Skip to content

feat: add CI/CD pipeline for Kolo Soroban smart contract #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Queenode merged 6 commits into from
Jul 21, 2026
Merged

feat: add CI/CD pipeline for Kolo Soroban smart contract #30

Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
399913a
feat: add CI/CD pipeline for Kolo Soroban smart contract
abimbolaalabi Jul 20, 2026
f391cf6
fix: set persist-credentials: false on checkout steps
abimbolaalabi Jul 20, 2026
0ac43dd
fix: merge CI pipeline into rust.yml instead of replacing file
abimbolaalabi Jul 21, 2026
d504b48
Merge branch 'main' into feat/pipeline-integration
abimbolaalabi Jul 21, 2026
7a202e7
fix: apply CodeRabbit review - add permissions block, fix Stellar CLI…
abimbolaalabi Jul 21, 2026
eed2367
fix: correct permissions YAML syntax to nested mapping
abimbolaalabi Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
108 changes: 90 additions & 18 deletions .github/workflows/rust.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,37 +1,109 @@
name: Rust CI
name: Kolo Backend CI

on: [push, pull_request]
on:
push:
branches: [ "main", "develop" ]
pull_request:
branches: [ "main", "develop" ]

env:
CARGO_TERM_COLOR: always
WORKING_DIR: contracts

jobs:
Comment thread
coderabbitai[bot] marked this conversation as resolved.
build-and-test:
name: Build & Test Soroban Contract
name: Build & Test
runs-on: ubuntu-latest
defaults:
run:
working-directory: contracts
working-directory: ${{ env.WORKING_DIR }}

steps:
- name: Checkout repository
uses: actions/checkout@v4
Comment thread
coderabbitai[bot] marked this conversation as resolved.
with:
persist-credentials: false

- name: Install Rust and wasm32 target
run: |
rustup toolchain install stable --profile minimal
rustup default stable
rustup target add wasm32-unknown-unknown
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
with:
components: rustfmt, clippy
targets: wasm32-unknown-unknown

- name: Install system dependencies for Soroban CLI
run: |
sudo apt-get update
sudo apt-get install -y libdbus-1-dev libudev-dev pkg-config
- name: Cache Cargo dependencies
uses: Swatinem/rust-cache@v2
with:
workspaces: ${{ env.WORKING_DIR }}

- name: Check formatting
run: cargo fmt --all -- --check

- name: Lint with Clippy
run: cargo clippy --all-targets --all-features -- -D warnings

- name: Install Soroban CLI
run: cargo install --locked soroban-cli
- name: Build (native)
run: cargo build

- name: Run unit tests
run: cargo test
- name: Run tests
run: cargo test --verbose

- name: Build contract for wasm (release)
- name: Build WebAssembly (release)
run: cargo build --target wasm32-unknown-unknown --release

- name: Upload WASM artifact
uses: actions/upload-artifact@v4
with:
name: kolo-savings-group-wasm
path: ${{ env.WORKING_DIR }}/target/wasm32-unknown-unknown/release/kolo_savings_group.wasm
retention-days: 14

deploy:
name: Deploy to Testnet
runs-on: ubuntu-latest
needs: build-and-test
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
defaults:
run:
working-directory: ${{ env.WORKING_DIR }}

steps:
- uses: actions/checkout@v4
with:
persist-credentials: false

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
with:
targets: wasm32-unknown-unknown

- name: Cache Cargo dependencies
uses: Swatinem/rust-cache@v2
with:
workspaces: ${{ env.WORKING_DIR }}

- name: Install Stellar CLI
run: |
mkdir -p "$HOME/.local/bin"
curl -sSL https://github.com/stellar/soroban-tools/releases/download/v21.2.0/soroban-cli-21.2.0-x86_64-unknown-linux-gnu.tar.gz | tar -xz
mv soroban "$HOME/.local/bin/soroban"
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
soroban --version
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated

- name: Build and optimize WASM
run: |
RUSTFLAGS="-C target-cpu=mvp" cargo build \
--target wasm32-unknown-unknown \
--release
cargo install wasm-opt --locked
wasm-opt \
target/wasm32-unknown-unknown/release/kolo_savings_group.wasm \
-o target/wasm32-unknown-unknown/release/kolo_savings_group.optimized.wasm

- name: Deploy contract to testnet
env:
STELLAR_SOURCE_ACCOUNT: ${{ secrets.STELLAR_DEPLOYER_KEY }}
run: |
soroban contract deploy \
--wasm target/wasm32-unknown-unknown/release/kolo_savings_group.optimized.wasm \
--source-account "$STELLAR_SOURCE_ACCOUNT" \
--network testnet
Comment on lines +107 to +114

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Secret key is passed as a literal CLI argument.

--source-account "$STELLAR_SOURCE_ACCOUNT" expands the raw deployer secret key directly into the soroban process's command-line arguments, which are visible to any other process on the runner via /proc/<pid>/cmdline or ps for the process lifetime. Prefer importing the key into a local identity (soroban keys add ... --secret-key, reading the secret from stdin/env inside that command) and referencing the identity alias with --source instead of interpolating the raw secret onto the command line.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/rust.yml around lines 102 - 109, Update the “Deploy
contract to testnet” step so the deployer secret is imported into a local
Soroban identity using soroban keys add with secret input supplied via stdin or
the environment, then invoke soroban contract deploy with the identity alias
through --source rather than passing the raw key via --source-account.