Harden QA, security, and release readiness

.env.example

@@ -1,2 +1,4 @@
 VITE_API_BASE_URL=https://localhost:8080
 VITE_APP_BASE_URL=/
+VITE_OBSERVABILITY_URL=https://observability.example.com/events
+VITE_RELEASE_ID=local

.env.test

@@ -0,0 +1,2 @@
+VITE_API_BASE_URL=http://localhost
+VITE_APP_BASE_URL=/

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto
+
+*.css text eol=lf
+*.html text eol=lf
+*.js text eol=lf
+*.json text eol=lf
+*.md text eol=lf
+*.ts text eol=lf
+*.tsx text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf

.github/CODEOWNERS

@@ -0,0 +1,32 @@
+# Default reviewer for all repository changes.
+* @sepaseh
+
+# Require explicit review for automation and dependency policy changes.
+/.github/ @sepaseh
+/package.json @sepaseh
+/package-lock.json @sepaseh
+
+# Release policy, version state, and generated release notes.
+/.release-please-manifest.json @sepaseh
+/CHANGELOG.md @sepaseh
+/docs/release-operations.md @sepaseh
+/docs/releasing.md @sepaseh
+/release-please-config.json @sepaseh
+
+# Production-like staging gate.
+/.github/workflows/staging.yml @sepaseh
+/docs/staging.md @sepaseh
+/staging.config.ts @sepaseh
+/staging/ @sepaseh
+
+# Security model, review evidence, and active scanning.
+/.github/workflows/dast.yml @sepaseh
+/docs/security/ @sepaseh
+/SECURITY.md @sepaseh
+
+# Test-effectiveness and frontend/backend compatibility gates.
+/.github/workflows/mutation.yml @sepaseh
+/contract/ @sepaseh
+/docs/contract-testing.md @sepaseh
+/stryker.config.json @sepaseh
+/vitest.contract.config.ts @sepaseh

.github/dependabot.yml

@@ -0,0 +1,48 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tehran
+    open-pull-requests-limit: 10
+    reviewers:
+      - sepaseh
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      production-minor-and-patch:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+      development-minor-and-patch:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tehran
+    open-pull-requests-limit: 5
+    reviewers:
+      - sepaseh
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      actions-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch

.github/workflows/ci.yml

@@ -17,71 +17,139 @@ permissions:
   contents: read
 
 env:
-  NODE_VERSION: 22
+  NODE_VERSION: 24.18.0
 
 jobs:
   check:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
 
       - run: npm ci
 
+      - run: npm run audit
+
       - run: npm run typecheck
 
       - run: npm run lint
 
+      - run: npm run format:check
+
       - run: npm run test:coverage
 
+      - run: npm run test:contract
+
+      - if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: consumer-contracts-${{ github.sha }}
+          path: pacts
+          retention-days: 14
+
+      - name: Validate SonarQube configuration
+        if: >-
+          github.event_name != 'pull_request' ||
+          github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
+          SONAR_PROJECT_KEY: ${{ vars.SONAR_PROJECT_KEY }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          missing=()
+
+          [[ -z "$SONAR_HOST_URL" ]] && missing+=("SONAR_HOST_URL")
+          [[ -z "$SONAR_PROJECT_KEY" ]] && missing+=("SONAR_PROJECT_KEY")
+          [[ -z "$SONAR_TOKEN" ]] && missing+=("SONAR_TOKEN")
+
+          if (( ${#missing[@]} > 0 )); then
+            missing_list=$(IFS=,; echo "${missing[*]}")
+            echo "::error title=Missing SonarQube configuration::Configure these repository settings: $missing_list"
+            exit 1
+          fi
+
+      - name: SonarQube scan
+        if: >-
+          github.event_name != 'pull_request' ||
+          github.event.pull_request.head.repo.full_name == github.repository
+        uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0
+        env:
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_PROJECT_KEY: ${{ vars.SONAR_PROJECT_KEY }}
+        with:
+          args: -Dsonar.projectKey=${{ env.SONAR_PROJECT_KEY }}
+
       - run: npm run knip
 
   build:
     needs: check
     runs-on: ubuntu-latest
+    env:
+      VITE_API_BASE_URL: https://api.example.com
+      VITE_APP_BASE_URL: /
+      VITE_RELEASE_ID: ${{ github.sha }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
 
       - run: npm ci
 
-      - run: npm run build
+      - run: npm run performance
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: dist-${{ github.sha }}
           path: dist
 
+      - if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: lighthouse-${{ github.sha }}
+          path: .lighthouseci
+          retention-days: 14
+
   e2e:
     needs: check
     runs-on: ubuntu-latest
+    env:
+      VITE_API_BASE_URL: https://api.example.com
+      VITE_APP_BASE_URL: /
+      VITE_RELEASE_ID: ${{ github.sha }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
 
       - run: npm ci
 
-      - run: npx playwright install --with-deps chromium
+      - run: npx playwright install --with-deps chromium firefox webkit
 
       - run: npm run test:e2e
 
       - if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: playwright-report-${{ github.sha }}
           path: |

.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "30 3 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze JavaScript and TypeScript
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - uses: github/codeql-action/init@f52b05f4acaaa234e44466e66d29050e135ea9ef # v4.36.0
+        with:
+          languages: javascript-typescript
+          queries: security-extended
+
+      - uses: github/codeql-action/analyze@f52b05f4acaaa234e44466e66d29050e135ea9ef # v4.36.0

.github/workflows/dast.yml

@@ -0,0 +1,63 @@
+name: DAST
+
+on:
+  schedule:
+    - cron: "0 3 1 * *"
+  workflow_dispatch:
+
+concurrency:
+  cancel-in-progress: false
+  group: staging-dast
+
+permissions:
+  contents: read
+
+jobs:
+  zap:
+    environment: staging
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      DAST_ALLOWED_HOST: ${{ vars.STAGING_ALLOWED_HOST }}
+      DAST_PRODUCTION_HOST: ${{ vars.PRODUCTION_HOST }}
+      DAST_TARGET: ${{ vars.STAGING_BASE_URL }}
+
+    steps:
+      - name: Validate authorized target
+        shell: bash
+        run: |
+          node -e '
+            const value = process.env.DAST_TARGET;
+            const allowedHost = process.env.DAST_ALLOWED_HOST?.toLowerCase();
+            const productionHost = process.env.DAST_PRODUCTION_HOST?.toLowerCase();
+            if (!value) throw new Error("STAGING_BASE_URL is required");
+            if (!allowedHost) throw new Error("STAGING_ALLOWED_HOST is required");
+            if (!productionHost) throw new Error("PRODUCTION_HOST is required");
+            const url = new URL(value);
+            if (url.protocol !== "https:") {
+              throw new Error("STAGING_BASE_URL must use HTTPS");
+            }
+            if (url.username || url.password) {
+              throw new Error("STAGING_BASE_URL must not contain credentials");
+            }
+            if (url.hostname.toLowerCase() !== allowedHost) {
+              throw new Error("STAGING_BASE_URL host is not explicitly allowed");
+            }
+            if (url.hostname.toLowerCase() === productionHost) {
+              throw new Error("DAST must not target the production host");
+            }
+          '
+
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Run authorized ZAP full scan
+        uses: zaproxy/action-full-scan@bee4e5be916301228d2b1b2dcad73aab6fa6a25b # v0.13.0
+        with:
+          allow_issue_writing: false
+          artifact_name: staging-dast-${{ github.run_id }}
+          cmd_options: "-a"
+          docker_name: ghcr.io/zaproxy/zaproxy:2.17.0@sha256:c558ee87358911ab17278c70991e856f57793e115d9cd0f88ca475cf82907a1a
+          fail_action: true
+          target: ${{ env.DAST_TARGET }}