Merge branch 'main' into Unread_notification_count

Author: akinerin

.github/SECURITY_SETUP_CHECKLIST.md

@@ -1,6 +1,6 @@
 # GitHub Security Setup Checklist
 
-This checklist helps ensure that GitHub's security features are properly configured for the FlowFi repository.
+This checklist helps repository administrators ensure that GitHub's security features are properly configured for the FlowFi repository. For the canonical security policy (reporting guidelines, supported versions, response timelines), see [SECURITY.md](../SECURITY.md). For the implementation status and next steps, see [SECURITY_IMPLEMENTATION_SUMMARY.md](../SECURITY_IMPLEMENTATION_SUMMARY.md).
 
 ## Repository Security Settings
 

.github/workflows/ci.yml

@@ -13,6 +13,24 @@ on:
     branches: [main, develop]
 
 jobs:
+  changes:
+    name: Detect changes
+    runs-on: ubuntu-latest
+    outputs:
+      backend: ${{ steps.filter.outputs.backend }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check changed files
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            backend:
+              - 'backend/**'
+              - 'package-lock.json'
+
   frontend:
     name: Frontend CI
     runs-on: ubuntu-latest
@@ -34,10 +52,6 @@ jobs:
         run: npm run lint
         working-directory: frontend
 
-      - name: Install Rollup Native Binding
-        run: npm install @rollup/rollup-linux-x64-gnu --no-save
-        working-directory: frontend
-
       - name: Run Frontend Tests
         run: npm run test:coverage
         working-directory: frontend
@@ -46,9 +60,17 @@ jobs:
         run: npm run build
         working-directory: frontend
 
+      - name: Check frontend bundle size
+        run: bash ./scripts/check-bundle-size.sh
+        working-directory: frontend
+
   backend:
     name: Backend CI
     runs-on: ubuntu-latest
+    needs: changes
+    if: >-
+      github.event_name == 'push' ||
+      needs.changes.outputs.backend == 'true'
     services:
       postgres:
         image: postgres:16-alpine@sha256:e013e867e712fec275706a6c51c966f0bb0c93cfa8f51000f85a15f9865a28cb
@@ -90,8 +112,14 @@ jobs:
         run: npm run build
         working-directory: backend
 
-      - name: Install Rollup Native Binding
-        run: npm install @rollup/rollup-linux-x64-gnu --no-save
+      - name: OpenAPI spec & API types drift check
+        run: |
+          cd backend
+          npm run codegen:openapi
+          cd ../frontend
+          npm run codegen:api-types
+          cd ..
+          git diff --exit-code -- backend/swagger/flowfi.openapi.json frontend/src/lib/api-types.generated.ts
 
       - name: Run Backend Tests
         run: |
@@ -192,8 +220,16 @@ jobs:
         run: cargo test
         working-directory: contracts
 
+      - name: Cache cargo-tarpaulin
+        id: tarpaulin-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/cargo-tarpaulin
+          key: cargo-tarpaulin-${{ runner.os }}-0.37.2
+
       - name: Install cargo-tarpaulin
-        run: cargo install cargo-tarpaulin --locked
+        if: steps.tarpaulin-cache.outputs.cache-hit != 'true'
+        run: cargo install cargo-tarpaulin@0.37.2 --locked
 
       - name: Run Contract Coverage
         run: cargo tarpaulin --workspace --out Xml --output-dir coverage --fail-under 70
@@ -212,9 +248,26 @@ jobs:
 
       - name: Install Stellar CLI
         run: |
-          curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh -s -- --install-deps
-          echo "$HOME/.stellar-cli/bin" >> $GITHUB_PATH
+          set -euo pipefail
+          # Authenticate the release lookup through the runner's token. The
+          # upstream installer queries the unauthenticated GitHub API and can
+          # fail on shared-runner rate limits.
+          mkdir -p "$RUNNER_TEMP/stellar-cli"
+          stellar_cli_tag=$(gh release view --repo stellar/stellar-cli --json tagName --jq .tagName)
+          gh release download "$stellar_cli_tag" \
+            --repo stellar/stellar-cli \
+            --pattern 'stellar-cli-*-x86_64-unknown-linux-gnu.tar.gz' \
+            --dir "$RUNNER_TEMP/stellar-cli" \
+            --clobber
+          tar -xzf "$RUNNER_TEMP/stellar-cli/stellar-cli-"*.tar.gz \
+            -C "$RUNNER_TEMP/stellar-cli"
+          mkdir -p "$HOME/.stellar-cli/bin"
+          mv "$RUNNER_TEMP/stellar-cli/stellar" "$HOME/.stellar-cli/bin/stellar"
+          chmod +x "$HOME/.stellar-cli/bin/stellar"
+          echo "$HOME/.stellar-cli/bin" >> "$GITHUB_PATH"
         shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
 
       - name: Optimize WASM files
         run: |

.github/workflows/deploy-contracts.yml

@@ -0,0 +1,146 @@
+# Contract Deployment Workflow for FlowFi
+#
+# Compiles the Soroban stream contract to optimized WASM, runs contract tests,
+# and deploys + initializes the contract on Stellar Testnet on demand (or on
+# Mainnet for release tags). The resulting contract ID is surfaced in the job
+# summary and published as a release artifact.
+name: Deploy Soroban Contracts
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      network:
+        description: "Target network (testnet|mainnet)"
+        required: true
+        default: "testnet"
+        type: choice
+        options:
+          - testnet
+          - mainnet
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.network || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  deploy:
+    name: Build & Deploy stream_contract
+    runs-on: ubuntu-latest
+    environment: ${{ github.event_name == 'release' && 'production' || 'staging' }}
+
+    env:
+      NETWORK: ${{ inputs.network || (github.event_name == 'release' && 'mainnet' || 'testnet') }}
+      DEPLOYER_SECRET: ${{ secrets.DEPLOYER_SECRET }}
+      ADMIN_ADDRESS: ${{ secrets.ADMIN_ADDRESS }}
+      TREASURY_ADDRESS: ${{ secrets.TREASURY_ADDRESS }}
+      FEE_RATE_BPS: ${{ secrets.FEE_RATE_BPS }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: wasm32-unknown-unknown
+          components: rustfmt, clippy
+
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspace: "contracts -> target"
+
+      - name: Install Stellar CLI
+        run: |
+          curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh -s -- --install-deps
+          echo "$HOME/.stellar-cli/bin" >> $GITHUB_PATH
+
+      - name: Run Contract Tests
+        run: cargo test --package stream_contract
+        working-directory: contracts
+
+      - name: Build & Optimize WASM
+        run: |
+          set -euo pipefail
+          cd contracts
+          cargo build --target wasm32-unknown-unknown --release
+          RELEASE_DIR="target/wasm32-unknown-unknown/release"
+          for w in "$RELEASE_DIR"/stream_contract.wasm; do
+            stellar contract optimize --wasm "$w" --wasm-out "$RELEASE_DIR/stream_contract.optimized.wasm"
+          done
+          ls -la "$RELEASE_DIR"/*.wasm
+
+      - name: Inspect Contract Interface & WASM Size
+        run: |
+          set -euo pipefail
+          WASM=contracts/target/wasm32-unknown-unknown/release/stream_contract.optimized.wasm
+          stellar contract inspect --wasm "$WASM"
+          SIZE=$(stat -c%s "$WASM")
+          echo "Optimized WASM size: $SIZE bytes"
+          if [ "$SIZE" -ge 65536 ]; then
+            echo "ERROR: optimized WASM exceeds 64KB budget ($SIZE bytes)"
+            exit 1
+          fi
+          echo "WASM_WASM_PATH=$WASM" >> $GITHUB_ENV
+
+      - name: Deploy & Initialize Contract
+        run: ./scripts/deploy.sh --network "$NETWORK"
+
+      - name: Read Deployed Contract ID
+        id: contract
+        run: |
+          set -euo pipefail
+          CONTRACT_ID=$(jq -r --arg net "$NETWORK" '.[$net].contractId' deployment-info.json)
+          echo "contract_id=$CONTRACT_ID" >> $GITHUB_OUTPUT
+          echo "deployment-json=$(jq -c . deployment-info.json)" >> $GITHUB_OUTPUT
+
+      - name: Emit Deployment Summary
+        if: always()
+        run: |
+          {
+            echo "## Deployment Summary"
+            echo ""
+            echo "- **Network**: \`$NETWORK\`"
+            echo "- **Contract ID**: \`${{ steps.contract.outputs.contract_id }}\`"
+            echo "- **WASM**: \`${{ env.WASM_WASM_PATH }}\`"
+            echo "- **Deployment info**: "
+            echo '```json'
+            echo "${{ steps.contract.outputs.deployment-json }}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload Optimized WASM Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: stream-contract-${{ env.NETWORK }}
+          path: contracts/target/wasm32-unknown-unknown/optimized/*.wasm
+          if-no-files-found: error
+
+      - name: Upload Deployment Info
+        uses: actions/upload-artifact@v4
+        with:
+          name: deployment-info-${{ env.NETWORK }}
+          path: deployment-info.json
+          if-no-files-found: error
+
+      - name: Commit Deployment Info
+        if: github.event_name == 'release'
+        env:
+          NETWORK: ${{ env.NETWORK }}
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add deployment-info.json
+          if git diff --cached --quiet; then
+            echo "No deployment-info.json changes to commit"
+            exit 0
+          fi
+          git commit -m "chore(contracts): record $NETWORK contract deployment"
+          git push

.github/workflows/pr-test-gate.yml

@@ -27,7 +27,9 @@ jobs:
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: postgres:15
+        # Pinned to match the version used in ci.yml and docker-compose.yml
+        # (production target). Keep these in sync — see issue #1282.
+        image: postgres:16-alpine@sha256:e013e867e712fec275706a6c51c966f0bb0c93cfa8f51000f85a15f9865a28cb
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: password
@@ -61,11 +63,6 @@ jobs:
         env:
           DATABASE_URL: postgresql://postgres:password@127.0.0.1:5432/flowfi_test
 
-      - name: Install Native Bindings
-        run: |
-          npm install @rollup/rollup-linux-x64-gnu --no-save
-        working-directory: backend
-
       - name: Run backend tests
         run: |
           ls -la src/generated/prisma