ci/sec: dependabot, cargo-audit, --locked pinning, wasm optimize error handling and env config for scripts (#122, #123, #125, #126, #130, #132, #133, #134, #135)

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/ci.yml

@@ -12,25 +12,33 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@1.84.0
         with:
           components: rustfmt, clippy
 
       - uses: Swatinem/rust-cache@v2
 
       - run: cargo fmt --check
-      - run: cargo clippy --workspace --all-targets -- -D warnings
-      - run: cargo test --workspace
+      - run: cargo clippy --workspace --all-targets --locked -- -D warnings
+      - run: cargo test --workspace --locked
+
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: rustsec/audit-check@v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
 
   wasm-build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@1.84.0
         with:
           targets: wasm32v1-none
 
       - uses: Swatinem/rust-cache@v2
 
-      - run: cargo build --target wasm32v1-none --release
+      - run: cargo build --target wasm32v1-none --release --locked

Makefile

@@ -16,10 +16,13 @@ build:
 		echo "wasm32v1-none not installed; run: rustup target add wasm32v1-none"; \
 		exit 1; \
 	fi
-	@command -v stellar >/dev/null 2>&1 && \
+	@if command -v stellar >/dev/null 2>&1; then \
 		for c in $(CONTRACTS); do \
-			stellar contract optimize --wasm $(WASM_DIR)/$$(echo $$c | tr - _).wasm || true; \
-		done || echo "stellar-cli not found; skipping wasm optimize step (optional)"
+			stellar contract optimize --wasm $(WASM_DIR)/$$(echo $$c | tr - _).wasm || { echo "stellar contract optimize failed for $$c"; exit 1; }; \
+		done; \
+	else \
+		echo "stellar-cli not found; skipping wasm optimize step (optional)"; \
+	fi
 
 ## Run the full workspace test suite on the native target (soroban-sdk
 ## supports native test execution via testutils, no wasm target required).

scripts/deploy.mjs

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import crypto from "node:crypto";
 import { fileURLToPath } from "node:url";
 import {
   Keypair,
@@ -12,16 +13,35 @@ import {
 } from "@stellar/stellar-sdk";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const RPC_URL = "https://soroban-testnet.stellar.org";
-const NETWORK_PASSPHRASE = Networks.TESTNET;
+
+const NETWORK_PASSPHRASE =
+  process.env.STELLAR_NETWORK_PASSPHRASE ||
+  (process.env.STELLAR_NETWORK === "mainnet" ? Networks.PUBLIC : Networks.TESTNET);
+
+const RPC_URL =
+  process.env.STELLAR_RPC_URL ||
+  (process.env.STELLAR_NETWORK === "mainnet"
+    ? "https://soroban-rpc.mainnet.stellar.org"
+    : "https://soroban-testnet.stellar.org");
 
 const server = new rpc.Server(RPC_URL);
-const deployerSecret = process.argv[2];
-const wasmPath = process.argv[3];
-const contractName = process.argv[4] ?? "contract";
+
+const deployerSecret =
+  process.env.MERGEFI_DEPLOYER_SECRET ||
+  process.env.STELLAR_SECRET_KEY ||
+  process.argv[2];
+
+const wasmPath = process.env.MERGEFI_DEPLOYER_SECRET || process.env.STELLAR_SECRET_KEY
+  ? process.argv[2]
+  : process.argv[3];
+
+const contractName = (process.env.MERGEFI_DEPLOYER_SECRET || process.env.STELLAR_SECRET_KEY
+  ? process.argv[3]
+  : process.argv[4]) ?? "contract";
 
 if (!deployerSecret || !wasmPath) {
-  console.error("Usage: node deploy.mjs <secret> <wasm-path> [name]");
+  console.error("Usage: node deploy.mjs [secret] <wasm-path> [name]");
+  console.error("Or provide secret via MERGEFI_DEPLOYER_SECRET / STELLAR_SECRET_KEY environment variable.");
   process.exit(1);
 }
 
@@ -73,9 +93,7 @@ async function main() {
       Operation.createCustomContract({
         address: new Address(kp.publicKey()),
         wasmHash,
-        salt: Buffer.from(
-          Array.from({ length: 32 }, () => Math.floor(Math.random() * 256)),
-        ),
+        salt: crypto.randomBytes(32),
       }),
     )
     .setTimeout(60)

scripts/invoke.mjs

@@ -9,13 +9,30 @@ import {
   rpc,
 } from "@stellar/stellar-sdk";
 
-const RPC_URL = "https://soroban-testnet.stellar.org";
-const NETWORK_PASSPHRASE = Networks.TESTNET;
+const NETWORK_PASSPHRASE =
+  process.env.STELLAR_NETWORK_PASSPHRASE ||
+  (process.env.STELLAR_NETWORK === "mainnet" ? Networks.PUBLIC : Networks.TESTNET);
+
+const RPC_URL =
+  process.env.STELLAR_RPC_URL ||
+  (process.env.STELLAR_NETWORK === "mainnet"
+    ? "https://soroban-rpc.mainnet.stellar.org"
+    : "https://soroban-testnet.stellar.org");
+
 const server = new rpc.Server(RPC_URL);
 
-const [, , secret, contractId, method, ...args] = process.argv;
+let secret = process.env.MERGEFI_SIGNER_SECRET || process.env.STELLAR_SECRET_KEY;
+let contractId, method, args;
+
+if (secret) {
+  [, , contractId, method, ...args] = process.argv;
+} else {
+  [, , secret, contractId, method, ...args] = process.argv;
+}
+
 if (!secret || !contractId || !method) {
-  console.error("Usage: node invoke.mjs <secret> <contractId> <method> [args as address:G... or u32:123]");
+  console.error("Usage: node invoke.mjs [secret] <contractId> <method> [args as address:G... or u32:123]");
+  console.error("Or provide signer secret via MERGEFI_SIGNER_SECRET / STELLAR_SECRET_KEY environment variable.");
   process.exit(1);
 }