[CI/CD] Add comprehensive GitHub Actions workflows for testing, linting, security, and deployment

.github/workflows/ci.yml

@@ -1,55 +1,64 @@
-name: Soroban CI
+name: CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [main, develop]
   pull_request:
-    branches: [ main ]
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
 
 jobs:
-  test-and-lint:
+  lint:
+    name: Lint & Format
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ./contracts
     steps:
       - uses: actions/checkout@v4
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@stable
         with:
-          targets: wasm32-unknown-unknown
           components: rustfmt, clippy
-      - name: Cache dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: "./contracts -> target"
       - name: Check formatting
         run: cargo fmt --all -- --check
       - name: Run clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
+
+  test:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Build contracts
+        run: cargo build --verbose
       - name: Run tests
-        run: cargo test
+        run: cargo test --verbose
 
-  build-wasm:
-    needs: test-and-lint
+  security:
+    name: Security Checks
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ./contracts
     steps:
       - uses: actions/checkout@v4
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-      - name: Cache dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: "./contracts -> target"
-      - name: Build WASM artifact
-        run: cargo build --target wasm32-unknown-unknown --release
-      - name: Upload compiled artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: wasm-artifacts
-          path: contracts/target/wasm32-unknown-unknown/release/*.wasm
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install cargo-audit
+        run: cargo install cargo-audit 2>/dev/null || true
+      - name: Run security audit
+        run: cargo audit
+      - name: Check for unsafe code
+        run: |
+          if grep -r "unsafe" contracts/ --include="*.rs" | grep -v "//" | grep -v "test"; then
+            echo "Unsafe code found in production contracts"
+            exit 1
+          fi
+
+  build:
+    name: Build All Contracts
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        contract: [utility_contracts, price_oracle]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Build
+        run: cargo build --release --verbose

.github/workflows/dependency-review.yml

@@ -0,0 +1,19 @@
+name: Dependency Review
+
+on: [pull_request]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: moderate
+          comment-summary-in-pr: always

.github/workflows/deploy.yml

@@ -0,0 +1,53 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+
+jobs:
+  deploy-testnet:
+    name: Deploy to Testnet
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    environment: testnet
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install soroban CLI
+        run: cargo install --locked soroban-cli 2>/dev/null || true
+      - name: Configure soroban
+        run: |
+          soroban config network add --global testnet \
+            --rpc-url https://soroban-testnet.stellar.org:443 \
+            --network-passphrase "Test SDF Future Network ; October 2022"
+      - name: Build contracts
+        run: |
+          for contract in contracts/*/; do
+            if [ -f "$contract/Cargo.toml" ]; then
+              name=$(basename "$contract")
+              soroban contract build -- "$contract"
+            fi
+          done
+      - name: Deploy contracts
+        env:
+          SECRET_KEY: ${{ secrets.DEPLOYER_SECRET }}
+        run: |
+          echo "Deploying contracts to testnet..."
+          # Deploy utility_contracts
+          soroban contract deploy \
+            --wasm target/wasm32-unknown-unknown/release/utility_contracts.wasm \
+            --source-account "$SECRET_KEY" \
+            --network testnet
+
+  notify:
+    name: Notify Deployment
+    runs-on: ubuntu-latest
+    needs: deploy-testnet
+    steps:
+      - name: Create deployment summary
+        run: |
+          echo "### Deployment Summary" >> $GITHUB_STEP_SUMMARY
+          echo "- **Tag:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Environment:** Testnet" >> $GITHUB_STEP_SUMMARY
+          echo "- **Status:** Completed" >> $GITHUB_STEP_SUMMARY