From 9bffa18b7507ceda051d9798953ab42a7daad0a7 Mon Sep 17 00:00:00 2001 From: software321dev Date: Sun, 18 Oct 2026 18:09:58 +0100 Subject: [PATCH] ci: modernize node lts, reconcile staging and release workflows, and wire governance scripts - Issue #1597: Move all workflows off EOL Node 20 to supported Node LTS via .nvmrc and declare engines across all packages - Issue #1595: Pin soroban-cli to version 21.0.0 and guard staging deploy steps against simulated reporting - Issue #1596: Reconcile release tag pattern with cliff.toml and create PR for CHANGELOG.md against protected main - Issue #1594: Wire up validate:* checks in governance CI workflow and mark shell scripts executable (100755) Closes #1594, Closes #1595, Closes #1596, Closes #1597 --- .github/workflows/backend-governance.yml | 2 +- .github/workflows/codeowners-check.yml | 17 +++++++++++++++- .github/workflows/codeql.yml | 2 +- .github/workflows/cypress.yml | 2 +- .github/workflows/dependency-security.yml | 4 ++-- .github/workflows/e2e.yml | 2 +- .github/workflows/flaky-detector.yml | 2 +- .github/workflows/frontend.yml | 12 ++++++------ .github/workflows/integration-smoke.yml | 4 ++-- .github/workflows/pnpm-version-check.yml | 4 ++-- .github/workflows/production-deploy.yml | 6 +++--- .github/workflows/release.yml | 24 +++++++++++------------ .github/workflows/rust-security.yml | 2 +- .github/workflows/rust-wasm.yml | 2 +- .github/workflows/staging-deploy.yml | 21 ++++++++++++-------- .github/workflows/test-coverage.yml | 6 +++--- .nvmrc | 1 + backend/package.json | 3 +++ frontend/package.json | 3 +++ package.json | 5 ++--- packages/api-schemas/package.json | 3 +++ scripts/check_bridge_abi.sh | 0 scripts/check_storage_layout.sh | 0 scripts/compress-pngs.sh | 0 scripts/new-postmortem.sh | 0 scripts/purge-git-large-blobs.sh | 0 scripts/validate-postmortem.sh | 0 scripts/validate_upgrade.sh | 0 scripts/wait-for-db.sh | 0 verify-security-setup.sh | 0 30 files changed, 78 insertions(+), 49 deletions(-) create mode 100644 .nvmrc mode change 100644 => 100755 scripts/check_bridge_abi.sh mode change 100644 => 100755 scripts/check_storage_layout.sh mode change 100644 => 100755 scripts/compress-pngs.sh mode change 100644 => 100755 scripts/new-postmortem.sh mode change 100644 => 100755 scripts/purge-git-large-blobs.sh mode change 100644 => 100755 scripts/validate-postmortem.sh mode change 100644 => 100755 scripts/validate_upgrade.sh mode change 100644 => 100755 scripts/wait-for-db.sh mode change 100644 => 100755 verify-security-setup.sh diff --git a/.github/workflows/backend-governance.yml b/.github/workflows/backend-governance.yml index 3713c23a3..20201448b 100644 --- a/.github/workflows/backend-governance.yml +++ b/.github/workflows/backend-governance.yml @@ -45,7 +45,7 @@ jobs: - name: Setup Node uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' cache: npm cache-dependency-path: backend/package-lock.json diff --git a/.github/workflows/codeowners-check.yml b/.github/workflows/codeowners-check.yml index e070be7f8..b001718df 100644 --- a/.github/workflows/codeowners-check.yml +++ b/.github/workflows/codeowners-check.yml @@ -50,7 +50,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' - name: Enable Corepack & Setup pnpm run: | @@ -80,3 +80,18 @@ jobs: - name: Run Contribution Standards Validation run: pnpm validate:contribution-standards + + - name: Validate Testing Strategy + run: pnpm validate:testing-strategy + + - name: Validate Sprint and Triage Conventions + run: pnpm validate:sprint-and-triage + + - name: Validate Release Notes + run: pnpm validate:release-notes + + - name: Validate NFR Baselines + run: pnpm validate:nfr-baselines + + - name: Validate Incident Severity + run: pnpm validate:incident-severity diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 875fe421a..aa3291b61 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -108,7 +108,7 @@ jobs: - name: Setup Node uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' cache: npm cache-dependency-path: | backend/package-lock.json diff --git a/.github/workflows/cypress.yml b/.github/workflows/cypress.yml index 19240c8e2..74adea7ef 100644 --- a/.github/workflows/cypress.yml +++ b/.github/workflows/cypress.yml @@ -26,7 +26,7 @@ jobs: - name: Setup Node uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' cache: 'npm' cache-dependency-path: frontend/package-lock.json diff --git a/.github/workflows/dependency-security.yml b/.github/workflows/dependency-security.yml index 090fb6c71..4200be928 100644 --- a/.github/workflows/dependency-security.yml +++ b/.github/workflows/dependency-security.yml @@ -19,7 +19,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' - name: Enable Corepack & Setup pnpm run: | @@ -48,7 +48,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' - name: Audit Frontend Dependencies working-directory: ./frontend diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 2fafbb6bd..472280423 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -25,7 +25,7 @@ jobs: - name: Setup Node uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' cache: npm cache-dependency-path: frontend/package-lock.json diff --git a/.github/workflows/flaky-detector.yml b/.github/workflows/flaky-detector.yml index 5b1026349..6c320a435 100644 --- a/.github/workflows/flaky-detector.yml +++ b/.github/workflows/flaky-detector.yml @@ -46,7 +46,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' cache: npm cache-dependency-path: backend/package-lock.json diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml index ef80e87b4..880487816 100644 --- a/.github/workflows/frontend.yml +++ b/.github/workflows/frontend.yml @@ -55,7 +55,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' cache: npm cache-dependency-path: frontend/package-lock.json - name: Build shared API schemas @@ -79,7 +79,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' - name: Install root dependencies run: npm ci - name: Build shared API schemas @@ -105,7 +105,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' cache: npm cache-dependency-path: frontend/package-lock.json - name: Build shared API schemas @@ -136,7 +136,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' cache: npm cache-dependency-path: backend/package-lock.json - name: Build shared API schemas @@ -170,7 +170,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' cache: npm cache-dependency-path: backend/package-lock.json - name: Build shared API schemas @@ -195,7 +195,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' - name: Install dependencies run: npm ci - name: Typecheck diff --git a/.github/workflows/integration-smoke.yml b/.github/workflows/integration-smoke.yml index e962726b1..9104bf291 100644 --- a/.github/workflows/integration-smoke.yml +++ b/.github/workflows/integration-smoke.yml @@ -75,7 +75,7 @@ jobs: - name: Setup Node (frontend) uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' cache: npm cache-dependency-path: frontend/package-lock.json @@ -86,7 +86,7 @@ jobs: - name: Setup Node (backend) uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' cache: npm cache-dependency-path: backend/package-lock.json diff --git a/.github/workflows/pnpm-version-check.yml b/.github/workflows/pnpm-version-check.yml index 8af02a517..0b4f04911 100644 --- a/.github/workflows/pnpm-version-check.yml +++ b/.github/workflows/pnpm-version-check.yml @@ -18,7 +18,7 @@ jobs: - uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' - name: Enable Corepack run: corepack enable @@ -38,7 +38,7 @@ jobs: - uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' - name: Install pnpm 8 (the bad version) run: npm install -g pnpm@8 diff --git a/.github/workflows/production-deploy.yml b/.github/workflows/production-deploy.yml index b50b76c19..2e048b308 100644 --- a/.github/workflows/production-deploy.yml +++ b/.github/workflows/production-deploy.yml @@ -64,7 +64,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' cache: npm cache-dependency-path: frontend/package-lock.json @@ -94,7 +94,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' cache: npm cache-dependency-path: frontend/package-lock.json @@ -147,7 +147,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' - name: Install Vercel CLI run: npm install --global vercel@latest diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7e745912a..8225bf0c4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,10 +3,11 @@ name: Release on: push: tags: - - 'v[0-9]+.[0-9]+.[0-9]+' + - 'v[0-9]+.[0-9]+.[0-9]+*' permissions: contents: write + pull-requests: write jobs: release: @@ -41,17 +42,16 @@ jobs: OUTPUT: /tmp/release-notes.md GITHUB_REPO: ${{ github.repository }} - # Commit the updated CHANGELOG.md back to the default branch - - name: Commit CHANGELOG.md - run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git add CHANGELOG.md - # Only commit if there are changes - if ! git diff --cached --quiet; then - git commit -m "chore(release): update CHANGELOG.md for ${{ github.ref_name }}" - git push origin HEAD:refs/heads/main - fi + # Open a PR for CHANGELOG.md updates to comply with branch protection + - name: Create Pull Request for CHANGELOG.md + uses: peter-evans/create-pull-request@v6 + with: + token: ${{ secrets.GITHUB_TOKEN }} + commit-message: "chore(release): update CHANGELOG.md for ${{ github.ref_name }}" + title: "chore(release): update CHANGELOG.md for ${{ github.ref_name }}" + body: "Automated changelog update for release ${{ github.ref_name }}." + branch: "chore/changelog-${{ github.ref_name }}" + base: "main" # Create the GitHub Release with the generated notes - name: Create GitHub Release diff --git a/.github/workflows/rust-security.yml b/.github/workflows/rust-security.yml index 3dcc79c58..86e7ad396 100644 --- a/.github/workflows/rust-security.yml +++ b/.github/workflows/rust-security.yml @@ -26,7 +26,7 @@ jobs: - name: Setup Node uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' cache: npm cache-dependency-path: | backend/package-lock.json diff --git a/.github/workflows/rust-wasm.yml b/.github/workflows/rust-wasm.yml index 2aaccedc7..9a0123a76 100644 --- a/.github/workflows/rust-wasm.yml +++ b/.github/workflows/rust-wasm.yml @@ -170,7 +170,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' - name: Install root dependencies run: npm ci diff --git a/.github/workflows/staging-deploy.yml b/.github/workflows/staging-deploy.yml index 8cf0d8dd7..c6b76dbc9 100644 --- a/.github/workflows/staging-deploy.yml +++ b/.github/workflows/staging-deploy.yml @@ -29,10 +29,11 @@ jobs: - name: Install Soroban CLI run: | - cargo install --locked soroban-cli + cargo install --locked soroban-cli --version 21.0.0 - name: Deploy Contracts to Testnet id: deploy_contracts + if: env.SOROBAN_SECRET_KEY != '' env: SOROBAN_SECRET_KEY: ${{ secrets.STAGING_SOROBAN_SECRET_KEY }} SOROBAN_NETWORK: testnet @@ -46,37 +47,41 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version-file: '.nvmrc' cache: 'npm' - name: Deploy Backend + if: env.DATABASE_URL != '' && env.VERCEL_TOKEN != '' working-directory: backend env: DATABASE_URL: ${{ secrets.STAGING_DATABASE_URL }} + VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} VAULT_CONTRACT_ID: ${{ steps.deploy_contracts.outputs.vault_id }} run: | npm ci npx prisma migrate deploy - # Replace with your actual backend deployment command (e.g., Vercel, Railway, Render) - # Example: npx vercel --token ${{ secrets.VERCEL_TOKEN }} --prod --yes - echo "Backend deployment simulated" + npx vercel --token ${{ secrets.VERCEL_TOKEN }} --prod --yes echo "BACKEND_URL=https://yieldvault-backend-staging.vercel.app" >> $GITHUB_ENV - name: Deploy Frontend + if: env.VERCEL_TOKEN != '' working-directory: frontend env: + VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} VITE_VAULT_CONTRACT_ID: ${{ steps.deploy_contracts.outputs.vault_id }} VITE_API_URL: ${{ env.BACKEND_URL }} run: | npm ci npm run build - # Replace with your actual frontend deployment command - # Example: npx vercel --token ${{ secrets.VERCEL_TOKEN }} --prod --yes - echo "Frontend deployment simulated" + npx vercel --token ${{ secrets.VERCEL_TOKEN }} --prod --yes echo "STAGING_URL=https://yieldvault-staging.vercel.app" >> $GITHUB_ENV - name: Post Staging URL to PR + if: env.STAGING_URL != '' uses: actions/github-script@v7 + env: + STAGING_URL: ${{ env.STAGING_URL }} + BACKEND_URL: ${{ env.BACKEND_URL }} with: script: | const { owner, repo } = context.repo; diff --git a/.github/workflows/test-coverage.yml b/.github/workflows/test-coverage.yml index b221a651e..7cd6f07b8 100644 --- a/.github/workflows/test-coverage.yml +++ b/.github/workflows/test-coverage.yml @@ -17,7 +17,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' - name: Install Dependencies working-directory: ./backend @@ -43,7 +43,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' - name: Install Dependencies working-directory: ./frontend @@ -70,7 +70,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '20' + node-version-file: '.nvmrc' - name: Download Backend Coverage Artifact uses: actions/download-artifact@v4 diff --git a/.nvmrc b/.nvmrc new file mode 100644 index 000000000..2bd5a0a98 --- /dev/null +++ b/.nvmrc @@ -0,0 +1 @@ +22 diff --git a/backend/package.json b/backend/package.json index 39511349e..d3a2ed243 100644 --- a/backend/package.json +++ b/backend/package.json @@ -2,6 +2,9 @@ "name": "yieldviault-backend", "version": "1.0.0", "description": "YieldVault Stellar RWA Backend API", + "engines": { + "node": ">=22" + }, "main": "dist/index.js", "scripts": { "predev": "npm run build:schemas", diff --git a/frontend/package.json b/frontend/package.json index 53c3fbd19..602287f39 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -4,6 +4,9 @@ "version": "0.0.0", "type": "module", "license": "MIT", + "engines": { + "node": ">=22" + }, "scripts": { "dev": "vite", "build": "tsc -b && vite build", diff --git a/package.json b/package.json index 7f9c206b5..298592151 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "packageManager": "pnpm@9.12.0", "engines": { - "node": ">=20", + "node": ">=22", "pnpm": ">=9.12" }, "name": "yieldvault-rwa", @@ -78,6 +78,5 @@ }, "resolutions": { "lodash": "^4.17.21" - }, - + } } diff --git a/packages/api-schemas/package.json b/packages/api-schemas/package.json index 163a5e7ad..77f1ffc60 100644 --- a/packages/api-schemas/package.json +++ b/packages/api-schemas/package.json @@ -3,6 +3,9 @@ "version": "1.0.0", "license": "MIT", "private": true, + "engines": { + "node": ">=22" + }, "description": "Shared Zod request/response schemas for YieldVault API consumers", "main": "./dist/index.js", "types": "./dist/index.d.ts", diff --git a/scripts/check_bridge_abi.sh b/scripts/check_bridge_abi.sh old mode 100644 new mode 100755 diff --git a/scripts/check_storage_layout.sh b/scripts/check_storage_layout.sh old mode 100644 new mode 100755 diff --git a/scripts/compress-pngs.sh b/scripts/compress-pngs.sh old mode 100644 new mode 100755 diff --git a/scripts/new-postmortem.sh b/scripts/new-postmortem.sh old mode 100644 new mode 100755 diff --git a/scripts/purge-git-large-blobs.sh b/scripts/purge-git-large-blobs.sh old mode 100644 new mode 100755 diff --git a/scripts/validate-postmortem.sh b/scripts/validate-postmortem.sh old mode 100644 new mode 100755 diff --git a/scripts/validate_upgrade.sh b/scripts/validate_upgrade.sh old mode 100644 new mode 100755 diff --git a/scripts/wait-for-db.sh b/scripts/wait-for-db.sh old mode 100644 new mode 100755 diff --git a/verify-security-setup.sh b/verify-security-setup.sh old mode 100644 new mode 100755