chore: standardize security and quality foundations

.gitea/workflows/ci-cd.yml

@@ -6,6 +6,10 @@ on:
       - beta
       - main
       - prod
+  pull_request:
+    branches:
+      - beta
+      - main
   workflow_dispatch:
 
 concurrency:
@@ -22,7 +26,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Set up Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -37,39 +41,40 @@ jobs:
       - name: Run backend quality gate
         run: bash scripts/ci_backend_quality_gate.sh
 
+      - name: Verify generated build metadata
+        run: python scripts/verify_build_metadata.py
+
+      - name: Audit frontend production dependencies
+        working-directory: frontend
+        run: npm audit --omit=dev --package-lock-only --audit-level=high
+
+      - name: Lint frontend
+        working-directory: frontend
+        run: npm run lint
+
+      - name: Check frontend formatting
+        working-directory: frontend
+        run: npm run format:check
+
+      - name: Type-check frontend
+        working-directory: frontend
+        run: npm run typecheck
+
+      - name: Test frontend
+        working-directory: frontend
+        run: npm test
+
       - name: Build frontend
         working-directory: frontend
         run: npm run build
 
-  deploy-prod:
-    if: github.ref_name == 'prod'
-    needs: verify
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Configure SSH key
-        env:
-          PROD_SSH_PRIVATE_KEY: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
-          PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
+      - name: Validate Compose configuration
         run: |
-          set -euo pipefail
-          : "${PROD_SSH_KNOWN_HOSTS:?PROD_SSH_KNOWN_HOSTS is required}"
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          printf '%s' "$PROD_SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-          chmod 644 ~/.ssh/known_hosts
+          cp .env.example .env
+          docker compose -f docker-compose.yml config --quiet
 
-      - name: Deploy to AMS-DEV01
-        env:
-          DEPLOY_HOST: ${{ secrets.PROD_SSH_HOST }}
-          DEPLOY_USER: ${{ secrets.PROD_SSH_USER }}
-          DEPLOY_PATH: ${{ secrets.PROD_DEPLOY_PATH }}
-          DEPLOY_SSH_OPTS: -o StrictHostKeyChecking=yes
-        run: bash scripts/deploy_ams_dev01.sh
+      - name: Build and smoke-test container
+        run: bash scripts/ci_container_smoke.sh
 
   deploy-beta:
     if: github.ref_name == 'beta'
@@ -97,6 +102,6 @@ jobs:
         env:
           DEPLOY_HOST: ${{ secrets.PROD_SSH_HOST }}
           DEPLOY_USER: ${{ secrets.PROD_SSH_USER }}
-          PROD_DEPLOY_PATH: ${{ secrets.PROD_DEPLOY_PATH }}
+          BETA_DEPLOY_PATH: ${{ secrets.PROD_DEPLOY_PATH }}
           DEPLOY_SSH_OPTS: -o StrictHostKeyChecking=yes
         run: bash scripts/deploy_beta_ams_dev01.sh