ci: Add SonarCloud code quality analysis

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,12 @@
+## Description
+<!-- What does this PR do? Why? -->
+
+## Changes
+<!-- List key changes -->
+
+## Checklist
+- [ ] Builds cleanly (`make build` or `cmake --build`)
+- [ ] Tests pass (`make test` or `ctest -V`)
+- [ ] README updated if new features, CLI commands, or behaviour changed
+- [ ] New public methods have doc comments
+- [ ] Branch is off `main` (not another feature branch)

.github/workflows/ci.yml

@@ -5,15 +5,165 @@ on:
   push:
     branches: [main]
 
+env:
+  CARGO_TERM_COLOR: always
+
 jobs:
-  test:
-    name: Tests
+  sonarcloud:
+    name: SonarCloud Scan
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Shallow clones are fine for SonarCloud
+      - uses: SonarSource/sonarcloud-github-action@master
+        with:
+          organization: logos-co
+          projectKey: logos-co_spel
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+  unit-tests:
+    name: Unit Tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - name: Build (core + macros)
-        run: cargo build -p nssa-framework -p nssa-framework-core -p nssa-framework-macros
-      - name: Test (core + macros)
-        run: cargo test -p nssa-framework -p nssa-framework-core -p nssa-framework-macros
+        with:
+          prefix-key: "unit"
+      - name: Build (framework + codegen)
+        run: cargo build -p spel-framework -p spel-framework-core -p spel-framework-macros -p spel-client-gen
+      - name: Unit tests
+        run: cargo test -p spel-framework-core -p spel-framework-macros -p spel-client-gen
+
+  e2e-tests:
+    name: E2E Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          prefix-key: "e2e"
+      - name: Install logos-blockchain-circuits
+        run: |
+          curl -sSL https://raw.githubusercontent.com/logos-blockchain/logos-blockchain/main/scripts/setup-logos-blockchain-circuits.sh | bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build (all packages including spel)
+        run: cargo build -p spel-framework -p spel-framework-core -p spel-framework-macros -p spel-client-gen -p spel
+      - name: E2E tests
+        run: cargo test -p spel-framework
+
+  privacy-smoke-test:
+    name: Privacy Smoke Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      RISC0_VERSION: "3.0.5"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          prefix-key: "privacy"
+
+      - name: Generate Cargo.lock
+        run: cargo generate-lockfile
+
+      - name: Extract LEZ revision from spel-framework/Cargo.toml
+        id: lez-ref
+        run: |
+          # Support both tag = "..." and rev = "..." formats
+          LEZ_REV=$(grep 'nssa_core' spel-framework/Cargo.toml | grep -oE '(tag|rev) = "[^"]*"' | cut -d'"' -f2)
+          if [ -z "$LEZ_REV" ]; then
+            echo "ERROR: Could not extract LEZ revision from spel-framework/Cargo.toml"
+            exit 1
+          fi
+          echo "LEZ_REV=$LEZ_REV" >> $GITHUB_OUTPUT
+          echo "LEZ_TAG=$LEZ_REV" >> $GITHUB_OUTPUT
+          echo "Using LEZ revision: $LEZ_REV"
+
+      - name: Determine SPEL ref for testing
+        id: spel-ref
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            # For PRs, use the PR head commit
+            SPEL_REF="refs/pull/${{ github.event.pull_request.number }}/head"
+          else
+            # For pushes to main, use the current commit
+            SPEL_REF="${{ github.sha }}"
+          fi
+          echo "SPEL_REF=$SPEL_REF" >> $GITHUB_OUTPUT
+          echo "Using SPEL ref: $SPEL_REF"
+
+      - name: Install risc0 toolchain
+        run: |
+          curl -L https://risc0.com/install | bash
+          echo "$HOME/.risc0/bin" >> $GITHUB_PATH
+          export PATH="$HOME/.risc0/bin:$PATH"
+          rzup install cargo-risczero ${{ env.RISC0_VERSION }}
+          rzup install rust
+
+      - name: Install logos-blockchain-circuits
+        run: |
+          curl -sSL https://raw.githubusercontent.com/logos-blockchain/logos-blockchain/main/scripts/setup-logos-blockchain-circuits.sh | bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install spel
+        run: cargo install --path spel-cli --locked
+
+      - name: Clone LEZ at correct revision
+        run: |
+          rm -rf /tmp/lssa
+          git clone https://github.com/logos-blockchain/logos-execution-zone.git /tmp/lssa
+          cd /tmp/lssa
+          # Fetch the specific tag/revision
+          git fetch --depth 1 origin ${{ steps.lez-ref.outputs.LEZ_REV }}
+          git checkout ${{ steps.lez-ref.outputs.LEZ_REV }}
+
+      - name: Cache sequencer binary
+        id: cache-sequencer
+        uses: actions/cache/restore@v4
+        with:
+          path: /tmp/lssa/target/release/sequencer_service
+          key: sequencer-${{ steps.lez-ref.outputs.LEZ_REV }}
+          restore-keys: |
+            sequencer-
+          fail-on-cache-miss: false
+
+      - name: Build sequencer
+        if: steps.cache-sequencer.outputs.cache-hit != 'true'
+        run: |
+          cd /tmp/lssa
+          cargo build --release --features standalone -p sequencer_service
+
+      - name: Save sequencer cache
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: /tmp/lssa/target/release/sequencer_service
+          key: sequencer-${{ steps.lez-ref.outputs.LEZ_REV }}
+
+      - name: Build wallet
+        run: |
+          cd /tmp/lssa
+          cargo build --release -p wallet
+
+      - name: Setup wallet
+        run: |
+          mkdir -p /tmp/wallet
+          echo '{"sequencer_addr":"http://127.0.0.1:3040","seq_poll_timeout":"30s","seq_tx_poll_max_blocks":15,"seq_poll_max_retries":10,"seq_block_poll_max_amount":100,"initial_accounts":[{"Public":{"account_id":"CbgR6tj5kWx5oziiFptM7jMvrQeYY3Mzaao6ciuhSr2r","pub_sign_key":"7f273098f25b71e6c005a9519f2678da8d1c7f01f6a27778e2d9948abdf901fb"}},{"Public":{"account_id":"2RHZhw9h534Zr3eq2RGhQete2Hh667foECzXPmSkGni2","pub_sign_key":"f434f8741720014586ae43356d2aec6257da086222f604ddb75d69733b86fc4c"}}]}' > /tmp/wallet/wallet_config.json
+
+      - name: Run privacy smoke test
+        env:
+          NSSA_WALLET_HOME_DIR: /tmp/wallet
+          LSSA_DIR: /tmp/lssa
+          LEZ_TAG: ${{ steps.lez-ref.outputs.LEZ_TAG }}
+          SPEL_TAG: ${{ steps.spel-ref.outputs.SPEL_REF }}
+        run: |
+          export PATH="/tmp/lssa/target/release:$PATH"
+          scripts/smoke-test-privacy.sh /tmp/privacy-smoke