diff --git a/.changeset/giant-pots-double.md b/.changeset/giant-pots-double.md new file mode 100644 index 0000000..4a73dfb --- /dev/null +++ b/.changeset/giant-pots-double.md @@ -0,0 +1,5 @@ +--- +"@fake-scope/fake-pkg": patch +--- + +added vector store diff --git a/.env.example b/.env.example index 13d5c28..d30d8aa 100644 --- a/.env.example +++ b/.env.example @@ -1,57 +1,238 @@ -# Database Configuration -DATABASE_URL=postgresql://user:password@localhost:5432/deafirst -DEAFAUTH_DATABASE_URL=postgresql://user:password@localhost:5432/deafauth - -# Redis Configuration -REDIS_URL=redis://localhost:6379 - -# JWT Configuration -JWT_SECRET=change-this-to-a-secure-secret-key -JWT_EXPIRY=7d - -# Frontend Configuration -VITE_API_URL=http://localhost:3000 -VITE_WS_URL=ws://localhost:3001 - -# Service Ports -BACKEND_PORT=3000 -DEAFAUTH_PORT=3002 -PINKSYNC_PORT=3003 -FIBONROSE_PORT=3004 -A11Y_PORT=3005 -AI_PORT=3006 - -# AI Services -OPENAI_API_KEY=your-openai-api-key-here - -# Node Environment -NODE_ENV=development - -# Logging -LOG_LEVEL=info - -# Webhook Configuration -WEBHOOK_SECRET=your-webhook-secret-key-here -XANO_WEBHOOK_SECRET=your-xano-webhook-secret - -# GCP Configuration (for Vertex AI and autonomous features) -GCP_PROJECT_ID=your-gcp-project-id -GCP_REGION=us-central1 -GCP_CREDENTIALS_PATH=./gcp-credentials.json - -# Vertex AI Configuration -VERTEX_AI_ENABLED=true -VERTEX_AI_REGION=us-central1 -VERTEX_AI_EMBEDDING_MODEL=textembedding-gecko@003 -VERTEX_AI_GENERATION_MODEL=gemini-pro -VERTEX_AI_CHAT_MODEL=gemini-pro-vision - -# RAG System Configuration -RAG_ENABLED=true -RAG_VECTOR_STORE=vertex-ai-matching-engine -RAG_FEEDBACK_SOURCES=community,proposals,accessibility - -# Autonomous Evolution -AUTONOMOUS_MODE=enabled -DISTRIBUTED_SYSTEM=true -COMMUNITY_FEEDBACK_ENABLED=true +# Environment Configuration for MBTQ Universe + +# ============================================ +# General Configuration +# ============================================ +NODE_ENV=development +PORT=3000 +API_BASE_URL=https://api.mbtquniverse.com + +# ============================================ +# DeafAUTH Configuration (Identity Cortex) +# ============================================ +DEAFAUTH_API_KEY=your_api_key_here +DEAFAUTH_SECRET=your_secret_here +DEAFAUTH_TOKEN_EXPIRY=3600 +DEAFAUTH_REFRESH_TOKEN_EXPIRY=604800 +DEAFAUTH_JWT_ALGORITHM=HS256 +DEAFAUTH_ISSUER=mbtquniverse.com +DEAFAUTH_AUDIENCE=mbtq-services + +# ============================================ +# PinkSync Configuration (Accessibility Engine) +# ============================================ +PINKSYNC_API_ENDPOINT=https://api.pinksync.mbtq.dev +PINKSYNC_WS_ENDPOINT=wss://sync.mbtq.dev +PINKSYNC_GOOGLE_CLOUD_API_KEY=your_google_api_key +PINKSYNC_SPEECH_TO_TEXT_ENABLED=true +PINKSYNC_VISION_API_ENABLED=true +PINKSYNC_TRANSLATE_API_ENABLED=true +PINKSYNC_SYNC_INTERVAL=5000 + +# ============================================ +# Fibonrose Configuration (Trust & Blockchain) +# ============================================ +FIBONROSE_BLOCKCHAIN_NODE=https://trust.mbtq.dev +FIBONROSE_CONTRACT_ADDRESS=0x0000000000000000000000000000000000000000 +FIBONROSE_NETWORK=mainnet +FIBONROSE_GAS_LIMIT=300000 +FIBONROSE_GAS_PRICE=20000000000 +FIBONROSE_PRIVATE_KEY=your_private_key_here +FIBONROSE_CHAIN_ID=1 + +# ============================================ +# 360Magicians Configuration (AI Agents) +# ============================================ +MAGICIANS_AI_KEY=your_ai_key_here +MAGICIANS_MODEL=gpt-4 + +# OpenAI Configuration +MAGICIANS_OPENAI_API_KEY=your_openai_key_here +MAGICIANS_OPENAI_ORG_ID=your_org_id + +# Anthropic Configuration +MAGICIANS_ANTHROPIC_API_KEY=your_anthropic_key_here + +# Google AI Configuration +MAGICIANS_GOOGLE_API_KEY=your_google_ai_key_here +MAGICIANS_GOOGLE_PROJECT_ID=your_project_id + +# Model Settings +MAGICIANS_MAX_TOKENS=4096 +MAGICIANS_TEMPERATURE=0.7 +MAGICIANS_TOP_P=1.0 + +# Vector Database Configuration +MAGICIANS_VECTOR_DB_URL=your_vector_db_url +MAGICIANS_VECTOR_DB_API_KEY=your_vector_db_key +MAGICIANS_EMBEDDING_MODEL=text-embedding-ada-002 +MAGICIANS_EMBEDDING_DIMENSIONS=1536 + +# Agent Configuration +MAGICIANS_MAX_AGENTS=100 +MAGICIANS_MAX_CONCURRENT_RUNS=10 +MAGICIANS_DEFAULT_TIMEOUT=300000 + +# File Storage +MAGICIANS_STORAGE_BUCKET=mbtq-magicians-files +MAGICIANS_MAX_FILE_SIZE=104857600 + +# ============================================ +# DAO Configuration (Governance) +# ============================================ +DAO_GOVERNANCE_ADDRESS=0x0000000000000000000000000000000000000000 +DAO_VOTING_PERIOD=604800 +DAO_QUORUM_PERCENTAGE=51 +DAO_PROPOSAL_THRESHOLD=1000 +DAO_NETWORK=mainnet +DAO_EXECUTION_DELAY=172800 + +# ============================================ +# Database Configuration +# ============================================ +DATABASE_URL=postgresql://user:password@localhost:5432/mbtq_platform +DATABASE_POOL_SIZE=20 +DATABASE_SSL=true + +# Redis Configuration +REDIS_URL=redis://localhost:6379 +REDIS_PASSWORD=your_redis_password +REDIS_DB=0 + +# ============================================ +# Google Cloud Services +# ============================================ +GOOGLE_APPLICATION_CREDENTIALS=/path/to/credentials.json +GOOGLE_CLOUD_PROJECT=your-project-id +GOOGLE_CLOUD_REGION=us-central1 + +# Google Cloud Vision API +GOOGLE_VISION_API_KEY=your_vision_api_key + +# Google Speech-to-Text API +GOOGLE_SPEECH_TO_TEXT_API_KEY=your_speech_api_key +GOOGLE_SPEECH_LANGUAGE=en-US + +# Google Translate API +GOOGLE_TRANSLATE_API_KEY=your_translate_api_key + +# ============================================ +# AI SDK Configuration +# ============================================ +# Multiple model support for 360Magicians +AI_SDK_PROVIDER=openai +AI_SDK_FALLBACK_PROVIDERS=anthropic,google + +# Streaming Configuration +AI_SDK_ENABLE_STREAMING=true +AI_SDK_STREAM_TIMEOUT=30000 + +# ============================================ +# Security & Encryption +# ============================================ +ENCRYPTION_KEY=your_encryption_key_here +ENCRYPTION_ALGORITHM=aes-256-gcm +JWT_SECRET=your_jwt_secret_here + +# ============================================ +# Monitoring & Logging +# ============================================ +LOG_LEVEL=info +LOG_FORMAT=json +SENTRY_DSN=your_sentry_dsn +SENTRY_ENVIRONMENT=development + +# ============================================ +# Rate Limiting +# ============================================ +RATE_LIMIT_WINDOW=900000 +RATE_LIMIT_MAX_REQUESTS=100 +RATE_LIMIT_SKIP_SUCCESSFUL=false + +# ============================================ +# CORS Configuration +# ============================================ +CORS_ORIGIN=* +CORS_METHODS=GET,POST,PUT,DELETE,PATCH +CORS_CREDENTIALS=true + +# ============================================ +# Webhook Configuration +# ============================================ +WEBHOOK_SECRET=your_webhook_secret +WEBHOOK_TIMEOUT=10000 + +# ============================================ +# Feature Flags +# ============================================ +FEATURE_ASL_MODE=true +FEATURE_REAL_TIME_CAPTIONS=true +FEATURE_BLOCKCHAIN_VERIFICATION=true +FEATURE_AI_AGENTS=true +FEATURE_DAO_GOVERNANCE=true + +# ============================================ +# Accessibility Configuration +# ============================================ +DEFAULT_CAPTIONS_ENABLED=true +DEFAULT_ASL_MODE=false +DEFAULT_CONTRAST=normal +DEFAULT_FONT_SIZE=medium + +# ============================================ +# External Services +# ============================================ +# Stripe (if needed for payments) +STRIPE_PUBLIC_KEY=your_stripe_public_key +STRIPE_SECRET_KEY=your_stripe_secret_key + +# Twilio (if needed for SMS/phone services) +TWILIO_ACCOUNT_SID=your_twilio_sid +TWILIO_AUTH_TOKEN=your_twilio_token +TWILIO_PHONE_NUMBER=+1234567890 + +# SendGrid (if needed for email services) +SENDGRID_API_KEY=your_sendgrid_key +SENDGRID_FROM_EMAIL=noreply@mbtquniverse.com + +# ============================================ +# Development/Testing Configuration +# ============================================ +ENABLE_DEBUG_MODE=false +MOCK_EXTERNAL_APIS=false +TEST_DATABASE_URL=postgresql://user:password@localhost:5432/mbtq_test +# Database Configuration +DATABASE_URL=postgresql://user:password@localhost:5432/deafirst +DEAFAUTH_DATABASE_URL=postgresql://user:password@localhost:5432/deafauth + +# Redis Configuration +REDIS_URL=redis://localhost:6379 + +# JWT Configuration +JWT_SECRET=change-this-to-a-secure-secret-key +JWT_EXPIRY=7d + +# Frontend Configuration +VITE_API_URL=http://localhost:3000 +VITE_WS_URL=ws://localhost:3001 + +# Service Ports +BACKEND_PORT=3000 +DEAFAUTH_PORT=3002 +PINKSYNC_PORT=3003 +FIBONROSE_PORT=3004 +A11Y_PORT=3005 +AI_PORT=3006 + +# AI Services +OPENAI_API_KEY=your-openai-api-key-here + +# Node Environment +NODE_ENV=development + +# Logging +LOG_LEVEL=info + +# Webhook Configuration +WEBHOOK_SECRET=your-webhook-secret-key-here +XANO_WEBHOOK_SECRET=your-xano-webhook-secret diff --git a/.github/co-pilot-instruction.md b/.github/co-pilot-instruction.md new file mode 100644 index 0000000..c29808b --- /dev/null +++ b/.github/co-pilot-instruction.md @@ -0,0 +1,16 @@ +# Project general coding guidelines + +## Code Style +- Use semantic HTML5 elements (header, main, section, article, etc.) +- Prefer modern JavaScript (ES6+) features like const/let, arrow functions, and template literals + +## Naming Conventions +- Use PascalCase for component names, interfaces, and type aliases +- Use camelCase for variables, functions, and methods +- Prefix private class members with underscore (_) +- Use ALL_CAPS for constants + +## Code Quality +- Use meaningful variable and function names that clearly describe their purpose +- Include helpful comments for complex logic +- Add error handling for user inputs and API calls diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4ccc035..5fe8aa4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,92 +1,59 @@ -version: 2 -updates: - # Enable version updates for npm - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 10 - reviewers: - - "pinkycollie" - labels: - - "dependencies" - - "automated" - commit-message: - prefix: "chore" - include: "scope" - versioning-strategy: increase - - # Frontend workspace - - package-ecosystem: "npm" - directory: "/frontend" - schedule: - interval: "weekly" - day: "monday" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "frontend" - - # Backend workspace - - package-ecosystem: "npm" - directory: "/backend" - schedule: - interval: "weekly" - day: "monday" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "backend" - - # Services workspaces - - package-ecosystem: "npm" - directory: "/services/deafauth" - schedule: - interval: "weekly" - labels: - - "dependencies" - - "deafauth" - - - package-ecosystem: "npm" - directory: "/services/pinksync" - schedule: - interval: "weekly" - labels: - - "dependencies" - - "pinksync" - - - package-ecosystem: "npm" - directory: "/services/fibonrose" - schedule: - interval: "weekly" - labels: - - "dependencies" - - "fibonrose" - - - package-ecosystem: "npm" - directory: "/services/accessibility-nodes" - schedule: - interval: "weekly" - labels: - - "dependencies" - - "accessibility" - - - package-ecosystem: "npm" - directory: "/ai" - schedule: - interval: "weekly" - labels: - - "dependencies" - - "ai" - - # GitHub Actions updates - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - labels: - - "dependencies" - - "github-actions" +# .github/dependabot.yml - COMPLETE VERSION +version: 2 +updates: + # Root dependencies + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + groups: + root-deps: + patterns: ["*"] + + # Frontend workspace + - package-ecosystem: "npm" + directory: "/frontend" + schedule: + interval: "weekly" + groups: + frontend-deps: + patterns: ["*"] + + # Backend workspace + - package-ecosystem: "npm" + directory: "/backend" + schedule: + interval: "weekly" + + # Services + - package-ecosystem: "npm" + directory: "/services/deafauth" + schedule: + interval: "weekly" + + - package-ecosystem: "npm" + directory: "/services/pinksync" + schedule: + interval: "weekly" + + - package-ecosystem: "npm" + directory: "/services/fibonrose" + schedule: + interval: "weekly" + + - package-ecosystem: "npm" + directory: "/services/accessibility-nodes" + schedule: + interval: "weekly" + + # AI workspace + - package-ecosystem: "npm" + directory: "/ai" + schedule: + interval: "weekly" + + # GitHub Actions + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" diff --git a/.github/workflows/Apply.yml b/.github/workflows/Apply.yml new file mode 100644 index 0000000..b2cbeef --- /dev/null +++ b/.github/workflows/Apply.yml @@ -0,0 +1,12 @@ +on: + workflow_dispatch: + +jobs: + apply: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Terraform Init + run: terraform init + - name: Terraform Apply + run: terraform apply diff --git a/.github/workflows/Security-hardening.yml b/.github/workflows/Security-hardening.yml new file mode 100644 index 0000000..8912316 --- /dev/null +++ b/.github/workflows/Security-hardening.yml @@ -0,0 +1,208 @@ +name: Security Hardening + +on: + pull_request: + branches: [ "main", "develop" ] + push: + branches: [ "main" ] + schedule: + # Run security checks daily at 2 AM UTC + - cron: '0 2 * * *' + +jobs: + security-audit: + name: Security Audit and Dependency Scan + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Run npm audit + run: | + echo "Running npm audit..." + npm audit --audit-level=high + continue-on-error: false + + - name: Check for banned imports in /api + run: | + echo "Checking for banned database imports in /api directory..." + if grep -r "import.*drizzle" ./api/ 2>/dev/null; then + echo "ERROR: Direct drizzle imports found in /api directory" + exit 1 + fi + if grep -r "import.*pg\>" ./api/ 2>/dev/null; then + echo "ERROR: Direct pg imports found in /api directory" + exit 1 + fi + if grep -r "from ['\"]drizzle" ./api/ 2>/dev/null; then + echo "ERROR: Direct drizzle imports found in /api directory" + exit 1 + fi + echo "✓ No banned imports found in /api directory" + + - name: Check for committed secrets + run: | + echo "Checking for accidentally committed secrets..." + # Check for common secret patterns + if grep -r "sk_live_" . --exclude-dir=node_modules --exclude-dir=.git 2>/dev/null; then + echo "ERROR: Stripe live secret key found in repository" + exit 1 + fi + if grep -r "sk_test_" . --exclude-dir=node_modules --exclude-dir=.git --exclude=".env.example" 2>/dev/null; then + echo "WARNING: Stripe test secret key found - should be in environment variables" + fi + if grep -r "PRIVATE_KEY" . --exclude-dir=node_modules --exclude-dir=.git --exclude="*.md" 2>/dev/null | grep -v "PRIVATE_KEY_PATH"; then + echo "ERROR: Private key found in repository" + exit 1 + fi + echo "✓ No obvious secrets found in repository" + + - name: Check SECURITY.md exists + run: | + if [ ! -f "SECURITY.md" ]; then + echo "ERROR: SECURITY.md not found in repository root" + exit 1 + fi + echo "✓ SECURITY.md exists" + + - name: Check agents.md exists + run: | + if [ ! -f "agents.md" ]; then + echo "ERROR: agents.md not found in repository root" + exit 1 + fi + echo "✓ agents.md exists" + + - name: Verify TypeScript compilation + run: | + echo "Checking TypeScript compilation..." + npm run check || echo "TypeScript errors found - review before merge" + continue-on-error: true + + api-security: + name: API Security Checks + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Check API routes for content-type enforcement + run: | + echo "Checking API routes for proper content-type handling..." + # Check for HTML responses in API routes (potential security issue) + if grep -r "text/html\|/dev/null; then + echo "WARNING: HTML content detected in API routes - API should return JSON only" + fi + echo "✓ API content-type check complete" + + - name: Check for SQL injection vulnerabilities + run: | + echo "Checking for potential SQL injection patterns..." + if grep -r "db.query.*\${" ./server/ --exclude-dir=node_modules 2>/dev/null; then + echo "WARNING: Template literal found in db.query - verify parameterized queries are used" + fi + echo "✓ SQL injection check complete" + + pii-detection: + name: PII and Sensitive Data Detection + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Check for PII in test files + run: | + echo "Checking for real PII in test files..." + # Look for real SSN patterns (not test data) + if grep -r "[0-9]\{3\}-[0-9]\{2\}-[0-9]\{4\}" ./test* --exclude-dir=node_modules 2>/dev/null | grep -v "000-00-0000" | grep -v "123-45-6789"; then + echo "WARNING: Real SSN patterns found in tests - use synthetic data only" + fi + echo "✓ PII detection check complete" + + - name: Check for hardcoded credentials + run: | + echo "Checking for hardcoded credentials..." + if grep -ri "password\s*=\s*['\"][^'\"]*['\"]" . --exclude-dir=node_modules --exclude-dir=.git --exclude="*.md" 2>/dev/null; then + echo "WARNING: Hardcoded passwords found - use environment variables" + fi + echo "✓ Credential check complete" + + dependency-pinning: + name: Verify Dependency Pinning + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Check for unpinned dependencies + run: | + echo "Checking package.json for unpinned dependencies..." + if grep -E '"\^|"~' package.json; then + echo "WARNING: Unpinned dependencies found in package.json" + echo "For production, consider using exact versions (remove ^ and ~)" + fi + echo "✓ Dependency pinning check complete" + + rate-limit-check: + name: Verify Rate Limiting + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Check for rate limiting implementation + run: | + echo "Checking for rate limiting in API routes..." + if ! grep -r "rateLimit\|rate-limit" ./server/ 2>/dev/null; then + echo "WARNING: No rate limiting implementation detected" + echo "Consider adding express-rate-limit or similar middleware" + else + echo "✓ Rate limiting implementation found" + fi + + summary: + name: Security Check Summary + runs-on: ubuntu-latest + needs: [security-audit, api-security, pii-detection, dependency-pinning, rate-limit-check] + if: always() + + steps: + - name: Summary + run: | + echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" + echo "Security Hardening Checks Complete" + echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" + echo "" + echo "Review any warnings above and ensure:" + echo " ✓ No high/critical vulnerabilities in dependencies" + echo " ✓ No banned imports in /api directory" + echo " ✓ SECURITY.md and agents.md are present" + echo " ✓ No secrets committed to repository" + echo " ✓ API routes enforce proper content-types" + echo " ✓ Rate limiting is implemented" + echo "" + echo "For security concerns, contact: security@mbtq.dev" + echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" diff --git a/.github/workflows/accessibility.yml b/.github/workflows/accessibility.yml index f5173de..dc46a1e 100644 --- a/.github/workflows/accessibility.yml +++ b/.github/workflows/accessibility.yml @@ -1,106 +1,106 @@ -name: Accessibility Testing - -on: - push: - branches: [ main, develop ] - pull_request: - branches: [ main ] - workflow_dispatch: - -permissions: - contents: read - issues: write - -jobs: - a11y-check: - name: Accessibility Checks - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '20' - cache: 'npm' - - - name: Install dependencies - run: npm ci - - - name: Build frontend - run: npm run build --workspace=frontend - - - name: Install pa11y - run: npm install -g pa11y-ci - - - name: Serve frontend - run: | - cd frontend/dist - npx serve -l 3000 & - sleep 5 - - - name: Run pa11y accessibility tests - run: | - echo "Running accessibility tests..." - echo "Testing WCAG 2.1 Level AAA compliance" - # pa11y-ci would run here with config - echo "✓ Accessibility tests would run against built frontend" - - - name: Check for WCAG violations - run: | - echo "Checking for common accessibility issues:" - echo "- Color contrast ratios" - echo "- ARIA labels" - echo "- Semantic HTML" - echo "- Keyboard navigation" - echo "- Screen reader compatibility" - - - name: Generate accessibility report - if: always() - run: | - mkdir -p reports - echo "# Accessibility Report" > reports/a11y-report.md - echo "" >> reports/a11y-report.md - echo "## WCAG 2.1 Level AAA Compliance Check" >> reports/a11y-report.md - echo "" >> reports/a11y-report.md - echo "✓ All accessibility checks passed" >> reports/a11y-report.md - cat reports/a11y-report.md - - - name: Upload accessibility report - if: always() - uses: actions/upload-artifact@v4 - with: - name: accessibility-report - path: reports/ - retention-days: 30 - - lighthouse-audit: - name: Lighthouse Audit - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '20' - cache: 'npm' - - - name: Install dependencies - run: npm ci - - - name: Build frontend - run: npm run build --workspace=frontend - - - name: Run Lighthouse CI - run: | - npm install -g @lhci/cli - echo "Lighthouse audit would run here" - echo "Checking: Performance, Accessibility, Best Practices, SEO" - - - name: Comment on PR with results - if: github.event_name == 'pull_request' - run: | - echo "Would post Lighthouse scores to PR comment" +name: Accessibility Testing + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main ] + workflow_dispatch: + +permissions: + contents: read + issues: write + +jobs: + a11y-check: + name: Accessibility Checks + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Build frontend + run: npm run build --workspace=frontend + + - name: Install pa11y + run: npm install -g pa11y-ci + + - name: Serve frontend + run: | + cd frontend/dist + npx serve -l 3000 & + sleep 5 + + - name: Run pa11y accessibility tests + run: | + echo "Running accessibility tests..." + echo "Testing WCAG 2.1 Level AAA compliance" + # pa11y-ci would run here with config + echo "✓ Accessibility tests would run against built frontend" + + - name: Check for WCAG violations + run: | + echo "Checking for common accessibility issues:" + echo "- Color contrast ratios" + echo "- ARIA labels" + echo "- Semantic HTML" + echo "- Keyboard navigation" + echo "- Screen reader compatibility" + + - name: Generate accessibility report + if: always() + run: | + mkdir -p reports + echo "# Accessibility Report" > reports/a11y-report.md + echo "" >> reports/a11y-report.md + echo "## WCAG 2.1 Level AAA Compliance Check" >> reports/a11y-report.md + echo "" >> reports/a11y-report.md + echo "✓ All accessibility checks passed" >> reports/a11y-report.md + cat reports/a11y-report.md + + - name: Upload accessibility report + if: always() + uses: actions/upload-artifact@v4 + with: + name: accessibility-report + path: reports/ + retention-days: 30 + + lighthouse-audit: + name: Lighthouse Audit + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Build frontend + run: npm run build --workspace=frontend + + - name: Run Lighthouse CI + run: | + npm install -g @lhci/cli + echo "Lighthouse audit would run here" + echo "Checking: Performance, Accessibility, Best Practices, SEO" + + - name: Comment on PR with results + if: github.event_name == 'pull_request' + run: | + echo "Would post Lighthouse scores to PR comment" diff --git a/.github/workflows/api-tests.yml b/.github/workflows/api-tests.yml new file mode 100644 index 0000000..08d2c3d --- /dev/null +++ b/.github/workflows/api-tests.yml @@ -0,0 +1,182 @@ +name: API Tests and Validation + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main, develop ] + +jobs: + test: + runs-on: ubuntu-latest + + strategy: + matrix: + node-version: [18.x, 20.x] + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v3 + with: + node-version: ${{ matrix.node-version }} + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Validate OpenAPI specifications + run: npm run validate:openapi + + - name: Run tests + run: npm test + + - name: Generate coverage report + run: npm run test:coverage + + - name: Upload coverage to Codecov + uses: codecov/codecov-action@v3 + with: + files: ./coverage/lcov.info + flags: unittests + name: codecov-umbrella + + validate-specs: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js + uses: actions/setup-node@v3 + with: + node-version: '20.x' + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Validate all OpenAPI specifications + run: npm run validate:openapi + + generate-sdks: + runs-on: ubuntu-latest + needs: [test, validate-specs] + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js + uses: actions/setup-node@v3 + with: + node-version: '20.x' + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Generate TypeScript SDK + run: npm run generate:sdk:typescript + + - name: Generate Python SDK + run: npm run generate:sdk:python + + - name: Upload SDK artifacts + uses: actions/upload-artifact@v3 + with: + name: generated-sdks + path: sdks/ + retention-days: 30 +======= +name: API Tests and Validation + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main, develop ] + +jobs: + test: + runs-on: ubuntu-latest + + strategy: + matrix: + node-version: [18.x, 20.x] + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v3 + with: + node-version: ${{ matrix.node-version }} + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Validate OpenAPI specifications + run: npm run validate:openapi + + - name: Run tests + run: npm test + + - name: Generate coverage report + run: npm run test:coverage + + - name: Upload coverage to Codecov + uses: codecov/codecov-action@v3 + with: + files: ./coverage/lcov.info + flags: unittests + name: codecov-umbrella + + validate-specs: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js + uses: actions/setup-node@v3 + with: + node-version: '20.x' + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Validate all OpenAPI specifications + run: npm run validate:openapi + + generate-sdks: + runs-on: ubuntu-latest + needs: [test, validate-specs] + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js + uses: actions/setup-node@v3 + with: + node-version: '20.x' + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Generate TypeScript SDK + run: npm run generate:sdk:typescript + + - name: Generate Python SDK + run: npm run generate:sdk:python + + - name: Upload SDK artifacts + uses: actions/upload-artifact@v3 + with: + name: generated-sdks + path: sdks/ + retention-days: 30 +>>>>>>> e961430... Add Node.js API automated tests and SDK generation capabilities diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 29cc01b..8a4d5ab 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,130 +1,329 @@ -name: CI/CD Pipeline +name: CI on: push: - branches: [ main, develop ] + branches: + - main + - release-v* pull_request: - branches: [ main, develop ] - workflow_dispatch: - -permissions: - contents: read - pull-requests: write + branches: + - main + - release-v* jobs: - lint: - name: Lint and Type Check + check: + name: 'Lint & Format' runs-on: ubuntu-latest steps: - - name: Checkout code - uses: actions/checkout@v4 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Setup pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 + with: + version: 10.11.0 - - name: Setup Node.js - uses: actions/setup-node@v4 + - name: Use Node.js 22 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: - node-version: '20' - cache: 'npm' + node-version: 22 + cache: 'pnpm' - name: Install dependencies - run: npm ci + run: pnpm install --frozen-lockfile - - name: Run linting - run: npm run lint + - name: Run ultracite check + run: pnpm run check - - name: Run type checking - run: npm run type-check + konsistent: + name: 'Code Consistency' + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - test: - name: Run Tests + - name: Setup pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 + with: + version: 10.11.0 + + - name: Use Node.js 22 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: 22 + cache: 'pnpm' + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Run konsistent + run: pnpm konsistent + + build-examples: + name: 'Build Examples' + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Setup pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 + with: + version: 10.11.0 + + - name: Use Node.js 22 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: 22 + cache: 'pnpm' + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Build Examples + run: pnpm run build:examples + + types: + name: 'TypeScript' runs-on: ubuntu-latest steps: - - name: Checkout code - uses: actions/checkout@v4 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Setup pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 + with: + version: 10.11.0 - - name: Setup Node.js - uses: actions/setup-node@v4 + - name: Use Node.js 22 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: - node-version: '20' - cache: 'npm' + node-version: 22 + cache: 'pnpm' - name: Install dependencies - run: npm ci + run: pnpm install --frozen-lockfile - - name: Run unit tests - run: npm run test + - name: Run TypeScript type check + run: pnpm run type-check:full - build: - name: Build All Workspaces + build-packages: + name: 'Build Packages' runs-on: ubuntu-latest - needs: [lint, test] steps: - - name: Checkout code - uses: actions/checkout@v4 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Setup Node.js - uses: actions/setup-node@v4 + - name: Setup pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 with: - node-version: '20' - cache: 'npm' + version: 10.11.0 + + - name: Use Node.js 22 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: 22 + cache: 'pnpm' - name: Install dependencies - run: npm ci + run: pnpm install --frozen-lockfile + + - name: Build packages + run: pnpm run build:packages - - name: Build all workspaces - run: npm run build + - name: Archive package build artifacts + run: tar -czf package-build-artifacts.tgz packages/*/dist - - name: Upload build artifacts - uses: actions/upload-artifact@v4 + - name: Upload package build artifacts + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - name: build-artifacts - path: | - frontend/dist - backend/dist - services/*/dist - ai/dist - retention-days: 7 + name: package-build-artifacts + path: package-build-artifacts.tgz - accessibility-check: - name: Accessibility Tests + bundle-size: + name: 'Bundle Size Check' runs-on: ubuntu-latest + needs: build-packages steps: - - name: Checkout code - uses: actions/checkout@v4 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Setup pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 + with: + version: 10.11.0 - - name: Setup Node.js - uses: actions/setup-node@v4 + - name: Use Node.js 22 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: - node-version: '20' - cache: 'npm' + node-version: 22 + cache: 'pnpm' - name: Install dependencies - run: npm ci + run: pnpm install --frozen-lockfile - - name: Build frontend - run: npm run build --workspace=frontend + - name: Download package build artifacts + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: package-build-artifacts - - name: Run accessibility tests - run: | - echo "Accessibility testing would run here" - echo "Install axe-core or pa11y for automated a11y testing" - # npm run test:a11y + - name: Extract package build artifacts + run: tar -xzf package-build-artifacts.tgz + + - name: Check bundle size + run: cd packages/ai && pnpm run check-bundle-size + + - name: Upload bundle size metafiles + if: ${{ always() }} + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: bundle-size-metafiles + path: packages/ai/dist-bundle-check/*.json + + test_matrix: + name: 'Test' + runs-on: ubuntu-latest + needs: build-packages + env: + TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }} + TURBO_TEAM: ${{ vars.TURBO_TEAM }} + strategy: + matrix: + node-version: [22, 24, 26] + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Setup pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 + with: + version: 10.11.0 + + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: ${{ matrix.node-version }} + cache: 'pnpm' + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Download package build artifacts + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: package-build-artifacts + + - name: Extract package build artifacts + run: tar -xzf package-build-artifacts.tgz + + - name: Install Playwright Browsers + timeout-minutes: 10 + run: pnpm exec playwright install --with-deps + + - name: Run tests + run: pnpm test:ci + + # separate "test" job to set as required in branch protections, + # as the matrix build names above change each time Node versions change + test: + runs-on: ubuntu-latest + needs: [build-packages, test_matrix] + if: ${{ !cancelled() }} + steps: + - name: All required jobs passed + if: ${{ !(contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')) }} + run: exit 0 + - name: Some required job failed or was skipped + if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }} + run: exit 1 - docker-build: - name: Docker Build Test + load-time_matrix: + name: 'Load Time Check' runs-on: ubuntu-latest - needs: [build] - if: github.event_name == 'push' + needs: build-packages + strategy: + fail-fast: false + matrix: + include: + - module: 'ai' + max-load-time: 105 + - module: '@ai-sdk/openai' + max-load-time: 70 + - module: '@ai-sdk/openai-compatible' + max-load-time: 70 + - module: '@ai-sdk/anthropic' + max-load-time: 70 + - module: '@ai-sdk/google' + max-load-time: 70 steps: - - name: Checkout code - uses: actions/checkout@v4 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + - name: Setup pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 + with: + version: 10.11.0 + + - name: Use Node.js 22 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: 22 + cache: 'pnpm' + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Download package build artifacts + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: package-build-artifacts - - name: Test Docker Compose + - name: Extract package build artifacts + run: tar -xzf package-build-artifacts.tgz + + - name: Measure and check load time for ${{ matrix.module }} + id: load-time + working-directory: examples/ai-functions run: | - if [ -f "configs/deployment/docker-compose.yml" ]; then - docker compose -f configs/deployment/docker-compose.yml config + echo "📦 Measuring load time for ${{ matrix.module }}..." + pnpm tsx src/benchmark/load-time.ts "${{ matrix.module }}" | tee load-time-output.txt + + # Extract the average time from the output + AVERAGE_TIME=$(grep "Average:" load-time-output.txt | awk '{print $2}' | sed 's/ms//') + + echo "" + echo "🔍 Checking threshold..." + echo "Average load time: ${AVERAGE_TIME}ms" + echo "Maximum allowed: ${{ matrix.max-load-time }}ms" + + if (( $(echo "$AVERAGE_TIME > ${{ matrix.max-load-time }}" | bc -l) )); then + echo "" + echo "❌ Load time check failed!" + echo "${{ matrix.module }}: ${AVERAGE_TIME}ms exceeds ${{ matrix.max-load-time }}ms threshold" + echo "" + echo "To fix this:" + echo "1. Investigate and optimize slow module initialization" + echo "2. Update the max-load-time in .github/workflows/ci.yml if the increase is justified" + exit 1 else - echo "Docker Compose file not found, skipping" + echo "" + echo "✅ Load time check passed!" + echo "${{ matrix.module }}: ${AVERAGE_TIME}ms is within ${{ matrix.max-load-time }}ms threshold" + + # write result to summary + echo "- Load Time Check for ${{ matrix.module }}: ${AVERAGE_TIME}ms (Max: ${{ matrix.max-load-time }}ms)" >> $GITHUB_STEP_SUMMARY fi + + # separate "load-time" job to set as required in branch protections, + # as the matrix build names above change each time modules are added/removed + load-time: + runs-on: ubuntu-latest + needs: [build-packages, load-time_matrix] + if: ${{ !cancelled() }} + steps: + - name: All required jobs passed + if: ${{ !(contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')) }} + run: exit 0 + - name: Some required job failed or was skipped + if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }} + run: exit 1 diff --git a/.github/workflows/cloudbuild.yaml b/.github/workflows/cloudbuild.yaml new file mode 100644 index 0000000..846eb50 --- /dev/null +++ b/.github/workflows/cloudbuild.yaml @@ -0,0 +1,9 @@ +# cloudbuild.yaml +steps: + - name: 'gcr.io/cloud-builders/docker' + args: ['build', '-t', 'gcr.io/$PROJECT_ID/deafauth', '.'] + - name: 'gcr.io/cloud-builders/docker' + args: ['push', 'gcr.io/$PROJECT_ID/deafauth'] + - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk' + entrypoint: gcloud + args: ['run', 'deploy', 'deafauth', '--image', 'gcr.io/$PROJECT_ID/deafauth'] diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 8a3160f..fae46e3 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -1,54 +1,261 @@ -name: Deploy to GitHub Pages +name: Release on: push: - branches: - - main + tags: + - 'v*' workflow_dispatch: + inputs: + version: + description: 'Version to release (e.g., v1.0.0)' + required: true + type: string permissions: - contents: read - pages: write - id-token: write - -concurrency: - group: "pages" - cancel-in-progress: false + contents: write + packages: write jobs: + validate: + name: Validate Release + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Validate version format + run: | + if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then + VERSION="${{ github.event.inputs.version }}" + else + VERSION="${{ github.ref_name }}" + fi + + # Validate semantic version format + if [[ ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9\.\-]+)?$ ]]; then + echo "❌ Invalid version format: $VERSION" + echo "Expected format: v1.0.0, v1.0.0-alpha, v1.0.0-beta.1, etc." + exit 1 + fi + + echo "✅ Valid version: $VERSION" + + test: + name: Run Tests + runs-on: ubuntu-latest + needs: validate + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version-file: .nvmrc + cache: 'npm' + cache-dependency-path: | + client/package-lock.json + server/package-lock.json + + - name: Install client dependencies + working-directory: ./client + run: npm ci + + - name: Install server dependencies + working-directory: ./server + run: npm ci + + - name: Run client tests + working-directory: ./client + run: npm test -- --run + + - name: Run type checking + working-directory: ./client + run: npx tsc --noEmit + + security: + name: Security Scan + runs-on: ubuntu-latest + needs: validate + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version-file: .nvmrc + cache: 'npm' + cache-dependency-path: | + client/package-lock.json + server/package-lock.json + + - name: Install dependencies + run: | + cd client && npm ci + cd ../server && npm ci + + - name: Run security audit + run: | + echo "Running security audit for client..." + cd client && npm audit --audit-level=moderate + echo "Running security audit for server..." + cd ../server && npm audit --audit-level=moderate + continue-on-error: false + build: + name: Build Release runs-on: ubuntu-latest + needs: [test, security] steps: - - name: Checkout + - name: Checkout code uses: actions/checkout@v4 - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: .nvmrc cache: 'npm' + cache-dependency-path: client/package-lock.json - name: Install dependencies + working-directory: ./client run: npm ci - - name: Build frontend - run: npm run build --workspace=frontend + - name: Build client + working-directory: ./client + run: npm run build + env: + NODE_ENV: production - - name: Setup Pages - uses: actions/configure-pages@v4 + - name: Upload build artifacts + uses: actions/upload-artifact@v4 + with: + name: build-artifacts + path: client/dist/ + retention-days: 7 - - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + release: + name: Create Release + runs-on: ubuntu-latest + needs: build + steps: + - name: Checkout code + uses: actions/checkout@v4 with: - path: './frontend/dist' + fetch-depth: 0 + + - name: Get version + id: version + run: | + if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then + VERSION="${{ github.event.inputs.version }}" + else + VERSION="${{ github.ref_name }}" + fi + echo "version=$VERSION" >> $GITHUB_OUTPUT + + # Determine if pre-release + if [[ "$VERSION" =~ (alpha|beta|rc) ]]; then + echo "prerelease=true" >> $GITHUB_OUTPUT + else + echo "prerelease=false" >> $GITHUB_OUTPUT + fi + + - name: Download build artifacts + uses: actions/download-artifact@v4 + with: + name: build-artifacts + path: ./dist + + - name: Create release archive + run: | + cd dist + zip -r ../mbtq-dev-${{ steps.version.outputs.version }}.zip . + cd .. + + - name: Generate release notes + id: release_notes + run: | + VERSION="${{ steps.version.outputs.version }}" + + # Get previous tag + PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "") + + # Generate notes + if [ -z "$PREV_TAG" ]; then + NOTES="Initial release of MBTQ.dev platform" + else + NOTES="## What's Changed\n\n" + NOTES+="### Commits\n\n" + NOTES+="$(git log $PREV_TAG..HEAD --pretty=format:'- %s (%h)' --no-merges)\n\n" + NOTES+="**Full Changelog**: https://github.com/${{ github.repository }}/compare/$PREV_TAG...$VERSION" + fi + + echo "notes<> $GITHUB_OUTPUT + echo -e "$NOTES" >> $GITHUB_OUTPUT + echo "EOF" >> $GITHUB_OUTPUT + + - name: Create GitHub Release + uses: softprops/action-gh-release@v1 + with: + tag_name: ${{ steps.version.outputs.version }} + name: ${{ steps.version.outputs.version }} + body: ${{ steps.release_notes.outputs.notes }} + draft: false + prerelease: ${{ steps.version.outputs.prerelease }} + files: | + mbtq-dev-${{ steps.version.outputs.version }}.zip + generate_release_notes: true + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Create pre-release notification + if: steps.version.outputs.prerelease == 'true' + run: | + echo "⚠️ This is a pre-release version: ${{ steps.version.outputs.version }}" + echo "Not recommended for production use." + + - name: Create production release notification + if: steps.version.outputs.prerelease == 'false' + run: | + echo "✅ Production release created: ${{ steps.version.outputs.version }}" + echo "This version is ready for production use." deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} + name: Deploy Release runs-on: ubuntu-latest - needs: build + needs: release + if: "!contains(github.ref, 'alpha') && !contains(github.ref, 'beta') && !contains(github.ref, 'rc')" steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version-file: .nvmrc + + - name: Install dependencies + working-directory: ./client + run: npm ci + + - name: Build for production + working-directory: ./client + run: npm run build + env: + NODE_ENV: production + - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@v4 + uses: peaceiris/actions-gh-pages@v3 + with: + github_token: ${{ secrets.GITHUB_TOKEN }} + publish_dir: ./client/dist + cname: mbtq.dev + + - name: Deployment success notification + run: | + echo "🚀 Deployment successful!" + echo "Version ${{ github.ref_name }} is now live." diff --git a/.github/workflows/docs-api.yml b/.github/workflows/docs-api.yml new file mode 100644 index 0000000..5a1d362 --- /dev/null +++ b/.github/workflows/docs-api.yml @@ -0,0 +1,80 @@ +name: API Docs + SDKs + +on: + push: + branches: [main] + paths: + - "openapi/**" + - ".github/workflows/docs-api.yml" + +jobs: + build-docs: + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Set up Node + uses: actions/setup-node@v4 + with: + node-version: 20 + + - name: Install Redoc CLI + run: npm install -g @redocly/cli + + - name: Install Swagger UI + run: npm install swagger-ui-dist + + - name: Prepare docs folder + run: mkdir -p public/docs + + # --- REDOC --- + - name: Generate Redoc HTML + run: | + redocly build-docs openapi/openapi.yaml \ + --output public/docs/index.html \ + --title "MBTQ API Documentation" + + # --- SWAGGER UI --- + - name: Build Swagger UI + run: | + mkdir -p public/docs/swagger + cp -r node_modules/swagger-ui-dist/* public/docs/swagger/ + cp openapi/openapi.yaml public/docs/swagger/openapi.yaml + sed -i 's|https://petstore.swagger.io/v2/swagger.json|./openapi.yaml|g' public/docs/swagger/index.html + + # --- SDK GENERATION --- + - name: Install OpenAPI Generator + run: | + wget https://repo1.maven.org/maven2/org/openapitools/openapi-generator-cli/7.0.0/openapi-generator-cli-7.0.0.jar -O openapi-generator.jar + + - name: Generate Python SDK + run: | + java -jar openapi-generator.jar generate \ + -i openapi/openapi.yaml \ + -g python \ + -o public/docs/sdk-python + + - name: Generate TypeScript SDK + run: | + java -jar openapi-generator.jar generate \ + -i openapi/openapi.yaml \ + -g typescript-fetch \ + -o public/docs/sdk-typescript + + - name: Generate Go SDK + run: | + java -jar openapi-generator.jar generate \ + -i openapi/openapi.yaml \ + -g go \ + -o public/docs/sdk-go + + # --- DEPLOY --- + - name: Upload artifact + uses: actions/upload-pages-artifact@v3 + with: + path: public/docs + + - name: Deploy to GitHub Pages + uses: actions/deploy-pages@v4 diff --git a/.github/workflows/infrastructure-gate.yml b/.github/workflows/infrastructure-gate.yml deleted file mode 100644 index 3ba2fa9..0000000 --- a/.github/workflows/infrastructure-gate.yml +++ /dev/null @@ -1,152 +0,0 @@ -name: Infrastructure Readiness Gate - -on: - push: - branches: - - main - - develop - pull_request: - branches: - - main - - develop - workflow_dispatch: - -permissions: - contents: read - pull-requests: write - checks: write - -jobs: - check-infrastructure: - name: Verify Infrastructure Completion - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Run Infrastructure Readiness Check - id: infra-check - run: | - cd ${{ github.workspace }} - bash scripts/check-infrastructure-ready.sh - - - name: Infrastructure Status - if: success() - run: | - echo "✅ Infrastructure readiness check passed" - echo "All required services are configured:" - echo " - DeafAUTH (/auth): Authentication service" - echo " - PinkSync (sync): Real-time synchronization service" - echo " - FibonRose (trust): Trust and optimization engine" - - - name: Block on Infrastructure Failure - if: failure() - run: | - echo "❌ Infrastructure is not ready for deployment" - echo "Please complete the infrastructure setup before pushing code." - echo "" - echo "Required components:" - echo " 1. DeafAUTH service configuration" - echo " 2. PinkSync service configuration" - echo " 3. FibonRose service configuration" - echo " 4. Complete Terraform infrastructure files" - echo " 5. Environment-specific configurations" - echo "" - echo "See terraform/README.md for deployment instructions." - exit 1 - - deployment-gate: - name: Deployment Gate Check - runs-on: ubuntu-latest - needs: check-infrastructure - if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Validate Services Configuration - run: | - echo "Validating core services..." - - # Check deafauth - if [ ! -f "services/deafauth/package.json" ]; then - echo "❌ DeafAUTH service not properly configured" - exit 1 - fi - echo "✅ DeafAUTH (/auth) - Ready" - - # Check pinksync - if [ ! -f "services/pinksync/package.json" ]; then - echo "❌ PinkSync service not properly configured" - exit 1 - fi - echo "✅ PinkSync (sync) - Ready" - - # Check fibonrose - if [ ! -f "services/fibonrose/package.json" ]; then - echo "❌ FibonRose service not properly configured" - exit 1 - fi - echo "✅ FibonRose (trust) - Ready" - - - name: Verify Terraform Configuration - run: | - echo "Verifying Terraform infrastructure..." - - if [ ! -d "terraform" ]; then - echo "❌ Terraform directory not found" - exit 1 - fi - - # Check for required terraform files - required_files=("main.tf" "variables.tf" "outputs.tf" "deafauth.tf" "pinksync.tf" "fibonrose.tf") - for file in "${required_files[@]}"; do - if [ ! -f "terraform/${file}" ]; then - echo "❌ Required Terraform file ${file} not found" - exit 1 - fi - done - - echo "✅ Terraform configuration complete" - - - name: Deployment Approval - run: | - echo "=========================================" - echo "🚀 DEPLOYMENT GATE PASSED" - echo "=========================================" - echo "" - echo "Infrastructure Status: ✅ READY" - echo "" - echo "Core Services Configured:" - echo " ✅ DeafAUTH (/auth) - Authentication & User Management" - echo " ✅ PinkSync (sync) - Real-time Synchronization" - echo " ✅ FibonRose (trust) - Trust & Optimization Engine" - echo "" - echo "Infrastructure Components:" - echo " ✅ Terraform configuration complete" - echo " ✅ Service configurations validated" - echo " ✅ Environment setup verified" - echo "" - echo "Platform Evolution:" - echo " 🤖 Ready for autonomous operation with Vertex AI" - echo " 📚 RAG system ready for community feedback integration" - echo " 🔄 Distributed system architecture configured" - echo "" - echo "✅ Code push approved - Infrastructure is complete" - echo "=========================================" - - notify-status: - name: Notify Infrastructure Status - runs-on: ubuntu-latest - needs: [check-infrastructure, deployment-gate] - if: always() - steps: - - name: Summary - run: | - if [ "${{ needs.check-infrastructure.result }}" == "success" ] && [ "${{ needs.deployment-gate.result }}" == "success" ]; then - echo "✅ All infrastructure checks passed" - echo "Platform is ready for deployment and autonomous evolution" - else - echo "⚠️ Infrastructure checks incomplete" - echo "Please review and complete infrastructure setup" - fi diff --git a/.github/workflows/major-updates.yml b/.github/workflows/major-updates.yml new file mode 100644 index 0000000..54fe88b --- /dev/null +++ b/.github/workflows/major-updates.yml @@ -0,0 +1,47 @@ +name: Check Major Version Updates + +on: + schedule: + - cron: '0 10 1 * *' # 1st of month at 10 AM + workflow_dispatch: + +permissions: + contents: read + issues: write + +jobs: + check-major: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + + - name: Check for major updates + id: check + run: | + echo "# 🚀 Major Version Updates Available" > report.md + echo "" >> report.md + + # Check each workspace + for dir in frontend backend services/* ai; do + if [ -f "$dir/package.json" ]; then + echo "## $dir" >> report.md + npm outdated --json | jq -r ' + to_entries[] | + select(.value.current | split(".")[0] != .value.latest | split(".")[0]) | + "- **\(.key)**: \(.value.current) → \(.value.latest) (major)" + ' >> report.md 2>&1 || true + echo "" >> report.md + fi + done + + - name: Create Issue + uses: peter-evans/create-issue-from-file@v5 + with: + title: Major Version Updates Available + content-filepath: ./report.md + labels: major-update, review-required diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..c4285d2 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,31 @@ +name: Publish JSR + +on: + push: + branches: + - main + +jobs: + publish: + runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + + # Skip publishing for forks + if: github.repository_owner == 'denoland' + + steps: + - uses: actions/checkout@v6 + + - name: Install Deno + uses: denoland/setup-deno@v2 + with: + cache: true + deno-version: canary + + - name: Install dependencies + run: deno install + + - name: Publish + run: deno publish diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 0c843d5..84307f5 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -1,83 +1,83 @@ -name: Security Scanning - -on: - push: - branches: [ main, develop ] - pull_request: - branches: [ main ] - schedule: - - cron: '0 0 * * 1' # Run weekly on Monday - workflow_dispatch: - -permissions: - contents: read - security-events: write - actions: read - -jobs: - codeql: - name: CodeQL Analysis - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - language: [ 'javascript', 'typescript' ] - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: ${{ matrix.language }} - queries: security-extended,security-and-quality - - - name: Autobuild - uses: github/codeql-action/autobuild@v3 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:${{matrix.language}}" - - dependency-review: - name: Dependency Review - runs-on: ubuntu-latest - if: github.event_name == 'pull_request' - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Dependency Review - uses: actions/dependency-review-action@v4 - with: - fail-on-severity: moderate - deny-licenses: GPL-2.0, GPL-3.0 - - npm-audit: - name: NPM Security Audit - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '20' - cache: 'npm' - - - name: Run npm audit - run: npm audit --audit-level=moderate - continue-on-error: true - - - name: Generate audit report - run: npm audit --json > audit-report.json || true - - - name: Upload audit report - uses: actions/upload-artifact@v4 - with: - name: npm-audit-report - path: audit-report.json - retention-days: 30 +name: Security Scanning + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main ] + schedule: + - cron: '0 0 * * 1' # Run weekly on Monday + workflow_dispatch: + +permissions: + contents: read + security-events: write + actions: read + +jobs: + codeql: + name: CodeQL Analysis + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + language: [ 'javascript', 'typescript' ] + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + queries: security-extended,security-and-quality + + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" + + dependency-review: + name: Dependency Review + runs-on: ubuntu-latest + if: github.event_name == 'pull_request' + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Dependency Review + uses: actions/dependency-review-action@v4 + with: + fail-on-severity: moderate + deny-licenses: GPL-2.0, GPL-3.0 + + npm-audit: + name: NPM Security Audit + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'npm' + + - name: Run npm audit + run: npm audit --audit-level=moderate + continue-on-error: true + + - name: Generate audit report + run: npm audit --json > audit-report.json || true + + - name: Upload audit report + uses: actions/upload-artifact@v4 + with: + name: npm-audit-report + path: audit-report.json + retention-days: 30 diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml new file mode 100644 index 0000000..2fec2b1 --- /dev/null +++ b/.github/workflows/semgrep.yml @@ -0,0 +1,26 @@ +on: + workflow_dispatch: {} + pull_request: {} + push: + branches: + - main + - master + paths: + - .github/workflows/semgrep.yml + schedule: + # random HH:MM to avoid a load spike on GitHub Actions at 00:00 + - cron: 16 12 * * * +name: Semgrep +jobs: + semgrep: + name: semgrep/ci + runs-on: ubuntu-latest + permissions: + contents: read + env: + SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} + container: + image: semgrep/semgrep + steps: + - uses: actions/checkout@v4 + - run: semgrep ci diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml index c19c4ac..2e750cb 100644 --- a/.github/workflows/terraform.yml +++ b/.github/workflows/terraform.yml @@ -1,334 +1,334 @@ -name: Terraform Infrastructure Deployment - -on: - pull_request: - paths: - - 'terraform/**' - - '.github/workflows/terraform.yml' - push: - branches: - - main - paths: - - 'terraform/**' - workflow_dispatch: - inputs: - environment: - description: 'Environment to deploy' - required: true - type: choice - options: - - development - - staging - - production - -permissions: - contents: read - pull-requests: write - id-token: write - -env: - TERRAFORM_VERSION: '1.5.0' - -jobs: - terraform-plan: - name: Terraform Plan - runs-on: ubuntu-latest - strategy: - matrix: - environment: [development, staging] - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 - with: - terraform_version: ${{ env.TERRAFORM_VERSION }} - - - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v2 - with: - credentials_json: ${{ secrets.GCP_CREDENTIALS }} - - - name: Setup gcloud CLI - uses: google-github-actions/setup-gcloud@v2 - - - name: Terraform Format Check - id: fmt - run: | - cd terraform - terraform fmt -check -recursive - continue-on-error: true - - - name: Terraform Init - id: init - run: | - cd terraform - terraform init -backend-config=backend-${{ matrix.environment }}.tfbackend - - - name: Terraform Validate - id: validate - run: | - cd terraform - terraform validate -no-color - - - name: Terraform Plan - id: plan - run: | - cd terraform - terraform plan \ - -var-file=terraform.tfvars.${{ matrix.environment }} \ - -out=tfplan-${{ matrix.environment }} \ - -no-color - continue-on-error: true - - - name: Comment PR with Plan - uses: actions/github-script@v7 - if: github.event_name == 'pull_request' - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\` - #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\` - #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\` - #### Terraform Plan 📖\`${{ steps.plan.outcome }}\` - -
Show Plan for ${{ matrix.environment }} - - \`\`\`terraform - ${{ steps.plan.outputs.stdout }} - \`\`\` - -
- - *Environment:* \`${{ matrix.environment }}\` - *Pusher:* @${{ github.actor }} - *Action:* \`${{ github.event_name }}\``; - - github.rest.issues.createComment({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - body: output - }) - - - name: Upload Plan Artifact - uses: actions/upload-artifact@v4 - with: - name: tfplan-${{ matrix.environment }} - path: terraform/tfplan-${{ matrix.environment }} - retention-days: 5 - - terraform-apply-dev: - name: Apply to Development - runs-on: ubuntu-latest - needs: terraform-plan - if: github.ref == 'refs/heads/main' && github.event_name == 'push' - environment: - name: development - url: https://console.cloud.google.com/home/dashboard?project=deaf-first-dev - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 - with: - terraform_version: ${{ env.TERRAFORM_VERSION }} - - - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v2 - with: - credentials_json: ${{ secrets.GCP_CREDENTIALS }} - - - name: Setup gcloud CLI - uses: google-github-actions/setup-gcloud@v2 - - - name: Terraform Init - run: | - cd terraform - terraform init -backend-config=backend-development.tfbackend - - - name: Download Plan Artifact - uses: actions/download-artifact@v4 - with: - name: tfplan-development - path: terraform - - - name: Terraform Apply - run: | - cd terraform - terraform apply -auto-approve tfplan-development - - - name: Terraform Output - id: output - run: | - cd terraform - terraform output -json > outputs.json - cat outputs.json - - - name: Upload Outputs - uses: actions/upload-artifact@v4 - with: - name: terraform-outputs-development - path: terraform/outputs.json - retention-days: 30 - - terraform-apply-staging: - name: Apply to Staging - runs-on: ubuntu-latest - needs: terraform-plan - if: github.ref == 'refs/heads/main' && github.event_name == 'push' - environment: - name: staging - url: https://console.cloud.google.com/home/dashboard?project=deaf-first-staging - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 - with: - terraform_version: ${{ env.TERRAFORM_VERSION }} - - - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v2 - with: - credentials_json: ${{ secrets.GCP_CREDENTIALS_STAGING }} - - - name: Setup gcloud CLI - uses: google-github-actions/setup-gcloud@v2 - - - name: Terraform Init - run: | - cd terraform - terraform init -backend-config=backend-staging.tfbackend - - - name: Download Plan Artifact - uses: actions/download-artifact@v4 - with: - name: tfplan-staging - path: terraform - - - name: Terraform Apply - run: | - cd terraform - terraform apply -auto-approve tfplan-staging - - - name: Terraform Output - id: output - run: | - cd terraform - terraform output -json > outputs.json - cat outputs.json - - - name: Upload Outputs - uses: actions/upload-artifact@v4 - with: - name: terraform-outputs-staging - path: terraform/outputs.json - retention-days: 30 - - terraform-apply-production: - name: Apply to Production - runs-on: ubuntu-latest - needs: terraform-apply-staging - if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'production' - environment: - name: production - url: https://console.cloud.google.com/home/dashboard?project=deaf-first-production - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 - with: - terraform_version: ${{ env.TERRAFORM_VERSION }} - - - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v2 - with: - credentials_json: ${{ secrets.GCP_CREDENTIALS_PRODUCTION }} - - - name: Setup gcloud CLI - uses: google-github-actions/setup-gcloud@v2 - - - name: Terraform Init - run: | - cd terraform - terraform init -backend-config=backend-prod.tfbackend - - - name: Terraform Plan - run: | - cd terraform - terraform plan \ - -var-file=terraform.tfvars.prod \ - -out=tfplan-production \ - -no-color - - - name: Terraform Apply - run: | - cd terraform - terraform apply -auto-approve tfplan-production - - - name: Terraform Output - id: output - run: | - cd terraform - terraform output -json > outputs.json - cat outputs.json - - - name: Upload Outputs - uses: actions/upload-artifact@v4 - with: - name: terraform-outputs-production - path: terraform/outputs.json - retention-days: 90 - - - name: Create Deployment Summary - run: | - cd terraform - echo "## 🎉 Production Deployment Complete" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "### Deployment Details" >> $GITHUB_STEP_SUMMARY - echo "- **Environment:** Production" >> $GITHUB_STEP_SUMMARY - echo "- **Deployed by:** @${{ github.actor }}" >> $GITHUB_STEP_SUMMARY - echo "- **Timestamp:** $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "### Infrastructure Outputs" >> $GITHUB_STEP_SUMMARY - echo "\`\`\`json" >> $GITHUB_STEP_SUMMARY - cat outputs.json >> $GITHUB_STEP_SUMMARY - echo "\`\`\`" >> $GITHUB_STEP_SUMMARY - - security-scan: - name: Security Scan - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Run Trivy security scanner - uses: aquasecurity/trivy-action@master - with: - scan-type: 'config' - scan-ref: 'terraform' - format: 'sarif' - output: 'trivy-results.sarif' - - - name: Upload Trivy results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: 'trivy-results.sarif' - - - name: Run Checkov security scan - uses: bridgecrewio/checkov-action@master - with: - directory: terraform - framework: terraform - output_format: cli - soft_fail: true +name: Terraform Infrastructure Deployment + +on: + pull_request: + paths: + - 'terraform/**' + - '.github/workflows/terraform.yml' + push: + branches: + - main + paths: + - 'terraform/**' + workflow_dispatch: + inputs: + environment: + description: 'Environment to deploy' + required: true + type: choice + options: + - development + - staging + - production + +permissions: + contents: read + pull-requests: write + id-token: write + +env: + TERRAFORM_VERSION: '1.5.0' + +jobs: + terraform-plan: + name: Terraform Plan + runs-on: ubuntu-latest + strategy: + matrix: + environment: [development, staging] + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: ${{ env.TERRAFORM_VERSION }} + + - name: Authenticate to Google Cloud + uses: google-github-actions/auth@v2 + with: + credentials_json: ${{ secrets.GCP_CREDENTIALS }} + + - name: Setup gcloud CLI + uses: google-github-actions/setup-gcloud@v2 + + - name: Terraform Format Check + id: fmt + run: | + cd terraform + terraform fmt -check -recursive + continue-on-error: true + + - name: Terraform Init + id: init + run: | + cd terraform + terraform init -backend-config=backend-${{ matrix.environment }}.tfbackend + + - name: Terraform Validate + id: validate + run: | + cd terraform + terraform validate -no-color + + - name: Terraform Plan + id: plan + run: | + cd terraform + terraform plan \ + -var-file=terraform.tfvars.${{ matrix.environment }} \ + -out=tfplan-${{ matrix.environment }} \ + -no-color + continue-on-error: true + + - name: Comment PR with Plan + uses: actions/github-script@v7 + if: github.event_name == 'pull_request' + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\` + #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\` + #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\` + #### Terraform Plan 📖\`${{ steps.plan.outcome }}\` + +
Show Plan for ${{ matrix.environment }} + + \`\`\`terraform + ${{ steps.plan.outputs.stdout }} + \`\`\` + +
+ + *Environment:* \`${{ matrix.environment }}\` + *Pusher:* @${{ github.actor }} + *Action:* \`${{ github.event_name }}\``; + + github.rest.issues.createComment({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + body: output + }) + + - name: Upload Plan Artifact + uses: actions/upload-artifact@v4 + with: + name: tfplan-${{ matrix.environment }} + path: terraform/tfplan-${{ matrix.environment }} + retention-days: 5 + + terraform-apply-dev: + name: Apply to Development + runs-on: ubuntu-latest + needs: terraform-plan + if: github.ref == 'refs/heads/main' && github.event_name == 'push' + environment: + name: development + url: https://console.cloud.google.com/home/dashboard?project=deaf-first-dev + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: ${{ env.TERRAFORM_VERSION }} + + - name: Authenticate to Google Cloud + uses: google-github-actions/auth@v2 + with: + credentials_json: ${{ secrets.GCP_CREDENTIALS }} + + - name: Setup gcloud CLI + uses: google-github-actions/setup-gcloud@v2 + + - name: Terraform Init + run: | + cd terraform + terraform init -backend-config=backend-development.tfbackend + + - name: Download Plan Artifact + uses: actions/download-artifact@v4 + with: + name: tfplan-development + path: terraform + + - name: Terraform Apply + run: | + cd terraform + terraform apply -auto-approve tfplan-development + + - name: Terraform Output + id: output + run: | + cd terraform + terraform output -json > outputs.json + cat outputs.json + + - name: Upload Outputs + uses: actions/upload-artifact@v4 + with: + name: terraform-outputs-development + path: terraform/outputs.json + retention-days: 30 + + terraform-apply-staging: + name: Apply to Staging + runs-on: ubuntu-latest + needs: terraform-plan + if: github.ref == 'refs/heads/main' && github.event_name == 'push' + environment: + name: staging + url: https://console.cloud.google.com/home/dashboard?project=deaf-first-staging + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: ${{ env.TERRAFORM_VERSION }} + + - name: Authenticate to Google Cloud + uses: google-github-actions/auth@v2 + with: + credentials_json: ${{ secrets.GCP_CREDENTIALS_STAGING }} + + - name: Setup gcloud CLI + uses: google-github-actions/setup-gcloud@v2 + + - name: Terraform Init + run: | + cd terraform + terraform init -backend-config=backend-staging.tfbackend + + - name: Download Plan Artifact + uses: actions/download-artifact@v4 + with: + name: tfplan-staging + path: terraform + + - name: Terraform Apply + run: | + cd terraform + terraform apply -auto-approve tfplan-staging + + - name: Terraform Output + id: output + run: | + cd terraform + terraform output -json > outputs.json + cat outputs.json + + - name: Upload Outputs + uses: actions/upload-artifact@v4 + with: + name: terraform-outputs-staging + path: terraform/outputs.json + retention-days: 30 + + terraform-apply-production: + name: Apply to Production + runs-on: ubuntu-latest + needs: terraform-apply-staging + if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'production' + environment: + name: production + url: https://console.cloud.google.com/home/dashboard?project=deaf-first-production + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: ${{ env.TERRAFORM_VERSION }} + + - name: Authenticate to Google Cloud + uses: google-github-actions/auth@v2 + with: + credentials_json: ${{ secrets.GCP_CREDENTIALS_PRODUCTION }} + + - name: Setup gcloud CLI + uses: google-github-actions/setup-gcloud@v2 + + - name: Terraform Init + run: | + cd terraform + terraform init -backend-config=backend-prod.tfbackend + + - name: Terraform Plan + run: | + cd terraform + terraform plan \ + -var-file=terraform.tfvars.prod \ + -out=tfplan-production \ + -no-color + + - name: Terraform Apply + run: | + cd terraform + terraform apply -auto-approve tfplan-production + + - name: Terraform Output + id: output + run: | + cd terraform + terraform output -json > outputs.json + cat outputs.json + + - name: Upload Outputs + uses: actions/upload-artifact@v4 + with: + name: terraform-outputs-production + path: terraform/outputs.json + retention-days: 90 + + - name: Create Deployment Summary + run: | + cd terraform + echo "## 🎉 Production Deployment Complete" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "### Deployment Details" >> $GITHUB_STEP_SUMMARY + echo "- **Environment:** Production" >> $GITHUB_STEP_SUMMARY + echo "- **Deployed by:** @${{ github.actor }}" >> $GITHUB_STEP_SUMMARY + echo "- **Timestamp:** $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "### Infrastructure Outputs" >> $GITHUB_STEP_SUMMARY + echo "\`\`\`json" >> $GITHUB_STEP_SUMMARY + cat outputs.json >> $GITHUB_STEP_SUMMARY + echo "\`\`\`" >> $GITHUB_STEP_SUMMARY + + security-scan: + name: Security Scan + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Run Trivy security scanner + uses: aquasecurity/trivy-action@master + with: + scan-type: 'config' + scan-ref: 'terraform' + format: 'sarif' + output: 'trivy-results.sarif' + + - name: Upload Trivy results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: 'trivy-results.sarif' + + - name: Run Checkov security scan + uses: bridgecrewio/checkov-action@master + with: + directory: terraform + framework: terraform + output_format: cli + soft_fail: true diff --git a/.gitignore b/.gitignore index d50ca93..cf58aa1 100644 --- a/.gitignore +++ b/.gitignore @@ -1,65 +1,131 @@ -# Dependencies -node_modules/ -.pnp -.pnp.js - -# Testing -coverage/ -*.lcov -.nyc_output - -# Production builds -dist/ -build/ -out/ -.next/ - -# Environment variables -.env -.env.local -.env.development.local -.env.test.local -.env.production.local - -# Logs -logs -*.log -npm-debug.log* -yarn-debug.log* -yarn-error.log* -lerna-debug.log* -pnpm-debug.log* - -# OS files -.DS_Store -Thumbs.db - -# Editor directories and files -.vscode/ -.idea/ -*.swp -*.swo -*~ -.project -.classpath -.settings/ - -# TypeScript -*.tsbuildinfo - -# Database -*.db -*.sqlite -*.sqlite3 - -# Docker -.docker/ - -# Temporary files -tmp/ -temp/ -*.tmp - -# MCP Server specific -.mcp/ -mcp-data/ +# Environment variables +.env +.env.local +.env.*.local + +# Dependencies +node_modules/** +package-lock.json +yarn.lock +pnpm-lock.yaml + +# Python +__pycache__/ +*.py[cod] +*$py.class +*.so +.Python +venv/** +env/** +ENV/** +.venv + +# Build outputs +dist/** +build/** +*.egg-info/** +.next/** +out/** + + +# Deployment platform overrides +.replit +replit.nix +vercel.json +.vercel/ + +# IDE +.vscode/** +.idea/** +*.swp +*.swo +*~ +.DS_Store + +# Logs +logs/ +# Dependencies +node_modules/** +.pnp +.pnp.js + +# Testing +coverage/ +*.lcov +.nyc_output + +# Production builds +dist/** +build/** +out/** +.next/** +"next-env.d.ts", + +# Environment variables +.env +.env.local +.env.development.local +.env.test.local +.env.production.local + +# Logs +logs +*.log +npm-debug.log* +yarn-debug.log* +yarn-error.log* + +# Testing +coverage/** +.nyc_output/** +.pytest_cache/** + +# Temporary files +tmp/** +temp/** +*.tmp +lerna-debug.log* +pnpm-debug.log* + +# OS files +.DS_Store +Thumbs.db + +# Editor directories and files +.vscode/** +.idea/** +*.swp +*.swo +*~ +.project +.classpath +.settings/** + +# TypeScript +*.tsbuildinfo + +# Database +*.db +*.sqlite +*.sqlite3 + +# Generated SDKs +sdks/** + +# API keys and secrets +*.pem +*.key +credentials.json +service-account.json +# Docker +.docker/** + +# Temporary files +tmp/** +temp/** +*.tmp + +# MCP Server specific +.mcp/** +mcp-data/** + diff --git a/.husky/pre-commit b/.husky/pre-commit index 7e15468..15e4d71 100755 --- a/.husky/pre-commit +++ b/.husky/pre-commit @@ -1,4 +1,4 @@ -#!/usr/bin/env sh -. "$(dirname -- "$0")/_/husky.sh" - -npm run lint-staged +#!/usr/bin/env sh +. "$(dirname -- "$0")/_/husky.sh" + +npm run lint-staged diff --git a/.husky/pre-push b/.husky/pre-push index a43a286..b31dd10 100755 --- a/.husky/pre-push +++ b/.husky/pre-push @@ -1,4 +1,4 @@ -#!/usr/bin/env sh -. "$(dirname -- "$0")/_/husky.sh" - -npm run type-check +#!/usr/bin/env sh +. "$(dirname -- "$0")/_/husky.sh" + +npm run type-check diff --git a/.lintstagedrc.json b/.lintstagedrc.json index cee9356..162eab8 100644 --- a/.lintstagedrc.json +++ b/.lintstagedrc.json @@ -1,9 +1,9 @@ -{ - "*.{ts,tsx,js,jsx}": [ - "eslint --fix", - "prettier --write" - ], - "*.{json,md,yml,yaml}": [ - "prettier --write" - ] -} +{ + "*.{ts,tsx,js,jsx}": [ + "eslint --fix", + "prettier --write" + ], + "*.{json,md,yml,yaml}": [ + "prettier --write" + ] +} diff --git a/.prettierrc.json b/.prettierrc.json index 8f6a964..49836a6 100644 --- a/.prettierrc.json +++ b/.prettierrc.json @@ -1,12 +1,12 @@ -{ - "semi": true, - "trailingComma": "es5", - "singleQuote": true, - "printWidth": 100, - "tabWidth": 2, - "useTabs": false, - "arrowParens": "always", - "endOfLine": "lf", - "bracketSpacing": true, - "bracketSameLine": false -} +{ + "semi": true, + "trailingComma": "es5", + "singleQuote": true, + "printWidth": 100, + "tabWidth": 2, + "useTabs": false, + "arrowParens": "always", + "endOfLine": "lf", + "bracketSpacing": true, + "bracketSameLine": false +} diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 7205387..88e6826 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -1,500 +1,500 @@ -# DEAF-FIRST Platform Architecture - -## Table of Contents -- [Overview](#overview) -- [System Architecture](#system-architecture) -- [Service Interconnections](#service-interconnections) -- [Data Flows](#data-flows) -- [AI Workflows](#ai-workflows) -- [Technology Stack](#technology-stack) -- [Deployment Architecture](#deployment-architecture) -- [Security Architecture](#security-architecture) - -## Overview - -The DEAF-FIRST Platform is a comprehensive, microservices-based SaaS ecosystem designed with accessibility as the primary focus. The architecture follows modern cloud-native patterns with emphasis on scalability, maintainability, and modularity. - -### Core Design Principles - -1. **Accessibility First**: Every component is designed with deaf and hard-of-hearing users in mind -2. **Modular Architecture**: Independent, loosely-coupled services that can be developed and deployed separately -3. **Real-time Communication**: WebSocket-based synchronization for instant updates -4. **AI-Powered**: Intelligent workflows and automation throughout the platform -5. **MCP Protocol**: Model Context Protocol integration for AI service communication - -## System Architecture - -```mermaid -graph TB - subgraph "Frontend Layer" - FE[React Frontend
@deaf-first/frontend] - end - - subgraph "API Gateway Layer" - BACKEND[Express Backend
@deaf-first/backend] - end - - subgraph "Core Services" - AUTH[DeafAUTH Service
Authentication & User Mgmt] - SYNC[PinkSync Service
Real-time Sync] - FIBR[FibonRose Service
Optimization Engine] - A11Y[Accessibility Nodes
A11Y Features] - AI[AI Services
AI Workflows] - end - - subgraph "Data Layer" - PGMAIN[(PostgreSQL
Main DB)] - PGAUTH[(PostgreSQL
Auth DB)] - REDIS[(Redis
Cache & Pub/Sub)] - end - - subgraph "External Services" - OPENAI[OpenAI API] - MCP[MCP Servers] - end - - FE -->|HTTP/REST| BACKEND - FE -->|WebSocket| SYNC - - BACKEND --> AUTH - BACKEND --> SYNC - BACKEND --> FIBR - BACKEND --> A11Y - BACKEND --> AI - - AUTH --> PGAUTH - BACKEND --> PGMAIN - SYNC --> REDIS - - AI --> OPENAI - AUTH -.->|MCP| MCP - SYNC -.->|MCP| MCP - FIBR -.->|MCP| MCP - A11Y -.->|MCP| MCP - AI -.->|MCP| MCP - - style FE fill:#667eea - style BACKEND fill:#764ba2 - style AUTH fill:#f093fb - style SYNC fill:#4facfe - style FIBR fill:#43e97b - style A11Y fill:#fa709a - style AI fill:#fee140 -``` - -## Service Interconnections - -### Frontend (@deaf-first/frontend) -- **Technology**: React 18, TypeScript, Vite -- **Port**: 5173 (dev), 80/443 (prod) -- **Dependencies**: Backend API, PinkSync WebSocket -- **Responsibilities**: - - User interface rendering - - Accessibility features (WCAG 2.1 AAA) - - Real-time UI updates - - Sign language support integration - -**API Connections**: -- `GET/POST /api/*` → Backend REST API -- `WS /ws` → PinkSync WebSocket connection - -### Backend (@deaf-first/backend) -- **Technology**: Express.js, TypeScript, PostgreSQL -- **Port**: 3000 -- **Dependencies**: All microservices, PostgreSQL, JWT -- **Responsibilities**: - - API gateway and request routing - - Business logic orchestration - - Database operations - - Webhook management - - Authentication middleware - -**Service Integration**: -```typescript -// Routes to services -/api/auth/* → DeafAUTH Service -/api/sync/* → PinkSync Service -/api/optimize/* → FibonRose Service -/api/accessibility/* → Accessibility Nodes -/api/ai/* → AI Services -/api/webhooks/* → Webhook handlers -``` - -### DeafAUTH Service (@deaf-first/deafauth) -- **Technology**: Express.js, TypeScript, PostgreSQL, JWT -- **Port**: 3002 -- **Database**: Dedicated PostgreSQL instance -- **Responsibilities**: - - User authentication (JWT-based) - - User registration and profile management - - Accessibility preferences storage - - Session management - - MCP server for auth operations - -**API Endpoints**: -- `POST /auth/register` - User registration -- `POST /auth/login` - User login -- `GET /auth/profile` - Get user profile -- `PUT /auth/preferences` - Update accessibility preferences -- `POST /auth/refresh` - Refresh JWT token - -**MCP Operations**: -- User creation and management -- Authentication status checks -- Permission validation - -### PinkSync Service (@deaf-first/pinksync) -- **Technology**: WebSocket, Redis Pub/Sub, TypeScript -- **Port**: 3003 -- **Dependencies**: Redis -- **Responsibilities**: - - Real-time data synchronization - - WebSocket connection management - - Event broadcasting - - State synchronization across clients - - MCP server for sync operations - -**Event Types**: -- `user.update` - User data changes -- `document.change` - Document modifications -- `notification.new` - New notifications -- `presence.change` - User presence updates - -**Architecture**: -``` -Client 1 → WebSocket → PinkSync → Redis Pub/Sub → PinkSync → WebSocket → Client 2 -``` - -### FibonRose Service (@deaf-first/fibonrose) -- **Technology**: TypeScript, Mathematical algorithms -- **Port**: 3004 -- **Responsibilities**: - - Fibonacci-based scheduling optimization - - Performance analytics - - Resource allocation optimization - - Load balancing calculations - - MCP server for optimization queries - -**Optimization Algorithms**: -- Fibonacci heap for priority queues -- Golden ratio-based scheduling -- Performance metric calculations -- Resource distribution optimization - -### Accessibility Nodes (@deaf-first/accessibility-nodes) -- **Technology**: TypeScript, Various A11Y libraries -- **Port**: 3005 -- **Responsibilities**: - - Sign language interpretation APIs - - Visual accessibility enhancements - - Screen reader optimization - - WCAG compliance validation - - MCP server for accessibility APIs - -**Features**: -- Text-to-sign-language conversion -- Visual contrast optimization -- Closed captioning generation -- Audio description synthesis -- Keyboard navigation enhancement - -### AI Services (@deaf-first/ai) -- **Technology**: TypeScript, OpenAI API -- **Port**: 3006 -- **Dependencies**: OpenAI API -- **Responsibilities**: - - Natural language processing - - Sign language generation - - Workflow automation - - Content simplification - - MCP server for AI operations - -**AI Workflows**: -- Document summarization -- Text simplification for accessibility -- Sign language avatar generation -- Context-aware assistance - -## Data Flows - -### User Authentication Flow - -```mermaid -sequenceDiagram - participant User - participant Frontend - participant Backend - participant DeafAUTH - participant Database - - User->>Frontend: Enter credentials - Frontend->>Backend: POST /api/auth/login - Backend->>DeafAUTH: Validate credentials - DeafAUTH->>Database: Query user - Database-->>DeafAUTH: User data - DeafAUTH->>DeafAUTH: Generate JWT - DeafAUTH-->>Backend: JWT + User data - Backend-->>Frontend: Auth token - Frontend->>Frontend: Store token - Frontend-->>User: Redirect to dashboard -``` - -### Real-time Synchronization Flow - -```mermaid -sequenceDiagram - participant Client1 - participant PinkSync - participant Redis - participant Client2 - - Client1->>PinkSync: WS: Update data - PinkSync->>Redis: Publish event - Redis->>PinkSync: Broadcast to subscribers - PinkSync->>Client1: Confirm update - PinkSync->>Client2: Push update - Client2->>Client2: Update UI -``` - -### AI Processing Flow - -```mermaid -sequenceDiagram - participant User - participant Frontend - participant Backend - participant AI Service - participant OpenAI - participant A11Y Nodes - - User->>Frontend: Request document summary - Frontend->>Backend: POST /api/ai/summarize - Backend->>AI Service: Process request - AI Service->>OpenAI: API call - OpenAI-->>AI Service: Summary result - AI Service->>A11Y Nodes: Generate accessible version - A11Y Nodes-->>AI Service: Accessible content - AI Service-->>Backend: Complete response - Backend-->>Frontend: Summary + A11Y version - Frontend-->>User: Display results -``` - -## AI Workflows - -### Document Processing Workflow - -1. **Input**: User uploads document -2. **OCR**: Extract text content -3. **Analysis**: AI Service analyzes content structure -4. **Simplification**: Generate simplified version -5. **Sign Language**: Create sign language interpretation -6. **Output**: Multiple accessible formats - -### Accessibility Enhancement Workflow - -1. **Content Scan**: Analyze content for accessibility issues -2. **Issue Detection**: Identify WCAG violations -3. **Auto-Fix**: Apply automated fixes where possible -4. **AI Enhancement**: Use AI to improve content clarity -5. **Validation**: Verify WCAG compliance -6. **Report**: Generate accessibility report - -### Real-time Assistance Workflow - -1. **User Query**: User asks question via chat -2. **Context Gathering**: Collect relevant context -3. **AI Processing**: OpenAI generates response -4. **Accessibility Check**: Ensure response is accessible -5. **Sign Language**: Generate sign interpretation -6. **Multi-format Response**: Deliver in text + sign language - -## Technology Stack - -### Frontend Technologies -- **Framework**: React 18 -- **Language**: TypeScript 5.7 -- **Build Tool**: Vite 6.0 -- **State Management**: TanStack Query -- **HTTP Client**: Axios -- **Styling**: CSS3 with modern features - -### Backend Technologies -- **Runtime**: Node.js 20+ -- **Framework**: Express.js -- **Language**: TypeScript 5.7 -- **Database**: PostgreSQL 14+ -- **Cache**: Redis 7+ -- **Authentication**: JWT (jsonwebtoken) -- **Security**: Helmet, CORS - -### DevOps & Infrastructure -- **Container**: Docker -- **Orchestration**: Docker Compose / Kubernetes -- **CI/CD**: GitHub Actions -- **Monitoring**: (To be implemented) -- **Logging**: (To be implemented) - -### AI & ML -- **AI Provider**: OpenAI API -- **Protocol**: MCP (Model Context Protocol) -- **Frameworks**: Custom TypeScript implementations - -## Deployment Architecture - -### Development Environment - -``` -Developer Workstation -├── Frontend (localhost:5173) -├── Backend (localhost:3000) -├── DeafAUTH (localhost:3002) -├── PinkSync (localhost:3003) -├── FibonRose (localhost:3004) -├── Accessibility Nodes (localhost:3005) -└── AI Services (localhost:3006) -``` - -### Docker Compose Deployment - -```yaml -services: - frontend: { image: deaf-first-frontend, ports: [80:80] } - backend: { image: deaf-first-backend, ports: [3000:3000] } - deafauth: { image: deaf-first-deafauth, ports: [3002:3002] } - pinksync: { image: deaf-first-pinksync, ports: [3003:3003] } - fibonrose: { image: deaf-first-fibonrose, ports: [3004:3004] } - accessibility: { image: deaf-first-a11y, ports: [3005:3005] } - ai: { image: deaf-first-ai, ports: [3006:3006] } - postgres: { image: postgres:14 } - redis: { image: redis:7 } -``` - -### Production Architecture (Recommended) - -``` -Internet - ↓ -Load Balancer (HTTPS) - ↓ -├─ Frontend (Static CDN) -└─ API Gateway (Backend) - ↓ - ├─ DeafAUTH Service (Auto-scaled) - ├─ PinkSync Service (Auto-scaled) - ├─ FibonRose Service (Auto-scaled) - ├─ Accessibility Nodes (Auto-scaled) - └─ AI Services (Auto-scaled) - ↓ - ├─ PostgreSQL (Managed DB) - ├─ Redis (Managed Cache) - └─ Object Storage -``` - -## Security Architecture - -### Authentication & Authorization - -- **JWT-based Authentication**: Stateless token authentication -- **Token Refresh**: Secure token rotation mechanism -- **RBAC**: Role-based access control (to be implemented) -- **Session Management**: Redis-backed session storage - -### Data Protection - -- **Encryption at Rest**: Database encryption -- **Encryption in Transit**: TLS/HTTPS for all connections -- **Password Security**: bcrypt hashing with salt -- **API Security**: Helmet middleware, CORS policies - -### Security Measures - -1. **Input Validation**: All inputs validated and sanitized -2. **SQL Injection Prevention**: Parameterized queries -3. **XSS Prevention**: Content Security Policy headers -4. **CSRF Protection**: CSRF tokens for state-changing operations -5. **Rate Limiting**: Request rate limiting per endpoint -6. **Audit Logging**: Security event logging (to be implemented) - -### Webhook Security - -- **HMAC Verification**: SHA-256 signature validation -- **Secret Management**: Environment-based secret storage -- **Replay Attack Prevention**: Timestamp validation -- **IP Whitelisting**: Configurable IP restrictions - -## Scalability Considerations - -### Horizontal Scaling - -All services are designed to be stateless and horizontally scalable: -- Multiple instances behind load balancer -- Shared state in Redis -- Database connection pooling -- WebSocket sticky sessions for PinkSync - -### Vertical Scaling - -- CPU-intensive AI operations can use larger instances -- Database can be scaled up for better query performance -- Redis can be increased for larger cache capacity - -### Caching Strategy - -1. **Application Cache**: Redis for frequently accessed data -2. **Database Query Cache**: PostgreSQL query result caching -3. **CDN Cache**: Static assets served from CDN -4. **API Response Cache**: Cacheable API responses - -## Monitoring & Observability - -### Metrics (To Be Implemented) - -- Request latency and throughput -- Error rates and types -- Service health checks -- Resource utilization (CPU, memory, disk) -- Database connection pool stats -- WebSocket connection counts - -### Logging Strategy (To Be Implemented) - -- Structured JSON logging -- Centralized log aggregation -- Log levels: ERROR, WARN, INFO, DEBUG -- Correlation IDs for request tracing -- Performance logging - -### Alerting (To Be Implemented) - -- Service downtime alerts -- High error rate alerts -- Performance degradation alerts -- Security incident alerts -- Resource exhaustion alerts - -## Future Enhancements - -1. **GraphQL API**: Add GraphQL layer for flexible querying -2. **Message Queue**: Implement RabbitMQ/Kafka for async processing -3. **Service Mesh**: Add Istio for advanced service management -4. **Monitoring Stack**: Implement Prometheus + Grafana -5. **Distributed Tracing**: Add Jaeger for request tracing -6. **API Rate Limiting**: Per-user rate limiting -7. **Multi-tenancy**: Support for multiple organizations -8. **Advanced AI**: Custom ML models for sign language -9. **Mobile Apps**: Native iOS/Android applications -10. **Offline Support**: Progressive Web App with offline capabilities - -## Contributing - -For information on contributing to this architecture, see [CONTRIBUTING.md](./CONTRIBUTING.md). - -## License - -MIT License - see [LICENSE](./LICENSE) file for details. - ---- - -**Version**: 2.0.0 -**Last Updated**: December 2024 -**Maintained By**: 360 Magicians +# DEAF-FIRST Platform Architecture + +## Table of Contents +- [Overview](#overview) +- [System Architecture](#system-architecture) +- [Service Interconnections](#service-interconnections) +- [Data Flows](#data-flows) +- [AI Workflows](#ai-workflows) +- [Technology Stack](#technology-stack) +- [Deployment Architecture](#deployment-architecture) +- [Security Architecture](#security-architecture) + +## Overview + +The DEAF-FIRST Platform is a comprehensive, microservices-based SaaS ecosystem designed with accessibility as the primary focus. The architecture follows modern cloud-native patterns with emphasis on scalability, maintainability, and modularity. + +### Core Design Principles + +1. **Accessibility First**: Every component is designed with deaf and hard-of-hearing users in mind +2. **Modular Architecture**: Independent, loosely-coupled services that can be developed and deployed separately +3. **Real-time Communication**: WebSocket-based synchronization for instant updates +4. **AI-Powered**: Intelligent workflows and automation throughout the platform +5. **MCP Protocol**: Model Context Protocol integration for AI service communication + +## System Architecture + +```mermaid +graph TB + subgraph "Frontend Layer" + FE[React Frontend
@deaf-first/frontend] + end + + subgraph "API Gateway Layer" + BACKEND[Express Backend
@deaf-first/backend] + end + + subgraph "Core Services" + AUTH[DeafAUTH Service
Authentication & User Mgmt] + SYNC[PinkSync Service
Real-time Sync] + FIBR[FibonRose Service
Optimization Engine] + A11Y[Accessibility Nodes
A11Y Features] + AI[AI Services
AI Workflows] + end + + subgraph "Data Layer" + PGMAIN[(PostgreSQL
Main DB)] + PGAUTH[(PostgreSQL
Auth DB)] + REDIS[(Redis
Cache & Pub/Sub)] + end + + subgraph "External Services" + OPENAI[OpenAI API] + MCP[MCP Servers] + end + + FE -->|HTTP/REST| BACKEND + FE -->|WebSocket| SYNC + + BACKEND --> AUTH + BACKEND --> SYNC + BACKEND --> FIBR + BACKEND --> A11Y + BACKEND --> AI + + AUTH --> PGAUTH + BACKEND --> PGMAIN + SYNC --> REDIS + + AI --> OPENAI + AUTH -.->|MCP| MCP + SYNC -.->|MCP| MCP + FIBR -.->|MCP| MCP + A11Y -.->|MCP| MCP + AI -.->|MCP| MCP + + style FE fill:#667eea + style BACKEND fill:#764ba2 + style AUTH fill:#f093fb + style SYNC fill:#4facfe + style FIBR fill:#43e97b + style A11Y fill:#fa709a + style AI fill:#fee140 +``` + +## Service Interconnections + +### Frontend (@deaf-first/frontend) +- **Technology**: React 18, TypeScript, Vite +- **Port**: 5173 (dev), 80/443 (prod) +- **Dependencies**: Backend API, PinkSync WebSocket +- **Responsibilities**: + - User interface rendering + - Accessibility features (WCAG 2.1 AAA) + - Real-time UI updates + - Sign language support integration + +**API Connections**: +- `GET/POST /api/*` → Backend REST API +- `WS /ws` → PinkSync WebSocket connection + +### Backend (@deaf-first/backend) +- **Technology**: Express.js, TypeScript, PostgreSQL +- **Port**: 3000 +- **Dependencies**: All microservices, PostgreSQL, JWT +- **Responsibilities**: + - API gateway and request routing + - Business logic orchestration + - Database operations + - Webhook management + - Authentication middleware + +**Service Integration**: +```typescript +// Routes to services +/api/auth/* → DeafAUTH Service +/api/sync/* → PinkSync Service +/api/optimize/* → FibonRose Service +/api/accessibility/* → Accessibility Nodes +/api/ai/* → AI Services +/api/webhooks/* → Webhook handlers +``` + +### DeafAUTH Service (@deaf-first/deafauth) +- **Technology**: Express.js, TypeScript, PostgreSQL, JWT +- **Port**: 3002 +- **Database**: Dedicated PostgreSQL instance +- **Responsibilities**: + - User authentication (JWT-based) + - User registration and profile management + - Accessibility preferences storage + - Session management + - MCP server for auth operations + +**API Endpoints**: +- `POST /auth/register` - User registration +- `POST /auth/login` - User login +- `GET /auth/profile` - Get user profile +- `PUT /auth/preferences` - Update accessibility preferences +- `POST /auth/refresh` - Refresh JWT token + +**MCP Operations**: +- User creation and management +- Authentication status checks +- Permission validation + +### PinkSync Service (@deaf-first/pinksync) +- **Technology**: WebSocket, Redis Pub/Sub, TypeScript +- **Port**: 3003 +- **Dependencies**: Redis +- **Responsibilities**: + - Real-time data synchronization + - WebSocket connection management + - Event broadcasting + - State synchronization across clients + - MCP server for sync operations + +**Event Types**: +- `user.update` - User data changes +- `document.change` - Document modifications +- `notification.new` - New notifications +- `presence.change` - User presence updates + +**Architecture**: +``` +Client 1 → WebSocket → PinkSync → Redis Pub/Sub → PinkSync → WebSocket → Client 2 +``` + +### FibonRose Service (@deaf-first/fibonrose) +- **Technology**: TypeScript, Mathematical algorithms +- **Port**: 3004 +- **Responsibilities**: + - Fibonacci-based scheduling optimization + - Performance analytics + - Resource allocation optimization + - Load balancing calculations + - MCP server for optimization queries + +**Optimization Algorithms**: +- Fibonacci heap for priority queues +- Golden ratio-based scheduling +- Performance metric calculations +- Resource distribution optimization + +### Accessibility Nodes (@deaf-first/accessibility-nodes) +- **Technology**: TypeScript, Various A11Y libraries +- **Port**: 3005 +- **Responsibilities**: + - Sign language interpretation APIs + - Visual accessibility enhancements + - Screen reader optimization + - WCAG compliance validation + - MCP server for accessibility APIs + +**Features**: +- Text-to-sign-language conversion +- Visual contrast optimization +- Closed captioning generation +- Audio description synthesis +- Keyboard navigation enhancement + +### AI Services (@deaf-first/ai) +- **Technology**: TypeScript, OpenAI API +- **Port**: 3006 +- **Dependencies**: OpenAI API +- **Responsibilities**: + - Natural language processing + - Sign language generation + - Workflow automation + - Content simplification + - MCP server for AI operations + +**AI Workflows**: +- Document summarization +- Text simplification for accessibility +- Sign language avatar generation +- Context-aware assistance + +## Data Flows + +### User Authentication Flow + +```mermaid +sequenceDiagram + participant User + participant Frontend + participant Backend + participant DeafAUTH + participant Database + + User->>Frontend: Enter credentials + Frontend->>Backend: POST /api/auth/login + Backend->>DeafAUTH: Validate credentials + DeafAUTH->>Database: Query user + Database-->>DeafAUTH: User data + DeafAUTH->>DeafAUTH: Generate JWT + DeafAUTH-->>Backend: JWT + User data + Backend-->>Frontend: Auth token + Frontend->>Frontend: Store token + Frontend-->>User: Redirect to dashboard +``` + +### Real-time Synchronization Flow + +```mermaid +sequenceDiagram + participant Client1 + participant PinkSync + participant Redis + participant Client2 + + Client1->>PinkSync: WS: Update data + PinkSync->>Redis: Publish event + Redis->>PinkSync: Broadcast to subscribers + PinkSync->>Client1: Confirm update + PinkSync->>Client2: Push update + Client2->>Client2: Update UI +``` + +### AI Processing Flow + +```mermaid +sequenceDiagram + participant User + participant Frontend + participant Backend + participant AI Service + participant OpenAI + participant A11Y Nodes + + User->>Frontend: Request document summary + Frontend->>Backend: POST /api/ai/summarize + Backend->>AI Service: Process request + AI Service->>OpenAI: API call + OpenAI-->>AI Service: Summary result + AI Service->>A11Y Nodes: Generate accessible version + A11Y Nodes-->>AI Service: Accessible content + AI Service-->>Backend: Complete response + Backend-->>Frontend: Summary + A11Y version + Frontend-->>User: Display results +``` + +## AI Workflows + +### Document Processing Workflow + +1. **Input**: User uploads document +2. **OCR**: Extract text content +3. **Analysis**: AI Service analyzes content structure +4. **Simplification**: Generate simplified version +5. **Sign Language**: Create sign language interpretation +6. **Output**: Multiple accessible formats + +### Accessibility Enhancement Workflow + +1. **Content Scan**: Analyze content for accessibility issues +2. **Issue Detection**: Identify WCAG violations +3. **Auto-Fix**: Apply automated fixes where possible +4. **AI Enhancement**: Use AI to improve content clarity +5. **Validation**: Verify WCAG compliance +6. **Report**: Generate accessibility report + +### Real-time Assistance Workflow + +1. **User Query**: User asks question via chat +2. **Context Gathering**: Collect relevant context +3. **AI Processing**: OpenAI generates response +4. **Accessibility Check**: Ensure response is accessible +5. **Sign Language**: Generate sign interpretation +6. **Multi-format Response**: Deliver in text + sign language + +## Technology Stack + +### Frontend Technologies +- **Framework**: React 18 +- **Language**: TypeScript 5.7 +- **Build Tool**: Vite 6.0 +- **State Management**: TanStack Query +- **HTTP Client**: Axios +- **Styling**: CSS3 with modern features + +### Backend Technologies +- **Runtime**: Node.js 20+ +- **Framework**: Express.js +- **Language**: TypeScript 5.7 +- **Database**: PostgreSQL 14+ +- **Cache**: Redis 7+ +- **Authentication**: JWT (jsonwebtoken) +- **Security**: Helmet, CORS + +### DevOps & Infrastructure +- **Container**: Docker +- **Orchestration**: Docker Compose / Kubernetes +- **CI/CD**: GitHub Actions +- **Monitoring**: (To be implemented) +- **Logging**: (To be implemented) + +### AI & ML +- **AI Provider**: OpenAI API +- **Protocol**: MCP (Model Context Protocol) +- **Frameworks**: Custom TypeScript implementations + +## Deployment Architecture + +### Development Environment + +``` +Developer Workstation +├── Frontend (localhost:5173) +├── Backend (localhost:3000) +├── DeafAUTH (localhost:3002) +├── PinkSync (localhost:3003) +├── FibonRose (localhost:3004) +├── Accessibility Nodes (localhost:3005) +└── AI Services (localhost:3006) +``` + +### Docker Compose Deployment + +```yaml +services: + frontend: { image: deaf-first-frontend, ports: [80:80] } + backend: { image: deaf-first-backend, ports: [3000:3000] } + deafauth: { image: deaf-first-deafauth, ports: [3002:3002] } + pinksync: { image: deaf-first-pinksync, ports: [3003:3003] } + fibonrose: { image: deaf-first-fibonrose, ports: [3004:3004] } + accessibility: { image: deaf-first-a11y, ports: [3005:3005] } + ai: { image: deaf-first-ai, ports: [3006:3006] } + postgres: { image: postgres:14 } + redis: { image: redis:7 } +``` + +### Production Architecture (Recommended) + +``` +Internet + ↓ +Load Balancer (HTTPS) + ↓ +├─ Frontend (Static CDN) +└─ API Gateway (Backend) + ↓ + ├─ DeafAUTH Service (Auto-scaled) + ├─ PinkSync Service (Auto-scaled) + ├─ FibonRose Service (Auto-scaled) + ├─ Accessibility Nodes (Auto-scaled) + └─ AI Services (Auto-scaled) + ↓ + ├─ PostgreSQL (Managed DB) + ├─ Redis (Managed Cache) + └─ Object Storage +``` + +## Security Architecture + +### Authentication & Authorization + +- **JWT-based Authentication**: Stateless token authentication +- **Token Refresh**: Secure token rotation mechanism +- **RBAC**: Role-based access control (to be implemented) +- **Session Management**: Redis-backed session storage + +### Data Protection + +- **Encryption at Rest**: Database encryption +- **Encryption in Transit**: TLS/HTTPS for all connections +- **Password Security**: bcrypt hashing with salt +- **API Security**: Helmet middleware, CORS policies + +### Security Measures + +1. **Input Validation**: All inputs validated and sanitized +2. **SQL Injection Prevention**: Parameterized queries +3. **XSS Prevention**: Content Security Policy headers +4. **CSRF Protection**: CSRF tokens for state-changing operations +5. **Rate Limiting**: Request rate limiting per endpoint +6. **Audit Logging**: Security event logging (to be implemented) + +### Webhook Security + +- **HMAC Verification**: SHA-256 signature validation +- **Secret Management**: Environment-based secret storage +- **Replay Attack Prevention**: Timestamp validation +- **IP Whitelisting**: Configurable IP restrictions + +## Scalability Considerations + +### Horizontal Scaling + +All services are designed to be stateless and horizontally scalable: +- Multiple instances behind load balancer +- Shared state in Redis +- Database connection pooling +- WebSocket sticky sessions for PinkSync + +### Vertical Scaling + +- CPU-intensive AI operations can use larger instances +- Database can be scaled up for better query performance +- Redis can be increased for larger cache capacity + +### Caching Strategy + +1. **Application Cache**: Redis for frequently accessed data +2. **Database Query Cache**: PostgreSQL query result caching +3. **CDN Cache**: Static assets served from CDN +4. **API Response Cache**: Cacheable API responses + +## Monitoring & Observability + +### Metrics (To Be Implemented) + +- Request latency and throughput +- Error rates and types +- Service health checks +- Resource utilization (CPU, memory, disk) +- Database connection pool stats +- WebSocket connection counts + +### Logging Strategy (To Be Implemented) + +- Structured JSON logging +- Centralized log aggregation +- Log levels: ERROR, WARN, INFO, DEBUG +- Correlation IDs for request tracing +- Performance logging + +### Alerting (To Be Implemented) + +- Service downtime alerts +- High error rate alerts +- Performance degradation alerts +- Security incident alerts +- Resource exhaustion alerts + +## Future Enhancements + +1. **GraphQL API**: Add GraphQL layer for flexible querying +2. **Message Queue**: Implement RabbitMQ/Kafka for async processing +3. **Service Mesh**: Add Istio for advanced service management +4. **Monitoring Stack**: Implement Prometheus + Grafana +5. **Distributed Tracing**: Add Jaeger for request tracing +6. **API Rate Limiting**: Per-user rate limiting +7. **Multi-tenancy**: Support for multiple organizations +8. **Advanced AI**: Custom ML models for sign language +9. **Mobile Apps**: Native iOS/Android applications +10. **Offline Support**: Progressive Web App with offline capabilities + +## Contributing + +For information on contributing to this architecture, see [CONTRIBUTING.md](./CONTRIBUTING.md). + +## License + +MIT License - see [LICENSE](./LICENSE) file for details. + +--- + +**Version**: 2.0.0 +**Last Updated**: December 2024 +**Maintained By**: 360 Magicians diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2317a03..8109ac4 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,487 +1,487 @@ -# Contributing to DEAF-FIRST Platform - -Thank you for your interest in contributing to the DEAF-FIRST Platform! This document provides guidelines and instructions for contributing to this project. - -## Table of Contents - -- [Code of Conduct](#code-of-conduct) -- [Getting Started](#getting-started) -- [Development Workflow](#development-workflow) -- [Code Standards](#code-standards) -- [Testing Guidelines](#testing-guidelines) -- [Commit Guidelines](#commit-guidelines) -- [Pull Request Process](#pull-request-process) -- [Accessibility Requirements](#accessibility-requirements) -- [Documentation](#documentation) - -## Code of Conduct - -This project is committed to providing a welcoming and inclusive environment for all contributors. We expect all participants to: - -- Be respectful and considerate -- Focus on accessibility and inclusive design -- Provide constructive feedback -- Accept constructive criticism gracefully -- Prioritize the needs of deaf and hard-of-hearing users - -## Getting Started - -### Prerequisites - -Before you begin, ensure you have the following installed: - -- **Node.js**: >= 20.0.0 -- **npm**: >= 10.0.0 -- **PostgreSQL**: 14+ (for backend development) -- **Redis**: 7+ (for PinkSync development) -- **Git**: Latest version - -### Fork and Clone - -1. Fork the repository on GitHub -2. Clone your fork locally: - ```bash - git clone https://github.com/YOUR-USERNAME/DEAF-FIRST-PLATFORM.git - cd DEAF-FIRST-PLATFORM - ``` - -3. Add the upstream repository: - ```bash - git remote add upstream https://github.com/pinkycollie/DEAF-FIRST-PLATFORM.git - ``` - -### Install Dependencies - -```bash -npm install -``` - -This will install all dependencies for the root workspace and all service workspaces. - -### Environment Setup - -1. Copy the example environment file: - ```bash - cp .env.example .env - ``` - -2. Update `.env` with your local configuration: - - Database credentials - - Redis connection - - API keys (OpenAI, etc.) - - JWT secrets - -### Running Locally - -Start all services in development mode: -```bash -npm run dev -``` - -Or run individual services: -```bash -npm run dev:frontend # Frontend only -npm run dev:backend # Backend only -npm run dev:deafauth # DeafAUTH only -npm run dev:pinksync # PinkSync only -npm run dev:fibonrose # FibonRose only -npm run dev:a11y # Accessibility nodes only -``` - -## Development Workflow - -### Create a Feature Branch - -Always create a new branch for your work: - -```bash -git checkout -b feature/your-feature-name -``` - -Branch naming conventions: -- `feature/` - New features -- `fix/` - Bug fixes -- `docs/` - Documentation updates -- `refactor/` - Code refactoring -- `test/` - Test additions or updates -- `chore/` - Maintenance tasks - -### Make Your Changes - -1. Make your changes in the appropriate workspace(s) -2. Follow the [Code Standards](#code-standards) -3. Write or update tests as needed -4. Update documentation if required - -### Test Your Changes - -Before committing, ensure all checks pass: - -```bash -# Run linting -npm run lint - -# Run type checking -npm run type-check - -# Run tests -npm run test - -# Format code -npm run format -``` - -### Commit Your Changes - -We use conventional commits for clear commit messages: - -```bash -git add . -git commit -m "feat(service): add new feature description" -``` - -See [Commit Guidelines](#commit-guidelines) for more details. - -## Code Standards - -### TypeScript Style Guide - -- Use TypeScript for all new code -- Enable strict mode in `tsconfig.json` -- Define explicit types (avoid `any`) -- Use interfaces for object shapes -- Use enums for fixed sets of values - -#### Example: - -```typescript -// Good -interface UserPreferences { - signLanguage: boolean; - highContrast: boolean; - fontSize: 'small' | 'medium' | 'large'; -} - -function updatePreferences(userId: string, prefs: UserPreferences): Promise { - // Implementation -} - -// Avoid -function updatePreferences(userId: any, prefs: any) { - // Implementation -} -``` - -### Code Formatting - -We use Prettier for consistent code formatting: - -- **Indentation**: 2 spaces -- **Quotes**: Single quotes -- **Semicolons**: Yes -- **Line length**: 100 characters -- **Trailing commas**: ES5 - -Configuration is in `.prettierrc.json`. - -### Linting - -We use ESLint for code quality: - -- Follow the existing ESLint configuration -- Fix all linting errors before committing -- Address warnings when possible - -### File Organization - -``` -workspace/ -├── src/ -│ ├── index.ts # Entry point -│ ├── routes/ # API routes -│ ├── controllers/ # Route controllers -│ ├── services/ # Business logic -│ ├── models/ # Data models -│ ├── types/ # TypeScript types -│ ├── utils/ # Utility functions -│ └── __tests__/ # Tests -├── package.json -└── tsconfig.json -``` - -### Naming Conventions - -- **Files**: kebab-case (e.g., `user-service.ts`) -- **Classes**: PascalCase (e.g., `UserService`) -- **Functions**: camelCase (e.g., `getUserProfile`) -- **Constants**: UPPER_SNAKE_CASE (e.g., `MAX_RETRY_COUNT`) -- **Interfaces**: PascalCase with 'I' prefix optional (e.g., `UserData` or `IUserData`) - -## Testing Guidelines - -### Test Coverage - -We strive for high test coverage: - -- **Unit Tests**: Test individual functions and classes -- **Integration Tests**: Test service interactions -- **E2E Tests**: Test complete user workflows (frontend) - -### Writing Tests - -Use Vitest for unit and integration tests: - -```typescript -import { describe, it, expect } from 'vitest'; -import { calculateFibonacci } from './math-utils'; - -describe('calculateFibonacci', () => { - it('should return correct Fibonacci number', () => { - expect(calculateFibonacci(0)).toBe(0); - expect(calculateFibonacci(1)).toBe(1); - expect(calculateFibonacci(10)).toBe(55); - }); - - it('should handle negative input', () => { - expect(() => calculateFibonacci(-1)).toThrow(); - }); -}); -``` - -### Running Tests - -```bash -# Run all tests -npm run test - -# Run tests in watch mode -npm run test -- --watch - -# Run tests for specific workspace -npm run test --workspace=backend - -# Run E2E tests -npm run test:e2e -``` - -## Commit Guidelines - -We follow the [Conventional Commits](https://www.conventionalcommits.org/) specification. - -### Commit Message Format - -``` -(): - - - -