Merge branch 'main' into feat/playwright-e2e-ci-343-rebase

Author: Francis6-git

.github/CODEOWNERS

@@ -0,0 +1,24 @@
+# Code Owners for FlowFi
+# This file controls who is automatically assigned for review
+# based on the files changed in a pull request.
+
+# Default owners for the entire repository
+* @LabsCrypt
+
+# Backend
+backend/ @LabsCrypt
+
+# Frontend  
+frontend/ @LabsCrypt
+
+# Smart contracts
+contracts/ @LabsCrypt
+
+# Documentation
+docs/ @LabsCrypt
+
+# GitHub workflows and CI/CD
+.github/ @LabsCrypt
+
+# Deployment scripts
+scripts/ @LabsCrypt

.github/codecov.yml

@@ -9,6 +9,10 @@ coverage:
         target: 70%
         flags:
           - contracts
+      frontend:
+        target: auto
+        flags:
+          - frontend
     patch:
       default:
         target: 60%

.github/dependabot.yml

@@ -2,6 +2,12 @@ version: 2
 
 updates:
   # ── npm: root workspace ────────────────────────────────────────────────────
+  # flowfi is a single npm workspace (frontend + backend hoisted into one root
+  # package-lock.json). Dependabot must update from the workspace root so the
+  # root lockfile CI runs `npm ci` against stays in sync. Per-directory entries
+  # for /frontend and /backend only touched their package.json without updating
+  # the root lockfile, so every PR they opened failed `npm ci` with
+  # "lock file's X does not satisfy Y". One root entry covers all workspaces.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
@@ -14,54 +20,43 @@ updates:
           - "minor"
           - "patch"
 
-  # ── npm: frontend ──────────────────────────────────────────────────────────
-  - package-ecosystem: "npm"
-    directory: "/frontend"
+  # ── Cargo: contracts ───────────────────────────────────────────────────────
+  - package-ecosystem: "cargo"
+    directory: "/contracts"
     schedule:
       interval: "weekly"
       day: "monday"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 5
     groups:
       minor-and-patch:
         update-types:
           - "minor"
           - "patch"
 
-  # ── npm: backend ───────────────────────────────────────────────────────────
-  - package-ecosystem: "npm"
-    directory: "/backend"
+  # ── GitHub Actions ─────────────────────────────────────────────────────────
+  - package-ecosystem: "github-actions"
+    directory: "/"
     schedule:
       interval: "weekly"
       day: "monday"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 5
     groups:
-      minor-and-patch:
+      actions-minor-and-patch:
         update-types:
           - "minor"
           - "patch"
 
-  # ── Cargo: contracts ───────────────────────────────────────────────────────
-  - package-ecosystem: "cargo"
-    directory: "/contracts"
+  # ── Docker ─────────────────────────────────────────────────────────────────
+  - package-ecosystem: "docker"
+    directory: "/backend"
     schedule:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
-    groups:
-      minor-and-patch:
-        update-types:
-          - "minor"
-          - "patch"
 
-  # ── GitHub Actions ─────────────────────────────────────────────────────────
-  - package-ecosystem: "github-actions"
+  - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
-    groups:
-      actions-minor-and-patch:
-        update-types:
-          - "minor"
-          - "patch"

.github/workflows/ci.yml

@@ -2,11 +2,15 @@
 # Covers frontend linting/build, backend build/test, and Soroban contract build/test.
 name: CI
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
-    branches: [ main, develop ]
+    branches: [main, develop]
   pull_request:
-    branches: [ main, develop ]
+    branches: [main, develop]
 
 jobs:
   frontend:
@@ -19,14 +23,13 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci
 
-
       - name: Lint
         run: npm run lint
         working-directory: frontend
@@ -36,7 +39,7 @@ jobs:
         working-directory: frontend
 
       - name: Run Frontend Tests
-        run: npm test
+        run: npm run test:coverage
         working-directory: frontend
 
       - name: Build
@@ -48,7 +51,7 @@ jobs:
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: postgres:15
+        image: postgres:16-alpine@sha256:e013e867e712fec275706a6c51c966f0bb0c93cfa8f51000f85a15f9865a28cb
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: password
@@ -68,8 +71,8 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: package-lock.json
 
       - name: Install dependencies
@@ -111,6 +114,40 @@ jobs:
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
+  backend-docker:
+    name: Backend Docker Image CI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check changed files
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            backend:
+              - 'backend/**'
+              - 'docker-compose.yml'
+
+      - name: Build Docker Image
+        if: steps.filter.outputs.backend == 'true' || github.event_name == 'push'
+        run: docker build -f backend/Dockerfile backend -t flowfi-backend:test
+
+      - name: Docker Compose Build
+        if: steps.filter.outputs.backend == 'true' || github.event_name == 'push'
+        run: docker compose build
+
+      - name: Boot and Check Health
+        if: steps.filter.outputs.backend == 'true' || github.event_name == 'push'
+        run: |
+          docker compose up -d postgres
+          sleep 10
+          docker compose run --rm -e DATABASE_URL=postgresql://flowfi:flowfi_dev_password@postgres:5432/flowfi backend npx -y prisma db push --accept-data-loss
+          docker compose up -d backend
+          sleep 15
+          curl --fail http://localhost:3001/health || (docker compose logs backend && exit 1)
+
   contracts:
     name: Soroban Contracts CI
     runs-on: ubuntu-latest
@@ -128,7 +165,7 @@ jobs:
       - name: Rust Cache
         uses: Swatinem/rust-cache@v2
         with:
-          workspaces: "contracts -> target"
+          workspace: "contracts -> target"
 
       - name: Check Formatting
         run: cargo fmt --all -- --check
@@ -167,26 +204,56 @@ jobs:
       - name: Install Stellar CLI
         run: |
           curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh -s -- --install-deps
+          echo "$HOME/.stellar-cli/bin" >> $GITHUB_PATH
         shell: bash
 
       - name: Optimize WASM files
         run: |
           set -euo pipefail
-          WASMS=$(find contracts/target -type f -name "*.wasm" -print)
+
+          # Target the precise release build directory
+          RELEASE_DIR="contracts/target/wasm32-unknown-unknown/release"
+
+          # Use your strict selection logic to target un-optimized raw binaries only
+          WASMS=$(find "$RELEASE_DIR" -maxdepth 1 -type f -name "*.wasm" ! -name "*.optimized.wasm")
+
           if [ -z "$WASMS" ]; then
-            echo "No wasm files found"
+            echo "Error: No raw WASM files found in $RELEASE_DIR"
             exit 1
           fi
+
           for w in $WASMS; do
-            out="${w%%.wasm}.optimized.wasm"
-            echo "Optimizing $w -> $out"
+            filename=$(basename "$w")
+            out="$RELEASE_DIR/${filename%.wasm}.optimized.wasm"
+            echo "Optimizing $filename -> $(basename "$out")"
             stellar contract optimize --wasm "$w" --wasm-out "$out"
           done
         shell: bash
 
+      - name: Check WASM size budget
+        run: |
+          set -euo pipefail
+
+          RELEASE_DIR="contracts/target/wasm32-unknown-unknown/release"
+          WASM_SIZE_LIMIT=200000  # 200KB budget for optimized WASM
+
+          for wasm in "$RELEASE_DIR"/*.optimized.wasm; do
+            if [ -f "$wasm" ]; then
+              size=$(stat -c%s "$wasm")
+              filename=$(basename "$wasm")
+              echo "Optimized WASM size: $filename = $size bytes"
+
+              if [ "$size" -gt "$WASM_SIZE_LIMIT" ]; then
+                echo "Error: $filename exceeds size budget of $WASM_SIZE_LIMIT bytes"
+                exit 1
+              fi
+            fi
+          done
+        shell: bash
+
       - name: Upload optimized WASM artifacts
         uses: actions/upload-artifact@v4
         with:
           name: optimized-wasm
-          path: |
-            contracts/target/**/**/*.optimized.wasm
+          path: contracts/target/wasm32-unknown-unknown/release/*.optimized.wasm
+          if-no-files-found: error

.github/workflows/security.yml

@@ -1,5 +1,9 @@
 name: Security Checks
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [ main, develop ]

.gitignore

@@ -12,4 +12,5 @@ fix.md
 
 # Playwright test execution items
 frontend/playwright-report/
-frontend/test-results/
+frontend/test-results/
+.npm-cache/