AST

.github/SECRETS.md

@@ -0,0 +1,35 @@
+# GitHub Actions — Secrets necesarios
+
+Configurá estos secrets en **Settings → Secrets and variables → Actions** de tu repo.
+
+## Secrets requeridos
+
+| Secret | Descripción | Usado en |
+|--------|-------------|----------|
+| `SEPOLIA_RPC_URL` | URL de Alchemy/Infura para Sepolia | `deploy-sepolia.yml` |
+| `DEPLOYER_PRIVATE_KEY` | Clave privada del wallet deployer (sin `0x`) | `deploy-sepolia.yml` |
+| `ETHERSCAN_API_KEY` | API key de Etherscan para verificar contratos | `deploy-sepolia.yml`, `contracts-ci.yml` |
+| `VITE_WALLETCONNECT_PROJECT_ID` | Project ID de WalletConnect Cloud | `frontend-ci.yml` |
+
+## Secrets opcionales
+
+| Secret | Descripción | Usado en |
+|--------|-------------|----------|
+| `VITE_SEPOLIA_RPC_URL` | RPC para el frontend (puede ser público) | `frontend-ci.yml` |
+| `POLYGONSCAN_API_KEY` | API key de Polygonscan | futuro |
+
+## Cómo obtenerlos
+
+- **SEPOLIA_RPC_URL**: [Alchemy](https://alchemy.com) → Create App → Ethereum Sepolia → `https://eth-sepolia.g.alchemy.com/v2/TU_KEY`
+- **DEPLOYER_PRIVATE_KEY**: MetaMask → Account details → Export private key (usá una wallet dedicada solo a deploy, nunca tu wallet principal)
+- **ETHERSCAN_API_KEY**: [etherscan.io/myapikey](https://etherscan.io/myapikey)
+- **VITE_WALLETCONNECT_PROJECT_ID**: [cloud.walletconnect.com](https://cloud.walletconnect.com)
+
+## Environment "sepolia"
+
+El workflow `deploy-sepolia.yml` usa el environment `sepolia`. Crealo en:
+**Settings → Environments → New environment → `sepolia`**
+
+Podés configurar "Required reviewers" para que el deploy requiera aprobación manual tuya antes de ejecutarse.
+
+> ⚠️ NUNCA commitees tu `PRIVATE_KEY` directamente en ningún archivo del repo.

.github/workflows/contracts-ci.yml

@@ -0,0 +1,127 @@
+name: Contracts CI
+
+on:
+  push:
+    branches: [master, main, develop]
+    paths:
+      - 'contracts/**'
+      - 'test/**'
+      - 'scripts/**'
+      - 'hardhat.config.js'
+      - 'package.json'
+  pull_request:
+    branches: [master, main, develop]
+    paths:
+      - 'contracts/**'
+      - 'test/**'
+      - 'scripts/**'
+      - 'hardhat.config.js'
+      - 'package.json'
+
+jobs:
+  # ─────────────────────────────────────────────
+  # 1. Compile + Test (Hardhat local network)
+  # ─────────────────────────────────────────────
+  test:
+    name: Compile & Test Contracts
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Compile contracts
+        run: npm run compile
+
+      - name: Run tests
+        run: npm test
+        env:
+          # No RPC key needed — runs on Hardhat local node
+          REPORT_GAS: true
+
+      - name: Upload artifacts (ABIs)
+        uses: actions/upload-artifact@v4
+        if: success()
+        with:
+          name: contract-artifacts
+          path: artifacts/
+          retention-days: 7
+
+  # ─────────────────────────────────────────────
+  # 2. Coverage report
+  # ─────────────────────────────────────────────
+  coverage:
+    name: Solidity Coverage
+    runs-on: ubuntu-latest
+    needs: test
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run coverage
+        run: npm run coverage
+
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage/
+          retention-days: 14
+
+  # ─────────────────────────────────────────────
+  # 3. Static analysis with Slither (security)
+  # ─────────────────────────────────────────────
+  slither:
+    name: Slither Static Analysis
+    runs-on: ubuntu-latest
+    needs: test
+    continue-on-error: true   # No bloquea el merge mientras ajustamos findings
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Compile contracts (needed for Slither)
+        run: npm run compile
+
+      - name: Run Slither
+        uses: crytic/slither-action@v0.4.0
+        with:
+          target: 'contracts/'
+          slither-args: '--exclude-dependencies'
+          sarif: results.sarif
+          fail-on: high
+
+      - name: Upload SARIF to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: results.sarif

.github/workflows/deploy-sepolia.yml

@@ -0,0 +1,86 @@
+name: Deploy to Sepolia
+
+# Solo se dispara de forma MANUAL desde la pestaña Actions
+# (workflow_dispatch) o cuando pusheás un tag con formato v*.*.*
+on:
+  workflow_dispatch:
+    inputs:
+      contract:
+        description: 'Contrato a deployar'
+        required: true
+        default: 'all'
+        type: choice
+        options:
+          - all
+          - AdvancedToken
+          - NFTCollection
+          - NFTMarketplace
+          - MinerToken
+          - CSUITEFaucet
+          - GasAccumulator
+      dry_run:
+        description: 'Dry run (solo simula, no deploya)'
+        required: false
+        default: false
+        type: boolean
+
+  push:
+    tags:
+      - 'v*.*.*'   # Ej: v1.0.0 → deploy automático a Sepolia
+
+jobs:
+  deploy:
+    name: Deploy Contracts → Sepolia
+    runs-on: ubuntu-latest
+    environment: sepolia   # Requiere aprobación manual si configurás "Required reviewers"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Compile contracts
+        run: npm run compile
+
+      - name: Run tests before deploy
+        run: npm test
+
+      - name: Deploy to Sepolia
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        run: npm run deploy:sepolia
+        env:
+          SEPOLIA_RPC_URL: ${{ secrets.SEPOLIA_RPC_URL }}
+          PRIVATE_KEY: ${{ secrets.DEPLOYER_PRIVATE_KEY }}
+          ETHERSCAN_API_KEY: ${{ secrets.ETHERSCAN_API_KEY }}
+
+      - name: Dry run info
+        if: ${{ github.event.inputs.dry_run == 'true' }}
+        run: echo "DRY RUN — Deploy simulado correctamente. No se ejecutó ninguna tx."
+
+      - name: Verify contracts on Etherscan
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        run: |
+          echo "Verificando contratos en Etherscan..."
+          # Descomentar cuando tengas las addresses desplegadas:
+          # npx hardhat verify --network sepolia $CONTRACT_ADDRESS
+        env:
+          ETHERSCAN_API_KEY: ${{ secrets.ETHERSCAN_API_KEY }}
+        continue-on-error: true
+
+      - name: Upload deployment artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: deployment-${{ github.sha }}
+          path: |
+            artifacts/
+            deployments/
+          retention-days: 30

.github/workflows/frontend-ci.yml

@@ -0,0 +1,81 @@
+name: Frontend CI
+
+on:
+  push:
+    branches: [master, main, develop]
+    paths:
+      - 'frontend/**'
+  pull_request:
+    branches: [master, main, develop]
+    paths:
+      - 'frontend/**'
+
+jobs:
+  # ─────────────────────────────────────────────
+  # 1. Build check
+  # ─────────────────────────────────────────────
+  build:
+    name: Vite Build
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: frontend
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: frontend/package.json
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build
+        run: npm run build
+        env:
+          # Variables de entorno mínimas para que Vite compile sin errores
+          VITE_WALLETCONNECT_PROJECT_ID: ${{ secrets.VITE_WALLETCONNECT_PROJECT_ID }}
+          VITE_SEPOLIA_RPC_URL: ${{ secrets.VITE_SEPOLIA_RPC_URL || 'https://rpc.sepolia.org' }}
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: frontend-dist
+          path: frontend/dist/
+          retention-days: 7
+
+  # ─────────────────────────────────────────────
+  # 2. Lint (ESLint) — corre en paralelo con build
+  # ─────────────────────────────────────────────
+  lint:
+    name: ESLint
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: frontend
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: frontend/package.json
+
+      - name: Install dependencies
+        run: npm install
+
+      # Si aún no tenés ESLint config, este step falla silenciosamente
+      - name: Run ESLint
+        run: npx eslint src/ --ext .js,.jsx --max-warnings 0 || echo "::warning::ESLint no configurado — agregá .eslintrc.json"
+        continue-on-error: true