mova-store/.github/workflows/ci.yml at main · ghzhost/mova-store · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

env:
  NODE_VERSION: "20"
  RUST_VERSION: "1.91.0"

jobs:
  # Frontend checks
  frontend:
    name: Frontend (Lint, Type Check, Test, Build)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run ESLint
        run: npm run lint

      - name: Type check
        run: npx tsc --noEmit --skipLibCheck
        continue-on-error: true # Allow to pass while fixing type errors

      - name: Run tests
        run: npm run test

      - name: Build Next.js
        run: npm run build
        env:
          # Minimal env vars for build
          NEXT_PUBLIC_STELLAR_NETWORK: testnet
          NEXT_PUBLIC_CHECKOUT_CONTRACT_ID: CDUMMY0000000000000000000000000000000000000000000000000
          NEXT_PUBLIC_SUPABASE_URL: https://dummy.supabase.co
          NEXT_PUBLIC_SUPABASE_ANON_KEY: dummy_anon_key
          NEXT_PUBLIC_EMAILJS_SERVICE_ID: service_dummy
          NEXT_PUBLIC_EMAILJS_TEMPLATE_ID: template_dummy
          NEXT_PUBLIC_EMAILJS_PUBLIC_KEY: dummy_key

  # Soroban contract checks
  contracts:
    name: Soroban Contracts (Build, Test)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}
          targets: wasm32v1-none

      - name: Cache Cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            contracts/checkout/target/
          key: ${{ runner.os }}-cargo-${{ env.RUST_VERSION }}-${{ hashFiles('contracts/checkout/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-${{ env.RUST_VERSION }}-
            ${{ runner.os }}-cargo-

      - name: Build contracts
        working-directory: contracts/checkout
        run: cargo build --release --target wasm32v1-none

      - name: Run contract tests
        working-directory: contracts/checkout
        run: cargo test

  # Security audit
  security:
    name: Security Audit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: "npm"

      - name: Audit dependencies
        run: npm audit --audit-level=high
        continue-on-error: true # Report but don't fail yet

      - name: Check for secrets
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

  # Rust security audit
  rust-security:
    name: Rust Security Audit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run cargo audit
        working-directory: contracts/checkout
        run: cargo audit
        continue-on-error: true

  # Summary job that requires all checks to pass
  ci-success:
    name: CI Success
    needs: [frontend, contracts, security]
    runs-on: ubuntu-latest
    if: always()

    steps:
      - name: Check all jobs passed
        run: |
          if [[ "${{ needs.frontend.result }}" != "success" ]]; then
            echo "Frontend job failed"
            exit 1
          fi
          if [[ "${{ needs.contracts.result }}" != "success" ]]; then
            echo "Contracts job failed"
            exit 1
          fi
          echo "All required checks passed!"