[Atisan12]

Summary

fix: address #270, #271, #273, #274

What was solved

#270 — SEC-32: Add security contact verification — replace placeholder email

Replace the placeholder security contact email in SECURITY.md with a real monitored address, align the README Security section, and audit docs/ files for placeholder emails. The issue is documentation-only; no code changes are needed.

Addressed:

• Changed: SECURITY.md, README.md
• Update SECURITY.md to replace security@paystream.example with a real, monitored security contact email
• Optionally add a PGP key or Signal number for encrypted reporting in SECURITY.md
• Update the README.md Security section so its contact matches SECURITY.md

#271 — OPS-16: Add mainnet deployment dry-run check to release workflow

Add a mainnet-dry-run job to the release workflow that runs after the release job on tag push, invoking stellar contract deploy --dry-run against the mainnet RPC and failing on non-zero exit; ensure the real mainnet deploy is a separate manual workflow_dispatch, and document mainnet deployment steps in docs/operations-runbook.md.

Addressed:

• Changed: .github/workflows/release.yml, docs/operations-runbook.md
• Add new workflow job mainnet-dry-run that runs after the release job on tag push
• Use stellar contract deploy --dry-run against the mainnet RPC in the dry-run job
• Job must fail if the dry-run returns a non-zero exit code

#273 — OPS-18: Add contract ABI/interface diff check to CI

Add a CI-enforced contract interface diff check for the stream contract: a script that generates a JSON interface spec from the compiled WASM via stellar contract bindings, a committed baseline at contracts/stream/interface.json, a CI workflow step that regenerates and diffs against the baseline with a clear failure diff, and CONTRIBUTING.md documentation for intentionally updating the interface file.

Addressed:

• Changed: .github/workflows/ci.yml, contracts/stream/interface.json, scripts/check-interface.sh
• Create a script that generates a JSON interface spec from the compiled stream contract WASM using stellar contract bindings
• Commit the generated baseline spec at contracts/stream/interface.json
• Add a CI step (in .github/workflows/ci.yml) that regenerates the spec and diffs it against the committed contracts/stream/interface.json

#274 — OPS-19: Add Docker multi-stage build for minimal production image

Add a multi-stage Dockerfile (builder compiles WASM, minimal runtime holds only artifacts), wire docker-compose build service to it, publish the image to GHCR on tag push in CI, and document the Docker workflow in the README.

Addressed:

• Changed: Dockerfile, docker-compose.yml, docker-compose.yml, .github/workflows/release.yml
• Convert Dockerfile to multi-stage: builder stage compiles the WASM contract, runtime stage contains only WASM artifacts
• Ensure final runtime image is under 50 MB
• Update docker-compose.yml build service to use the multi-stage image

Changes

• SECURITY.md (modify)
• .github/workflows/release.yml (modify)
• .github/workflows/ci.yml (modify)
• README.md (modify)
• docs/operations-runbook.md (modify)
• contracts/stream/interface.json (create)
• scripts/check-interface.sh (create)
• docker-compose.yml (modify)
• Dockerfile (modify)

Approach

1. SEC-32: Add security contact verification — replace placeholder email #270 — SEC-32: Add security contact verification — replace placeholder email (Changed: SECURITY.md, README.md)
2. OPS-16: Add mainnet deployment dry-run check to release workflow #271 — OPS-16: Add mainnet deployment dry-run check to release workflow (Changed: .github/workflows/release.yml, docs/operations-runbook.md)
3. OPS-18: Add contract ABI/interface diff check to CI #273 — OPS-18: Add contract ABI/interface diff check to CI (Changed: .github/workflows/ci.yml, contracts/stream/interface.json, scripts/check-interface.sh)
4. OPS-19: Add Docker multi-stage build for minimal production image #274 — OPS-19: Add Docker multi-stage build for minimal production image (Changed: Dockerfile, docker-compose.yml, docker-compose.yml, .github/workflows/release.yml)

Issues

Closes #270
Closes #271
Closes #273
Closes #274

[drips-wave]

@Atisan12 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits