From 38f43ef0a403b213d6364295c2a00038b485eeb7 Mon Sep 17 00:00:00 2001 From: leanworld7-netizen Date: Sat, 1 Aug 2026 01:05:27 +0000 Subject: [PATCH 1/3] feat(#22): add deploy.yml --- .github/workflows/deploy.yml | 53 ++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 .github/workflows/deploy.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml new file mode 100644 index 0000000..18cc98c --- /dev/null +++ b/.github/workflows/deploy.yml @@ -0,0 +1,53 @@ +name: Deploy + +on: + push: + branches: [main] + tags: ['v*'] + +jobs: + deploy-testnet: + name: Deploy to Testnet + runs-on: ubuntu-latest + if: startsWith(github.ref, 'refs/tags/v') + environment: testnet + steps: + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@stable + - name: Install soroban CLI + run: cargo install --locked soroban-cli 2>/dev/null || true + - name: Configure soroban + run: | + soroban config network add --global testnet \ + --rpc-url https://soroban-testnet.stellar.org:443 \ + --network-passphrase "Test SDF Future Network ; October 2022" + - name: Build contracts + run: | + for contract in contracts/*/; do + if [ -f "$contract/Cargo.toml" ]; then + name=$(basename "$contract") + soroban contract build -- "$contract" + fi + done + - name: Deploy contracts + env: + SECRET_KEY: ${{ secrets.DEPLOYER_SECRET }} + run: | + echo "Deploying contracts to testnet..." + # Deploy utility_contracts + soroban contract deploy \ + --wasm target/wasm32-unknown-unknown/release/utility_contracts.wasm \ + --source-account "$SECRET_KEY" \ + --network testnet + + notify: + name: Notify Deployment + runs-on: ubuntu-latest + needs: deploy-testnet + steps: + - name: Create deployment summary + run: | + echo "### Deployment Summary" >> $GITHUB_STEP_SUMMARY + echo "- **Tag:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY + echo "- **Environment:** Testnet" >> $GITHUB_STEP_SUMMARY + echo "- **Status:** Completed" >> $GITHUB_STEP_SUMMARY From 6fd4158fe14b9161a8e4d3a41bcb6b02e98659c4 Mon Sep 17 00:00:00 2001 From: leanworld7-netizen Date: Sat, 1 Aug 2026 01:05:28 +0000 Subject: [PATCH 2/3] feat(#22): add dependency-review.yml --- .github/workflows/dependency-review.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..bec1b2a --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,19 @@ +name: Dependency Review + +on: [pull_request] + +permissions: + contents: read + pull-requests: write + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + - name: Dependency Review + uses: actions/dependency-review-action@v4 + with: + fail-on-severity: moderate + comment-summary-in-pr: always From 212f3a116d52a45a9ecd70594767df0ddd6c7d06 Mon Sep 17 00:00:00 2001 From: leanworld7-netizen Date: Sat, 1 Aug 2026 01:06:05 +0000 Subject: [PATCH 3/3] feat(#22): add ci.yml workflow --- .github/workflows/ci.yml | 79 ++++++++++++++++++++++------------------ 1 file changed, 44 insertions(+), 35 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c2ad601..2a1d771 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,55 +1,64 @@ -name: Soroban CI +name: CI on: push: - branches: [ main ] + branches: [main, develop] pull_request: - branches: [ main ] + branches: [main] + +env: + CARGO_TERM_COLOR: always jobs: - test-and-lint: + lint: + name: Lint & Format runs-on: ubuntu-latest - defaults: - run: - working-directory: ./contracts steps: - uses: actions/checkout@v4 - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@stable with: - targets: wasm32-unknown-unknown components: rustfmt, clippy - - name: Cache dependencies - uses: Swatinem/rust-cache@v2 - with: - workspaces: "./contracts -> target" - name: Check formatting run: cargo fmt --all -- --check - name: Run clippy run: cargo clippy --all-targets --all-features -- -D warnings + + test: + name: Unit Tests + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@stable + - name: Build contracts + run: cargo build --verbose - name: Run tests - run: cargo test + run: cargo test --verbose - build-wasm: - needs: test-and-lint + security: + name: Security Checks runs-on: ubuntu-latest - defaults: - run: - working-directory: ./contracts steps: - uses: actions/checkout@v4 - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@stable - with: - targets: wasm32-unknown-unknown - - name: Cache dependencies - uses: Swatinem/rust-cache@v2 - with: - workspaces: "./contracts -> target" - - name: Build WASM artifact - run: cargo build --target wasm32-unknown-unknown --release - - name: Upload compiled artifacts - uses: actions/upload-artifact@v4 - with: - name: wasm-artifacts - path: contracts/target/wasm32-unknown-unknown/release/*.wasm \ No newline at end of file + - uses: dtolnay/rust-toolchain@stable + - name: Install cargo-audit + run: cargo install cargo-audit 2>/dev/null || true + - name: Run security audit + run: cargo audit + - name: Check for unsafe code + run: | + if grep -r "unsafe" contracts/ --include="*.rs" | grep -v "//" | grep -v "test"; then + echo "Unsafe code found in production contracts" + exit 1 + fi + + build: + name: Build All Contracts + runs-on: ubuntu-latest + strategy: + matrix: + contract: [utility_contracts, price_oracle] + steps: + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@stable + - name: Build + run: cargo build --release --verbose