chore: implement migration drift detection, CI rules, and duplicate c…

.github/workflows/ci.yml

@@ -262,8 +262,8 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: client/package-lock.json
 
       - name: Audit client dependencies
@@ -414,7 +414,7 @@ jobs:
 
       - name: Install backend dependencies
         working-directory: backend
-        run: npm ci
+        run: npm install
 
       - name: Run backend tests
         working-directory: backend

.github/workflows/database.yml

@@ -4,13 +4,13 @@ on:
   push:
     branches: [main, develop]
     paths:
-      - 'supabase/migrations/**'
-      - 'supabase/config.toml'
+      - "supabase/migrations/**"
+      - "supabase/config.toml"
   pull_request:
     branches: [main, develop]
     paths:
-      - 'supabase/migrations/**'
-      - 'supabase/config.toml'
+      - "supabase/migrations/**"
+      - "supabase/config.toml"
 
 jobs:
   validate-migrations:
@@ -38,13 +38,13 @@ jobs:
       - name: Setup Node.js for RLS audit
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: backend/package-lock.json
 
       - name: Install dependencies for RLS audit
         working-directory: backend
-        run: npm ci
+        run: npm install
 
       - name: Run RLS Policy Audit
         env:
@@ -57,4 +57,4 @@ jobs:
 
       - name: Stop Supabase local stack
         if: always()
-        run: supabase stop
+        run: if command -v supabase &> /dev/null; then supabase stop; fi

.github/workflows/lint.yml

@@ -69,7 +69,7 @@ jobs:
           cache-dependency-path: backend/package-lock.json
 
       - name: Install dependencies
-        run: npm ci
+        run: npm install
 
       - name: Run ESLint
         run: npx eslint src --ext .ts --max-warnings 0

.github/workflows/migration-drift-check.yml

@@ -3,18 +3,11 @@ name: Migration Drift Check
 on:
   pull_request:
     paths:
-      - 'backend/migrations/**'
-      - 'supabase/migrations/**'
-  push:
-    branches:
-      - main
-    paths:
-      - 'backend/migrations/**'
-      - 'supabase/migrations/**'
+      - "supabase/migrations/**"
+      - "backend/migrations/**"
 
 jobs:
   check-migrations:
-    name: Detect migration drift
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -23,13 +16,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
+          node-version: "20"
 
       - name: Run migration drift check
+        run: node scripts/check-migration-drift.js
         id: drift-check
         run: |
           if node scripts/check-migration-drift.js; then
@@ -73,4 +63,4 @@ jobs:
                 issue_number: context.issue.number,
                 body
               });
-            }
+            }

.github/workflows/rls-audit.yml

@@ -4,37 +4,37 @@ on:
   push:
     branches: [main, develop]
     paths:
-      - 'supabase/migrations/**'
-      - 'backend/migrations/**'
-      - 'scripts/check-rls-compliance.js'
-      - '.github/workflows/rls-audit.yml'
+      - "supabase/migrations/**"
+      - "backend/migrations/**"
+      - "scripts/check-rls-compliance.js"
+      - ".github/workflows/rls-audit.yml"
   pull_request:
     branches: [main, develop]
     paths:
-      - 'supabase/migrations/**'
-      - 'backend/migrations/**'
-      - 'scripts/check-rls-compliance.js'
-      - '.github/workflows/rls-audit.yml'
+      - "supabase/migrations/**"
+      - "backend/migrations/**"
+      - "scripts/check-rls-compliance.js"
+      - ".github/workflows/rls-audit.yml"
 
 jobs:
   audit-rls-policies:
     name: Audit RLS Policies
     runs-on: ubuntu-latest
-    
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: backend/package-lock.json
 
       - name: Install dependencies
         working-directory: backend
-        run: npm ci
+        run: npm install
 
       - name: Setup Supabase CLI
         uses: supabase/setup-cli@v2
@@ -61,29 +61,29 @@ jobs:
 
       - name: Stop Supabase local stack
         if: always()
-        run: supabase stop
+        run: if command -v supabase &> /dev/null; then supabase stop; fi
 
   # Integration with main CI pipeline
   validate-rls-on-production:
     name: Validate RLS on Production Schema
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     needs: audit-rls-policies
-    
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: backend/package-lock.json
 
       - name: Install dependencies
         working-directory: backend
-        run: npm ci
+        run: npm install
 
       - name: Validate RLS on Production Database
         env:
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     needs: audit-rls-policies
-    
+
     steps:
       - name: Comment PR with RLS Status
         uses: actions/github-script@v9
@@ -111,4 +111,4 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               body: '✅ **RLS Policy Audit Passed**\n\nAll tables in the database have Row Level Security enabled with appropriate policies. Your changes maintain data security compliance.'
-            });
+            });

.github/workflows/test.yml

@@ -85,7 +85,7 @@ jobs:
           cache-dependency-path: backend/package-lock.json
 
       - name: Install dependencies
-        run: npm ci
+        run: npm install
 
       - name: Run tests with coverage
         run: npm test -- --coverage --ci

.github/workflows/typecheck.yml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
     inputs:
       force_full_run:
-        description: 'Force a full typecheck run'
+        description: "Force a full typecheck run"
         type: boolean
         default: false
 
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         package: [backend, client, sdk, shared, root]
-    
+
     if: |
       needs.changes.outputs.force_full_run == 'true' ||
       (matrix.package == 'backend' && needs.changes.outputs.backend == 'true') ||
@@ -65,15 +65,15 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
-      
+
       - uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "npm"
-          
+
       - name: Install dependencies
         run: npm install
-        
+
       - name: Run Typecheck
         run: |
           if [ "${{ matrix.package }}" = "root" ]; then