fix: track contracts/Cargo.lock, harden benchmark CI, fork-friendly secret

- .gitignore: track contracts/Cargo.lock for reproducible builds while
  keeping target/ and other Cargo.lock files ignored
- contract-smoke.yml: propagate benchmark failures to CI (remove || true),
  add --locked --features testutils for reproducible benchmarks,
  guard against missing BENCHMARK_RESULT output,
  make secret check fork-friendly (warning + HAS_TESTNET_SECRET gate)

Author: fredericklamar342-prog

.github/workflows/contract-smoke.yml

@@ -30,10 +30,16 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Ensure testnet secret exists
+        # Fork PRs and PRs from contributors without `secrets.STELLAR_TESTNET_SECRET_KEY`
+        # cannot deploy to testnet (GitHub strips secrets for non-trusted contexts).
+        # The build, audit, and benchmark steps still run so the contract code is
+        # verified on every PR; the testnet deploy step below is gated on the secret.
         run: |
-          if [ -z "${STELLAR_SECRET_KEY}" ]; then
-            echo "::error::Missing STELLAR_TESTNET_SECRET_KEY repository secret"
-            exit 1
+          if [ -z "${STELLAR_SECRET_KEY:-}" ]; then
+            echo "::warning::STELLAR_TESTNET_SECRET_KEY not available in this run context (fork PR or maintenance run); skipping on-chain deploy step."
+            echo "HAS_TESTNET_SECRET=false" >> "$GITHUB_ENV"
+          else
+            echo "HAS_TESTNET_SECRET=true" >> "$GITHUB_ENV"
           fi
 
       - name: Setup Rust
@@ -72,8 +78,15 @@ jobs:
       - name: Run benchmarks
         working-directory: ./contracts
         if: github.event_name == 'pull_request'
+        # Benchmarks need the testutils feature for ledger/env manipulation.
+        # cargo test failures (compilation or test assertion) propagate;
+        # only skip summary generation when no BENCHMARK_RESULT lines exist.
         run: |
-          cargo test benchmark_ -- --nocapture > bench_output.txt || true
+          cargo test --locked --features testutils benchmark_ -- --nocapture > bench_output.txt
+          if ! grep -q 'BENCHMARK_RESULT|' bench_output.txt; then
+            echo "No BENCHMARK_RESULT lines found; skipping summary generation."
+            exit 0
+          fi
           python3 -c '
           import json
           lines = [line.strip() for line in open("bench_output.txt") if "BENCHMARK_RESULT|" in line]
@@ -110,6 +123,7 @@ jobs:
 
       - name: Deploy and initialize on testnet
         working-directory: ./contracts
+        if: env.HAS_TESTNET_SECRET == 'true'
         run: |
           soroban network add testnet --global \
             --rpc-url "${SOROBAN_RPC_URL}" \

.gitignore

@@ -127,7 +127,10 @@ logs
 
 # Rust/Cargo
 target/
+# Cargo.lock is committed for the contracts crate to ensure reproducible
+# builds, especially with pinned ed25519-dalek to avoid version conflicts.
 Cargo.lock
+!contracts/Cargo.lock
 **/*.rs.bk
 
 # Soroban
@@ -236,5 +239,5 @@ monitoring/logs/
 # Generated output files
 backend/test_results.txt
 frontend/tsc-output.txt
-
-*storybook.log
+
+*storybook.log