fix: commit Cargo.lock for reproducible builds and add zero/negative amount guard to pool deposit (#384 #806)

.github/workflows/ci.yml

@@ -33,15 +33,15 @@ jobs:
       # files, so these must exist before ANY `cargo test` invocation that
       # touches the full workspace — including the unqualified one below.
       - name: Build contracts for integration tests
-        run: cargo build --target wasm32v1-none --release -p invoice -p pool -p credit_score -p share -p oracle_registry
-      - run: cargo test
+        run: cargo build --locked --target wasm32v1-none --release -p invoice -p pool -p credit_score -p share -p oracle_registry
+      - run: cargo test --locked
         timeout-minutes: 10
       - name: Run fuzz tests (short)
         timeout-minutes: 10
-        run: cargo test -p invoice --test fuzz_tests -p pool --test fuzz_tests -p credit_score --test fuzz_tests -p share --test fuzz_tests -p oracle_registry --test fuzz_tests
+        run: cargo test --locked -p invoice --test fuzz_tests -p pool --test fuzz_tests -p credit_score --test fuzz_tests -p share --test fuzz_tests -p oracle_registry --test fuzz_tests
       - name: Run integration tests
         timeout-minutes: 15
-        run: cargo test -p integration-tests --test integration_tests
+        run: cargo test --locked -p integration-tests --test integration_tests
       # #781: code coverage for the Soroban contracts. Runs after the tests
       # above (not instead of them) since cargo-llvm-cov's own instrumented
       # `cargo test` still needs the prebuilt wasm32v1-none release
@@ -62,7 +62,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y binaryen
       - name: Check WASM size
         run: |
-          cargo build --target wasm32-unknown-unknown --release
+          cargo build --locked --target wasm32-unknown-unknown --release
           for wasm in target/wasm32-unknown-unknown/release/*.wasm; do
             SIZE=$(wc -c < "$wasm" | tr -d ' ')
             if [ "$SIZE" -gt 204800 ]; then
@@ -93,7 +93,7 @@ jobs:
       # as a production failure. `--noplot` skips gnuplot/plotters output,
       # which isn't needed (or reliably available) on the CI runner.
       - name: Run contract benchmarks
-        run: cargo bench -p benchmarks -- --noplot
+        run: cargo bench --locked -p benchmarks -- --noplot
       - name: Upload benchmark results
         if: always()
         uses: actions/upload-artifact@v4
@@ -131,11 +131,11 @@ jobs:
           workspaces: .
 
       - name: Build contracts
-        run: cargo build --target wasm32v1-none --release -p invoice -p pool -p credit_score -p share -p oracle_registry
+        run: cargo build --locked --target wasm32v1-none --release -p invoice -p pool -p credit_score -p share -p oracle_registry
 
       - name: Run cross-contract integration tests
         working-directory: .
-        run: cargo test --manifest-path contracts/tests/Cargo.toml
+        run: cargo test --locked --manifest-path contracts/tests/Cargo.toml
 
       # #781: frontend Jest coverage, uploaded to Codecov under its own flag
       # so contract and frontend coverage are tracked (and can regress)
@@ -267,7 +267,7 @@ jobs:
       - name: Build contracts
         if: env.HAS_DEPLOY_SECRET == 'true'
         run: |
-          cargo build --target wasm32-unknown-unknown --release -p invoice -p pool -p credit_score -p share
+          cargo build --locked --target wasm32-unknown-unknown --release -p invoice -p pool -p credit_score -p share
       - name: Deploy invoice contract to testnet
         id: deploy-invoice
         if: env.HAS_DEPLOY_SECRET == 'true'

.github/workflows/testnet-deploy.yml

@@ -22,7 +22,7 @@ jobs:
         run: cargo install --locked stellar-cli@22.6.0
 
       - name: Build contracts
-        run: cargo build --target wasm32-unknown-unknown --release -p invoice -p pool -p credit_score -p share -p governance
+        run: cargo build --locked --target wasm32-unknown-unknown --release -p invoice -p pool -p credit_score -p share -p governance
 
       - name: Deploy contracts to testnet
         run: |

.gitignore

@@ -2,7 +2,6 @@
 target/
 target*/
 **/*.rs.bk
-!Cargo.lock
 
 # Node
 node_modules/

CONTRIBUTING.md

@@ -72,6 +72,11 @@ git remote add upstream https://github.com/astera-hq/Astera.git
 git checkout -b feat/your-feature-name
 ```
 
+> **Cargo.lock**: The workspace `Cargo.lock` is committed to the repository for
+> reproducible builds and security audits. If you update any contract dependency
+> (via `cargo add`, `cargo update`, or editing `Cargo.toml`), commit the resulting
+> `Cargo.lock` changes alongside your code changes.
+
 ### Step 4: Set up your environment
 
 Follow the **Development Environment Setup** section below to install Rust,