[Sirejay]

…heck script

What

Four improvements to make the repo self-contained and safe to deploy:

1. Contributor docs (CONTRIBUTING.md, SECURITY.md, CODEOWNERS, templates)

• CONTRIBUTING.md: full setup guide (prerequisites, local stack, npm scripts, check-env usage), test/lint commands, shell & K8s & docs conventions, PR scope and submission process, issue reporting, and security pointer.
• SECURITY.md: supported versions, scope table, two reporting paths (GitHub Private Advisories + email), response SLA, and operational security rules (zero secrets in Git, backup encryption, mainnet guardrails, supply chain, workflow permissions, security-sensitive change tagging).
• CODEOWNERS: granular path rules — infra team on k8s/, Dockerfiles, and workflows; core on scripts/, docs/, monitoring/, and issue/PR templates; explicit security-sensitive file list (secrets.yaml, deploy-k8s.yml, etc.).
• PR template: type-of-change checkbox, changes list, testing section, and a full verification checklist (check-env, shellcheck, kubeconform, kube-linter, promtool, compose config, docs/env-vars, no-secrets check).
• Bug report template: environment table, affected component checklist (includes check-env.js), steps/expected/actual/logs fields.
• Feature request template: problem/solution/alternatives, component checklist, acceptance criteria, additional context.

2. Mermaid architecture diagrams in README.md

• Docker Compose diagram: browser, frontend, backend, migrate, postgres, monitoring profile (postgres-exporter, prometheus, alertmanager, grafana), and external services (Supabase, Stellar, OpenRouter) with labelled edges.
• Kubernetes diagram: ingress, frontend/backend deployments, HPA, migrate job, ServiceMonitors, PrometheusRule, PDB, ConfigMap, Secrets, GHCR image pulls, and external services with labelled edges.

3. Canonical Railway deployment guide (docs/railway-deploy.md)

• Merged the best of railway-deploy.md and DEPLOY-BACKEND-GUIDE.md into one authoritative guide covering: prerequisites (including check-env call), Supabase setup (DB URL, API keys, storage bucket), Railway deploy via dashboard and CLI, full environment variable table (required + optional + copy-paste block), migrations, verification curl commands, frontend connection, catalog seeding, cost table, and troubleshooting.
• docs/DEPLOY-BACKEND-GUIDE.md replaced with a short stub that explains the consolidation and links to the canonical guide.
• README.md Step 5 updated to link only to docs/railway-deploy.md and include the check-env call; redundant inline env-var list removed.

4. scripts/check-env.js + wiring

• New ESM script that reads a .env file and process.env, then reports:
  • Missing variables (not set anywhere)
  • Placeholder values (SXXX..., CXXX..., GXXX..., change-me-, your-, REPLACE_ME_*, [YOUR-...], <your-...>, truncated JWTs eyJ..., etc.) with masked output for secrets and human-readable descriptions.
• Three targets: compose (14 vars), k8s (17 vars), railway (15 vars).
• Exports parseEnvFile, validateEnv, parseArgs, run for offline unit testing.
• Exits 0 on success, 1 on any failure; suitable for CI and pre-deploy gates.
• package.json: added "type": "module" (was causing Node reparsing warning), and four new npm scripts: check:env, check:env:compose, check:env:k8s, check:env:railway.
• ci.yml node job: syntax-checks check-env.js and runs it against .env.example (informational — placeholders are expected there) to ensure it doesn't crash.
• ci.yml compose-smoke job: runs check-env --target compose before stack start.
• deploy-k8s.yml deploy-staging job: runs check-env --target k8s with secrets and vars mapped from the GitHub Actions environment before kubectl apply.

Testing

• node --check scripts/check-env.js passes
• check-env --target compose --env-file .env.example correctly flags all 8 placeholder variables (SXXX*, your-, change-me-)
• check-env --target railway --env-file .env.example flags 2 missing + 9 placeholder variables
• check-env --target k8s --env-file .env.example flags 12 placeholder variables
• check-env --target compose with all vars set via process.env exits 0 and prints: 'all 14 required variables are set'
• check-env --help exits 0 with no warnings
• check-env --target badtarget exits 1 with a clear error message

Summary

Related Issues

Closes #

Verification Checklist

• Shell scripts pass shellcheck scripts/*.sh and bash -n scripts/*.sh
• Node scripts and unit tests pass (npm test)
• Kubernetes manifests render and validate cleanly (kubectl kustomize k8s/ / kubeconform -strict)
• Documentation in docs/ or README.md has been updated if operational behavior changed
  closes Add a script to validate required env vars before deploy #104
  closes Consolidate overlapping backend deployment docs #105
  closes Add an architecture diagram to the README #106
  closes Add CONTRIBUTING.md, SECURITY.md and issue/PR templates #107

[drips-wave]

@Sirejay Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits