Skip to content

Commit 3d8bb53

Browse files
a-malik-gha-malik-gh
authored
Merge branch 'main' into feat/616-618-620-625-contract-improvements
2 parents 84466e0 + aee12ca commit 3d8bb53

486 files changed

Lines changed: 41707 additions & 2707 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.env.example‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Copy to .env and fill in values before running docker compose up
2+
# Place TLS certificates at nginx/certs/cert.pem and nginx/certs/key.pem

‎.github/workflows/codeql.yml‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
##############################################################################
2+
# CodeQL Analysis — EsuStellar
3+
#
4+
# Runs GitHub's CodeQL static analysis on TypeScript and Rust code.
5+
# This workflow helps identify security vulnerabilities and code quality issues
6+
# before mainnet launch.
7+
#
8+
# Triggers:
9+
# - Push to main, develop branches
10+
# - Pull requests to main, develop branches
11+
# - Weekly schedule (Sundays at 00:00 UTC)
12+
# - Manual workflow dispatch
13+
##############################################################################
14+
15+
name: CodeQL Analysis
16+
17+
on:
18+
push:
19+
branches: [main, develop]
20+
pull_request:
21+
branches: [main, develop]
22+
schedule:
23+
- cron: '0 0 * * 0' # Weekly on Sunday at 00:00 UTC
24+
workflow_dispatch:
25+
26+
# Cancel in-flight runs on the same PR to save runner minutes
27+
concurrency:
28+
group: codeql-${{ github.ref }}
29+
cancel-in-progress: true
30+
31+
jobs:
32+
analyze:
33+
name: CodeQL Analysis
34+
runs-on: ubuntu-latest
35+
timeout-minutes: 90
36+
permissions:
37+
actions: read
38+
contents: read
39+
security-events: write
40+
name: CodeQL SAST
41+
42+
on:
43+
push:
44+
branches: [main]
45+
pull_request:
46+
branches: [main]
47+
schedule:
48+
- cron: "0 3 * * 1"
49+
50+
jobs:
51+
analyze:
52+
name: Analyze
53+
runs-on: ubuntu-latest
54+
permissions:
55+
security-events: write
56+
actions: read
57+
contents: read
58+
59+
strategy:
60+
fail-fast: false
61+
matrix:
62+
language: ['typescript', 'rust']
63+
64+
steps:
65+
- name: Checkout repository
66+
uses: actions/checkout@v4
67+
68+
# ── TypeScript Analysis ───────────────────────────────────────────────────
69+
- name: Initialize CodeQL (TypeScript)
70+
if: matrix.language == 'typescript'
71+
uses: github/codeql-action/init@v3
72+
with:
73+
languages: typescript
74+
queries: security-extended,security-and-quality
75+
config: |
76+
packs:
77+
- codeql/javascript-queries:*
78+
query-filters:
79+
- exclude:
80+
id: js/unused-local-variable
81+
- exclude:
82+
id: js/unused-import
83+
84+
- name: Setup Node.js for TypeScript
85+
if: matrix.language == 'typescript'
86+
uses: actions/setup-node@v4
87+
with:
88+
node-version: '20'
89+
90+
- name: Install dependencies (mobile)
91+
if: matrix.language == 'typescript'
92+
working-directory: mobile
93+
run: npm ci
94+
95+
- name: Install dependencies (web)
96+
if: matrix.language == 'typescript'
97+
working-directory: apps/web
98+
run: npm ci
99+
100+
- name: Install dependencies (sdk)
101+
if: matrix.language == 'typescript'
102+
working-directory: packages/sdk
103+
run: npm ci
104+
105+
- name: Install dependencies (shared)
106+
if: matrix.language == 'typescript'
107+
working-directory: packages/shared
108+
run: npm ci
109+
110+
# ── Rust Analysis ─────────────────────────────────────────────────────────
111+
- name: Initialize CodeQL (Rust)
112+
if: matrix.language == 'rust'
113+
uses: github/codeql-action/init@v3
114+
with:
115+
languages: rust
116+
queries: security-extended,security-and-quality
117+
config: |
118+
packs:
119+
- codeql/rust-queries:*
120+
121+
- name: Setup Rust toolchain
122+
if: matrix.language == 'rust'
123+
uses: dtolnay/rust-toolchain@stable
124+
with:
125+
toolchain: stable
126+
127+
- name: Cache Cargo registry
128+
if: matrix.language == 'rust'
129+
uses: actions/cache@v4
130+
with:
131+
path: ~/.cargo/registry
132+
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
133+
134+
- name: Cache Cargo index
135+
if: matrix.language == 'rust'
136+
uses: actions/cache@v4
137+
with:
138+
path: ~/.cargo/git
139+
key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }}
140+
141+
- name: Cache Cargo build
142+
if: matrix.language == 'rust'
143+
uses: actions/cache@v4
144+
with:
145+
path: target
146+
key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}
147+
148+
- name: Build Rust contracts
149+
if: matrix.language == 'rust'
150+
run: |
151+
cargo build --manifest-path contracts/registry/Cargo.toml
152+
cargo build --manifest-path contracts/savings/Cargo.toml
153+
154+
- name: Run cargo clippy (Rust)
155+
if: matrix.language == 'rust'
156+
run: |
157+
cargo clippy --all-targets --manifest-path contracts/registry/Cargo.toml -- -D warnings
158+
cargo clippy --all-targets --manifest-path contracts/savings/Cargo.toml -- -D warnings
159+
160+
# ── Perform Analysis ───────────────────────────────────────────────────────
161+
- name: Perform CodeQL Analysis
162+
uses: github/codeql-action/analyze@v3
163+
with:
164+
category: "/language:${{matrix.language}}"
165+
upload: true
166+
wait-for-processing: true
167+
language: [javascript-typescript]
168+
169+
steps:
170+
- name: Checkout
171+
uses: actions/checkout@v4
172+
173+
- name: Initialize CodeQL
174+
uses: github/codeql-action/init@v3
175+
with:
176+
languages: ${{ matrix.language }}
177+
queries: security-and-quality
178+
179+
- name: Autobuild
180+
uses: github/codeql-action/autobuild@v3
181+
182+
- name: Perform CodeQL Analysis
183+
uses: github/codeql-action/analyze@v3
184+
with:
185+
category: "/language:${{ matrix.language }}"

‎.github/workflows/deployer-balance-check.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Deployer Balance Check
2+
3+
on:
4+
schedule:
5+
- cron: "0 */6 * * *"
6+
workflow_dispatch:
7+
8+
jobs:
9+
check-balance:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v4
13+
- name: Check deployer balance (testnet)
14+
run: |
15+
chmod +x scripts/check-deployer-balance.sh
16+
DEPLOYER_PUBLIC_KEY="${{ secrets.DEPLOYER_PUBLIC_KEY }}" \
17+
STELLAR_NETWORK="testnet" \
18+
HORIZON_URL="https://horizon-testnet.stellar.org" \
19+
scripts/check-deployer-balance.sh
20+
- name: Check deployer balance (mainnet)
21+
run: |
22+
DEPLOYER_PUBLIC_KEY="${{ secrets.DEPLOYER_PUBLIC_KEY }}" \
23+
STELLAR_NETWORK="mainnet" \
24+
HORIZON_URL="https://horizon.stellar.org" \
25+
scripts/check-deployer-balance.sh

‎.github/workflows/docker-ci.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Docker CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
tags: ["v*"]
7+
pull_request:
8+
branches: [main]
9+
10+
env:
11+
REGISTRY: ghcr.io
12+
IMAGE_NAME: blockhaven-labs/esustellar-web
13+
DOCKER_BUILDKIT: 1
14+
BUILDKIT_PROGRESS: plain
15+
16+
jobs:
17+
build:
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
packages: write
22+
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@v4
26+
27+
- name: Set up Docker Buildx
28+
uses: docker/setup-buildx-action@v3
29+
30+
- name: Log in to GHCR
31+
if: github.event_name != 'pull_request'
32+
uses: docker/login-action@v3
33+
with:
34+
registry: ${{ env.REGISTRY }}
35+
username: ${{ github.actor }}
36+
password: ${{ secrets.GITHUB_TOKEN }}
37+
38+
- name: Extract metadata
39+
id: meta
40+
uses: docker/metadata-action@v5
41+
with:
42+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
43+
44+
- name: Build and push
45+
uses: docker/build-push-action@v6
46+
with:
47+
context: .
48+
file: Dockerfile
49+
platforms: linux/amd64,linux/arm64
50+
cache-from: |
51+
type=gha
52+
type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cache
53+
cache-to: type=gha,mode=max
54+
push: ${{ github.event_name != 'pull_request' }}
55+
tags: ${{ steps.meta.outputs.tags }}
56+
labels: ${{ steps.meta.outputs.labels }}

0 commit comments

Comments
 (0)