Merge branch 'main' into feat/issue-152-matching-engine

Author: LaPoshBaby

.github/dependabot.yml

@@ -0,0 +1,70 @@
+name: Nightly Accessibility Scan
+
+# Runs every day at 06:00 UTC (≈1:00 AM EST). Also runs on manual trigger.
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  a11y-scan:
+    name: Axe DevTools AA scan (live pages)
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Install Playwright Chromium
+        working-directory: frontend
+        run: npx playwright install --with-deps chromium
+
+      - name: Build Next.js production bundle
+        working-directory: frontend
+        run: npm run build
+        env:
+          NEXT_PUBLIC_STELLAR_NETWORK: testnet
+          NEXT_PUBLIC_HORIZON_URL: https://horizon-testnet.stellar.org
+          NEXT_PUBLIC_API_URL: http://localhost:4000
+
+      - name: Start Next.js server in background
+        working-directory: frontend
+        run: |
+          nohup npm run start > next-start.log 2>&1 &
+          # Wait up to 60s for the server to respond.
+          timeout 60 bash -c 'until curl -fs http://localhost:3000 > /dev/null; do sleep 2; done'
+          echo "Next.js server is up."
+
+      - name: Run axe-core scan
+        working-directory: frontend
+        run: npm run a11y:scan
+
+      - name: Upload a11y report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: a11y-report
+          path: frontend/a11y-report.json
+          if-no-files-found: warn
+
+      - name: Upload server log
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: next-start.log
+          path: frontend/next-start.log
+          if-no-files-found: ignore

.github/workflows/a11y-nightly.yml

@@ -6,28 +6,6 @@ on:
   pull_request:
 
 jobs:
-  frontend:
-    name: Frontend (Next.js)
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - run: npm ci
-      - run: npm run type-check
-      - run: npm run lint
-      - run: npm run build
-        env:
-          NEXT_PUBLIC_STELLAR_NETWORK: testnet
-          NEXT_PUBLIC_HORIZON_URL: https://horizon-testnet.stellar.org
-          NEXT_PUBLIC_API_URL: http://localhost:4000
-
   backend:
     name: Backend (Node.js)
     runs-on: ubuntu-latest
@@ -43,26 +21,18 @@ jobs:
           cache-dependency-path: backend/package-lock.json
       - run: npm ci
       - run: npm run lint
-      - run: docker compose -f docker-compose.test.yml up --abort-on-container-exit --exit-code-from backend --build
-        working-directory: .
-
-  contracts:
-    name: Soroban Contracts (Rust)
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: contracts
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v7
         with:
-          targets: wasm32v1-none
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: contracts
-      - run: cargo check --workspace
-      - run: cargo test --workspace
-      - run: cargo build --workspace --target wasm32v1-none --release
+          context: ./backend
+          file: ./backend/Dockerfile
+          target: test
+          load: true
+          tags: indigopay-backend-test:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - run: docker compose -f docker-compose.test.yml up --abort-on-container-exit --exit-code-from backend
+        working-directory: .
 
   helm:
     name: Helm Chart Validation

.github/workflows/backend.yml

@@ -7,9 +7,6 @@ on:
   pull_request:
     paths: [contracts/**]
   workflow_dispatch:
-  schedule:
-    # Nightly deep fuzz run -- 1 000 000 iterations every day at 03:00 UTC
-    - cron: "0 3 * * *"
 
 jobs:
   test:
@@ -46,7 +43,7 @@ jobs:
         run: cargo build --workspace --target wasm32v1-none --release
 
   fuzz:
-    name: Fuzz Tests (10k iterations)
+    name: Fuzz Tests (256 cases each)
     runs-on: ubuntu-latest
     timeout-minutes: 20
     defaults:
@@ -67,13 +64,13 @@ jobs:
         with:
           workspaces: contracts
 
-      - name: Run fuzz tests (10k iterations)
+      - name: Run fuzz tests
         run: cargo test --features testutils -- fuzz
         env:
-          FUZZ_ITERATIONS: 10000
+          FUZZ_ITERATIONS: 256
 
   deep-fuzz:
-    name: Deep Fuzz (1M iterations -- nightly)
+    name: Deep Fuzz (2k cases each -- nightly)
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     timeout-minutes: 120
@@ -95,10 +92,61 @@ jobs:
         with:
           workspaces: contracts
 
-      - name: Run deep fuzz tests (1M iterations)
+  deep-fuzz:
+    name: Deep Fuzz (2k cases each -- nightly)
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    defaults:
+      run:
+        working-directory: contracts
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: 1.91.0
+          targets: wasm32v1-none
+          components: rustfmt, clippy
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: contracts
+
+      - name: Run deep fuzz tests
+        run: cargo test --features testutils -- fuzz
+        env:
+          FUZZ_ITERATIONS: 2000
+
+  deep-fuzz-pr:
+    name: Deep Fuzz (500 cases each -- PR)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: contracts
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: 1.91.0
+          targets: wasm32v1-none
+          components: rustfmt, clippy
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: contracts
+
+      - name: Run deep fuzz tests
         run: cargo test --features testutils -- fuzz
         env:
-          FUZZ_ITERATIONS: 1000000
+          FUZZ_ITERATIONS: 500
 
   coverage:
     name: Coverage (tarpaulin)
@@ -125,7 +173,7 @@ jobs:
           workspaces: contracts
 
       - name: Run coverage
-        run: cargo tarpaulin --config indigopay-contract/.tarpaulin.toml --out Html --out Lcov
+        run: cargo tarpaulin --config indigopay-contract/.tarpaulin.toml --features testutils --out Html --out Lcov -- --skip fuzz
 
       - name: Upload coverage report
         uses: actions/upload-artifact@v4