From 399913a8b1dd8bf02a5ea6cdf7ec2af314e047ce Mon Sep 17 00:00:00 2001 From: Alabi Ibrahim Abimbola Date: Mon, 20 Jul 2026 10:46:00 +0100 Subject: [PATCH 1/5] feat: add CI/CD pipeline for Kolo Soroban smart contract Implement automated GitHub Actions workflow that validates every pull request and push to main/develop. The issue description references a Node.js/TypeScript/Prisma pipeline, but this repository is a Rust Soroban smart contract. This implementation follows the repository's actual build and validation requirements. Key changes: - Create .github/workflows/ci.yml with comprehensive Rust/Soroban CI/CD - Remove redundant .github/workflows/rust.yml (replaced by ci.yml) Pipeline jobs: build-and-test (runs on every push/PR to main/develop): - Rust toolchain setup (rustfmt, clippy, wasm32 target) - Cargo dependency caching for faster builds - Format check: cargo fmt --all -- --check - Linting: cargo clippy --all-targets --all-features -- -D warnings - Native build: cargo build (quick compile check) - Tests: cargo test --verbose (all 7 unit tests) - WASM build: cargo build --target wasm32-unknown-unknown --release - Artifact upload: saves optimized .wasm for 14 days deploy (only on push to main, after all checks pass): - Installs Stellar CLI (soroban v21.2.0) - MVP-compatible WASM build + wasm-opt optimization - Deploys contract to Stellar testnet This pipeline acts as the final gatekeeper against merging broken code that could cause production outages or loss of user funds. --- .github/workflows/ci.yml | 105 +++++++++++++++++++++++++++++++++++++ .github/workflows/rust.yml | 37 ------------- 2 files changed, 105 insertions(+), 37 deletions(-) create mode 100644 .github/workflows/ci.yml delete mode 100644 .github/workflows/rust.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..1b8c948 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,105 @@ +name: Kolo Backend CI + +on: + push: + branches: [ "main", "develop" ] + pull_request: + branches: [ "main", "develop" ] + +env: + CARGO_TERM_COLOR: always + WORKING_DIR: contracts + +jobs: + build-and-test: + name: Build & Test + runs-on: ubuntu-latest + defaults: + run: + working-directory: ${{ env.WORKING_DIR }} + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@stable + with: + components: rustfmt, clippy + targets: wasm32-unknown-unknown + + - name: Cache Cargo dependencies + uses: Swatinem/rust-cache@v2 + with: + workspaces: ${{ env.WORKING_DIR }} + + - name: Check formatting + run: cargo fmt --all -- --check + + - name: Lint with Clippy + run: cargo clippy --all-targets --all-features -- -D warnings + + - name: Build (native) + run: cargo build + + - name: Run tests + run: cargo test --verbose + + - name: Build WebAssembly (release) + run: cargo build --target wasm32-unknown-unknown --release + + - name: Upload WASM artifact + uses: actions/upload-artifact@v4 + with: + name: kolo-savings-group-wasm + path: ${{ env.WORKING_DIR }}/target/wasm32-unknown-unknown/release/kolo_savings_group.wasm + retention-days: 14 + + deploy: + name: Deploy to Testnet + runs-on: ubuntu-latest + needs: build-and-test + if: github.ref == 'refs/heads/main' && github.event_name == 'push' + defaults: + run: + working-directory: ${{ env.WORKING_DIR }} + + steps: + - uses: actions/checkout@v4 + + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@stable + with: + targets: wasm32-unknown-unknown + + - name: Cache Cargo dependencies + uses: Swatinem/rust-cache@v2 + with: + workspaces: ${{ env.WORKING_DIR }} + + - name: Install Stellar CLI + run: | + mkdir -p "$HOME/.local/bin" + curl -sSL https://github.com/stellar/soroban-tools/releases/download/v21.2.0/soroban-cli-21.2.0-x86_64-unknown-linux-gnu.tar.gz | tar -xz + mv soroban "$HOME/.local/bin/soroban" + echo "$HOME/.local/bin" >> "$GITHUB_PATH" + soroban --version + + - name: Build and optimize WASM + run: | + RUSTFLAGS="-C target-cpu=mvp" cargo build \ + --target wasm32-unknown-unknown \ + --release + cargo install wasm-opt --locked + wasm-opt \ + target/wasm32-unknown-unknown/release/kolo_savings_group.wasm \ + -o target/wasm32-unknown-unknown/release/kolo_savings_group.optimized.wasm + + - name: Deploy contract to testnet + env: + STELLAR_SOURCE_ACCOUNT: ${{ secrets.STELLAR_DEPLOYER_KEY }} + run: | + soroban contract deploy \ + --wasm target/wasm32-unknown-unknown/release/kolo_savings_group.optimized.wasm \ + --source-account "$STELLAR_SOURCE_ACCOUNT" \ + --network testnet diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml deleted file mode 100644 index 45d1a3e..0000000 --- a/.github/workflows/rust.yml +++ /dev/null @@ -1,37 +0,0 @@ -name: Rust CI - -on: [push, pull_request] - -env: - CARGO_TERM_COLOR: always - -jobs: - build-and-test: - name: Build & Test Soroban Contract - runs-on: ubuntu-latest - defaults: - run: - working-directory: contracts - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install Rust and wasm32 target - run: | - rustup toolchain install stable --profile minimal - rustup default stable - rustup target add wasm32-unknown-unknown - - - name: Install system dependencies for Soroban CLI - run: | - sudo apt-get update - sudo apt-get install -y libdbus-1-dev libudev-dev pkg-config - - - name: Install Soroban CLI - run: cargo install --locked soroban-cli - - - name: Run unit tests - run: cargo test - - - name: Build contract for wasm (release) - run: cargo build --target wasm32-unknown-unknown --release From f391cf65b8091f2c6d777b9c688080896daa4ab0 Mon Sep 17 00:00:00 2001 From: Alabi Ibrahim Abimbola Date: Mon, 20 Jul 2026 10:53:31 +0100 Subject: [PATCH 2/5] fix: set persist-credentials: false on checkout steps Security hardening per CodeRabbit review. Prevents GITHUB_TOKEN from being persisted in .git/config, reducing credential exposure risk in a workflow that handles deployment secrets. --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1b8c948..b590131 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,6 +21,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v4 + with: + persist-credentials: false - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable @@ -66,6 +68,8 @@ jobs: steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable From 0ac43dd7dfdada05874ae63c6e0b7f470d2a60e2 Mon Sep 17 00:00:00 2001 From: Alabi Ibrahim Abimbola Date: Tue, 21 Jul 2026 14:52:30 +0100 Subject: [PATCH 3/5] fix: merge CI pipeline into rust.yml instead of replacing file --- .github/workflows/{ci.yml => rust.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{ci.yml => rust.yml} (100%) diff --git a/.github/workflows/ci.yml b/.github/workflows/rust.yml similarity index 100% rename from .github/workflows/ci.yml rename to .github/workflows/rust.yml From 7a202e71ce91f5e66f7cfa09dcde98db784613d9 Mon Sep 17 00:00:00 2001 From: Alabi Ibrahim Abimbola Date: Tue, 21 Jul 2026 15:56:21 +0100 Subject: [PATCH 4/5] fix: apply CodeRabbit review - add permissions block, fix Stellar CLI install --- .github/workflows/rust.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 23001d1..79d6c83 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -1,5 +1,7 @@ name: Kolo Backend CI +permissions: contents: read + on: push: branches: [ "main", "develop" ] @@ -88,11 +90,8 @@ jobs: - name: Install Stellar CLI run: | - mkdir -p "$HOME/.local/bin" - curl -sSL https://github.com/stellar/soroban-tools/releases/download/v21.2.0/soroban-cli-21.2.0-x86_64-unknown-linux-gnu.tar.gz | tar -xz - mv soroban "$HOME/.local/bin/soroban" - echo "$HOME/.local/bin" >> "$GITHUB_PATH" - soroban --version + cargo install stellar-cli --locked + stellar --version - name: Build and optimize WASM run: | @@ -108,7 +107,7 @@ jobs: env: STELLAR_SOURCE_ACCOUNT: ${{ secrets.STELLAR_DEPLOYER_KEY }} run: | - soroban contract deploy \ + stellar contract deploy \ --wasm target/wasm32-unknown-unknown/release/kolo_savings_group.optimized.wasm \ --source-account "$STELLAR_SOURCE_ACCOUNT" \ --network testnet From eed23673463e18c3a12f516ce41338dfebd312b5 Mon Sep 17 00:00:00 2001 From: Alabi Ibrahim Abimbola Date: Tue, 21 Jul 2026 16:22:15 +0100 Subject: [PATCH 5/5] fix: correct permissions YAML syntax to nested mapping --- .github/workflows/rust.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 79d6c83..d5dbb09 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -1,6 +1,7 @@ name: Kolo Backend CI -permissions: contents: read +permissions: + contents: read on: push: