feat(analyzer): Daml DAR analyzer — core, CLI, REST, and Web UI

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,56 @@
+name: Bug report
+description: Report a problem with canton-devkit or a LocalNet instance
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing, run `canton-devkit localnet doctor` and check [troubleshooting](https://github.com/bitdynamics-ab/canton-devkit/blob/main/docs/troubleshooting.md).
+        Redact JWTs, party IDs, and other secrets from pasted output.
+
+  - type: textarea
+    id: what_happened
+    attributes:
+      label: What happened?
+      description: Describe the problem and what you expected instead.
+      placeholder: |
+        I ran `canton-devkit localnet up demo`. The command exited with an error instead of starting containers.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Run `canton-devkit localnet up demo`
+        2. Run `canton-devkit localnet status --name demo`
+        3. See error
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: canton-devkit version
+      description: Output of `canton-devkit version` or `dpm version`.
+      placeholder: e.g. v0.1.0
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Environment (optional)
+      description: OS, CLI vs Web UI, instance name, Splice version.
+      placeholder: |
+        macOS, CLI, instance `demo`, Splice 0.6.4
+
+  - type: textarea
+    id: output
+    attributes:
+      label: Command output / logs (optional)
+      description: stderr, `canton-devkit localnet doctor`, or docker compose output.
+      render: shell

.github/actions/e2e-dpm-test/action.yml

@@ -0,0 +1,105 @@
+name: Run dpm localnet bats E2E test
+description: Build the binary, install the DPM CLI, and run one dpm localnet bats e2e file.
+
+# Keep dpm-version / dpm-linux-sha256 defaults in sync with release.yml
+# and e2e-test-dpm-installation.yml.
+inputs:
+  bats-file:
+    description: Bats file under e2e-tests/ (for example dpm-dar-001.bats)
+    required: true
+  dpm-version:
+    description: DPM CLI version to install
+    required: false
+    default: "1.0.16"
+  dpm-linux-sha256:
+    description: SHA-256 of the linux/amd64 DPM tarball
+    required: false
+    default: "387421d4b3d0e799f05cde1f5c2adc704acd2824796d436861602eb2be759874"
+
+runs:
+  using: composite
+  steps:
+    - name: Build binary
+      # All jobs run on the same single self-hosted runner, so the binary
+      # is built here rather than passed between jobs via a GitHub
+      # artifact. CDK_BIN then lets bats skip its own rebuild.
+      shell: bash
+      run: make build
+
+    - name: Install DPM CLI (sha256-verified)
+      shell: bash
+      run: |
+        set -euo pipefail
+        tar="${RUNNER_TEMP}/dpm-${{ inputs.dpm-version }}-linux-amd64.tar.gz"
+        curl -sSfL \
+          "https://github.com/digital-asset/dpm/releases/download/${{ inputs.dpm-version }}/dpm-${{ inputs.dpm-version }}-linux-amd64.tar.gz" \
+          -o "$tar"
+        echo "${{ inputs.dpm-linux-sha256 }}  ${tar}" | sha256sum --check --strict -
+        bindir="${RUNNER_TEMP}/dpm-bin"
+        mkdir -p "$bindir"
+        tar -xzf "$tar" -C "$bindir" dpm
+        chmod 0755 "$bindir/dpm"
+        echo "$bindir" >> "$GITHUB_PATH"
+        "$bindir/dpm" --version
+
+    - name: Run bats test (TAP)
+      shell: bash
+      env:
+        # Use the binary built above; skips the in-bats `make build`.
+        CDK_BIN: ${{ github.workspace }}/bin/canton-devkit
+        BATS_LIB_PATH: ${{ github.workspace }}/e2e-tests/test_helper
+      run: |
+        set -o pipefail
+        e2e-tests/bats/bin/bats --formatter tap "e2e-tests/${{ inputs.bats-file }}" \
+          | tee "${RUNNER_TEMP}/bats.tap"
+
+    - name: Write job summary
+      if: always()
+      shell: bash
+      run: |
+        tap="${RUNNER_TEMP}/bats.tap"
+        [ -f "$tap" ] || exit 0
+
+        {
+          echo "### E2E: ${{ inputs.bats-file }}"
+          echo
+          echo "| Result | # | Test |"
+          echo "| --- | --- | --- |"
+        } >> "$GITHUB_STEP_SUMMARY"
+
+        passed=0 failed=0 skipped=0
+        while IFS= read -r line; do
+          case "$line" in
+            "ok "*"# skip"*|"ok "*"SKIP"*)
+              num="${line#ok }"; num="${num%% *}"
+              name="${line#ok "$num" }"; name="${name%%#*}"
+              echo "| ⏭️ | $num | ${name% } |" >> "$GITHUB_STEP_SUMMARY"
+              skipped=$((skipped + 1))
+              ;;
+            "ok "*)
+              num="${line#ok }"; num="${num%% *}"
+              name="${line#ok "$num" }"
+              echo "| ✅ | $num | $name |" >> "$GITHUB_STEP_SUMMARY"
+              passed=$((passed + 1))
+              ;;
+            "not ok "*)
+              num="${line#not ok }"; num="${num%% *}"
+              name="${line#not ok "$num" }"
+              echo "| ❌ | $num | $name |" >> "$GITHUB_STEP_SUMMARY"
+              failed=$((failed + 1))
+              ;;
+          esac
+        done < "$tap"
+
+        {
+          echo
+          echo "**Total:** ${passed} passed, ${failed} failed, ${skipped} skipped"
+        } >> "$GITHUB_STEP_SUMMARY"
+
+    - name: Dump container state on failure
+      if: failure()
+      shell: bash
+      run: |
+        docker ps -a || true
+        docker compose ls || true
+        docker volume ls || true

.github/actions/e2e-m1-test/action.yml

@@ -0,0 +1,33 @@
+name: Run Milestone 1 E2E test
+description: Download the built binary and run one Milestone 1 E2E test script.
+
+inputs:
+  script:
+    description: Script filename under scripts/e2e/ (for example m1-up-001.sh)
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download built binary
+      # actions/download-artifact@v4.1.7
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e
+      with:
+        name: canton-devkit-binary
+        path: bin
+
+    - name: Make scripts executable
+      shell: bash
+      run: chmod +x bin/canton-devkit scripts/e2e/*.sh
+
+    - name: Run test
+      shell: bash
+      run: scripts/e2e/${{ inputs.script }}
+
+    - name: Dump container state on failure
+      if: failure()
+      shell: bash
+      run: |
+        docker ps -a || true
+        docker compose ls || true
+        docker volume ls || true

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Summary
+
+<!-- 1-3 sentences: what changed and why -->
+
+## Changes
+
+<!-- bullet list; omit section for trivial fixes -->
+
+## Test plan
+
+- [ ] `make test`
+- [ ] `make lint`
+- [ ] `scripts/e2e/run-all.sh`
+- [ ] <!-- manual verification steps -->
+
+## Checklist
+
+- [ ] Tests pass locally
+- [ ] No coverage regression on touched code
+- [ ] Docs updated (and `website/` synced if any mirrored `docs/*.md` changed)
+- [ ] CLI ↔ Web UI parity maintained (or follow-up issue + `TODO(#issue)` comment)

.github/workflows/analyzer-image.yml

@@ -0,0 +1,35 @@
+name: daml-analyzer image
+
+# Builds the pinned daml-analyzer image (build/daml-analyzer/Dockerfile) and
+# pushes it to GHCR. Manual dispatch: the analyzer image changes rarely (only
+# when the pinned upstream commit is bumped), so it is not built on every push.
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Image tag (keep in sync with analyzer.DefaultImage)"
+        required: true
+        default: "0.1.0-143a7e2"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-push:
+    runs-on: [self-hosted, Linux]
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        run: |
+          set -euo pipefail
+          owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          image="ghcr.io/${owner}/daml-analyzer:${{ inputs.tag }}"
+          docker build -t "$image" build/daml-analyzer
+          docker push "$image"
+          echo "pushed $image"

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on:
       - "go.mod"
       - "go.sum"
       - ".github/workflows/ci.yml"
+      - "install.sh"
       - "docs/design/mockups/**.jsx"
       - "frontend/**"
       - "Makefile"
@@ -26,6 +27,7 @@ on:
       - "go.mod"
       - "go.sum"
       - ".github/workflows/ci.yml"
+      - "install.sh"
       - "docs/design/mockups/**.jsx"
       - "frontend/**"
       - "Makefile"
@@ -56,6 +58,9 @@ jobs:
           go-version-file: go.mod
           cache: false
 
+      - name: Validate install.sh syntax
+        run: sh -n install.sh
+
       - name: Build
         run: go build ./...
 

.github/workflows/docs.yml

@@ -0,0 +1,65 @@
+name: docs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "website/**"
+      - "docs/**"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# One Pages deployment at a time; don't cancel an in-flight production deploy.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build site
+    runs-on: [self-hosted, Linux]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: website/.nvmrc
+          cache: npm
+          cache-dependency-path: website/package-lock.json
+
+      - name: Install dependencies
+        working-directory: website
+        run: npm ci
+
+      - name: Build
+        working-directory: website
+        run: npm run build
+
+      - name: Configure Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: website/dist
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: build
+    runs-on: [self-hosted, Linux]
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0