ci: resolve issues #109, #110, #111, #112 — full-stack CI, cargo-deny, npm audit, dependabot, release workflow

.github/dependabot.yml

@@ -0,0 +1,141 @@
+# Dependabot configuration — automated dependency updates
+# See https://docs.github.com/en/code-security/dependabot/dependabot-version-updates
+# for all config options.
+
+version: 2
+updates:
+  # ── Root workspace ──────────────────────────────────────────────
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    commit-message:
+      prefix: "chore(deps)"
+      prefix-development: "chore(deps-dev)"
+    labels:
+      - "dependencies"
+      - "npm"
+    open-pull-requests-limit: 10
+    versioning-strategy: auto
+    groups:
+      nestjs:
+        patterns:
+          - "@nestjs/*"
+        update-types:
+          - "minor"
+          - "patch"
+      react:
+        patterns:
+          - "react"
+          - "react-dom"
+          - "@types/react"
+          - "@types/react-dom"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # ── Frontend ────────────────────────────────────────────────────
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    commit-message:
+      prefix: "chore(deps/frontend)"
+      prefix-development: "chore(deps-dev/frontend)"
+    labels:
+      - "dependencies"
+      - "frontend"
+    open-pull-requests-limit: 10
+    versioning-strategy: auto
+    ignore:
+      # Next.js v15 is a breaking change; handle manually
+      - dependency-name: "next"
+        update-types: ["version-update:semver-major"]
+    groups:
+      radix-ui:
+        patterns:
+          - "@radix-ui/*"
+        update-types:
+          - "minor"
+          - "patch"
+      stellar:
+        patterns:
+          - "@stellar/*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # ── Backend ─────────────────────────────────────────────────────
+  - package-ecosystem: "npm"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    commit-message:
+      prefix: "chore(deps/backend)"
+      prefix-development: "chore(deps-dev/backend)"
+    labels:
+      - "dependencies"
+      - "backend"
+    open-pull-requests-limit: 10
+    versioning-strategy: auto
+    groups:
+      nestjs:
+        patterns:
+          - "@nestjs/*"
+        update-types:
+          - "minor"
+          - "patch"
+      typeorm:
+        patterns:
+          - "typeorm"
+          - "@nestjs/typeorm"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # ── Onchain (Cargo/Rust) ────────────────────────────────────────
+  - package-ecosystem: "cargo"
+    directory: "/onchain"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    commit-message:
+      prefix: "chore(deps/onchain)"
+    labels:
+      - "dependencies"
+      - "onchain"
+      - "rust"
+    open-pull-requests-limit: 10
+    groups:
+      soroban:
+        patterns:
+          - "soroban-sdk"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # ── GitHub Actions (self-update) ────────────────────────────────
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    commit-message:
+      prefix: "ci(deps)"
+    labels:
+      - "dependencies"
+      - "ci"
+    open-pull-requests-limit: 5

.github/workflows/build.yml

@@ -8,8 +8,12 @@ on:
   pull_request:
 permissions: read-all
 
+# ─────────────────────────────────────────────────────────────────────
+# Onchain jobs (contracts)
+# ─────────────────────────────────────────────────────────────────────
 jobs:
-  build:
+  onchain-build:
+    name: Build contracts
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -20,24 +24,29 @@ jobs:
           targets: wasm32-unknown-unknown
           components: rustfmt
 
-      # The "Install Soroban / Stellar CLI" step was removed: stellar-cli
-      # v22.0.0 is not published (the release URL returns 404) and no step
-      # in this workflow invokes the CLI. Re-add with a verified release
-      # tag if/when a deployment step is introduced.
-      # `cargo --locked` reads the committed `onchain/Cargo.lock` verbatim
-      # (most importantly pinning `ed25519-dalek 2.1.1` to work around the
-      # `soroban-env-host 22.1.3` ↔ `ed25519-dalek 3.0` trait-bound
-      # incompatibility) and fails if the resolved graph would diverge.
-      # Build for wasm32 — Soroban contracts are deployed as WASM cdylibs.
-      - name: Build contracts
+      # See onchain/Cargo.lock for pinned dependency resolutions.
+      - name: Build contracts (release wasm)
         working-directory: onchain
         run: cargo build --workspace --target wasm32-unknown-unknown --release --locked
 
       - name: Format check
         working-directory: onchain
         run: cargo fmt --all -- --check
 
-  test:
+      # ── cargo-deny ────────────────────────────────────────────
+      # Audit dependencies for security advisories, license compliance,
+      # and duplicate crate versions.
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+
+      - name: cargo-deny check
+        working-directory: onchain
+        run: cargo deny --locked check advisories licenses bans sources
+
+  onchain-test:
+    name: Test contracts
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -47,18 +56,112 @@ jobs:
         with:
           toolchain: stable
 
-      # The "Install Soroban / Stellar CLI" step was removed: stellar-cli
-      # v22.0.0 is not published (the release URL returns 404) and no step
-      # in this workflow invokes the CLI. Re-add with a verified release
-      # tag if/when a deployment step is introduced.
-      # Build tests on host with the `testutils` feature (see each
-      # contract's `[dev-dependencies] soroban-sdk = { features = ["testutils"] }`)
-      # so `mock_all_auths`, `register_contract`, `Address::generate`, etc.
-      # are available. `--locked` honours the committed Cargo.lock.
       - name: Build contracts (test profile)
         working-directory: onchain
         run: cargo build --workspace --tests --locked
 
       - name: Run unit tests
         working-directory: onchain
         run: cargo test --workspace --locked
+
+  # ─────────────────────────────────────────────────────────────────────
+  # Backend CI
+  # ─────────────────────────────────────────────────────────────────────
+  backend-lint:
+    name: Backend lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: backend
+        run: npm ci
+
+      - name: Lint
+        working-directory: backend
+        run: npm run lint
+
+      - name: npm audit
+        working-directory: backend
+        # --audit-level=high exits with non-zero if any advisory at
+        # severity high or critical is found.
+        run: npm audit --audit-level=high
+        continue-on-error: true
+
+  backend-test:
+    name: Backend tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: backend
+        run: npm ci
+
+      - name: Run unit tests
+        working-directory: backend
+        run: npm test -- --passWithNoTests
+
+  # ─────────────────────────────────────────────────────────────────────
+  # Frontend CI
+  # ─────────────────────────────────────────────────────────────────────
+  frontend-lint:
+    name: Frontend lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Lint
+        working-directory: frontend
+        run: npm run lint
+
+      - name: npm audit
+        working-directory: frontend
+        run: npm audit --audit-level=high
+        continue-on-error: true
+
+  frontend-build:
+    name: Frontend build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Build
+        working-directory: frontend
+        run: npm run build