feat(devops): Soroban CI, Playwright E2E Learner Journey, Multi-stage Docker Stack & Quality Gates

.github/release-drafter.yml

@@ -0,0 +1,58 @@
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+change-template: '- $TITLE (#$NUMBER) @$AUTHOR'
+change-title-escapes: '\<*_&'
+
+version-resolver:
+  major:
+    labels:
+      - 'major'
+      - 'breaking'
+  minor:
+    labels:
+      - 'minor'
+      - 'feature'
+      - 'feat'
+      - 'enhancement'
+  patch:
+    labels:
+      - 'patch'
+      - 'fix'
+      - 'bug'
+      - 'chore'
+      - 'docs'
+  default: patch
+
+categories:
+  - title: '🚀 Features & Enhancements'
+    labels:
+      - 'feat'
+      - 'feature'
+      - 'enhancement'
+  - title: '🐛 Bug Fixes'
+    labels:
+      - 'fix'
+      - 'bug'
+  - title: '🔒 Security Updates'
+    labels:
+      - 'security'
+  - title: '📝 Documentation'
+    labels:
+      - 'docs'
+      - 'documentation'
+  - title: '🧰 Maintenance & Infrastructure'
+    labels:
+      - 'chore'
+      - 'refactor'
+      - 'style'
+      - 'ci'
+      - 'build'
+      - 'test'
+
+template: |
+  ## What's Changed in $RESOLVED_VERSION
+
+  $CHANGELOG
+
+  ## Contributors
+  $CONTRIBUTORS

.github/workflows/codeql.yml

@@ -0,0 +1,48 @@
+name: CodeQL Static Analysis
+
+on:
+  push:
+    branches: [ "main", "master" ]
+    paths:
+      - 'frontend/**'
+      - 'backend/**'
+      - 'contracts/**'
+      - '.github/workflows/codeql.yml'
+  pull_request:
+    branches: [ "main", "master" ]
+    paths:
+      - 'frontend/**'
+      - 'backend/**'
+      - 'contracts/**'
+      - '.github/workflows/codeql.yml'
+  schedule:
+    - cron: '0 4 * * 1'
+
+jobs:
+  analyze:
+    name: CodeQL Security Analysis
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript-typescript' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended,security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/commitlint.yml

@@ -0,0 +1,47 @@
+name: Lint Commit Messages & PR Titles
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+  push:
+    branches: [main]
+
+jobs:
+  commitlint:
+    name: Validate Conventional Commit & PR Title Format
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Codebase
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js Environment
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Validate PR Title Format
+        if: github.event_name == 'pull_request'
+        uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            docs
+            style
+            refactor
+            perf
+            test
+            build
+            ci
+            chore
+            revert
+          requireScope: false
+
+      - name: Validate Git Commit Messages
+        if: github.event_name == 'push'
+        run: |
+          npx @commitlint/cli --from ${{ github.event.before }} --to ${{ github.sha }} --verbose

.github/workflows/playwright.yml

@@ -0,0 +1,57 @@
+name: Playwright E2E Tests
+
+on:
+  push:
+    branches: [ "main", "master" ]
+    paths:
+      - 'frontend/**'
+      - '.github/workflows/playwright.yml'
+  pull_request:
+    branches: [ "main", "master" ]
+    paths:
+      - 'frontend/**'
+      - '.github/workflows/playwright.yml'
+
+jobs:
+  e2e-testing:
+    name: Playwright E2E Learner Journey Tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v3
+        with:
+          version: 10.33.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        working-directory: ./frontend
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Install Playwright Browsers with Dependencies
+        working-directory: ./frontend
+        run: npx playwright install --with-deps
+
+      - name: Run Playwright E2E Tests
+        working-directory: ./frontend
+        env:
+          CI: 'true'
+        run: pnpm test:e2e
+
+      - name: Upload Playwright Report & Trace Artifacts on Failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-e2e-artifacts
+          path: |
+            frontend/playwright-report/
+            frontend/test-results/
+          retention-days: 30

.github/workflows/release-drafter.yml

@@ -0,0 +1,22 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, reopened, synchronize, labeled]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update_release_draft:
+    name: Draft Release & Update Changelog
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Release Drafter
+        uses: release-drafter/release-drafter@v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,49 @@
+name: Build Release Artifacts & Notify
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build_release_assets:
+    name: Build WASM Contracts & Frontend Release Bundle
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Codebase
+        uses: actions/checkout@v4
+
+      - name: Install Rust Toolchain for Soroban
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+
+      - name: Build Soroban Contract WASM Artifacts
+        run: |
+          cd contracts
+          cargo build --target wasm32-unknown-unknown --release
+          mkdir -p ../release_artifacts/wasm
+          cp target/wasm32-unknown-unknown/release/*.wasm ../release_artifacts/wasm/ || true
+          cd ..
+
+      - name: Package Frontend Release Archive
+        run: |
+          mkdir -p release_artifacts/frontend
+          tar -czf release_artifacts/frontend/frontend-release.tar.gz -C frontend .
+
+      - name: Attach Artifacts to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            release_artifacts/wasm/*.wasm
+            release_artifacts/frontend/frontend-release.tar.gz
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Notify Team Webhooks (Discord / Slack)
+        if: always()
+        run: |
+          if [ -n "$DISCORD_WEBHOOK" ]; then
+            curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"🚀 **New Platform Release Published!** Version: ${{ github.event.release.tag_name }} is now live. Releases: ${{ github.event.release.html_url }}\"}" "$DISCORD_WEBHOOK" || true
+          fi
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

.github/workflows/sonarqube.yml

@@ -0,0 +1,30 @@
+name: SonarQube Quality Gate
+
+on:
+  push:
+    branches: [ "main", "master" ]
+  pull_request:
+    types: [ opened, synchronize, reopened ]
+
+jobs:
+  sonarqube:
+    name: SonarQube Quality Gate Analysis
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: SonarQube Scan & Quality Gate Evaluation
+        uses: SonarSource/sonarqube-scan-action@v2.0.2
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL || 'https://sonarcloud.io' }}
+
+      - name: SonarQube Quality Gate Status Check
+        uses: SonarSource/sonarqube-quality-gate-action@v1.1.0
+        timeout-minutes: 5
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/soroban-contracts.yml

@@ -0,0 +1,67 @@
+name: Soroban Smart Contracts CI
+
+on:
+  push:
+    branches: [ "main", "master" ]
+    paths:
+      - 'contracts/**'
+      - '.github/workflows/soroban-contracts.yml'
+  pull_request:
+    branches: [ "main", "master" ]
+    paths:
+      - 'contracts/**'
+      - '.github/workflows/soroban-contracts.yml'
+
+jobs:
+  test-and-build:
+    name: Soroban Contract Verification & WASM Build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+          components: clippy, rustfmt
+
+      - name: Cache Cargo registry & build artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: contracts -> target
+
+      - name: Code Formatting Check
+        working-directory: ./contracts
+        run: cargo fmt --check
+
+      - name: Clippy Linter Check
+        working-directory: ./contracts
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: Workspace Compilation Check
+        working-directory: ./contracts
+        run: cargo check --workspace --all-targets
+
+      - name: Unit & Integration Test Suite
+        working-directory: ./contracts
+        env:
+          RUST_BACKTRACE: 1
+          CARGO_TERM_COLOR: always
+        run: cargo test --workspace -- --nocapture
+
+      - name: Property & Fuzzing Tests
+        working-directory: ./contracts
+        run: cargo test --lib
+
+      - name: Compile Release WASM Bytecodes
+        working-directory: ./contracts
+        run: cargo build --workspace --target wasm32-unknown-unknown --release
+
+      - name: Upload Compiled WASM Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: soroban-wasm-binaries
+          path: contracts/target/wasm32-unknown-unknown/release/*.wasm
+          retention-days: 30

.gitignore

@@ -1,3 +1,8 @@
+# Temporary script artifacts
+scripts/*.tmp
+*.payload.tmp
+scripts/.cache/
+
 # ──────────────────────────────────────────────────────────────────────────────
 # Dependencies
 # ──────────────────────────────────────────────────────────────────────────────

.husky/commit-msg

@@ -0,0 +1,2 @@
+#!/bin/sh
+npx --no -- commitlint --edit "$1"