fix: apply audit "this week" items (data safety, auth gating, CI gates)

.github/workflows/ci.yml

@@ -1,145 +1,127 @@
-name: CI/CD Pipeline
+name: CI
 
 on:
-  # Run on all pull requests
   pull_request:
-    branches: [ Master, develop, "**" ]
-
-  # Run on pushes to main and develop branches
   push:
-    branches: [ Master, develop ]
-
-  # Allow manual triggering
+    branches: [Master]
   workflow_dispatch:
 
+# One run per PR (or per push to Master); new commits cancel the previous run.
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
-  pull-requests: write
+
+env:
+  BUN_VERSION: "1.4.2"
 
 jobs:
-  # Job 1: Run Tests
-  test:
-    name: Run Test
+  quality:
+    name: Lint, Types, Tests
     runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [18.x, 20.x]
-
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-      
+        uses: actions/checkout@v5
+
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@v2
         with:
-          bun-version: '1.4.2'
-
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Cache Bun packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
-      
-      - name: Run linter
+
+      - name: Lint
         run: bun run lint
-      
-      - name: Run type checking
+
+      - name: Type check
         run: bun x tsc --noEmit
 
-      - name: Run tests with coverage
-        run: bun run test:coverage
+      - name: Tests with coverage
+        run: bun run test:ci
 
       - name: Upload coverage to Codecov
-        if: matrix.node-version == '20.x'
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         with:
-          file: ./coverage/lcov.info
+          files: ./coverage/lcov.info
           flags: unittests
-          name: codecov-umbrella
           fail_ci_if_error: false
 
-  # Job 2: Build Check
   build:
-    name: Build Check
+    name: Build
     runs-on: ubuntu-latest
-    needs: test
-
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-      
+        uses: actions/checkout@v5
+
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Cache Bun packages
+        uses: actions/cache@v4
         with:
-          bun-version: '1.4.2'
-
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
-      
+
       - name: Build application
         run: bun run build
         env:
           NEXT_TELEMETRY_DISABLED: 1
-          NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }}
-          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY }}
           NEXT_PUBLIC_CONVEX_URL: ${{ secrets.NEXT_PUBLIC_CONVEX_URL || 'https://dummy.convex.cloud' }}
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ secrets.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
 
-  # Job 3: Security Audit
   security:
     name: Security Audit
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-      
+        uses: actions/checkout@v5
+
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Cache Bun packages
+        uses: actions/cache@v4
         with:
-          bun-version: '1.4.2'
-
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
-
-      - name: Run security scan
-        run: bun pm scan || echo "Security scan completed with warnings"
-
-      - name: Run security scan (all)
-        run: bun pm scan --all || echo "No additional issues found"
-
-  # Job 4: Dependency Check
+
+      # Ignored advisories are transitive pins with no patched release in range:
+      # image-size (fumadocs-core) DoS parsers, js-cookie (@clerk/shared).
+      # Re-check with `bun audit` when bumping fumadocs or Clerk.
+      - name: Audit dependencies
+        run: bun run audit:deps
+
   dependency-review:
     name: Dependency Review
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
-
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Dependency Review
-        uses: actions/dependency-review-action@v3
-        with:
-          fail-on-severity: moderate
-        continue-on-error: true  # Don't fail if Advanced Security is not enabled
+        uses: actions/checkout@v5
 
-# Optional: Add deployment job that runs after tests pass
-  deploy-preview:
-    name: Deploy Preview
-    runs-on: ubuntu-latest
-    needs: [test, build]
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Comment PR with preview info
-        uses: actions/github-script@v7
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
         with:
-          script: |
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: '🚀 Tests passed! Preview deployment will be available shortly.'
-            }) 
+          fail-on-severity: high

.github/workflows/deploy.yml

@@ -24,10 +24,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@v2
         with:
           bun-version: '1.4.2'
 
@@ -58,9 +58,9 @@ jobs:
     if: github.ref == 'refs/heads/Master' || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@v2
         with:
           bun-version: '1.4.2'
       - name: Install dependencies
@@ -80,7 +80,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Deploy to Vercel
         uses: amondnet/vercel-action@v25