ci: improve CI/CD workflows and infrastructure

.github/codecov.yml

@@ -9,6 +9,10 @@ coverage:
         target: 70%
         flags:
           - contracts
+      frontend:
+        target: auto
+        flags:
+          - frontend
     patch:
       default:
         target: 60%

.github/workflows/ci.yml

@@ -2,6 +2,10 @@
 # Covers frontend linting/build, backend build/test, and Soroban contract build/test.
 name: CI
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main, develop]
@@ -35,9 +39,20 @@ jobs:
         working-directory: frontend
 
       - name: Run Frontend Tests
-        run: npm test
+        run: npm run test:coverage
         working-directory: frontend
 
+      - name: Upload frontend coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: frontend/coverage/lcov.info
+          flags: frontend
+          name: frontend-coverage
+          fail_ci_if_error: false
+          verbose: true
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
       - name: Build
         run: npm run build
         working-directory: frontend

.github/workflows/security.yml

@@ -1,5 +1,9 @@
 name: Security Checks
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [ main, develop ]

PR_DESCRIPTION.md

@@ -1,66 +1,68 @@
 ## Description
-This PR resolves two backend issues:
-1. **Issue #524 [Backend] Indexer ignores fee_config_updated and admin_transferred governance events**: Added indexing and SSE broadcasting for `fee_config_updated` and `admin_transferred` contract governance events. Used an elegant, referentially safe `streamId = 0` system stream fallback to preserve Prisma schema integrity and foreign-key constraints.
-2. **Issue #525 [Backend] migration_lock.toml declares sqlite but the datasource is postgresql**: Fixed a production-blocking validation mismatch in Prisma by changing `provider` from `"sqlite"` to `"postgresql"` in `migration_lock.toml`.
+This PR resolves four CI/CD and infrastructure issues:
+1. **Issue #897 [CI] Frontend tests run without coverage and are never uploaded to Codecov**: Added frontend test coverage to CI workflow and configured Codecov to track frontend coverage.
+2. **Issue #894 [Infra] No .dockerignore for the backend build context**: Created `.dockerignore` for backend to exclude unnecessary files from Docker build context.
+3. **Issue #892 [CI] Workflows have no concurrency control**: Added concurrency control to `ci.yml` and `security.yml` workflows to cancel superseded runs.
+4. **Issue #891 [CI] pr-test-gate.yml fully duplicates ci.yml's backend and contracts jobs**: Removed `pr-test-gate.yml` as it duplicates tests already covered by `ci.yml`.
 
 ## Type of Change
 <!-- Mark the relevant option with an 'x' -->
 
+- [x] 🔧 Infrastructure/CI improvements
 - [x] 🐛 Bug fix (non-breaking change which fixes an issue)
-- [x] ✨ New feature (non-breaking change which adds functionality)
+- [ ] ✨ New feature (non-breaking change which adds functionality)
 - [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
 - [ ] 📚 Documentation update
-- [ ] 🔧 Refactoring (no functional changes)
 - [ ] ⚡ Performance improvement
-- [x] 🧪 Test addition or update
+- [ ] 🧪 Test addition or update
 
 ## Related Issues
 <!-- Link related issues using keywords like "Closes", "Fixes", "Resolves" -->
 <!-- Example: Closes #123, Fixes #456 -->
 
-Closes #524
-Closes #525
+Closes #897
+Closes #894
+Closes #892
+Closes #891
 
 ## Changes Made
-- **Database Configuration**:
-  - Updated `provider` in `backend/prisma/migrations/migration_lock.toml` to `"postgresql"`.
-- **Worker Indexer (`soroban-event-worker.ts`)**:
-  - Added `decodeU32` helper function to decode `u32` event values.
-  - Implemented `ensureSystemStream` to upsert a system user and stream with `streamId = 0` during transaction callbacks to prevent database foreign-key constraint violations when writing protocol-level events.
-  - Modified `processEvent` to allow single-topic events (`topic.length === 1`) for the two new protocol events while keeping the `streamId` requirement for per-stream events.
-  - Implemented `handleFeeConfigUpdated` and `handleAdminTransferred` handlers to write records of types `FEE_CONFIG_UPDATED` and `ADMIN_TRANSFERRED` and broadcast payloads over the SSE admin channels `stream.fee_config_updated` and `stream.admin_transferred`.
-- **Classification Lists**:
-  - Added `FEE_CONFIG_UPDATED` and `ADMIN_TRANSFERRED` to allowed list arrays in `events.routes.ts` (`EVENT_TYPES`) and `stream.controller.ts` (`validEventTypes`).
-- **Syntax and Compile Fixes**:
-  - Resolved a pre-existing syntax error (missing arrow function opening brace `{`) in `backend/tests/integration/stream-actions.test.ts` to allow the test runner to compile all files.
+- **Frontend Test Coverage (#897)**:
+  - Updated `.github/workflows/ci.yml` to run `npm run test:coverage` instead of `npm test` for frontend
+  - Added frontend coverage upload step to Codecov with `frontend` flag
+  - Updated `.github/codecov.yml` to include frontend project status with `target: auto`
+- **Docker Build Optimization (#894)**:
+  - Created `backend/.dockerignore` to exclude: `node_modules`, `dist`, `coverage`, `.env*`, `*.log`, `src/generated`
+  - This reduces Docker build context size and prevents secrets from being sent to build cache
+- **Concurrency Control (#892)**:
+  - Added `concurrency` block to `.github/workflows/ci.yml` with `cancel-in-progress: true`
+  - Added `concurrency` block to `.github/workflows/security.yml` with `cancel-in-progress: true`
+  - Both workflows use group: `${{ github.workflow }}-${{ github.ref }}`
+- **Remove Duplicate Workflow (#891)**:
+  - Deleted `.github/workflows/pr-test-gate.yml` as it duplicated backend and contracts tests already in `ci.yml`
+  - This eliminates duplicate Postgres services and redundant test runs on PRs to main
 
 ## Testing
 <!-- Describe the tests you ran and how to verify your changes -->
 
 ### Test Coverage
-- [x] Unit tests added/updated
-- [x] Integration tests added/updated
+- [ ] Unit tests added/updated
+- [ ] Integration tests added/updated
 - [x] Manual testing performed
 
 ### Test Steps
 <!-- If applicable, provide steps to test the changes -->
-1. Run mocked event worker unit tests validating governance event decoding, database upserts, and SSE broadcast trigger:
-   ```bash
-   npx vitest run tests/soroban-event-worker.test.ts
-   ```
-2. Run database-mocked integration tests asserting the event lifecycle:
-   ```bash
-   DATABASE_URL=postgresql://localhost/flowfi npx vitest run src/__tests__/integration/streams.test.ts
-   ```
-3. Verify that the Prisma migrate status check successfully resolves schema and migration lock providers without crashing:
-   ```bash
-   DATABASE_URL=postgresql://localhost/flowfi npx prisma migrate status
-   ```
+1. Verify frontend tests run with coverage in CI by checking workflow logs
+2. Verify frontend coverage appears in Codecov dashboard
+3. Verify Docker build context size is reduced by checking build logs
+4. Verify concurrent workflow runs cancel previous runs by pushing multiple commits to same branch
+5. Verify PRs to main no longer launch duplicate Postgres services
 
 ## Breaking Changes
 <!-- If this PR includes breaking changes, describe them here -->
 <!-- If none, you can remove this section -->
 
+None. Branch protection rules should be updated to point to `ci.yml` jobs instead of `pr-test-gate.yml` if they were previously configured.
+
 ## Screenshots/Demo
 <!-- If applicable, add screenshots or a link to a demo -->
 
@@ -72,10 +74,12 @@ Closes #525
 - [x] I have commented my code, particularly in hard-to-understand areas
 - [x] I have made corresponding changes to the documentation
 - [x] My changes generate no new warnings
-- [x] I have added tests that prove my fix is effective or that my feature works
-- [x] New and existing unit tests pass locally with my changes
+- [ ] I have added tests that prove my fix is effective or that my feature works
+- [ ] New and existing unit tests pass locally with my changes
 - [x] Any dependent changes have been merged and published
 - [x] I have checked for breaking changes and documented them if applicable
 
 ## Additional Notes
 <!-- Any additional information that reviewers should know -->
+- Branch protection rules may need to be updated to reference `ci.yml` jobs instead of the removed `pr-test-gate.yml` workflow
+- Frontend coverage threshold is set to `auto` in Codecov to allow establishing a baseline before setting specific targets

backend/.dockerignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+coverage
+.env*
+*.log
+src/generated