Feature/adr documentation

.env.example

@@ -0,0 +1,13 @@
+# Database
+DATABASE_URL=postgres://postgres:postgres@127.0.0.1/vulnerablenode
+
+# Session
+SESSION_SECRET=change-me-to-a-random-string-at-least-32-chars
+
+# Application
+NODE_ENV=development
+PORT=3000
+LOG_LEVEL=info
+
+# Docker override
+STAGE=LOCAL

.github/workflows/ci-quality.yml

@@ -0,0 +1,134 @@
+name: CI Quality Pipeline
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+
+jobs:
+  unit-tests:
+    name: Unit Tests & Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+      - run: npm ci
+      - name: Run unit tests with coverage
+        run: npm run test:ci
+        env:
+          NODE_OPTIONS: --experimental-vm-modules
+      - uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage/lcov.info
+          retention-days: 1
+
+  e2e-tests:
+    name: E2E Tests
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: vulnerablenode
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+      - run: npm ci
+      - name: Run E2E tests
+        run: npm run test:e2e
+        env:
+          NODE_OPTIONS: --experimental-vm-modules
+          DATABASE_URL: postgres://postgres:postgres@localhost:5432/vulnerablenode
+          SESSION_SECRET: ci-test-secret-key
+
+  sbom-and-scan:
+    name: SBOM Generation & Vulnerability Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+      - run: npm ci
+
+      # ── SBOM generation ──────────────────────────────────────────────────────
+      - name: Generate SBOM with Syft (CycloneDX JSON)
+        uses: anchore/sbom-action@v0
+        with:
+          path: "."
+          format: "cyclonedx-json"
+          output-file: "sbom-ci.json"
+          artifact-name: "sbom"
+
+      # ── Vulnerability scan: Grype (Anchore) ──────────────────────────────────
+      - name: Scan dependencies with Grype
+        uses: anchore/scan-action@v6
+        id: grype-scan
+        with:
+          path: "."
+          fail-build: true
+          severity-cutoff: high
+          output-format: table
+
+      # ── Vulnerability scan: Trivy (Aqua Security) ───────────────────────────
+      - name: Scan filesystem with Trivy
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: "fs"
+          scan-ref: "."
+          format: "table"
+          severity: "CRITICAL,HIGH"
+          exit-code: "1"
+          ignore-unfixed: true
+
+      # ── npm audit gate ────────────────────────────────────────────────────────
+      - name: npm audit (HIGH/CRITICAL gate — production deps only)
+        run: npm run audit:check
+
+      # ── Upload evidence artifacts ─────────────────────────────────────────────
+      - name: Upload vulnerability reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: security-reports
+          path: reports/vulnerability/
+          retention-days: 30
+
+  sonarcloud:
+    name: SonarCloud Analysis
+    runs-on: ubuntu-latest
+    needs: [unit-tests]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/download-artifact@v4.3.0
+        with:
+          name: coverage-report
+          path: coverage/
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarcloud-github-action@v3
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/deploy-tracker.yml

@@ -0,0 +1,36 @@
+name: Deploy Tracker
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  track-deployment:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create GitHub Deployment Record
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Create a deployment record
+            const deployment = await github.rest.repos.createDeployment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              ref: context.sha,
+              environment: 'production',
+              auto_merge: false,
+              required_contexts: [],
+              description: `Deployment from commit ${context.sha.substring(0, 7)}`
+            });
+
+            // Mark it as successful
+            await github.rest.repos.createDeploymentStatus({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              deployment_id: deployment.data.id,
+              state: 'success',
+              description: 'Deployment completed successfully',
+              environment: 'production'
+            });
+
+            console.log(`Created deployment #${deployment.data.id} for ${context.sha.substring(0, 7)}`);

.gitignore

@@ -1,85 +1,43 @@
-# Created by .ignore support plugin (hsz.mobi)
-### Node template
+# Dependencies
+node_modules/
+
+# Environment
+.env
+
 # Logs
-logs
+logs/
 *.log
-npm-debug.log*
+app-custom.log
+access.log
 
-# Runtime data
-pids
-*.pid
-*.seed
+# Test coverage
+coverage/
 
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
+# Build output
+dist/
 
-# Coverage directory used by tools like istanbul
-coverage
+# OS files
+.DS_Store
 
-# nyc test coverage
-.nyc_output
+# IDE
+.idea/
+*.iws
+/out/
+.idea_modules/
 
-# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
+# Runtime
+pids
+*.pid
+*.seed
+.nyc_output
 .grunt
-
-# node-waf configuration
 .lock-wscript
-
-# Compiled binary addons (http://nodejs.org/api/addons.html)
 build/Release
-
-# Dependency directories
-node_modules
+lib-cov
 jspm_packages
-
-# Optional npm cache directory
 .npm
-
-# Optional REPL history
 .node_repl_history
-### JetBrains template
-# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm
-# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
-
-# User-specific stuff:
-.idea/workspace.xml
-.idea/tasks.xml
-.idea/dictionaries
-.idea/vcs.xml
-.idea/jsLibraryMappings.xml
-
-# Sensitive or high-churn files:
-.idea/dataSources.ids
-.idea/dataSources.xml
-.idea/dataSources.local.xml
-.idea/sqlDataSources.xml
-.idea/dynamic.xml
-.idea/uiDesigner.xml
-
-# Gradle:
-.idea/gradle.xml
-.idea/libraries
-
-# Mongo Explorer plugin:
-.idea/mongoSettings.xml
-
-## File-based project format:
-*.iws
-
-## Plugin-specific files:
-
-# IntelliJ
-/out/
-
-# mpeltonen/sbt-idea plugin
-.idea_modules/
-
-# JIRA plugin
-atlassian-ide-plugin.xml
-
-# Crashlytics plugin (for Android Studio and IntelliJ)
-com_crashlytics_export_strings.xml
-crashlytics.properties
-crashlytics-build.properties
-fabric.properties
 
+# Claude / MCP config
+.claude/
+.playwright-mcp/

.husky/pre-commit

@@ -0,0 +1,25 @@
+echo "Scanning staged files for secrets..."
+
+# Get list of staged files (exclude deleted files)
+STAGED=$(git diff --cached --name-only --diff-filter=d)
+
+if [ -z "$STAGED" ]; then
+  echo "No staged files to check."
+  exit 0
+fi
+
+# Run secretlint on each staged file
+echo "$STAGED" | xargs npx secretlint --no-color
+
+EXIT_CODE=$?
+
+if [ $EXIT_CODE -ne 0 ]; then
+  echo ""
+  echo "ERROR: Potential secrets detected in staged files."
+  echo "   Remove secrets before committing."
+  echo "   Use 'git commit --no-verify' to bypass (not recommended)."
+  echo ""
+  exit 1
+fi
+
+echo "No secrets detected. Proceeding with commit."

.secretlintignore

@@ -0,0 +1,9 @@
+node_modules/
+coverage/
+package-lock.json
+sbom.json
+reports/
+public/
+logs/
+*.min.js
+.github/

.secretlintrc.json

@@ -0,0 +1,7 @@
+{
+  "rules": [
+    {
+      "id": "@secretlint/secretlint-rule-preset-recommend"
+    }
+  ]
+}