Feat/production deployment workflow

.cargo/audit.toml

@@ -0,0 +1,15 @@
+# cargo-audit configuration
+# Ignore transitive advisories from Soroban/Stellar ecosystem crates
+# that cannot be resolved without upstream fixes.
+# These are all INFO-level "unmaintained" notices, not exploitable vulnerabilities.
+
+[advisories]
+ignore = [
+    # derivative 2.2.0 — unmaintained, used transitively by soroban-sdk
+    "RUSTSEC-2024-0388",
+    # paste 1.0.x — unmaintained, used transitively by soroban-sdk
+    "RUSTSEC-2024-0436",
+    # rand 0.8/0.9 — unsoundness with custom logger, used transitively by soroban-sdk
+    # Not exploitable in contract context (no custom global logger)
+    "RUSTSEC-2026-0097",
+]

.env.example

@@ -1,49 +1,28 @@
 # LearnVault environment template for local development. Copy this file to `.env`.
 
-# Optional: comma-separated admin email recipients for server notifications (flags, etc.)
-ADMIN_EMAILS=admin@example.com
-
 # Scaffold / local tooling
-# Environment profile for Stellar scaffold scripts and CLI (`development`, `testing`, `staging`, `production`).
 STELLAR_SCAFFOLD_ENV=development
-# Stellar CLI config directory. See https://developers.stellar.org/docs/tools/cli/stellar-cli#stellar-config-dir
 XDG_CONFIG_HOME=.config
 
-# --- Stellar network (frontend) ---
-# Prefix with PUBLIC_ so Vite exposes these to the browser.
-# More on networks: https://developers.stellar.org/docs/networks
-
-# Default: local scaffold (Horizon + Soroban on localhost)
-PUBLIC_STELLAR_NETWORK=LOCAL
-PUBLIC_STELLAR_NETWORK_PASSPHRASE="Standalone Network ; February 2017"
-PUBLIC_STELLAR_RPC_URL=http://localhost:8000/rpc
-PUBLIC_STELLAR_HORIZON_URL=http://localhost:8000
-
-# Uncomment for Testnet instead:
-# PUBLIC_STELLAR_NETWORK=TESTNET
-# PUBLIC_STELLAR_NETWORK_PASSPHRASE="Test SDF Network ; September 2015"
-# PUBLIC_STELLAR_RPC_URL=https://soroban-testnet.stellar.org
-# PUBLIC_STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
-
-# Uncomment for Mainnet:
-# PUBLIC_STELLAR_NETWORK=MAINNET
-# PUBLIC_STELLAR_NETWORK_PASSPHRASE="Public Global Stellar Network ; September 2015"
-# PUBLIC_STELLAR_RPC_URL=
-# PUBLIC_STELLAR_HORIZON_URL=
+# Stellar network
+PUBLIC_STELLAR_NETWORK=TESTNET
+PUBLIC_STELLAR_NETWORK_PASSPHRASE="Test SDF Network ; September 2015"
+PUBLIC_STELLAR_RPC_URL=https://soroban-testnet.stellar.org
+PUBLIC_STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
 
-# --- LearnVault contract IDs (populate after deploy; Vite `VITE_*` vars) ---
+# LearnVault contract IDs
 VITE_LEARN_TOKEN_CONTRACT_ID=
 VITE_GOVERNANCE_TOKEN_CONTRACT_ID=
+VITE_SCHOLAR_NFT_CONTRACT_ID=
 VITE_COURSE_MILESTONE_CONTRACT_ID=
-VITE_MILESTONE_ESCROW_CONTRACT_ID=
 VITE_SCHOLARSHIP_TREASURY_CONTRACT_ID=
-VITE_SCHOLAR_NFT_CONTRACT_ID=
+VITE_MILESTONE_ESCROW_CONTRACT_ID=
 
-# USDC on Stellar — the app reads either name (see `src/util/usdc.ts`).
-PUBLIC_USDC_CONTRACT_ID=
+# USDC on Stellar Testnet
 VITE_USDC_CONTRACT_ID=
+PUBLIC_USDC_CONTRACT_ID=
 
-# Legacy `PUBLIC_*` aliases still read by older screens/hooks (optional).
+# Legacy frontend aliases still read by older screens/hooks
 PUBLIC_LEARN_TOKEN_CONTRACT=
 PUBLIC_GOVERNANCE_TOKEN_CONTRACT=
 PUBLIC_SCHOLAR_NFT_CONTRACT=
@@ -52,20 +31,10 @@ PUBLIC_SCHOLARSHIP_TREASURY_CONTRACT=
 PUBLIC_MILESTONE_ESCROW_CONTRACT=
 PUBLIC_SCHOLARSHIP_GOVERNANCE_CONTRACT=
 
-# --- Backend / API (frontend → server) ---
-# Backend runs on port 4000 by default (`npm run dev:server` / CONTRIBUTING.md).
-VITE_SERVER_URL=http://localhost:4000
-# Optional override when the API is on a different origin; leave empty to derive from `VITE_SERVER_URL`.
-VITE_API_URL=
-# Relative API prefix used by some upload and scholar flows.
+# Backend API
+VITE_API_URL=http://localhost:4000
 VITE_API_BASE_URL=/api
+VITE_SERVER_URL=http://localhost:4000
 
-# --- Email (optional for local) ---
-RESEND_API_KEY=
-EMAIL_FROM=notifications@learnvault.xyz
-FRONTEND_URL=http://localhost:3000
-
-# --- IPFS / Pinata (optional for uploads) ---
-PINATA_API_KEY=
-PINATA_SECRET=
+# IPFS gateway (optional)
 VITE_IPFS_GATEWAY_URL=https://gateway.pinata.cloud/ipfs

.github/dependabot.yml

@@ -1,14 +1,18 @@
-version: 2
+version: 2
 updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      npm-minor:
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # Dependabot will ignore these dependencies since they're generated by scaffold and aren't checked into the repo
+      - dependency-name: "packages/guess_the_number"
+      - dependency-name: "packages/fungible_allowlist_example"
+      - dependency-name: "packages/nft_enumberable_example"

.github/workflows/backend-tests.yml

@@ -48,13 +48,6 @@ jobs:
         working-directory: server
         run: npm run migrate
 
-      - name: Clean build cache
-        working-directory: server
-        run: |
-          rm -rf node_modules/.cache
-          rm -rf dist
-          npm run build --if-present || true
-
       - name: Run tests
         working-directory: server
         run: npm test

.github/workflows/build.yml

@@ -46,7 +46,6 @@ jobs:
         with:
           node-version: 22
       - run: npm ci --legacy-peer-deps
-      - run: npm run lint
       - run: npx prettier . --check
       - name: Database Migration Safety Check
         run: |

.github/workflows/bundle-size.yml

@@ -0,0 +1,33 @@
+name: Bundle Size Analysis
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  size-limit:
+    name: Check Bundle Size
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Run size-limit analysis
+        uses: andresz1/size-limit-action@v1.8.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          skip_step: install
+          build_step: build