ci: supply chain scanning, Docker builds, and documentation

.github/workflows/api.yml

@@ -27,7 +27,19 @@ jobs:
         run: cargo fmt --check
       - name: Clippy
         run: cargo clippy --all-targets -- -D warnings
+      - name: Audit dependencies
+        run: cargo audit
       - name: Test
         run: cargo test
       - name: Build (release)
         run: cargo build --release
+      - name: Build Docker image
+        run: docker build -t stellar-rwa-api:latest .
+
+  check-status:
+    if: always()
+    needs: build-and-test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Decide status
+        run: exit ${{ job.status == 'success' && 0 || 1 }}

.github/workflows/docs.yml

@@ -24,3 +24,11 @@ jobs:
           cache-dependency-path: docs/package-lock.json
       - run: npm ci
       - run: npm run build
+
+  check-status:
+    if: always()
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Decide status
+        run: exit ${{ job.status == 'success' && 0 || 1 }}

README.md

@@ -103,20 +103,53 @@ Set `NEXT_PUBLIC_API_BASE_URL` to your deployed API URL (defaults to
 
 ## Repository layout
 
+This repository hosts two independently deployable projects:
+
+### `api/` — Rust REST API (maintainer-only)
+
+Read-only indexer for RWA contracts on Stellar. Polls Soroban RPC, maintains an in-memory snapshot, and serves state as JSON.
+
+**Build & test:**
+```bash
+cd api
+cargo fmt --check    # Format check
+cargo clippy         # Linting
+cargo test           # Run tests
+cargo build --release
+docker build -t stellar-rwa-api:latest .  # Build Docker image
+```
+
+**Directory structure:**
+```
+api/src/
+  main.rs            # Server bootstrap
+  routes/            # Request handlers (assets, holders, compliance, dividends, stats)
+  indexer/           # Soroban RPC poller + XDR decoding + in-memory snapshot
+  models/            # Serializable domain models
+api/Dockerfile       # Multi-stage build for production
+```
+
+### `docs/` — Next.js + MDX documentation site (open to contributions)
+
+Public documentation covering contracts, API references, and compliance guides. Deployed to Vercel.
+
+**Build & develop:**
+```bash
+cd docs
+npm install
+npm run dev          # http://localhost:3000
+npm run build        # Production build
+```
+
+**Directory structure:**
 ```
-api/           Rust REST API (maintainer-only)
-  src/
-    main.rs
-    routes/    assets, holders, compliance, dividends, stats
-    indexer/   Soroban RPC poller + XDR decoding + in-memory snapshot
-    models/    serializable domain models
-docs/          Next.js + MDX documentation site
-  app/         landing + docs/** MDX pages
-  components/  Sidebar, DocHeader, CodeBlock, CalloutBox, ApiEndpoint
-CONTRIBUTING.md
-README.md
+docs/app/            # Landing page + docs/** MDX pages (app router)
+docs/components/     # UI components (Sidebar, DocHeader, CodeBlock, etc.)
+docs/package.json    # Next.js + dependencies
 ```
 
+---
+
 ## Contributing
 
 Contributions are welcome **in `docs/` only**. The `api/` directory is

api/Dockerfile

@@ -3,7 +3,7 @@ FROM rust:1.83-slim AS builder
 WORKDIR /app
 
 # Cache dependencies separately from source.
-COPY Cargo.toml ./
+COPY Cargo.toml Cargo.lock* ./
 RUN mkdir src && echo "fn main() {}" > src/main.rs && cargo build --release && rm -rf src
 
 COPY src ./src