's
+# block 0 is the whole of what has to be ingested.
+node ./print-api-schema.js "http://localhost:8000/subgraphs/name/$subgraph_name" \
+  > "$root/$generated"
+
+cd "$root"
+if ! diff -u "$snapshot" "$generated"; then
+  echo "$snapshot is not the API schema graph-node derives from subgraph/schema.graphql." >&2
+  echo "Copy $generated (uploaded by this job as an artifact) over it." >&2
+  exit 1
+fi

subgraph/docker-compose.graph-node.yml

@@ -0,0 +1,46 @@
+# A SEPARATE compose file from ./docker-compose.yml: rainix's `subgraph-test`
+# runs `docker compose up --abort-on-container-exit` over the default file in
+# this directory, so these long-lived services must not land in it.
+services:
+  postgres:
+    image: postgres:14
+    command: postgres -cshared_preload_libraries=pg_stat_statements
+    environment:
+      POSTGRES_USER: graph-node
+      POSTGRES_PASSWORD: let-me-in
+      POSTGRES_DB: graph-node
+      POSTGRES_INITDB_ARGS: -E UTF8 --locale=C
+    healthcheck:
+      test: pg_isready -U graph-node
+      interval: 2s
+      timeout: 5s
+      retries: 30
+  ipfs:
+    image: ipfs/kubo:v0.17.0
+    ports:
+      - 5001:5001
+  graph-node:
+    image: graphprotocol/graph-node:v0.35.1
+    depends_on:
+      postgres:
+        condition: service_healthy
+      ipfs:
+        condition: service_started
+    # graph-node will not accept a deployment naming a chain it has no adapter
+    # for, so anvil runs on the host and is reached over the docker gateway.
+    extra_hosts:
+      - host.docker.internal:host-gateway
+    ports:
+      - 8000:8000
+      - 8020:8020
+      - 8030:8030
+    environment:
+      postgres_host: postgres
+      postgres_user: graph-node
+      postgres_pass: let-me-in
+      postgres_db: graph-node
+      ipfs: ipfs:5001
+      # Named for the network the committed manifest declares, so the manifest
+      # deploys as committed and nothing has to rewrite it.
+      ethereum: sepolia:http://host.docker.internal:8545
+      GRAPH_LOG: info

subgraph/package.json

@@ -10,6 +10,7 @@
     "dependencies": {
         "@graphprotocol/graph-cli": "^0.63.0",
         "@graphprotocol/graph-ts": "=0.32.0",
+        "graphql": "15.5.0",
         "matchstick-as": "^0.6.0",
         "source-map-support": "^0.5.21"
     }

subgraph/print-api-schema.js

@@ -0,0 +1,61 @@
+const {
+  buildClientSchema,
+  getIntrospectionQuery,
+  lexicographicSortSchema,
+  printSchema,
+} = require("graphql");
+
+const endpoint = process.argv[2];
+const attempts = 30;
+const delayMs = 2000;
+const timeoutMs = 10000;
+
+async function introspect() {
+  const response = await fetch(endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ query: getIntrospectionQuery() }),
+    // Bounded, because a graph-node that accepts the connection and then
+    // stalls would hang this await and the retry below would never run. The
+    // signal covers reading the body, not just the headers.
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}`);
+  }
+  const body = await response.json();
+  if (body.errors) {
+    throw new Error(JSON.stringify(body.errors));
+  }
+  return body.data;
+}
+
+async function main() {
+  if (!endpoint) {
+    throw new Error("usage: print-api-schema.js <graphql endpoint>");
+  }
+  let last;
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      const introspection = await introspect();
+      // Sorted, because the order introspection reports types and fields in is
+      // graph-node's own and is not what the snapshot is asserting.
+      process.stdout.write(
+        printSchema(lexicographicSortSchema(buildClientSchema(introspection))),
+      );
+      return;
+    } catch (error) {
+      last = error;
+      console.error(
+        `${endpoint}: attempt ${attempt}/${attempts}: ${error.message}`,
+      );
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
+  }
+  throw last;
+}
+
+main().catch((error) => {
+  console.error(error.message);
+  process.exit(1);
+});