Fix OTLP collector wiring, workflow permissions, Node 20 and tool caching (#1785-#1788)

.github/workflows/accessibility.yml

@@ -10,8 +10,11 @@ on:
     paths:
       - 'frontend/**'
 
+permissions:
+  contents: read
+
 env:
-  NODE_VERSION: '18.x'
+  NODE_VERSION: '20.x'
   # Lighthouse accessibility threshold (issue #1610).
   # Rationale: a zero-tolerance 100/100 gate on a synthetic Lighthouse run made
   # the all-tests-passed gate brittle — a single non-actionable Lighthouse quirk

.github/workflows/contract-deployment.yml

@@ -56,8 +56,14 @@ jobs:
           path: target
           key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}
 
+      - name: Cache soroban-cli binary
+        uses: actions/cache@v5
+        with:
+          path: ~/.cargo/bin/soroban
+          key: ${{ runner.os }}-bin-soroban-cli-v1
+
       - name: Install Soroban CLI
-        run: cargo install --locked soroban-cli --features opt
+        run: command -v soroban >/dev/null 2>&1 || cargo install --locked soroban-cli --features opt
 
       - name: Run unit tests
         run: cargo test --lib --workspace
@@ -145,9 +151,15 @@ jobs:
           name: contract-wasm
           path: ./artifacts
 
+      - name: Cache soroban-cli binary
+        uses: actions/cache@v5
+        with:
+          path: ~/.cargo/bin/soroban
+          key: ${{ runner.os }}-bin-soroban-cli-v1
+
       - name: Install Soroban CLI
         run: |
-          cargo install --locked soroban-cli --features opt
+          command -v soroban >/dev/null 2>&1 || cargo install --locked soroban-cli --features opt
 
       - name: Configure Soroban for Testnet
         run: |
@@ -214,9 +226,15 @@ jobs:
           name: contract-wasm
           path: ./artifacts
 
+      - name: Cache soroban-cli binary
+        uses: actions/cache@v5
+        with:
+          path: ~/.cargo/bin/soroban
+          key: ${{ runner.os }}-bin-soroban-cli-v1
+
       - name: Install Soroban CLI
         run: |
-          cargo install --locked soroban-cli --features opt
+          command -v soroban >/dev/null 2>&1 || cargo install --locked soroban-cli --features opt
 
       - name: Configure Soroban for Mainnet
         run: |

.github/workflows/dependency-scan.yml

@@ -11,6 +11,9 @@ on:
 # Pinned tool versions for reproducible scans. Bump deliberately.
 # cargo-audit is pinned so a new release cannot silently change scan
 # behavior, JSON output shape, or exit-code semantics mid-stream.
+permissions:
+  contents: read
+
 env:
   CARGO_AUDIT_VERSION: '0.21.2'
 
@@ -27,8 +30,14 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
+      - name: Cache cargo-audit binary
+        uses: actions/cache@v5
+        with:
+          path: ~/.cargo/bin/cargo-audit
+          key: ${{ runner.os }}-bin-cargo-audit-v1
+
       - name: Install cargo-audit
-        run: cargo install cargo-audit --version "$CARGO_AUDIT_VERSION" --locked
+        run: command -v cargo-audit >/dev/null 2>&1 || cargo install cargo-audit --version "$CARGO_AUDIT_VERSION" --locked
 
       - name: Audit contracts/predict-iq dependencies
         run: cargo audit --deny warnings
@@ -74,7 +83,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v6
         with:
-          node-version: '18'
+          node-version: '20'
 
       - name: Install dependencies
         run: npm ci
@@ -103,6 +112,9 @@ jobs:
   scan-trivy:
     name: Scan with Trivy
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -129,6 +141,10 @@ jobs:
     timeout-minutes: 20
     needs: [scan-rust, scan-npm, scan-trivy]
     if: always()
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 

.github/workflows/docker.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}

.github/workflows/license-check.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main, develop]
 
+permissions:
+  contents: read
+
 jobs:
   rust-licenses-contracts:
     name: Rust License Check — contracts/predict-iq
@@ -25,8 +28,14 @@ jobs:
             ~/.cargo/git
           key: ${{ runner.os }}-cargo-deny-contracts-${{ hashFiles('**/Cargo.lock') }}
 
+      - name: Cache cargo-deny binary
+        uses: actions/cache@v5
+        with:
+          path: ~/.cargo/bin/cargo-deny
+          key: ${{ runner.os }}-bin-cargo-deny-v1
+
       - name: Install cargo-deny
-        run: cargo install cargo-deny --locked
+        run: command -v cargo-deny >/dev/null 2>&1 || cargo install cargo-deny --locked
 
       - name: Check licenses — contracts workspace
         run: cargo deny check licenses
@@ -50,8 +59,14 @@ jobs:
             ~/.cargo/git
           key: ${{ runner.os }}-cargo-deny-api-${{ hashFiles('services/api/Cargo.lock') }}
 
+      - name: Cache cargo-deny binary
+        uses: actions/cache@v5
+        with:
+          path: ~/.cargo/bin/cargo-deny
+          key: ${{ runner.os }}-bin-cargo-deny-v1
+
       - name: Install cargo-deny
-        run: cargo install cargo-deny --locked
+        run: command -v cargo-deny >/dev/null 2>&1 || cargo install cargo-deny --locked
 
       - name: Check licenses — services/api
         run: cargo deny check licenses
@@ -67,7 +82,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "18"
+          node-version: "20"
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
 
@@ -99,7 +114,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "18"
+          node-version: "20"
           cache: "npm"
           cache-dependency-path: services/tts/package-lock.json
 

.github/workflows/openapi-validation.yml

@@ -14,6 +14,9 @@ on:
       - "services/api/src/**"
       - "services/api/tests/openapi_contract_test.rs"
 
+permissions:
+  contents: read
+
 jobs:
   spectral-lint:
     name: Spectral — OpenAPI structural lint
@@ -25,7 +28,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "18"
+          node-version: "20"
 
       - name: Install Spectral
         run: npm install -g @stoplight/spectral-cli

.github/workflows/protect-changelog.yml

@@ -5,6 +5,9 @@ on:
     paths:
       - "CHANGELOG.md"
 
+permissions:
+  contents: read
+
 jobs:
   block-manual-changelog:
     name: Block manual CHANGELOG edits