feat: CI summary check, path filters, TS backend coverage, SHA pinning

.github/dependabot.yml

@@ -0,0 +1,72 @@
+version: 2
+
+updates:
+  # Keep GitHub Actions SHAs up to date.
+  # Dependabot will open PRs to update pinned commit SHAs whenever a new
+  # version tag is published, preserving the SHA-pinning security posture
+  # while still receiving upstream updates.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"
+      - "ci"
+
+  # Keep npm dependencies up to date for comebackhere-frontend.
+  - package-ecosystem: "npm"
+    directory: "/comebackhere-frontend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"
+
+  # Keep npm dependencies up to date for comebackhere-backend.
+  - package-ecosystem: "npm"
+    directory: "/comebackhere-backend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"
+
+  # Keep npm dependencies up to date for frontend.
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"
+
+  # Keep Cargo dependencies up to date for the contracts tree.
+  - package-ecosystem: "cargo"
+    directory: "/contracts"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"
+
+  # Keep Cargo dependencies up to date for the COMEBACKHERE-contracts tree.
+  - package-ecosystem: "cargo"
+    directory: "/COMEBACKHERE-contracts"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"

.github/workflows/backend-tests.yml

@@ -3,40 +3,44 @@ name: Backend Tests
 on:
   pull_request:
     branches: [main]
+  workflow_call: # called by ci-summary.yml
 
 permissions:
   contents: read
 
 jobs:
+  # ── Rust backend (backend/) ─────────────────────────────────────────────
   unit:
+    name: rust / unit tests (contracts/)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
         with:
           toolchain: stable
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: ~/.cargo/registry
           key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: cargo-registry-
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: contracts/target
           key: cargo-target-${{ hashFiles('**/Cargo.lock') }}-${{ runner.os }}
           restore-keys: cargo-target-
 
-      - name: Run unit tests
+      - name: Run unit tests (Rust backend)
         run: cargo test -p comebackhere-invoice
         working-directory: contracts
 
   integration:
+    name: rust / integration tests (contracts/)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Start Soroban sandbox
         run: docker compose up -d soroban
@@ -50,22 +54,54 @@ jobs:
             sleep 3
           done
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
         with:
           toolchain: stable
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: ~/.cargo/registry
           key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: cargo-registry-
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: contracts/target
           key: cargo-target-${{ hashFiles('**/Cargo.lock') }}-${{ runner.os }}
           restore-keys: cargo-target-
 
-      - name: Run API integration tests
+      - name: Run API integration tests (Rust backend)
         run: cargo test -p api-integration-tests -- --test-threads=1
         working-directory: contracts
+
+  # ── TypeScript backend (comebackhere-backend/) ─────────────────────────
+  # Previously missing: this job covers the Node/TS backend tree that was
+  # not exercised by the original workflow. Fixes #493.
+  ts-backend:
+    name: typescript / unit tests (comebackhere-backend/)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: comebackhere-backend
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 20
+
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: comebackhere-backend/node_modules
+          key: node-modules-ts-backend-${{ runner.os }}-${{ hashFiles('comebackhere-backend/package-lock.json') }}
+          restore-keys: node-modules-ts-backend-
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npx tsc --noEmit
+
+      - name: Run tests
+        run: npm test

.github/workflows/ci-abi-metadata.yml

@@ -5,6 +5,7 @@ on:
     branches: [main]
     paths:
       - 'COMEBACKHERE-contracts/contracts/**'
+  workflow_call: # called by ci-summary.yml
 
 permissions:
   contents: read
@@ -15,17 +16,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: WHEELBACK/COMEBACKHERE-contracts
           ref: main
           path: COMEBACKHERE-contracts
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@9399c7bb15d4c7d47b27263d024f0a4978346ba4 # v1.11.0
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: |
             ~/.cargo/registry
@@ -35,7 +36,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-abi-meta-
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
 

.github/workflows/ci-abi-snapshots.yml

@@ -3,24 +3,25 @@ name: CI - ABI Snapshots
 on:
   pull_request:
     branches: [main]
+  workflow_call: # called by ci-summary.yml
 
 jobs:
   check-abi:
     name: check-abi-snapshots
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: WHEELBACK/COMEBACKHERE-contracts
           ref: main
           path: COMEBACKHERE-contracts
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@9399c7bb15d4c7d47b27263d024f0a4978346ba4 # v1.11.0
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: |
             ~/.cargo/registry
@@ -30,7 +31,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-abi-
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
 

.github/workflows/ci-contracts.yml

@@ -3,6 +3,11 @@ name: CI - Contracts
 on:
   pull_request:
     branches: [main]
+    paths:
+      - 'COMEBACKHERE-contracts/**'
+      - 'contracts/**'
+      - 'abis/**'
+  workflow_call: # called by ci-summary.yml
 
 jobs:
   test:
@@ -13,15 +18,15 @@ jobs:
         working-directory: COMEBACKHERE-contracts
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: WHEELBACK/COMEBACKHERE-contracts
           ref: main
           path: COMEBACKHERE-contracts
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@9399c7bb15d4c7d47b27263d024f0a4978346ba4 # v1.11.0
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: |
             ~/.cargo/registry

.github/workflows/ci-coverage.yml

@@ -3,6 +3,7 @@ name: CI - Contract Coverage
 on:
   pull_request:
     branches: [main]
+  workflow_call: # called by ci-summary.yml
 
 permissions:
   contents: read
@@ -20,20 +21,20 @@ jobs:
         working-directory: COMEBACKHERE-contracts
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: WHEELBACK/COMEBACKHERE-contracts
           ref: main
           path: COMEBACKHERE-contracts
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@9399c7bb15d4c7d47b27263d024f0a4978346ba4 # v1.11.0
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@e03236526ace47fa2e04bebcfc6da471ebd4690c # v2.49.0
         with:
           tool: cargo-llvm-cov
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: |
             ~/.cargo/registry
@@ -68,7 +69,7 @@ jobs:
             'BEGIN { if (p+0 < t+0) { print "FAIL: coverage below threshold"; exit 1 } }'
 
       - name: Upload coverage artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-report
           path: |
@@ -77,7 +78,7 @@ jobs:
 
       - name: Post coverage comment
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const pct = '${{ steps.cov.outputs.pct }}';

.github/workflows/ci-error-docs.yml

@@ -9,6 +9,7 @@ on:
       - 'docs/error-codes.md'
       - 'scripts/check_error_docs_sync.sh'
       - '.github/workflows/ci-error-docs.yml'
+  workflow_call: # called by ci-summary.yml
 
 permissions:
   contents: read
@@ -19,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Verify contract error variants are documented
         run: ./scripts/check_error_docs_sync.sh