feat: selfrica circuit and tests

.cursorignore

@@ -199,9 +199,6 @@ app/ios/App Thinning Size Report.txt
 local.properties
 app/android/android-passport-nfc-reader/examples/
 
-# React Native config
-app/react-native.config.cjs
-
 # ========================================
 # Miscellaneous
 # ========================================

.eslintignore

@@ -0,0 +1,15 @@
+node_modules
+dist
+build
+coverage
+ios/build
+android/build
+android/app/build
+app/vendor
+circuits/build
+contracts/artifacts
+contracts/cache
+contracts/typechain-types
+**/*.js
+**/*.cjs
+**/*.mjs

.gitguardian.yml

@@ -36,9 +36,57 @@ paths-ignore:
   - "**/generated/**/*.crt"
   - "**/generated/**/*.pem"
 
+  # iOS frameworks and build artifacts
+  - "**/*.xcframework"
+  - "**/*.xcframework/**"
+  - "**/*.swiftinterface"
+  - "**/NFCPassportReader.xcframework/**"
+  - "**/OpenSSL.xcframework/**"
+  - "**/SelfSDK.xcframework/**"
+  - "**/packages/mobile-sdk-alpha/ios/Frameworks/**"
+  - "**/packages/mobile-sdk-alpha/ios/SelfSDK/**"
 # Ignore specific secret types for mock files
 secrets-ignore:
   - "Generic Private Key" # For mock certificate keys
   - "Generic Certificate" # For mock certificates
   - "RSA Private Key" # For mock RSA keys
   - "EC Private Key" # For mock EC keys
+
+
+secret:
+  ignored_matches:
+  - match: 2036b4e50ad3042969b290e354d9864465107a14de6f5a36d49f81ea8290def8
+    name: prebuilt-ios-arm64-apple-ios.private.swiftinterface
+  ignored_paths:
+  - '**/*.swiftinterface'
+  - '**/*.xcframework/**'
+  - '**/packages/mobile-sdk-alpha/ios/Frameworks/**'
+  - '**/OpenSSL.xcframework/**'
+  - '**/demo-app/**/mock/**'
+  - common/src/mock_certificates/aadhaar/mockAadhaarCert.ts
+  - '**/NFCPassportReader.xcframework/**'
+  - common/src/utils/passports/genMockIdDoc.ts
+  - '**/tests/**/*.crt'
+  - '**/mock_certificates/**/*.crt'
+  - '**/mock_certificates/**/*.key'
+  - '**/demo-app/**/test-data/**'
+  - '**/generated/**/*.key'
+  - '**/SelfSDK.xcframework/**'
+  - '**/mock/**/*.crt'
+  - '**/generated/**/*.crt'
+  - '**/test/**/*.key'
+  - '**/mock/**/*.key'
+  - '**/test/**/*.crt'
+  - '**/test/**/*.pem'
+  - '**/constants/mockCertificates.ts'
+  - '**/mock/**/*.pem'
+  - '**/mock_certificates/**/*.pem'
+  - '**/mock-data/**'
+  - '**/packages/mobile-sdk-alpha/ios/SelfSDK/**'
+  - '**/tests/**/*.key'
+  - '**/generated/**/*.pem'
+  - '**/tests/**/*.pem'
+  - '**/test-data/**'
+  - common/src/mock_certificates/**
+  - '**/*.xcframework'
+version: 2

.github/actions/cache-gradle/action.yml

@@ -7,7 +7,9 @@ inputs:
     description: Paths to cache
     required: false
     default: |
-      ~/.gradle/caches
+      ~/.gradle/caches/modules-*
+      ~/.gradle/caches/jars-*
+      ~/.gradle/caches/build-cache-*
       ~/.gradle/wrapper
   cache-version:
     description: Additional cache version segment

.github/actions/cleanup-gradle-artifacts/action.yml

@@ -0,0 +1,23 @@
+name: Clean Up Gradle Artifacts
+
+description: Clean up unnecessary Gradle build artifacts to save disk space and reduce cache size.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Clean up Gradle build artifacts
+      shell: bash
+      run: |
+        echo "Cleaning up unnecessary build artifacts to save disk space..."
+        # Remove build outputs (APK/AAB already tested, no need to cache them)
+        # Find all Android build directories and clean up intermediates and tmp
+        find . -type d -path "*/android/app/build/intermediates" -exec rm -rf {} + 2>/dev/null || true
+        find . -type d -path "*/android/app/build/tmp" -exec rm -rf {} + 2>/dev/null || true
+        # Clean up Gradle daemon logs and lock files
+        rm -rf ~/.gradle/daemon
+        rm -rf ~/.gradle/*.lock
+        # Remove large cache files that aren't needed for subsequent builds
+        find ~/.gradle/caches -name "*.lock" -delete 2>/dev/null || true
+        find ~/.gradle/caches -type f -name "gc.properties" -delete 2>/dev/null || true
+        echo "Disk usage after cleanup:"
+        df -h

.github/actions/create-version-bump-pr/action.yml

@@ -0,0 +1,62 @@
+name: Create Version Bump PR
+description: Creates a PR from staging changes onto dev branch
+inputs:
+  platform:
+    description: Platform name (ios or android)
+    required: true
+  version:
+    description: Current version string
+    required: true
+  file_paths:
+    description: File paths to include in the PR (newline separated)
+    required: true
+  github_token:
+    description: GitHub token for creating PR
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Create version bump PR
+      shell: bash
+      run: |
+        BRANCH_NAME="ci/bump-${{ inputs.platform }}-build-${{ github.run_id }}"
+
+        git config user.name "github-actions[bot]"
+        git config user.email "github-actions[bot]@users.noreply.github.com"
+
+        # Ensure we're on staging branch, not detached HEAD
+        git fetch origin staging dev
+        git checkout staging
+
+        # Check if staging has commits not in dev (version bumps + any build changes)
+        COMMITS_AHEAD=$(git rev-list --count origin/dev..staging)
+
+        if [ "$COMMITS_AHEAD" -eq 0 ]; then
+          echo "ℹ️  No new commits on staging compared to dev. Skipping PR creation."
+          exit 0
+        fi
+
+        echo "📊 Staging is $COMMITS_AHEAD commit(s) ahead of dev"
+
+        # Create new branch from current staging (which has all version changes)
+        git checkout -b ${BRANCH_NAME}
+
+        # Push the branch
+        git push --set-upstream origin ${BRANCH_NAME}
+
+        # Determine PR title based on platform
+        if [ "${{ inputs.platform }}" = "mobile" ]; then
+          PR_TITLE="chore: bump mobile app version to ${{ inputs.version }}"
+        else
+          PR_TITLE="chore: bump ${{ inputs.platform }} build for ${{ inputs.version }}"
+        fi
+
+        gh pr create \
+          --base dev \
+          --head ${BRANCH_NAME} \
+          --title "$PR_TITLE" \
+          --body "Automated version bump by CI" \
+          --label "automated"
+      env:
+        GH_TOKEN: ${{ inputs.github_token }}

.github/actions/free-disk-space/action.yml

@@ -0,0 +1,26 @@
+name: Free Disk Space
+
+description: Free up disk space on GitHub Actions runners by removing unnecessary pre-installed tools.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Free up disk space
+      shell: bash
+      run: |
+        echo "Disk usage before cleanup:"
+        df -h
+        # Remove unnecessary pre-installed tools to free up space
+        # These are commonly available on GitHub runners but not needed for most builds
+        # DO NOT remove $AGENT_TOOLSDIRECTORY as it contains active tools like Node.js
+        sudo rm -rf /usr/share/dotnet
+        sudo rm -rf /opt/ghc
+        sudo rm -rf /usr/local/share/boost
+        # Remove unused languages from hostedtoolcache to save space
+        # but preserve the directory structure and Node.js
+        sudo rm -rf /opt/hostedtoolcache/CodeQL 2>/dev/null || true
+        sudo rm -rf /opt/hostedtoolcache/PyPy 2>/dev/null || true
+        sudo rm -rf /opt/hostedtoolcache/go 2>/dev/null || true
+        sudo rm -rf /opt/hostedtoolcache/Ruby 2>/dev/null || true
+        echo "Disk usage after cleanup:"
+        df -h

.github/actions/get-version/action.yml

@@ -7,11 +7,18 @@ inputs:
     description: "Path to the app directory"
     required: true
 
+outputs:
+  version:
+    description: "Extracted app version from package.json"
+    value: ${{ steps.get-version.outputs.version }}
+
 runs:
   using: "composite"
   steps:
     - name: Get version from package.json
+      id: get-version
       shell: bash
       run: |
         VERSION=$(node -p "require('${{ inputs.app_path }}/package.json').version")
+        echo "version=$VERSION" >> $GITHUB_OUTPUT
         echo "VERSION=$VERSION" >> $GITHUB_ENV

.github/workflows/block-non-dev-to-main.yml

@@ -1,4 +1,4 @@
-name: Block non-dev PRs to main
+name: Block non-staging PRs to main
 
 on:
   pull_request:
@@ -8,9 +8,9 @@ jobs:
   check-source:
     runs-on: ubuntu-latest
     steps:
-      - name: Block PRs not from dev
+      - name: Block PRs not from staging
         run: |
-          if [[ "${{ github.head_ref }}" != "dev" ]]; then
-            echo "You can only merge from dev to main."
+          if [[ "${{ github.head_ref }}" != "staging" ]]; then
+            echo "You can only merge from staging to main."
             exit 1
           fi

.github/workflows/circuits-build.yml

@@ -9,6 +9,22 @@ on:
       - "circuits/circuits/**"
       - ".github/workflows/artifacts.yml"
   workflow_dispatch:
+    inputs:
+      circuit-type:
+        description: "Circuits to build (comma-separated: register, register_id, register_aadhaar, disclose, dsc). Leave empty to build all."
+        required: false
+        type: string
+        default: ""
+      circuit-name:
+        description: "Circuit names to build (comma-separated: register_sha256_sha224_sha224_ecdsa_secp224r1, dsc_sha256_rsa_65537_4096). Cannot be used with circuit-type."
+        required: false
+        type: string
+        default: ""
+      run-id:
+        description: "Run ID to download artifacts ."
+        required: false
+        type: string
+        default: ""
 
 concurrency:
   group: circuits-build-${{ github.workflow }}-${{ github.ref }}
@@ -19,6 +35,7 @@ jobs:
     runs-on: ["128ram"]
     permissions:
       contents: read
+      actions: read
     env:
       CIRCOM_VERSION: "2.1.9"
       CIRCOM_SHA256: "e5575829252d763b7818049df9de2ef9304df834697de77fa63ce7babc23c967"
@@ -139,14 +156,61 @@ jobs:
       - name: Print Circom version
         run: circom --version
 
+      - name: Download previous artifacts
+        if: github.event_name == 'workflow_dispatch' && inputs.run-id != ''
+        uses: dawidd6/action-download-artifact@v6
+        with:
+          name: circuits
+          path: output/
+          run_id: ${{ inputs.run-id }}
+
       - name: Build cpp circuits
         run: |
-          chmod +x circuits/scripts/build/build_cpp.sh && \
-          ./circuits/scripts/build/build_cpp.sh register &&
-          ./circuits/scripts/build/build_cpp.sh register_id &&
-          ./circuits/scripts/build/build_cpp.sh register_aadhaar &&
-          ./circuits/scripts/build/build_cpp.sh disclose &&
-          ./circuits/scripts/build/build_cpp.sh dsc
+          chmod +x circuits/scripts/build/build_cpp.sh
+          chmod +x circuits/scripts/build/build_single_circuit.sh
+
+          # Validate inputs - only one should be provided
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            if [[ "${{ inputs.circuit-type }}" != "" && "${{ inputs.circuit-name }}" != "" ]]; then
+              echo " Error: Cannot provide both circuit-type and circuit-name. Use only one."
+              exit 1
+            fi
+          fi
+
+          # Check what type of build to perform
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.circuit-name }}" != "" ]]; then
+            # Build circuits by name
+            INPUT_CIRCUITS="${{ inputs.circuit-name }}"
+            INPUT_CIRCUITS=$(echo "$INPUT_CIRCUITS" | tr -d ' ')
+            IFS=',' read -ra CIRCUITS_ARRAY <<< "$INPUT_CIRCUITS"
+
+            echo "Building selected circuits: ${{ inputs.circuit-name }}"
+            for circuit_name in "${CIRCUITS_ARRAY[@]}"; do
+              echo "Building circuit: $circuit_name"
+              ./circuits/scripts/build/build_single_circuit.sh "$circuit_name"
+            done
+
+          elif [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.circuit-type }}" != "" ]]; then
+            # Build circuits by type
+            INPUT_CIRCUITS="${{ inputs.circuit-type }}"
+            INPUT_CIRCUITS=$(echo "$INPUT_CIRCUITS" | tr -d ' ')
+            IFS=',' read -ra CIRCUITS_ARRAY <<< "$INPUT_CIRCUITS"
+
+            echo "Building selected circuits: ${{ inputs.circuit-type }}"
+            for circuit in "${CIRCUITS_ARRAY[@]}"; do
+              echo "Building circuit: $circuit"
+              ./circuits/scripts/build/build_cpp.sh "$circuit"
+            done
+
+          else
+            # Build all circuits (default behavior)
+            echo "Building all circuits (default behavior)"
+            ./circuits/scripts/build/build_cpp.sh register
+            ./circuits/scripts/build/build_cpp.sh register_id
+            ./circuits/scripts/build/build_cpp.sh register_aadhaar
+            ./circuits/scripts/build/build_cpp.sh disclose
+            ./circuits/scripts/build/build_cpp.sh dsc
+          fi
 
       - name: Upload Artifact
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4