Harden QA, security, and release readiness - #5

Merged

sepaseh merged 81 commits into

mainfrom

codex/qa-hardening

Jul 31, 2026

Commits on Jul 30, 2026

chore: enforce formatting in CI
sepaseh
committed
b071072
chore: declare Node.js version
sepaseh
committed
bf8f541
docs: add repository contribution policies
sepaseh
committed
df9381a
refactor: centralize API error messages
sepaseh
committed
48cf147
build: validate production environment
sepaseh
committed
4e71996
chore: enforce dependency security audit
sepaseh
committed
779452c
chore: update dependencies and Node runtime
sepaseh
committed
9036ee0
chore: configure automated dependency updates
sepaseh
committed
65e4486
ci: pin GitHub Actions to immutable revisions
sepaseh
committed
976f01b
ci: add CodeQL security scanning
sepaseh
committed
70d7e22
ci: integrate SonarQube analysis
sepaseh
committed
73e3249
test: cover API authentication lifecycle
sepaseh
committed
48854d1
test: cover login journey end to end
sepaseh
committed
2a6412d
docs: define SonarQube quality gate
sepaseh
committed
97bbe62
docs: define main branch protection
sepaseh
committed
7c609e7
test token handling
sepaseh
committed
f0fd67e
test storage utilities
sepaseh
committed
1715711
test routing permissions
sepaseh
committed
138ce17
test API error handling
sepaseh
committed
d0ed5c7
test authentication refresh failures
sepaseh
committed
ab7df50
test priority forms and pages
sepaseh
committed
0f94910
test authentication journeys
sepaseh
committed
67f533b
test role and user management
sepaseh
committed
2af82cf
test application accessibility
sepaseh
committed
d384755
test localized critical journeys
sepaseh
committed
a6198b5
test cross-browser coverage
sepaseh
committed
bf20247
test add visual regression coverage
sepaseh
committed
897579b
perf split application bundle
sepaseh
committed
63b0a07
perf enforce performance budgets
sepaseh
committed
b1a6492
security enforce production headers
sepaseh
committed
42889e9
test add deployment smoke checks
sepaseh
committed
aa73007
feat add structured observability
sepaseh
committed
8c1d023
chore: establish automated releases
sepaseh
committed
c719881
docs: define release rollback procedures
sepaseh
committed
a6605ea
test: add staging validation gate
sepaseh
committed
b1ab9e0
security: add threat modeling and DAST
sepaseh
committed
c8aa8a6
test: add mutation and API contract gates
sepaseh
committed
7d94379
style: bundle local Vazirmatn font
sepaseh
committed
cb50735

Commits on Jul 31, 2026

ci: require SonarQube quality gate configuration
sepaseh
committed
fc68a9d
test: isolate Vitest environment configuration
sepaseh
committed
d5e2f99
test: raise production coverage baseline
sepaseh
committed
5193ab8
fix: prevent email redaction regex backtracking
sepaseh
committed
783adc6
fix: prevent query redaction regex backtracking
sepaseh
committed
f474eea
fix: validate untrusted API error responses
sepaseh
committed
faa13a9
refactor: reduce API interceptor complexity
sepaseh
committed
e058e3a
refactor: normalize error boundary render type
sepaseh
committed
f536c9f
refactor: sanitize OTP input props
sepaseh
committed
f3c31e5
refactor: normalize route wrapper return type
sepaseh
committed
5e7063a
refactor: remove redundant permission type alias
sepaseh
committed
546d197
test: centralize synthetic E2E credentials
sepaseh
committed
0b1f086
fix: configure SonarQube organization
sepaseh
committed
deab43e
fix: satisfy Sonar quality analysis
sepaseh
committed
7bb1207
test: raise coverage for routing and observability
sepaseh
committed
abb2e93
test: fix performance entry mock type
sepaseh
committed
1f4ec49
ci: stabilize Lighthouse first paint budget
sepaseh
committed
ec3d23b
fix(ci): skip SonarQube for fork pull requests
sepaseh
committed
6db617e
fix(ci): pin ZAP image digest
sepaseh
committed
e0055f0
ci: account for Lighthouse runner variance
sepaseh
committed
547f67b
fix(ci): disable staging checkout credentials
sepaseh
committed
86660f8
test(contract): require account authorization
sepaseh
committed
fcdbf62
docs: correct required check contexts
sepaseh
committed
2f456fd
docs: align referrer policy description
sepaseh
committed
e1f60fc
fix: align Node.js engine support
sepaseh
committed
d851308
docs(security): complete authentication review record
sepaseh
committed
bf730f1
fix(security): restrict DAST to staging
sepaseh
committed
cc7e47f
fix(performance): respect application base path
sepaseh
committed
ea29331
fix(a11y): preserve required OTP semantics
sepaseh
committed
e490cb0
fix(styles): unquote Vazirmatn family name
sepaseh
committed
fb15b22
test: document ResizeObserver no-ops
sepaseh
committed
9d5a36b
fix(types): include staging and contract configs
sepaseh
committed
31787e5
fix(ci): disable checkout credential persistence
sepaseh
committed
05c2a8d
fix: resolve SonarCloud maintainability issues
sepaseh
committed
fcfe9d3
refactor source modules into colocated directories
sepaseh
committed
92c59b2
fix: satisfy Sonar quality gate
sepaseh
committed
0d8599b
test: stabilize account flow coverage
sepaseh
committed
65a02b1
test: cover management actions
sepaseh
committed
57efb16
test: allow CI time for user management flow
sepaseh
committed
0545854
test: align management fixtures with API types
sepaseh
committed
07331aa
fix: remove invalid OTP aria attribute
sepaseh
committed
42cb9bd
fix: remove redundant password fields fragment
sepaseh
committed
6fd17ab
fix remaining coderabbit findings
sepaseh
committed
b2255f7