ci: add least-privilege permissions and concurrency guards to workflows

.eslintrc.js

@@ -0,0 +1,13 @@
+module.exports = {
+  root: true,
+  extends: ["tariffshield"],
+  parserOptions: {
+    tsconfigRootDir: __dirname,
+    project: [
+      "./apps/api/tsconfig.json",
+      "./apps/web/tsconfig.json",
+      "./packages/sdk/tsconfig.json",
+    ],
+  },
+  ignorePatterns: ["dist/**", "node_modules/**", ".next/**", "playwright-report/**"],
+};

.github/workflows/api-integration.yml

@@ -48,6 +48,12 @@ jobs:
 
       - run: npm ci
 
+      - name: Build SDK
+        # apps/api's src/stellar.ts imports @tariffshield/sdk via its built
+        # dist/index.js (see packages/sdk/package.json "main"/"types"), so
+        # it has to be built before anything imports apps/api's source.
+        run: npm run build --workspace=packages/sdk
+
       - name: Run database migrations
         run: npm run db:migrate --workspace=apps/api
 

.github/workflows/benchmark.yml

@@ -77,6 +77,10 @@ jobs:
 
       - name: Start API in background
         run: |
+          # apps/api imports @tariffshield/sdk via its built dist/index.d.ts
+          # (see packages/sdk/package.json "types"), so it has to be built
+          # before apps/api's own build.
+          npm run build --workspace=packages/sdk
           npm run build --workspace=apps/api
           nohup npm run start --workspace=apps/api > api.log 2>&1 &
           echo "waiting for API to become healthy..."

.github/workflows/contract.yml

@@ -6,6 +6,10 @@ on:
   push:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   # Fails the build if the release .wasm exceeds this size. Override per-run
   # via workflow_dispatch inputs or by editing this value.

.github/workflows/dast.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -29,13 +32,18 @@ jobs:
 
       - name: Start Staging Environment
         run: |
+          # docker-compose.yml declares env_file: apps/api/.env for the api
+          # service; compose resolves every service's config (not just the
+          # one being targeted) before starting anything, so this has to
+          # exist before the first `docker compose up`, not just before the
+          # one that starts api.
+          cp .env.example .env
+          cp .env apps/api/.env
+
           docker compose up -d postgres
           # Wait for Postgres to be healthy
           docker compose exec -T postgres sh -c "until pg_isready -U tariffshield -d tariffshield; do sleep 1; done"
-
-          # Setup environment and start api
-          cp .env.example .env
-          cp .env apps/api/.env
+
           docker compose up -d api
 
           # Wait for API to be ready (bounded: max 60 attempts, 2s apart = 120s)

.github/workflows/dependency_scan.yml

@@ -30,4 +30,11 @@ jobs:
       - name: Cargo Audit
         run: |
           cargo install cargo-audit
-          cd contracts/tariff-shield && cargo audit -D warnings
+          # Run from the workspace root, where Cargo.lock lives (contracts/tariff-shield
+          # is a workspace member, not its own root) — cargo-audit does not walk up to
+          # find it like `cargo build`/`cargo test` do.
+          # RUSTSEC-2024-0388 (derivative) and RUSTSEC-2024-0436 (paste) are unmaintained
+          # advisories transitively pulled in by soroban-env-host's ark-* crypto stack
+          # with "No safe upgrade available" upstream; see deny.toml for the same
+          # documented exception.
+          cargo audit -D warnings --ignore RUSTSEC-2024-0388 --ignore RUSTSEC-2024-0436

.github/workflows/deploy-api.yml

@@ -55,7 +55,7 @@ jobs:
 
       - name: Notify Slack on success
         if: success()
-        uses: slackapi/slack-github-action@v1.24.0
+        uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0
         with:
           webhook: ${{ secrets.SLACK_DEPLOY_WEBHOOK_URL }}
           webhook-type: incoming-webhook
@@ -64,7 +64,7 @@ jobs:
 
       - name: Notify Slack on failure
         if: failure()
-        uses: slackapi/slack-github-action@v1.24.0
+        uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0
         with:
           webhook: ${{ secrets.SLACK_DEPLOY_WEBHOOK_URL }}
           webhook-type: incoming-webhook

.github/workflows/typecheck.yml

@@ -43,6 +43,12 @@ jobs:
       - name: Type check SDK
         run: npx tsc --noEmit -p packages/sdk/tsconfig.json
 
+      - name: Build SDK
+        # apps/api imports @tariffshield/sdk via its built dist/index.d.ts
+        # (see packages/sdk/package.json "types"), not its source directly,
+        # so the API type check below needs it built first.
+        run: npm run build --workspace=packages/sdk
+
       - name: Type check API
         run: npx tsc --noEmit -p apps/api/tsconfig.json
 

.gitignore

@@ -18,7 +18,6 @@ deployments.json
 .vercel
 .vscode
 .idea
-Cargo.lock
 
 # Test snapshots
 __snapshots__/