Merge branch 'main' into feat/rate-limiting-abuse-protection

Author: kelly-musk

.github/workflows/ci.yml

@@ -2,11 +2,14 @@ name: CI
 
 on:
   push:
-    branches: [main, "feat/**", "fix/**"]
+    branches:
+      - main
   pull_request:
+    branches:
+      - main
 
-env:
-  CARGO_TERM_COLOR: always
+permissions:
+  contents: read
 
 jobs:
   # ── Soroban ABI golden-vector drift guard ────────────────────────────────
@@ -46,75 +49,78 @@ jobs:
   contract:
     name: Contract (Rust / Soroban)
     runs-on: ubuntu-latest
-    env:
-      RUSTFLAGS: "-D warnings"
     steps:
       - uses: actions/checkout@v4
-
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-          components: rustfmt, clippy
-
-      - uses: actions/cache@v4
+      - uses: actions/setup-node@v4
         with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-
-      - run: cargo fmt --all -- --check
-      - run: cargo clippy --target wasm32-unknown-unknown --release -- -D warnings
-      - run: cargo test
-      - run: cargo build --target wasm32-unknown-unknown --release
-
-      - name: Record wasm SHA-256
-        run: sha256sum target/wasm32-unknown-unknown/release/niffyinsure.wasm | tee niffyinsure.wasm.sha256
-
-      - name: Simulate wasm drift (staging acceptance test)
+          node-version: '20'
+      - name: Determine package manager
+        id: pkgmgr
         run: |
-          ACTUAL=$(cat niffyinsure.wasm.sha256 | awk '{print $1}')
-          EXPECTED=$(jq -r '.contracts[0].expectedWasmHash' contracts/deployment-registry.json)
-          # In CI the registry holds a placeholder; drift is detected when they differ.
-          # In staging, set NIFFYINSURE_EXPECTED_WASM_HASH to a known-wrong value to
-          # verify the alert path fires. Exit 0 here — alerting is runtime, not build-time.
-          if [ "$EXPECTED" = "\${NIFFYINSURE_EXPECTED_WASM_HASH}" ]; then
-            echo "Registry uses env placeholder — skipping drift comparison in CI"
-          elif [ "$ACTUAL" != "$EXPECTED" ]; then
-            echo "::warning::Wasm drift detected: expected=$EXPECTED actual=$ACTUAL"
+          if [ -f pnpm-lock.yaml ]; then
+            echo "manager=pnpm" >> "$GITHUB_OUTPUT"
+          elif [ -f package-lock.json ]; then
+            echo "manager=npm" >> "$GITHUB_OUTPUT"
+          elif [ -f yarn.lock ]; then
+            echo "manager=yarn" >> "$GITHUB_OUTPUT"
           else
-            echo "Wasm hash matches registry: $ACTUAL"
+            echo "manager=npm" >> "$GITHUB_OUTPUT"
           fi
-
-      - uses: actions/upload-artifact@v4
+      - name: Setup pnpm when needed
+        if: steps.pkgmgr.outputs.manager == 'pnpm'
+        uses: pnpm/action-setup@v2
+        with:
+          version: 8
+      - name: Cache node modules
+        uses: actions/cache@v4
         with:
-          name: niffyinsure-wasm-${{ github.sha }}
           path: |
-            target/wasm32-unknown-unknown/release/niffyinsure.wasm
-            niffyinsure.wasm.sha256
-          retention-days: 30
+            node_modules
+            ~/.pnpm-store
+          key: ${{ runner.os }}-node-${{ steps.pkgmgr.outputs.manager }}-${{ hashFiles('**/package-lock.json', '**/pnpm-lock.yaml', '**/yarn.lock') }}
+          restore-keys: ${{ runner.os }}-node-${{ steps.pkgmgr.outputs.manager }}-
+      - name: Cache .next cache
+        uses: actions/cache@v4
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-next-cache-${{ hashFiles('**/package-lock.json', '**/pnpm-lock.yaml', '**/yarn.lock') }}
+          restore-keys: ${{ runner.os }}-next-cache-
+      - name: Install dependencies
+        run: |
+          if [ "${{ steps.pkgmgr.outputs.manager }}" = "pnpm" ]; then
+            pnpm install --frozen-lockfile
+          else
+            npm ci
+          fi
+      - name: Lint (fail on warnings)
+        run: |
+          if [ "${{ steps.pkgmgr.outputs.manager }}" = "pnpm" ]; then
+            pnpm eslint --max-warnings=0 .
+          else
+            npm run lint -- --max-warnings=0
+          fi
+      - name: TypeScript compile
+        run: |
+          if [ "${{ steps.pkgmgr.outputs.manager }}" = "pnpm" ]; then
+            pnpm tsc --noEmit
+          else
+            npm run build --if-present -- --noEmit
+          fi
+      - name: Build
+        run: |
+          if [ "${{ steps.pkgmgr.outputs.manager }}" = "pnpm" ]; then
+            pnpm build
+          else
+            npm run build
+          fi
 
-  # ── Backend ───────────────────────────────────────────────────────────────
-  backend:
-    name: Backend (Node / TypeScript)
+  unit-tests:
+    name: Unit tests
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: backend
 
-    services:
-      redis:
-        image: redis:7-alpine
-        ports:
-          - 6379:6379
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 5s
-          --health-timeout 3s
-          --health-retries 5
-          --health-start-period 5s
-
     env:
       REDIS_HOST: 127.0.0.1
       REDIS_PORT: 6379
@@ -123,84 +129,45 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # Install Redis directly on the runner — avoids Docker Hub rate limits entirely
+      - name: Start Redis
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y redis-server
+          sudo systemctl start redis-server
+          redis-cli ping
+
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
-
-      - run: npm install
-      - run: npm run lint
-      - run: npm run build
-      - run: npm test
-
-  # ── Dependency audit / supply-chain ─────────────────────────────────────
-  # Policy: CRITICAL CVEs fail the build. HIGH CVEs produce a warning and
-  # must be triaged within 7 days. Accepted risks require a signed-off entry
-  # in docs/ops/audit-exceptions.md before the override label is applied.
-  # Override process:
-  #   1. Engineer opens a PR adding the CVE to audit-exceptions.md with
-  #      justification, mitigations, and a review-by date.
-  #   2. A second engineer approves the PR.
-  #   3. Add the GitHub label `audit-exception-approved` to the failing PR.
-  #   4. Re-run this job — it will pass once the exception is documented.
-  dependency-audit:
-    name: Dependency Audit (npm / SBOM)
+          node-version: '20'
+      - name: Install dependencies
+        run: npm ci
+      - name: Run unit tests
+        run: npm test
+
+  e2e-tests:
+    name: Playwright E2E tests
     runs-on: ubuntu-latest
+    needs: quality-build
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
-
-      - name: Audit backend dependencies
-        working-directory: backend
-        run: |
-          npm install --ignore-scripts
-          # Fail on critical; warn on high (exit 0 so we can capture output)
-          npm audit --audit-level=critical
-          npm audit --audit-level=high || echo "::warning::High-severity advisories found — triage within 7 days per audit policy"
-
-      - name: Audit frontend dependencies
-        working-directory: frontend
-        run: |
-          npm ci --ignore-scripts
-          npm audit --audit-level=critical
-          npm audit --audit-level=high || echo "::warning::High-severity advisories found — triage within 7 days per audit policy"
-
-      - name: Generate SBOM (backend)
-        working-directory: backend
-        run: npx --yes @cyclonedx/cyclonedx-npm --output-format JSON --output-file ../sbom-backend.json
-
-      - name: Generate SBOM (frontend)
-        working-directory: frontend
-        run: npx --yes @cyclonedx/cyclonedx-npm --output-format JSON --output-file ../sbom-frontend.json
-
-      - uses: actions/upload-artifact@v4
+          node-version: '20'
+      - name: Install dependencies
+        run: npm ci
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps
+      - name: Run Playwright tests
+        run: npx playwright test --reporter=html
+        continue-on-error: true
+      - name: Upload Playwright artifacts on failure
+        if: failure()
+        uses: actions/upload-artifact@v3
         with:
-          name: sbom-${{ github.sha }}
+          name: playwright-failure-${{ github.run_id }}
           path: |
-            sbom-backend.json
-            sbom-frontend.json
-          retention-days: 90
-
-  # ── Frontend ──────────────────────────────────────────────────────────────
-  frontend:
-    name: Frontend (Next.js / TypeScript)
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: frontend
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
-
-      - run: npm ci
-      - run: npm run lint
-      - run: npm run check-docs
-      - run: npm run build
-      - run: npm test
+            test-results
+            playwright-report
+            traces
+            .playwright/traces