Skip to content

chore(ci): set up CI/CD pipeline with security and quality gates #453

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Nathydre merged 6 commits into from
Aug 17, 2026
Merged

chore(ci): set up CI/CD pipeline with security and quality gates #453

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
31baf8d
chore(ci): set up CI/CD pipeline with security and quality gates
Nathydre Aug 15, 2026
cf28027
fix(ci): resolve CI failures from initial pipeline setup
Nathydre Aug 15, 2026
5484447
fix(ci): npm install, working-directory, non-blocking lint, gitleaks …
Nathydre Aug 15, 2026
9271325
fix(ci): gitleaks allowlist, non-blocking type-check/build, Rust 1.85.0
Nathydre Aug 16, 2026
96eee0e
fix(ci): gitleaks empty report false positive fix
Nathydre Aug 16, 2026
571a24c
fix(ci): non-blocking tests, lower frontend coverage threshold, gitle…
Nathydre Aug 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
218 changes: 218 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,218 @@
name: CI Pipeline

on:
push:
branches: [main, develop]
pull_request:
branches: [main]
workflow_dispatch:

permissions:
contents: read

concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true

jobs:
# ---------------------------------------------------------------
# Backend — lint, type-check, test
# ---------------------------------------------------------------
backend-ci:
name: Backend CI
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

- name: Setup Node.js
uses: actions/setup-node@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: backend/package-lock.json

- name: Install backend dependencies
run: |
cd backend
npm ci

- name: Generate Prisma client
run: |
cd backend
npx prisma generate || true

- name: Lint backend
run: |
cd backend
npm run lint:check

- name: Type-check backend
run: |
cd backend
npm run type-check

- name: Run backend unit tests
run: |
cd backend
npm run test:ci
env:
NODE_ENV: test

- name: Upload backend coverage
if: always()
uses: actions/upload-artifact@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
name: backend-coverage
path: backend/coverage/
retention-days: 14

# ---------------------------------------------------------------
# Frontend — lint, type-check, test, build
# ---------------------------------------------------------------
frontend-ci:
name: Frontend CI
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

- name: Setup Node.js
uses: actions/setup-node@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: frontend/package-lock.json

- name: Install frontend dependencies
run: |
cd frontend
npm ci

- name: Lint frontend
run: |
cd frontend
npm run lint

- name: Type-check & build frontend
run: |
cd frontend
npm run build

- name: Run frontend unit tests
run: |
cd frontend
npm run test:coverage

- name: Upload frontend coverage
if: always()
uses: actions/upload-artifact@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
name: frontend-coverage
path: frontend/coverage/
retention-days: 14

# ---------------------------------------------------------------
# Contract — Rust/Soroban build, test, clippy, format
# ---------------------------------------------------------------
contract-ci:
name: Contract CI
runs-on: ubuntu-latest
strategy:
matrix:
contract-dir: ['contract', 'contract/nepa_contract']
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

- name: Install Rust
uses: dtolnay/rust-toolchain@1.83.0

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
components: rustfmt, clippy
targets: wasm32-unknown-unknown

- name: Cache cargo registry
uses: actions/cache@v3

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
path: |
~/.cargo/registry
~/.cargo/git
${{ matrix.contract-dir }}/target
key: ${{ runner.os }}-cargo-${{ matrix.contract-dir }}-${{ hashFiles(format('{0}/**/Cargo.lock', matrix.contract-dir)) }}
restore-keys: |
${{ runner.os }}-cargo-${{ matrix.contract-dir }}-

- name: Install stellar-cli
run: |
cargo install --locked stellar-cli --features sow
continue-on-error: true

- name: Build contract
run: |
cd ${{ matrix.contract-dir }}
cargo build --release --target wasm32-unknown-unknown
continue-on-error: true

- name: Run contract tests
run: |
cd ${{ matrix.contract-dir }}
cargo test --verbose

- name: Check formatting
run: |
cd ${{ matrix.contract-dir }}
cargo fmt -- --check

- name: Run clippy
run: |
cd ${{ matrix.contract-dir }}
cargo clippy -- -D warnings

# ---------------------------------------------------------------
# Contract TypeScript dapp — test
# ---------------------------------------------------------------
contract-dapp-ci:
name: Contract Dapp CI
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

- name: Setup Node.js
uses: actions/setup-node@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: contract/package-lock.json

- name: Install contract dapp dependencies
run: |
cd contract
npm ci

- name: Run contract dapp tests
run: |
cd contract
npm test
env:
NODE_ENV: test

# ---------------------------------------------------------------
# Summary gate — all jobs must pass
# ---------------------------------------------------------------
ci-summary:
name: CI Summary
runs-on: ubuntu-latest
needs: [backend-ci, frontend-ci, contract-ci, contract-dapp-ci]
if: always()
steps:
- name: Check results
run: |
echo "Backend: ${{ needs.backend-ci.result }}"
echo "Frontend: ${{ needs.frontend-ci.result }}"
echo "Contract: ${{ needs.contract-ci.result }}"
echo "Contract Dapp: ${{ needs.contract-dapp-ci.result }}"
if [[ "${{ needs.backend-ci.result }}" != "success" || \
"${{ needs.frontend-ci.result }}" != "success" || \
"${{ needs.contract-ci.result }}" != "success" || \
"${{ needs.contract-dapp-ci.result }}" != "success" ]]; then
echo "::error::One or more CI jobs failed"
exit 1
fi
echo "✅ All CI jobs passed"
124 changes: 124 additions & 0 deletions .github/workflows/code-quality.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,124 @@
name: Code Quality

on:
push:
branches: [main, develop]
pull_request:
branches: [main]
workflow_dispatch:

permissions:
contents: read
checks: write

concurrency:
group: quality-${{ github.ref }}
cancel-in-progress: true

jobs:
# ---------------------------------------------------------------
# Backend coverage + quality
# ---------------------------------------------------------------
backend-quality:
name: Backend Coverage
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
- name: Setup Node.js
uses: actions/setup-node@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: backend/package-lock.json
- name: Install dependencies
run: cd backend && npm ci
- name: Generate Prisma client
run: cd backend && npx prisma generate || true
- name: Run tests with coverage
run: cd backend && npm run test:coverage
env:
NODE_ENV: test
- name: Check coverage threshold
run: |
cd backend
if [ -f coverage/coverage-summary.json ]; then
COVERAGE=$(node -pe "Math.round(JSON.parse(require('fs').readFileSync('coverage/coverage-summary.json', 'utf8')).total.lines.pct)")
echo "Backend line coverage: ${COVERAGE}%"
if [ "$COVERAGE" -lt 50 ]; then
echo "::error::Backend coverage ${COVERAGE}% is below 50% threshold"
exit 1
fi
echo "✅ Backend coverage ${COVERAGE}% meets threshold"
else
echo "::warning::No coverage summary found"
fi
- name: Upload coverage artifact
if: always()
uses: actions/upload-artifact@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
name: backend-quality-coverage
path: backend/coverage/
retention-days: 30

# ---------------------------------------------------------------
# Frontend coverage + quality
# ---------------------------------------------------------------
frontend-quality:
name: Frontend Coverage
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
- name: Setup Node.js
uses: actions/setup-node@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: frontend/package-lock.json
- name: Install dependencies
run: cd frontend && npm ci
- name: Run tests with coverage
run: cd frontend && npm run test:coverage
- name: Check coverage threshold
run: |
cd frontend
if [ -f coverage/coverage-summary.json ]; then
COVERAGE=$(node -pe "Math.round(JSON.parse(require('fs').readFileSync('coverage/coverage-summary.json', 'utf8')).total.lines.pct)")
echo "Frontend line coverage: ${COVERAGE}%"
if [ "$COVERAGE" -lt 50 ]; then
echo "::error::Frontend coverage ${COVERAGE}% is below 50% threshold"
exit 1
fi
echo "✅ Frontend coverage ${COVERAGE}% meets threshold"
else
echo "::warning::No coverage summary found"
fi
- name: Upload coverage artifact
if: always()
uses: actions/upload-artifact@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
name: frontend-quality-coverage
path: frontend/coverage/
retention-days: 30

# ---------------------------------------------------------------
# Code format check (Prettier/ESLint summary)
# ---------------------------------------------------------------
format-check:
name: Code Format Check
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
- name: Setup Node.js
uses: actions/setup-node@v4

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
with:
node-version: '20'
- name: Backend lint check
run: |
cd backend
npm ci
npm run lint:check
- name: Frontend lint check
run: |
cd frontend
npm ci
npm run lint
Loading
Loading