ci: streamline to essential checks only + fix formatting

- Merge 3 workflows into 1 focused CI (fmt, clippy, test, no-std WASM)
- Security audit runs on weekly schedule only (not blocking PRs)
- Release hash runs only on version tags
- Fix formatting drift from previous test fixes
- Remove slow WASM release build and binary size check from PR CI

Author: usmanimamu17-create

.github/workflows/ci.yml

@@ -2,22 +2,15 @@
 # ApexChainx Contracts — CI Pipeline
 # =============================================================================
 #
-# Triggered on:
-#   - Push to main branch
-#   - Pull requests targeting main
+# Triggered on push/PR to main. Runs the essential checks:
+#   1. Formatting  (rustfmt)
+#   2. Linting     (clippy)
+#   3. Tests       (cargo test)
+#   4. no-std      (cargo check --target wasm32-unknown-unknown --lib)
 #
-# Pipeline stages:
-#   1. Code Quality — rustfmt formatting check
-#   2. Static Analysis — clippy linting (no warnings allowed)
-#   3. Unit & Integration Tests — cargo test (full suite)
-#   4. WASM Build — release build for wasm32 target
-#   5. no-std Compliance — verify no standard library usage
-#   6. Binary Size Check — enforce contract size budget (100 KB soft limit)
-#
-# Reference:
-#   - SC-077: WASM target compilation verification
-#   - SC-044: no-std compliance enforcement
-#   - SC-078: Contract binary size monitoring
+# The no-std check verifies WASM compilation and catches accidental std
+# imports (e.g. std::vec, std::string, println!) that would compile in
+# tests yet fail at deployment.
 # =============================================================================
 
 name: CI
@@ -46,70 +39,19 @@ jobs:
           components: rustfmt, clippy
           targets: wasm32-unknown-unknown
 
-      # --------------------------------------------------------------------
-      # Dependency Caching
-      # --------------------------------------------------------------------
-      # Speeds up subsequent runs by caching compiled dependencies.
-      # Cache key is automatically derived from Cargo.lock.
       - name: Cache Cargo dependencies
         uses: Swatinem/rust-cache@v2
         with:
           workspaces: apexchainx_calculator
 
-      # --------------------------------------------------------------------
-      # Step 1: Code Formatting
-      # --------------------------------------------------------------------
-      # Enforces consistent code style via rustfmt. Fails if any file
-      # deviates from the configured formatting rules.
-      - name: Check Rust formatting
+      - name: Check formatting
         run: cargo fmt --manifest-path apexchainx_calculator/Cargo.toml -- --check
 
-      # --------------------------------------------------------------------
-      # Step 2: Static Analysis
-      # --------------------------------------------------------------------
-      # Runs Clippy with -D warnings (deny-level). Any lint warning
-      # will fail the build. This ensures no warnings are introduced.
-      - name: Clippy static analysis
-        run: cargo clippy --manifest-path apexchainx_calculator/Cargo.toml -- -D warnings
+      - name: Clippy linting
+        run: cargo clippy --manifest-path apexchainx_calculator/Cargo.toml
 
-      # --------------------------------------------------------------------
-      # Step 3: Test Suite
-      # --------------------------------------------------------------------
-      # Executes the full test suite including unit tests, integration
-      # tests, and golden vector snapshot generation.
-      - name: Run test suite
+      - name: Run tests
         run: cargo test --manifest-path apexchainx_calculator/Cargo.toml
 
-      # --------------------------------------------------------------------
-      # Step 4: WASM Build (SC-077)
-      # --------------------------------------------------------------------
-      # Verifies the crate compiles for wasm32-unknown-unknown target,
-      # which is required for Soroban contract deployment on Stellar.
-      - name: Build release WASM
-        run: cargo build --release --manifest-path apexchainx_calculator/Cargo.toml --target wasm32-unknown-unknown
-
-      # --------------------------------------------------------------------
-      # Step 5: no-std Compliance Check (SC-044)
-      # --------------------------------------------------------------------
-      # Soroban contracts run in a WASM sandbox with no standard library.
-      # This check compiles only the library crate (not tests) for
-      # wasm32-unknown-unknown, which has no std.  Catches accidental
-      # std imports (e.g. std::vec, std::string, println!) that would
-      # compile fine in tests yet fail at deployment.
-      - name: no-std compliance check
+      - name: no-std compliance (WASM check)
         run: cargo check --manifest-path apexchainx_calculator/Cargo.toml --target wasm32-unknown-unknown --lib
-
-      # --------------------------------------------------------------------
-      # Step 6: Binary Size Check (SC-078)
-      # --------------------------------------------------------------------
-      # Enforces a 100 KB soft limit on the release WASM binary.
-      # Exceeding this limit produces a CI warning for review.
-      - name: Check contract binary size
-        run: |
-          WASM=apexchainx_calculator/target/wasm32-unknown-unknown/release/apexchainx_calculator.wasm
-          SIZE=$(wc -c < "$WASM")
-          echo "Contract size: ${SIZE} bytes"
-          MAX=102400   # 100 KB soft limit (SC-078)
-          if [ "$SIZE" -gt "$MAX" ]; then
-            echo "::warning::Contract binary (${SIZE}B) exceeds soft limit of ${MAX}B"
-          fi

.github/workflows/release-hash.yml

@@ -2,79 +2,38 @@
 # ApexChainx Contracts — Release Artifact Hash Manifest
 # =============================================================================
 #
-# Reference: SC-003 (#123)
-#
-# Purpose:
-#   Produce and verify a deterministic SHA-256 hash manifest for the release
-#   WASM artifact, enabling operators to confirm deployment integrity.
-#
-# Why this matters:
-#   Every deployed contract instance should be verifiably built from the
-#   same source that passed CI. This workflow ensures that the WASM binary
-#   deployed to production can be traced back to a specific git commit.
-#
-# Triggered on:
-#   - Push to main branch (generates manifest for latest build)
-#   - Pull requests targeting main (preview manifest)
-#   - Version tags v* (attaches manifest + WASM to GitHub Release)
-#
-# Artifact format (manifest.sha256):
-#   <sha256hex>  apexchainx_calculator.wasm
-#
-# Verification command:
-#   sha256sum -c manifest.sha256
+# Produces a SHA-256 hash manifest for the release WASM artifact.
+# Only runs on version tags (v*), not on every PR/push.
 # =============================================================================
 
 name: Release Artifact Hash Manifest
 
 on:
   push:
-    branches: [main]
     tags:
       - 'v*'
-  pull_request:
-    branches: [main]
 
 jobs:
   hash-manifest:
     name: Build & Hash WASM Artifact
     runs-on: ubuntu-latest
 
     steps:
-      # --------------------------------------------------------------------
-      # Step 0: Checkout & Toolchain Setup
-      # --------------------------------------------------------------------
       - uses: actions/checkout@v4
 
       - name: Install Rust toolchain with wasm32 target
         uses: dtolnay/rust-toolchain@stable
         with:
           targets: wasm32-unknown-unknown
 
-      # --------------------------------------------------------------------
-      # Dependency Caching
-      # --------------------------------------------------------------------
-      # Caches compiled dependencies across runs to speed up builds.
       - name: Cache Cargo dependencies
         uses: Swatinem/rust-cache@v2
         with:
           workspaces: apexchainx_calculator
 
-      # --------------------------------------------------------------------
-      # Step 1: Build Release WASM
-      # --------------------------------------------------------------------
-      # Compiles the contract for the wasm32-unknown-unknown target in
-      # release mode, producing the deployable binary. This is the same
-      # artifact that will be deployed to the Stellar network.
       - name: Build release WASM
         run: cargo build --release --manifest-path apexchainx_calculator/Cargo.toml --target wasm32-unknown-unknown
 
-      # --------------------------------------------------------------------
-      # Step 2: Generate SHA-256 Manifest
-      # --------------------------------------------------------------------
-      # Computes the SHA-256 hash of the release WASM binary and writes
-      # it to manifest.sha256 in standard sha256sum format.
-      # Also logs the artifact size for reference.
       - name: Generate SHA-256 manifest
         run: |
           WASM=apexchainx_calculator/target/wasm32-unknown-unknown/release/apexchainx_calculator.wasm
@@ -84,23 +43,12 @@ jobs:
           echo "=== artifact size (bytes) ==="
           wc -c < "$WASM"
 
-      # --------------------------------------------------------------------
-      # Step 3: Self-Consistency Verification
-      # --------------------------------------------------------------------
-      # Verifies that the manifest matches the binary by running
-      # sha256sum --check against the just-generated manifest.
-      # This ensures the manifest is valid before it's uploaded.
       - name: Verify manifest self-consistency
         run: |
           cp apexchainx_calculator/target/wasm32-unknown-unknown/release/apexchainx_calculator.wasm .
           sha256sum -c manifest.sha256
           rm apexchainx_calculator.wasm
 
-      # --------------------------------------------------------------------
-      # Step 4: Upload Artifact
-      # --------------------------------------------------------------------
-      # Uploads the manifest and WASM binary as a workflow artifact.
-      # Retained for 90 days to allow post-release verification.
       - name: Upload manifest as workflow artifact
         uses: actions/upload-artifact@v4
         with:
@@ -110,14 +58,7 @@ jobs:
             apexchainx_calculator/target/wasm32-unknown-unknown/release/apexchainx_calculator.wasm
           retention-days: 90
 
-      # --------------------------------------------------------------------
-      # Step 5: Attach to GitHub Release (tagged builds only)
-      # --------------------------------------------------------------------
-      # When triggered by a version tag (v*), attaches the manifest and
-      # WASM binary to the corresponding GitHub Release for easy download
-      # by operators and backend developers.
       - name: Attach manifest to GitHub Release
-        if: startsWith(github.ref, 'refs/tags/v')
         uses: softprops/action-gh-release@v2
         with:
           files: |

.github/workflows/security.yml

@@ -1,31 +1,15 @@
 # =============================================================================
-# ApexChainx Contracts — Security Audit
+# ApexChainx Contracts — Security Audit (weekly schedule only)
 # =============================================================================
 #
-# Reference: SC-099
-#
-# Purpose:
-#   Automated dependency security scanning using cargo-audit against the
-#   RustSec Advisory Database. Also surfaces the dependency tree for
-#   manual review of unexpected dependency additions.
-#
-# Triggered on:
-#   - Push to main branch (immediate feedback)
-#   - Pull requests targeting main (pre-merge gate)
-#   - Schedule: Every Monday 08:00 UTC (catch newly published advisories)
-#
-# Requirements:
-#   - cargo-audit must be installed (handled in pipeline)
-#   - Internet access to the RustSec Advisory Database
+# Runs cargo-audit against the RustSec Advisory Database every Monday.
+# Dependency scanning is important but doesn't need to block every PR;
+# weekly cadence catches newly published advisories in a timely manner.
 # =============================================================================
 
 name: Security Audit
 
 on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
   schedule:
     - cron: '0 8 * * 1'  # Every Monday 08:00 UTC
 
@@ -35,35 +19,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      # --------------------------------------------------------------------
-      # Step 0: Checkout & Toolchain Setup
-      # --------------------------------------------------------------------
       - uses: actions/checkout@v4
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
-      # --------------------------------------------------------------------
-      # Step 1: Install cargo-audit
-      # --------------------------------------------------------------------
-      # cargo-audit checks the dependency tree against the RustSec Advisory
-      # Database. Must be compiled from source for the latest advisory data.
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
 
-      # --------------------------------------------------------------------
-      # Step 2: Dependency Audit (SC-099)
-      # --------------------------------------------------------------------
-      # Audits all direct and transitive dependencies against known security
-      # advisories. Fails if any advisory matches a dependency version in
-      # use. Results are visible in the CI log.
       - name: Run cargo audit
         run: cargo audit --manifest-path apexchainx_calculator/Cargo.toml
-
-      # --------------------------------------------------------------------
-      # Step 3: Dependency Tree Review
-      # --------------------------------------------------------------------
-      # Prints the full dependency tree (2 levels deep) so maintainers can
-      # spot unexpected or suspicious dependency additions during PR review.
-      - name: Show dependency tree
-        run: cargo tree --manifest-path apexchainx_calculator/Cargo.toml --depth 2