[Feature]: Add GitHub Actions CI pipeline for pytest (backend) and Jest (frontend) with coverage reporting on every PR

[divyanshim27]

Summary

AccountSafe has a .github/ directory (confirmed from the file tree — it contains deployment workflows) but no CI workflow that runs tests on pull requests. For a zero-knowledge credential manager handling AES-256-GCM encryption and Argon2id key derivation, the absence of automated test validation on PRs is a critical gap — a single bad merge could silently break the encryption contract.

---

Problem

• No .github/workflows/ci.yml or equivalent PR test workflow exists.
• Makefile already defines make test, make test-backend, make test-frontend — these are not wired into any automated PR check.
• The backend/ uses pytest with coverage (pytest --cov) and the frontend/ uses jest — both are already configured but run only on developer machines.
• The existing .github/workflows/deploy-oracle.yml deploys on push to main — but there is no gate that ensures tests pass before that deploy runs.

---

Impact

• A broken PR that corrupts the AES-256-GCM encrypt/decrypt cycle could land in main and deploy directly to Oracle Cloud.
• Zero-knowledge credential managers have zero tolerance for encryption regressions — a silent bug could make vaults permanently unrecoverable.
• New GSSoC contributors have no confidence their changes don't break existing security invariants.

---

Proposed Solution

# .github/workflows/ci.yml
name: CI — Test Suite

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  backend-tests:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_DB: accountsafe_test
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: --health-cmd pg_isready --health-interval 10s --health-retries 5
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install backend dependencies
        run: pip install -r backend/requirements-local.txt
      - name: Run migrations
        run: python backend/manage.py migrate
        env:
          DEBUG: "True"
          SECRET_KEY: ci-only-insecure-key
          DB_NAME: accountsafe_test
          DB_USER: postgres
          DB_PASSWORD: postgres
          DB_HOST: localhost
          DB_PORT: 5432
      - name: Run pytest with coverage
        run: python -m pytest backend/ -v --cov=api --cov-report=xml
        env:
          DEBUG: "True"
          SECRET_KEY: ci-only-insecure-key
          DB_NAME: accountsafe_test
          DB_USER: postgres
          DB_PASSWORD: postgres
          DB_HOST: localhost
          DB_PORT: 5432
      - name: Upload coverage report
        uses: codecov/codecov-action@v4
        with:
          files: coverage.xml

  frontend-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "18"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci
        working-directory: frontend
      - run: npm test -- --watchAll=false --coverage
        working-directory: frontend

---

Additional Notes

• PostgreSQL 15 is available as a GitHub Actions service container, matching the production database version.
• I will also update deploy-oracle.yml to require the ci job to pass before deployment can proceed, using needs: [backend-tests, frontend-tests].
• Coverage reports will be uploaded to Codecov (free for open-source) with a badge added to the README.

I am happy to implement this. Could you assign this issue to me?

Labels: enhancement, ci/cd, security, GSSoC 2026