Merge develop into master (Feb 3)

.github/dependabot.yml

@@ -0,0 +1,98 @@
+version: 2
+updates:
+  # Frontend (Clients) - npm dependencies
+  - package-ecosystem: "npm"
+    directory: "/Clients"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    reviewers:
+      - "bluewave-labs/verifywise-maintainers"
+    labels:
+      - "dependencies"
+      - "security"
+    commit-message:
+      prefix: "deps(frontend):"
+    groups:
+      # Group minor and patch updates together
+      frontend-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Backend (Servers) - npm dependencies
+  - package-ecosystem: "npm"
+    directory: "/Servers"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    reviewers:
+      - "bluewave-labs/verifywise-maintainers"
+    labels:
+      - "dependencies"
+      - "security"
+    commit-message:
+      prefix: "deps(backend):"
+    groups:
+      backend-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # EvaluationModule - Python dependencies
+  - package-ecosystem: "pip"
+    directory: "/EvaluationModule"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "bluewave-labs/verifywise-maintainers"
+    labels:
+      - "dependencies"
+      - "security"
+      - "python"
+    commit-message:
+      prefix: "deps(eval):"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "bluewave-labs/verifywise-maintainers"
+    labels:
+      - "dependencies"
+      - "ci/cd"
+    commit-message:
+      prefix: "ci:"
+
+  # Docker dependencies
+  - package-ecosystem: "docker"
+    directory: "/Clients"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "docker(frontend):"
+
+  - package-ecosystem: "docker"
+    directory: "/Servers"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "docker(backend):"

.github/workflows/backend-checks.yml

@@ -1,22 +1,29 @@
 name: Backend Checks
+
 permissions:
   contents: read
+  security-events: write
 
 on:
   pull_request:
     branches: ['master', 'develop']
     paths:
       - 'Servers/**'
+  push:
+    branches: ['master', 'develop']
+    paths:
+      - 'Servers/**'
+
 jobs:
-  build-check:
-    name: Backend Checks / build-check
+  security-audit:
+    name: Security Audit
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: Servers
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node
         uses: actions/setup-node@v4
@@ -26,8 +33,54 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Build
+      - name: Run npm audit
+        run: npm audit --audit-level=high
+        continue-on-error: true
+
+      - name: Run npm audit (JSON output for review)
+        run: npm audit --json > ../audit-results.json || true
+
+      - name: Upload audit results
+        uses: actions/upload-artifact@v6
+        with:
+          name: backend-npm-audit-results
+          path: audit-results.json
+          retention-days: 30
+
+  lint-and-build:
+    name: Lint and Build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: Servers
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: TypeScript type check
         run: npm run build
 
-      - name: Run Tests
+      - name: Run tests
         run: npm test
+
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        continue-on-error: true
+        with:
+          fail-on-severity: high
+          deny-licenses: GPL-3.0, AGPL-3.0

.github/workflows/deploy-to-production.yml

@@ -0,0 +1,26 @@
+name: Deploy to Production
+
+on:
+  workflow_run:
+    workflows: ["Build and Push Images to GitHub Container Registry"]
+    types:
+      - completed
+
+jobs:
+  deploy:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    environment: Build
+
+    steps:
+      - name: Deploy to Production
+        uses: appleboy/[email protected]
+        with:
+          host: ${{ secrets.PROD_HOST }}
+          username: ${{ secrets.PROD_USER }}
+          key: ${{ secrets.PROD_SSH_KEY }}
+          script: |
+            cd /root/verifywise/_saas_deployment
+            docker-compose --env-file .env.prod down
+            docker images --format "table {{.Repository}}:{{.Tag}}\t{{.ID}}" | grep -v -E "(redis|postgres|admin)" | awk 'NR>1 {print $2}' | xargs -r docker rmi -f || true
+            ./install.sh