test: enforce-develop-branch

.github/workflows/enforce-develop-branch.yml

@@ -0,0 +1,37 @@
+name: Enforce Develop Branch
+
+on:
+  pull_request:
+    branches:
+      - main
+    types: [opened, synchronize]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  enforce-develop:
+    name: Block PR Against Main
+    runs-on: ubuntu-latest
+    steps:
+      - name: Post comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `❌ **PR Against Wrong Branch**\n\nPlease create PRs against the **\`develop\`** branch, not \`main\`.\n\n**Why?**\n- \`main\` is for stable releases only\n- \`develop\` is for active development\n\n**What to do:**\n1. Close this PR\n2. Create a new PR with \`develop\` as the base branch\n3. Ensure you're pulling from your feature branch\n\nThis PR will be closed automatically.`
+            })
+
+      - name: Close PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.pulls.update({
+              pull_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'closed'
+            })

.github/workflows/lint.yml

@@ -0,0 +1,31 @@
+name: Lint & Format (Optional)
+
+on:
+  pull_request:
+    branches: [develop]
+    paths:
+      - '**/*.ts'
+      - '**/*.tsx'
+      - '**/*.js'
+      - '**/*.jsx'
+      - '.github/workflows/lint.yml'
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  lint:
+    name: ESLint & Biome
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22.x"
+          cache: "pnpm"
+      - run: pnpm install --frozen-lockfile
+      - name: Run lint
+        run: pnpm run lint --filter=frontend --filter=backend
+        continue-on-error: true

.github/workflows/pr.yml

@@ -0,0 +1,133 @@
+name: PR Checks
+
+on:
+  pull_request:
+    branches: [develop]
+
+permissions:
+  contents: read
+
+jobs:
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Frontend
+  # ─────────────────────────────────────────────────────────────────────────────
+  frontend:
+    name: Frontend — Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22.x"
+          cache: "pnpm"
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build --filter=frontend
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Backend
+  # ─────────────────────────────────────────────────────────────────────────────
+  backend:
+    name: Backend — Build, Test & Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22.x"
+          cache: "pnpm"
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build --filter=backend
+      - run: pnpm run test --filter=backend
+      - run: pnpm audit --audit-level=moderate
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Contracts
+  # ─────────────────────────────────────────────────────────────────────────────
+  contracts:
+    name: Contracts — Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22.x"
+          cache: "pnpm"
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run test --filter=contracts
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Crypto
+  # ─────────────────────────────────────────────────────────────────────────────
+  crypto:
+    name: Crypto — Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22.x"
+          cache: "pnpm"
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run test --filter=crypto
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Rust/Soroban Contract
+  # ─────────────────────────────────────────────────────────────────────────────
+  rust:
+    name: Rust — Build WASM, Test & Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.91"
+          targets: wasm32v1-none
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+      - name: Build WASM (release)
+        run: cargo build --target wasm32v1-none --release --locked
+      - name: Run tests
+        run: cargo test --locked
+      - name: Audit dependencies
+        run: cargo audit
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Merge Gate — All checks must pass
+  # ─────────────────────────────────────────────────────────────────────────────
+  pr-merge-gate:
+    name: PR Merge Gate
+    runs-on: ubuntu-latest
+    needs: [frontend, backend, contracts, crypto, rust]
+    if: always()
+    steps:
+      - name: Verify all checks passed
+        run: |
+          echo "Checking PR status..."
+          echo ""
+
+          FAILED=0
+
+          [[ "${{ needs.frontend.result }}" == "success" ]] && echo "✅ Frontend" || { echo "❌ Frontend"; FAILED=1; }
+          [[ "${{ needs.backend.result }}" == "success" ]] && echo "✅ Backend" || { echo "❌ Backend"; FAILED=1; }
+          [[ "${{ needs.contracts.result }}" == "success" ]] && echo "✅ Contracts" || { echo "❌ Contracts"; FAILED=1; }
+          [[ "${{ needs.crypto.result }}" == "success" ]] && echo "✅ Crypto" || { echo "❌ Crypto"; FAILED=1; }
+          [[ "${{ needs.rust.result }}" == "success" ]] && echo "✅ Rust" || { echo "❌ Rust"; FAILED=1; }
+
+          echo ""
+          if [[ $FAILED -eq 1 ]]; then
+            echo "🚫 PR blocked — one or more checks failed"
+            exit 1
+          fi
+
+          echo "✅ All checks passed — PR ready to merge"

.github/workflows/security.yml

@@ -0,0 +1,53 @@
+name: Security Scanning (Scheduled)
+
+on:
+  schedule:
+    # Run every Monday at 00:00 UTC
+    - cron: '0 0 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  cargo-audit:
+    name: Cargo Audit — Rust Dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.91"
+      - name: Install cargo-audit
+        run: cargo install cargo-audit
+      - name: Run cargo audit
+        run: cargo audit
+
+  npm-audit:
+    name: NPM Audit — Node Dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22.x"
+          cache: "pnpm"
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm audit --audit-level=moderate
+
+  secret-scanning:
+    name: Secret Scanning — TruffleHog
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: trufflesecurity/trufflehog@main
+        with:
+          path: ./
+          base: ${{ github.event.repository.default_branch }}
+          head: HEAD
+          extra_args: --debug

.gitignore

@@ -5,3 +5,5 @@ dist/
 .DS_Store
 coverage/
 .kiro/
+test_snapshots/
+target/

.secretsignore

@@ -0,0 +1,22 @@
+# TruffleHog ignore patterns for secrets scanning
+# Use gitignore-style patterns to exclude false positives
+
+# Example test credentials and known safe patterns:
+# *.test.ts
+# test/fixtures/**
+
+# Node modules (scanned separately)
+node_modules/
+dist/
+build/
+
+# Rust build artifacts
+target/
+
+# Lock files (legitimate)
+pnpm-lock.yaml
+Cargo.lock
+
+# Example keys and test vectors (tagged with TEST- prefix are assumed false positives)
+TEST_KEY_*
+EXAMPLE_*

.trivyignore

@@ -0,0 +1,6 @@
+# Trivy ignore file for managing known false positives
+# Format: <vulnerability_id> exp:<expiration_date>
+# Leave blank or add known safe patterns
+
+# Example (uncomment if needed):
+# CVE-2021-12345 exp:2025-12-31

.turbo/cache/3d6c59582ea88268-manifest.json

@@ -0,0 +1 @@
+{"files":{"packages/crypto/.turbo/turbo-test.log":{"size":22901,"mtime_nanos":1788789332893239600,"mode":420,"is_dir":false}},"order":["packages/crypto/.turbo/turbo-test.log"]}

.turbo/cache/3d6c59582ea88268-meta.json

@@ -0,0 +1 @@
+{"hash":"3d6c59582ea88268","duration":67533,"sha":"26d10f004dabe550e6772155f8bd60801d3bc9a0","dirty_hash":"3da2203952a7c74abfa1c014dbbee492b0992550976f6e0ebc1f755839bc682c"}

.turbo/cache/b80440051c04aa10-manifest.json

@@ -0,0 +1 @@
+{"files":{"apps/frontend/.turbo/turbo-test.log":{"size":187,"mtime_nanos":1788789266725693000,"mode":420,"is_dir":false}},"order":["apps/frontend/.turbo/turbo-test.log"]}

.turbo/cache/b80440051c04aa10-meta.json

@@ -0,0 +1 @@
+{"hash":"b80440051c04aa10","duration":1366,"sha":"26d10f004dabe550e6772155f8bd60801d3bc9a0","dirty_hash":"3da2203952a7c74abfa1c014dbbee492b0992550976f6e0ebc1f755839bc682c"}

.turbo/cache/e1546cb98d7ff70a-manifest.json

@@ -0,0 +1 @@
+{"files":{"packages/contracts/.turbo/turbo-test.log":{"size":70131,"mtime_nanos":1788789270105601600,"mode":420,"is_dir":false}},"order":["packages/contracts/.turbo/turbo-test.log"]}

.turbo/cache/e1546cb98d7ff70a-meta.json

@@ -0,0 +1 @@
+{"hash":"e1546cb98d7ff70a","duration":4746,"sha":"26d10f004dabe550e6772155f8bd60801d3bc9a0","dirty_hash":"3da2203952a7c74abfa1c014dbbee492b0992550976f6e0ebc1f755839bc682c"}

.turbo/cache/fc3abc9d70877c9e-manifest.json

@@ -0,0 +1 @@
+{"files":{"apps/backend/.turbo/turbo-test.log":{"size":163,"mtime_nanos":1788789266809249600,"mode":420,"is_dir":false}},"order":["apps/backend/.turbo/turbo-test.log"]}

.turbo/cache/fc3abc9d70877c9e-meta.json

@@ -0,0 +1 @@
+{"hash":"fc3abc9d70877c9e","duration":1449,"sha":"26d10f004dabe550e6772155f8bd60801d3bc9a0","dirty_hash":"3da2203952a7c74abfa1c014dbbee492b0992550976f6e0ebc1f755839bc682c"}

CODE_OF_CONDUCT.md

@@ -0,0 +1,32 @@
+# Code of Conduct
+
+## Our Commitment
+
+We are committed to providing a welcoming, inclusive, and harassment-free environment for all contributors and community members.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+- Being respectful and inclusive
+- Welcoming diverse perspectives and feedback
+- Being patient and understanding with others
+- Focusing on constructive criticism
+
+Examples of unacceptable behavior:
+- Harassment or discrimination of any kind
+- Offensive comments related to personal characteristics
+- Trolling or intentionally disruptive behavior
+- Publishing private information without consent
+- Any form of violence or threats
+
+## Reporting
+
+If you experience or witness unacceptable behavior, please report it to the maintainers. All reports will be reviewed and kept confidential.
+
+## Enforcement
+
+Violations of this code of conduct may result in temporary or permanent removal from the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant.

CONTRACT_ID

@@ -0,0 +1,20 @@
+# AnonVote — deployed Soroban contract IDs
+#
+# This file is updated automatically by deploy.sh after each deployment.
+# Keep it committed so the contract ID is always traceable in git history.
+#
+# Format: one entry per network
+#   testnet: <CONTRACT_ID>
+#   mainnet: <CONTRACT_ID>
+#
+# To deploy:
+#   cp .env.example .env
+#   # Fill in STELLAR_SECRET_KEY in .env
+#   source .env
+#   ./deploy.sh testnet
+#
+# The script will update deployments.json and print the contract ID.
+# Copy it here and into backend/.env as SOROBAN_CONTRACT_ID=<id>
+
+testnet: CDPSKEL3SXLUQWU55EWIZY2BAXJOT4CQOXMQUVCRPM2J74LDTULFINPH
+mainnet: (not yet deployed)