add Plutus contract

.forgejo/workflows/aiken.yaml

@@ -0,0 +1,55 @@
+name: Aiken contracts
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  image:
+    name: resolve CI image
+    runs-on: nixos-amd64
+    container:
+      image: code.blockchain-applied.com/bca/nixos:1.0.0
+      credentials:
+        username: ci_bca
+        password: ${{ secrets.PAT }}
+    outputs:
+      image: ${{ steps.ref.outputs.image }}
+    steps:
+      - name: Check out repository code
+        uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          submodules: false
+
+      # CI_IMAGE: Forgejo variable with the image name without tag; the tag is
+      # the version this commit declares in docker/ci-cardano.version.
+      - id: ref
+        env:
+          CI_IMAGE: ${{ vars.CI_IMAGE }}
+        run: |
+          if [ -z "$CI_IMAGE" ]; then
+            echo "::error::Actions variable CI_IMAGE (image name without tag) is not set"
+            exit 1
+          fi
+          echo "image=${CI_IMAGE}:$(cat docker/ci-cardano.version)" >> "$GITHUB_OUTPUT"
+          echo "CI image: ${CI_IMAGE}:$(cat docker/ci-cardano.version)"
+
+  aiken:
+    name: aiken fmt / check / budgets / build
+    needs: image
+    runs-on: nixos-amd64
+    container:
+      image: ${{ needs.image.outputs.image }}
+      credentials:
+        username: ci_bca
+        password: ${{ secrets.PAT }}
+    steps:
+      - name: Check out repository code
+        uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          submodules: false
+
+      - name: Aiken CI
+        run: ci/aiken.sh

.forgejo/workflows/build-ci-cardano-image.yaml

@@ -0,0 +1,75 @@
+name: Build ci-cardano image
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docker/Dockerfile.ci-cardano"
+      - "docker/ci-cardano.version"
+      - ".forgejo/workflows/build-ci-cardano-image.yaml"
+  workflow_dispatch:
+
+jobs:
+  build-ci-cardano:
+    name: build-ci-cardano
+    runs-on: nixos-amd64
+    env:
+      # Forgejo variable: image name without tag (the tag is docker/ci-cardano.version)
+      IMAGE: ${{ vars.CI_IMAGE }}
+    container:
+      image: code.blockchain-applied.com/bca/nixos:1.0.0
+      options: >-
+        --privileged
+        --security-opt seccomp=unconfined
+      credentials:
+        username: ci_bca
+        password: ${{ secrets.PAT }}
+      env:
+        DOCKER_HOST: tcp://localhost:2375
+        DOCKER_TLS_CERTDIR: ""
+
+    steps:
+      - name: Check out repository code
+        uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          submodules: false
+
+      - name: Docker login
+        shell: nix-shell --run "bash {0}"
+        env:
+          DOCKER_USERNAME: "ci_bca"
+          DOCKER_PASSWORD: ${{ secrets.PAT }}
+        run: |
+          if [ -z "${IMAGE}" ]; then echo "::error::Actions variable CI_IMAGE (image name without tag) is not set"; exit 1; fi
+          echo "${DOCKER_PASSWORD}" | docker login "${IMAGE%%/*}" --username "${DOCKER_USERNAME}" --password-stdin
+          docker version || echo "🚨 Cannot connect to Docker daemon"
+
+      - name: Set up Docker Buildx
+        shell: nix-shell --run "{0}"
+        run: docker buildx create --name multiarch-builder --driver docker-container --use && docker buildx inspect --bootstrap
+
+      # Bump docker/ci-cardano.version when the Aiken/Node/pnpm pins in the
+      # Dockerfile change; CI workflows reference the image by this tag.
+      - name: 🐳 Build and push ci-cardano image (amd64 + arm64)
+        shell: nix-shell --run "{0}"
+        run: |
+          VERSION="$(cat docker/ci-cardano.version)"
+          docker buildx build \
+            --platform linux/amd64 \
+            --tag ${IMAGE}:${VERSION}-amd64 \
+            --file docker/Dockerfile.ci-cardano \
+            --push \
+            .
+          docker buildx build \
+            --platform linux/arm64 \
+            --tag ${IMAGE}:${VERSION}-arm64 \
+            --file docker/Dockerfile.ci-cardano \
+            --push \
+            .
+          docker buildx imagetools create \
+            --tag ${IMAGE}:${VERSION} \
+            --tag ${IMAGE}:latest \
+            --tag ${IMAGE}:${{ forgejo.sha }} \
+            ${IMAGE}:${VERSION}-arm64 \
+            ${IMAGE}:${VERSION}-amd64
+          docker buildx imagetools inspect ${IMAGE}:${VERSION}

.forgejo/workflows/typescript.yaml

@@ -0,0 +1,57 @@
+name: TypeScript packages
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  image:
+    name: resolve CI image
+    runs-on: nixos-amd64
+    container:
+      image: code.blockchain-applied.com/bca/nixos:1.0.0
+      credentials:
+        username: ci_bca
+        password: ${{ secrets.PAT }}
+    outputs:
+      image: ${{ steps.ref.outputs.image }}
+    steps:
+      - name: Check out repository code
+        uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          submodules: false
+
+      # CI_IMAGE: Forgejo variable with the image name without tag; the tag is
+      # the version this commit declares in docker/ci-cardano.version.
+      - id: ref
+        env:
+          CI_IMAGE: ${{ vars.CI_IMAGE }}
+        run: |
+          if [ -z "$CI_IMAGE" ]; then
+            echo "::error::Actions variable CI_IMAGE (image name without tag) is not set"
+            exit 1
+          fi
+          echo "image=${CI_IMAGE}:$(cat docker/ci-cardano.version)" >> "$GITHUB_OUTPUT"
+          echo "CI image: ${CI_IMAGE}:$(cat docker/ci-cardano.version)"
+
+  check:
+    name: npm ci / check / test / audit
+    needs: image
+    runs-on: nixos-amd64
+    container:
+      image: ${{ needs.image.outputs.image }}
+      credentials:
+        username: ci_bca
+        password: ${{ secrets.PAT }}
+    steps:
+      - name: Check out repository code
+        uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          submodules: false
+
+      - name: TypeScript CI
+        env:
+          NPM_TOKEN: ${{ secrets.PAT }}
+        run: ci/typescript.sh

.github/dependabot.yml

@@ -1,11 +1,35 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
+# Dependabot version updates, see
 # https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# Aiken (compiler + stdlib) is not a Dependabot ecosystem; it is updated by hand,
+# see bca-token-plutus/README.md "Updating Aiken".
 
 version: 2
+
+registries:
+  # @bca/evolution-sdk (the Evolution SDK fork) is published here; the root
+  # workspace lockfile cannot be resolved without it. BCA_NPM_TOKEN is a
+  # Dependabot secret holding a Forgejo token with read:package.
+  bca-forgejo-npm:
+    type: npm-registry
+    url: https://code.blockchain-applied.com/api/packages/BCA/npm/
+    token: ${{secrets.BCA_NPM_TOKEN}}
+
 updates:
-  - package-ecosystem: "npm" # See documentation for possible values
-    directory: "/bca-token-solidity" # Location of package manifests
+  - package-ecosystem: "npm"
+    directory: "/bca-token-solidity"
+    schedule:
+      interval: "weekly"
+
+  # Root npm workspace: packages/chain-adapter, chain-adapter-evm, chain-adapter-cardano.
+  - package-ecosystem: "npm"
+    directory: "/"
+    registries:
+      - bca-forgejo-npm
     schedule:
       interval: "weekly"
+    ignore:
+      # Pinned to a fork commit (<upstream>-bca.<sha7>); bumped by hand together
+      # with the fork, see packages/chain-adapter-cardano/README.md.
+      - dependency-name: "evolution-sdk-bca"
+      - dependency-name: "@bca/evolution-sdk"

.github/workflows/aiken.yaml

@@ -0,0 +1,28 @@
+name: Aiken contracts
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    uses: ./.github/workflows/build-ci-cardano-image.yaml
+
+  aiken:
+    name: aiken fmt / check / budgets / build
+    needs: image
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ needs.image.outputs.image }}
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - run: ci/aiken.sh

.github/workflows/build-ci-cardano-image.yaml

@@ -0,0 +1,85 @@
+name: CI image
+
+# Builds docker/Dockerfile.ci-cardano for amd64 + arm64 and pushes it to
+# <vars.CI_IMAGE>:<docker/ci-cardano.version> (and :latest), unless that
+# version tag already exists. CI_IMAGE is the repository variable with the
+# image name without tag, e.g. ghcr.io/blockchain-data-analytics/ci-cardano.
+# Called by the CI workflows, which run inside the image.
+
+on:
+  workflow_call:
+    outputs:
+      image:
+        description: Image reference the CI jobs run in
+        value: ${{ jobs.image.outputs.image }}
+  workflow_dispatch:
+    inputs:
+      rebuild:
+        description: Rebuild and overwrite the tag even if it exists
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    # The Aiken and TypeScript workflows both call this; the second waits and
+    # then finds the tag already published.
+    concurrency:
+      group: ci-cardano-image
+      cancel-in-progress: false
+    outputs:
+      image: ${{ steps.ref.outputs.image }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - id: ref
+        env:
+          CI_IMAGE: ${{ vars.CI_IMAGE }}
+        run: |
+          if [[ -z "$CI_IMAGE" ]]; then
+            echo "::error::repository variable CI_IMAGE (image name without tag) is not set"
+            exit 1
+          fi
+          echo "name=${CI_IMAGE}" >> "$GITHUB_OUTPUT"
+          echo "image=${CI_IMAGE}:$(cat docker/ci-cardano.version)" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: exists
+        env:
+          IMAGE: ${{ steps.ref.outputs.image }}
+          REBUILD: ${{ inputs.rebuild || false }}
+        run: |
+          if [[ "$REBUILD" != "true" ]] && docker manifest inspect "$IMAGE" > /dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "$IMAGE already published"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - if: steps.exists.outputs.exists == 'false'
+        uses: docker/setup-qemu-action@v3
+
+      - if: steps.exists.outputs.exists == 'false'
+        uses: docker/setup-buildx-action@v3
+
+      - if: steps.exists.outputs.exists == 'false'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile.ci-cardano
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            ${{ steps.ref.outputs.image }}
+            ${{ steps.ref.outputs.name }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/typescript.yaml

@@ -0,0 +1,32 @@
+name: TypeScript packages
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    uses: ./.github/workflows/build-ci-cardano-image.yaml
+
+  check:
+    name: npm ci / check / test / audit
+    needs: image
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ needs.image.outputs.image }}
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: TypeScript CI
+        env:
+          # Forgejo token with read:package for @bca/evolution-sdk (see .npmrc)
+          NPM_TOKEN: ${{ secrets.BCA_NPM_TOKEN }}
+        run: ci/typescript.sh

.gitignore

@@ -3,7 +3,6 @@ out
 
 node_modules
 */node_modules
-*/package-lock.json
 
 */prisma/migrations
 
@@ -15,3 +14,5 @@ node_modules
 */README.local*
 
 .DS_Store
+
+bca-token-market/node_modules.txt*

.npmrc

@@ -0,0 +1 @@
+@bca:registry=https://code.blockchain-applied.com/api/packages/BCA/npm/