chore: clean up deployments and environment workflows

.github/workflows/ci.yml

@@ -3,78 +3,142 @@ name: CI
 on:
   push:
     branches: [main, develop]
+    paths:
+      - "src/**"
+      - "public/**"
+      - "api/**"
+      - "backend/**"
+      - "app-portal/**"
+      - "explorer/**"
+      - "convex/**"
+      - ".github/workflows/**"
+      - "package.json"
+      - "package-lock.json"
+      - "next.config.js"
   pull_request:
     branches: [main, develop]
+    paths:
+      - "src/**"
+      - "public/**"
+      - "api/**"
+      - "backend/**"
+      - "app-portal/**"
+      - "explorer/**"
+      - "convex/**"
+      - ".github/workflows/**"
+      - "package.json"
+      - "package-lock.json"
+      - "next.config.js"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   lint:
+    name: Lint main site and app portal
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
-          cache: "npm"
-
-      - name: Install dependencies (root)
-        # Temporary bridge for the existing Next.js 14 / WorkOS peer-range mismatch.
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: package-lock.json
+      - name: Install main-site dependencies
         run: npm ci --legacy-peer-deps
-
-      - name: Lint (root)
-        run: npm run lint || true
-
-      - name: Install dependencies (app-portal)
+      - name: Lint main site
+        run: npm run lint
+      - name: Install portal dependencies
         working-directory: app-portal
         run: npm ci
-
-      - name: Lint (app-portal)
+      - name: Lint app portal
         working-directory: app-portal
-        run: npm run lint || true
+        run: npm run lint
 
-  test-backend:
+  build-main-site:
+    name: Build main website
     runs-on: ubuntu-latest
+    needs: lint
+    env:
+      NEXT_PUBLIC_API_URL: https://api.decentralizedrights.com
+      NEXT_PUBLIC_RPC_URL: https://rpc.decentralizedrights.com
+      NEXT_PUBLIC_CHAIN_ID: "31337"
+      NEXT_PUBLIC_IPFS_GATEWAY: https://ipfs.decentralizedrights.com
+      NEXT_PUBLIC_AI_API: https://ai.decentralizedrights.com
+      NEXT_PUBLIC_LEARN_URL: https://decentralizedrights.com/learn
     steps:
       - uses: actions/checkout@v4
-
-      - name: Setup Python
-        uses: actions/setup-python@v5
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          python-version: "3.11"
-          cache: "pip"
-
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install dependencies
-        working-directory: backend
-        run: pip install -r requirements.txt
-
-      - name: Run tests (placeholder)
-        working-directory: backend
-        run: |
-          echo "Backend tests not yet implemented"
-          # python -m pytest tests/
+        run: npm ci --legacy-peer-deps
+      - name: Build
+        run: npm run build
 
-  build-frontend:
+  build-app-portal:
+    name: Build app portal
     runs-on: ubuntu-latest
-    needs: [lint]
+    needs: lint
+    env:
+      NEXT_PUBLIC_API_URL: https://api.decentralizedrights.com
+      NEXT_PUBLIC_RPC_URL: https://rpc.decentralizedrights.com
+      NEXT_PUBLIC_CHAIN_ID: "31337"
+      NEXT_PUBLIC_IPFS_GATEWAY: https://ipfs.decentralizedrights.com
+      NEXT_PUBLIC_AI_API: https://ai.decentralizedrights.com
+      NEXT_PUBLIC_LEARN_URL: https://decentralizedrights.com/learn
     steps:
       - uses: actions/checkout@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: app-portal/package-lock.json
+      - name: Install dependencies
+        working-directory: app-portal
+        run: npm ci
+      - name: Build
+        working-directory: app-portal
+        run: npm run build
 
+  build-explorer:
+    name: Build blockchain explorer
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v4
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
-          cache: "npm"
+          node-version: "22"
+      - name: Install dependencies
+        working-directory: explorer
+        run: npm install --legacy-peer-deps
+      - name: Build
+        working-directory: explorer
+        run: npm run build
 
-      - name: Build app-portal
-        working-directory: app-portal
-        env:
-          NEXT_PUBLIC_API_URL: https://api.decentralizedrights.com
-          NEXT_PUBLIC_RPC_URL: https://rpc.decentralizedrights.com
-          NEXT_PUBLIC_CHAIN_ID: 31337
-          NEXT_PUBLIC_IPFS_GATEWAY: https://ipfs.decentralizedrights.com
-          NEXT_PUBLIC_AI_API: https://ai.decentralizedrights.com
-          NEXT_PUBLIC_LEARN_URL: https://decentralizedrights.com/learn
-        run: |
-          npm ci
-          npm run build
+  validate-backend-python:
+    name: Validate backend Python syntax
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install backend dependencies
+        working-directory: backend
+        run: pip install -r requirements.txt
+      - name: Compile Python sources
+        working-directory: backend
+        run: python -m compileall -q .

.github/workflows/convex-deploy.yml

@@ -5,7 +5,9 @@ on:
     branches: [main]
     paths:
       - 'convex/**'
-      - 'package.json'
+      - 'convex.json'
+      - 'convex.config.ts'
+      - 'convex.config.js'
       - '.github/workflows/convex-deploy.yml'
   workflow_dispatch:
 
@@ -21,7 +23,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
 
       - name: Install dependencies
@@ -30,10 +32,14 @@ jobs:
           # Ensure we have the correct esbuild version
           npm install esbuild@0.25.0 --force
 
-      - name: Configure Convex deployment key
+      - name: Validate Convex production key
+        env:
+          CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
         run: |
-          # Use production deployment
-          echo "CONVEX_DEPLOY_KEY=${{ secrets.CONVEX_DEPLOY_KEY }}" >> $GITHUB_ENV
+          if [ -z "$CONVEX_DEPLOY_KEY" ]; then
+            echo "::error::Missing required GitHub Actions secret CONVEX_DEPLOY_KEY. Add it in repository Settings > Secrets and variables > Actions."
+            exit 1
+          fi
 
       - name: Deploy to Convex Production
         run: |
@@ -42,11 +48,6 @@ jobs:
           CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
           CONVEX_DEPLOYMENT: courteous-wildcat-368
 
-      - name: Verify deployment
-        run: |
-          # Simple verification that deployment succeeded
-          curl -s "https://courteous-wildcat-368.convex.cloud" || echo "Deployment verification failed"
-
   deploy-dev:
     name: Deploy Convex Dev
     runs-on: ubuntu-latest
@@ -60,14 +61,23 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
 
       - name: Install dependencies
         run: |
           npm install
           npm install esbuild@0.25.0 --force
 
+      - name: Validate Convex development key
+        env:
+          CONVEX_DEV_DEPLOY_KEY: ${{ secrets.CONVEX_DEV_DEPLOY_KEY }}
+        run: |
+          if [ -z "$CONVEX_DEV_DEPLOY_KEY" ]; then
+            echo "::error::Missing required GitHub Actions secret CONVEX_DEV_DEPLOY_KEY. Add it in repository Settings > Secrets and variables > Actions."
+            exit 1
+          fi
+
       - name: Deploy to Convex Dev
         run: |
           npx convex deploy

.github/workflows/security.yml

@@ -14,10 +14,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Use Node.js 20
+      - name: Use Node.js 22
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
 
       - name: Install dependencies

app-portal/src/app/privacy/page.tsx

@@ -13,7 +13,7 @@ export default function PrivacyPage() {
       <section><h2 className="text-xl font-bold text-white">5. Service providers</h2><p className="mt-3">The Portal may use infrastructure providers such as Vercel, Convex, Render, Storacha/IPFS, wallet providers and blockchain/network infrastructure. They may process information on DRP&apos;s behalf or as independent providers. Their own terms and privacy notices may also apply.</p></section>
       <section><h2 className="text-xl font-bold text-white">6. Retention and security</h2><p className="mt-3">We retain information only for as long as reasonably necessary for the stated purpose, security, dispute handling and legal obligations. We use access controls, encryption in transit and other reasonable safeguards, but no online system can be guaranteed completely secure.</p></section>
       <section><h2 className="text-xl font-bold text-white">7. Your rights</h2><p className="mt-3">Depending on applicable law, you may have rights to access, correct, delete, restrict or object to certain processing, and to withdraw consent where consent is the legal basis. Some rights may be limited where information is required for security, legal compliance, or has already been irreversibly committed to a decentralized network.</p></section>
-      <section><h2 className="text-xl font-bold text-white">8. Ghana data protection</h2><p className="mt-3">DRP is designed with Ghana's Data Protection Act, 2012 (Act 843) in mind. Where Ghana data-protection obligations apply, processing should be fair, lawful, transparent and limited to necessary purposes. The Ghana Data Protection Commission is the relevant regulator.</p></section>
+      <section><h2 className="text-xl font-bold text-white">8. Ghana data protection</h2><p className="mt-3">DRP is designed with Ghana&apos;s Data Protection Act, 2012 (Act 843) in mind. Where Ghana data-protection obligations apply, processing should be fair, lawful, transparent and limited to necessary purposes. The Ghana Data Protection Commission is the relevant regulator.</p></section>
       <section><h2 className="text-xl font-bold text-white">9. International processing</h2><p className="mt-3">Infrastructure providers may process data outside Ghana. Where applicable law requires safeguards for international transfers, DRP will use appropriate contractual, technical or other safeguards.</p></section>
       <section><h2 className="text-xl font-bold text-white">10. Contact</h2><p className="mt-3">For privacy requests or questions, email <a className="text-[#00e5cc] underline" href="mailto:contact@decentralizedrights.com">contact@decentralizedrights.com</a>.</p></section>
     </div>