Skip to content

Commit 5fdbd78

Browse files
Xhristin3Xhristin3
authored
Merge pull request #382 from JamesEjembi/feature/ci-cd-optimization-and-securities
feat: implement CI/CD, Security Auditing, Gas Profiling, and Verification
2 parents 5f83899 + be66bdf commit 5fdbd78

16 files changed

Lines changed: 679 additions & 277 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
name: Gatheraa CI/CD Pipeline
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
9+
env:
10+
CARGO_TERM_COLOR: always
11+
NODE_VERSION: '20.x'
12+
IMAGE_NAME: gatheraa/backend
13+
14+
jobs:
15+
# --- Contract Jobs ---
16+
contract-lint:
17+
name: Contract Linting (Clippy & Fmt)
18+
runs-on: ubuntu-latest
19+
steps:
20+
- uses: actions/checkout@v4
21+
22+
- name: Install Rust stable toolchain
23+
uses: dtolnay/rust-toolchain@stable
24+
with:
25+
components: clippy, rustfmt
26+
27+
- name: Cache Cargo registry
28+
uses: actions/cache@v4
29+
with:
30+
path: |
31+
~/.cargo/registry
32+
~/.cargo/git
33+
contract/target
34+
key: ${{ runner.os }}-cargo-${{ hashFiles('contract/**/Cargo.toml') }}
35+
restore-keys: |
36+
${{ runner.os }}-cargo-
37+
38+
- name: Add wasm32 target
39+
run: rustup target add wasm32-unknown-unknown
40+
41+
- name: Check formatting
42+
working-directory: contract
43+
run: cargo fmt --all -- --check
44+
45+
- name: Run Clippy
46+
working-directory: contract
47+
run: |
48+
cargo clippy \
49+
--target wasm32-unknown-unknown \
50+
--all-targets \
51+
--all-features \
52+
-- \
53+
-D warnings \
54+
-D clippy::all \
55+
-D clippy::pedantic \
56+
-W clippy::nursery \
57+
-A clippy::module_name_repetitions \
58+
-A clippy::too_many_arguments \
59+
-A clippy::cast_possible_truncation
60+
61+
contract-test:
62+
name: Contract Unit Tests
63+
runs-on: ubuntu-latest
64+
steps:
65+
- uses: actions/checkout@v4
66+
67+
- name: Install Rust stable toolchain
68+
uses: dtolnay/rust-toolchain@stable
69+
70+
- name: Cache Cargo registry
71+
uses: actions/cache@v4
72+
with:
73+
path: |
74+
~/.cargo/registry
75+
~/.cargo/git
76+
contract/target
77+
key: ${{ runner.os }}-cargo-tests-${{ hashFiles('contract/**/Cargo.toml') }}
78+
restore-keys: |
79+
${{ runner.os }}-cargo-tests-
80+
81+
- name: Run contract tests
82+
working-directory: contract
83+
run: cargo test --workspace --all-features
84+
85+
# --- Backend Jobs ---
86+
backend-test:
87+
name: Backend Tests
88+
runs-on: ubuntu-latest
89+
steps:
90+
- uses: actions/checkout@v4
91+
92+
- name: Use Node.js ${{ env.NODE_VERSION }}
93+
uses: actions/setup-node@v4
94+
with:
95+
node-version: ${{ env.NODE_VERSION }}
96+
cache: 'npm'
97+
cache-dependency-path: app/backend/package-lock.json
98+
99+
- name: Install dependencies
100+
working-directory: app/backend
101+
run: npm ci
102+
103+
- name: Run tests
104+
working-directory: app/backend
105+
run: npm test
106+
107+
# --- Security & Dependency Scanning (#349) ---
108+
security-audit:
109+
name: Security & Dependency Scan
110+
runs-on: ubuntu-latest
111+
steps:
112+
- uses: actions/checkout@v4
113+
114+
- name: Install cargo-audit
115+
uses: taiki-e/install-action@cargo-audit
116+
117+
- name: Run Cargo Audit
118+
working-directory: contract
119+
run: cargo audit
120+
121+
- name: Run NPM Audit
122+
working-directory: app/backend
123+
run: npm audit --audit-level=high
124+
125+
- name: Run Trivy Vulnerability Scanner
126+
uses: aquasecurity/trivy-action@master
127+
with:
128+
scan-type: 'fs'
129+
scan-ref: '.'
130+
format: 'table'
131+
exit-code: '1'
132+
ignore-unfixed: true
133+
severity: 'CRITICAL,HIGH'
134+
135+
# --- Gas Profiling (#350) ---
136+
gas-profiling:
137+
name: Gas Usage Profiling
138+
runs-on: ubuntu-latest
139+
steps:
140+
- uses: actions/checkout@v4
141+
142+
- name: Install Rust stable toolchain
143+
uses: dtolnay/rust-toolchain@stable
144+
145+
- name: Install Soroban CLI
146+
run: cargo install --locked soroban-cli --features opt
147+
148+
- name: Build contracts
149+
working-directory: contract
150+
run: cargo build --target wasm32-unknown-unknown --release
151+
152+
- name: Run Gas Profiling Script
153+
run: bash scripts/profile_gas.sh
154+
continue-on-error: true
155+
156+
- name: Upload Gas Reports
157+
uses: actions/upload-artifact@v4
158+
with:
159+
name: gas-reports
160+
path: contract/gas_reports/
161+
162+
# --- Deployment & Verification (#348, #351) ---
163+
deploy-and-verify:
164+
name: Deploy & Verify Contracts
165+
needs: [contract-lint, contract-test, backend-test, security-audit]
166+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
167+
runs-on: ubuntu-latest
168+
steps:
169+
- uses: actions/checkout@v4
170+
171+
- name: Install Soroban CLI
172+
run: cargo install --locked soroban-cli
173+
174+
- name: Build Contracts
175+
working-directory: contract
176+
run: cargo build --target wasm32-unknown-unknown --release
177+
178+
- name: Deploy to Testnet/Mainnet
179+
run: bash scripts/deploy_contracts.sh
180+
env:
181+
SOROBAN_NETWORK: testnet
182+
SOROBAN_ACCOUNT_SECRET: ${{ secrets.SOROBAN_ACCOUNT_SECRET }}
183+
184+
- name: Verify Deployed Contracts
185+
run: bash scripts/verify_contracts.sh
186+
env:
187+
SOROBAN_NETWORK: testnet
188+
189+
build-and-push-docker:
190+
name: Build & Push Docker Image
191+
needs: [deploy-and-verify]
192+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
193+
runs-on: ubuntu-latest
194+
steps:
195+
- uses: actions/checkout@v4
196+
197+
- name: Login to Docker Hub
198+
uses: docker/login-action@v3
199+
with:
200+
username: ${{ secrets.DOCKERHUB_USERNAME }}
201+
password: ${{ secrets.DOCKERHUB_TOKEN }}
202+
203+
- name: Build and Push
204+
uses: docker/build-push-action@v5
205+
with:
206+
context: ./app/backend
207+
push: true
208+
tags: ${{ env.IMAGE_NAME }}:${{ github.sha }},${{ env.IMAGE_NAME }}:latest

0 commit comments

Comments
 (0)