ci: modernize node lts, reconcile staging and release workflows, and wire governance scripts

.github/workflows/backend-governance.yml

@@ -45,7 +45,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: backend/package-lock.json
 

.github/workflows/codeowners-check.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
 
       - name: Enable Corepack & Setup pnpm
         run: |
@@ -80,3 +80,18 @@ jobs:
 
       - name: Run Contribution Standards Validation
         run: pnpm validate:contribution-standards
+
+      - name: Validate Testing Strategy
+        run: pnpm validate:testing-strategy
+
+      - name: Validate Sprint and Triage Conventions
+        run: pnpm validate:sprint-and-triage
+
+      - name: Validate Release Notes
+        run: pnpm validate:release-notes
+
+      - name: Validate NFR Baselines
+        run: pnpm validate:nfr-baselines
+
+      - name: Validate Incident Severity
+        run: pnpm validate:incident-severity

.github/workflows/codeql.yml

@@ -108,7 +108,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: |
             backend/package-lock.json

.github/workflows/cypress.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
           cache-dependency-path: frontend/package-lock.json
 

.github/workflows/dependency-security.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
 
       - name: Enable Corepack & Setup pnpm
         run: |
@@ -48,7 +48,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
 
       - name: Audit Frontend Dependencies
         working-directory: ./frontend

.github/workflows/e2e.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 

.github/workflows/flaky-detector.yml

@@ -46,7 +46,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: backend/package-lock.json
 

.github/workflows/frontend.yml

@@ -55,7 +55,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: frontend/package-lock.json
       - name: Build shared API schemas
@@ -79,7 +79,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
       - name: Install root dependencies
         run: npm ci
       - name: Build shared API schemas
@@ -105,7 +105,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: frontend/package-lock.json
       - name: Build shared API schemas
@@ -136,7 +136,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: backend/package-lock.json
       - name: Build shared API schemas
@@ -170,7 +170,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: backend/package-lock.json
       - name: Build shared API schemas
@@ -195,7 +195,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
       - name: Install dependencies
         run: npm ci
       - name: Typecheck

.github/workflows/integration-smoke.yml

@@ -75,7 +75,7 @@ jobs:
       - name: Setup Node (frontend)
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 
@@ -86,7 +86,7 @@ jobs:
       - name: Setup Node (backend)
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: backend/package-lock.json
 

.github/workflows/pnpm-version-check.yml

@@ -18,7 +18,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
 
       - name: Enable Corepack
         run: corepack enable
@@ -38,7 +38,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
 
       - name: Install pnpm 8 (the bad version)
         run: npm install -g pnpm@8

.github/workflows/production-deploy.yml

@@ -64,7 +64,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 
@@ -94,7 +94,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 
@@ -147,7 +147,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
 
       - name: Install Vercel CLI
         run: npm install --global vercel@latest

.github/workflows/release.yml

@@ -3,10 +3,11 @@ name: Release
 on:
   push:
     tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   release:
@@ -41,17 +42,16 @@ jobs:
           OUTPUT: /tmp/release-notes.md
           GITHUB_REPO: ${{ github.repository }}
 
-      # Commit the updated CHANGELOG.md back to the default branch
-      - name: Commit CHANGELOG.md
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add CHANGELOG.md
-          # Only commit if there are changes
-          if ! git diff --cached --quiet; then
-            git commit -m "chore(release): update CHANGELOG.md for ${{ github.ref_name }}"
-            git push origin HEAD:refs/heads/main
-          fi
+      # Open a PR for CHANGELOG.md updates to comply with branch protection
+      - name: Create Pull Request for CHANGELOG.md
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "chore(release): update CHANGELOG.md for ${{ github.ref_name }}"
+          title: "chore(release): update CHANGELOG.md for ${{ github.ref_name }}"
+          body: "Automated changelog update for release ${{ github.ref_name }}."
+          branch: "chore/changelog-${{ github.ref_name }}"
+          base: "main"
 
       # Create the GitHub Release with the generated notes
       - name: Create GitHub Release

.github/workflows/rust-security.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: npm
           cache-dependency-path: |
             backend/package-lock.json

.github/workflows/rust-wasm.yml

@@ -170,7 +170,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
 
       - name: Install root dependencies
         run: npm ci

.github/workflows/staging-deploy.yml

@@ -29,10 +29,11 @@ jobs:
 
       - name: Install Soroban CLI
         run: |
-          cargo install --locked soroban-cli
+          cargo install --locked soroban-cli --version 21.0.0
 
       - name: Deploy Contracts to Testnet
         id: deploy_contracts
+        if: env.SOROBAN_SECRET_KEY != ''
         env:
           SOROBAN_SECRET_KEY: ${{ secrets.STAGING_SOROBAN_SECRET_KEY }}
           SOROBAN_NETWORK: testnet
@@ -46,37 +47,41 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Deploy Backend
+        if: env.DATABASE_URL != '' && env.VERCEL_TOKEN != ''
         working-directory: backend
         env:
           DATABASE_URL: ${{ secrets.STAGING_DATABASE_URL }}
+          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
           VAULT_CONTRACT_ID: ${{ steps.deploy_contracts.outputs.vault_id }}
         run: |
           npm ci
           npx prisma migrate deploy
-          # Replace with your actual backend deployment command (e.g., Vercel, Railway, Render)
-          # Example: npx vercel --token ${{ secrets.VERCEL_TOKEN }} --prod --yes
-          echo "Backend deployment simulated"
+          npx vercel --token ${{ secrets.VERCEL_TOKEN }} --prod --yes
           echo "BACKEND_URL=https://yieldvault-backend-staging.vercel.app" >> $GITHUB_ENV
 
       - name: Deploy Frontend
+        if: env.VERCEL_TOKEN != ''
         working-directory: frontend
         env:
+          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
           VITE_VAULT_CONTRACT_ID: ${{ steps.deploy_contracts.outputs.vault_id }}
           VITE_API_URL: ${{ env.BACKEND_URL }}
         run: |
           npm ci
           npm run build
-          # Replace with your actual frontend deployment command
-          # Example: npx vercel --token ${{ secrets.VERCEL_TOKEN }} --prod --yes
-          echo "Frontend deployment simulated"
+          npx vercel --token ${{ secrets.VERCEL_TOKEN }} --prod --yes
           echo "STAGING_URL=https://yieldvault-staging.vercel.app" >> $GITHUB_ENV
 
       - name: Post Staging URL to PR
+        if: env.STAGING_URL != ''
         uses: actions/github-script@v7
+        env:
+          STAGING_URL: ${{ env.STAGING_URL }}
+          BACKEND_URL: ${{ env.BACKEND_URL }}
         with:
           script: |
             const { owner, repo } = context.repo;

.github/workflows/test-coverage.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
 
       - name: Install Dependencies
         working-directory: ./backend
@@ -43,7 +43,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
 
       - name: Install Dependencies
         working-directory: ./frontend
@@ -70,7 +70,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
 
       - name: Download Backend Coverage Artifact
         uses: actions/download-artifact@v4

.nvmrc

@@ -0,0 +1 @@
+22

backend/package.json

@@ -2,6 +2,9 @@
   "name": "yieldviault-backend",
   "version": "1.0.0",
   "description": "YieldVault Stellar RWA Backend API",
+  "engines": {
+    "node": ">=22"
+  },
   "main": "dist/index.js",
   "scripts": {
     "predev": "npm run build:schemas",

frontend/package.json

@@ -4,6 +4,9 @@
   "version": "0.0.0",
   "type": "module",
   "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
   "scripts": {
     "dev": "vite",
     "build": "tsc -b && vite build",

package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "pnpm@9.12.0",
   "engines": {
-    "node": ">=20",
+    "node": ">=22",
     "pnpm": ">=9.12"
   },
   "name": "yieldvault-rwa",
@@ -78,6 +78,5 @@
   },
   "resolutions": {
     "lodash": "^4.17.21"
-  },
-
+  }
 }