Merge branch 'main' into feat/redis-task-store

Author: ugoocreates-pixel

.github/dependabot.yml

@@ -1,23 +1,65 @@
-# Dependabot version updates are intentionally disabled on this repository.
-#
-# The Dependabot configuration schema requires at least one entry under
-# `updates`. The minimum-viable disable below uses the GitHub Actions
-# ecosystem with `open-pull-requests-limit: 0` so that Dependabot cannot
-# open any pull request, and by listing only one ecosystem here we ensure
-# that no other ecosystem (npm, pip, cargo, etc.) will be scanned at all.
-#
-# To re-enable Dependabot in the future, replace this file with a full
-# configuration generated from the official options reference:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-#
-# Note: this file only governs Dependabot *version* updates. To also
-# disable Dependabot *security* updates, toggle the repo setting
-# "Dependabot security updates" off under
-# Settings -> Code security and analysis on GitHub.
 version: 2
 updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "npm"
+    commit-message:
+      prefix: "chore(npm)"
+      include: "scope"
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "cargo"
+    directory: "/app/onchain"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "cargo"
+    commit-message:
+      prefix: "chore(cargo)"
+      include: "scope"
+    groups:
+      cargo-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "pip"
+    commit-message:
+      prefix: "chore(pip)"
+      include: "scope"
+    groups:
+      pip-dependencies:
+        patterns:
+          - "*"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 0
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore(actions)"
+      include: "scope"
+    groups:
+      github-actions-dependencies:
+        patterns:
+          - "*"

.github/renovate.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "docker:pinDigests",
+    "helpers:pinGitHubActionDigests"
+  ],
+  "packageRules": [
+    {
+      "matchManagers": ["npm"],
+      "groupName": "npm dependencies",
+      "commitMessagePrefix": "chore(npm):",
+      "schedule": ["before 5am on monday"]
+    },
+    {
+      "matchManagers": ["cargo"],
+      "groupName": "cargo dependencies",
+      "commitMessagePrefix": "chore(cargo):",
+      "schedule": ["before 5am on monday"]
+    },
+    {
+      "matchManagers": ["pip_requirements"],
+      "groupName": "pip dependencies",
+      "commitMessagePrefix": "chore(pip):",
+      "schedule": ["before 5am on monday"]
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions dependencies",
+      "commitMessagePrefix": "chore(actions):",
+      "schedule": ["before 5am on monday"]
+    }
+  ],
+  "prHourlyLimit": 0,
+  "prConcurrentLimit": 5,
+  "labels": ["dependencies"],
+  "commitMessagePrefix": "chore(deps):"
+}

.github/workflows/backend-ci.yml

@@ -13,10 +13,37 @@ on:
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: chainforge_test
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_USER: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d chainforge_test"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
 
     steps:
       - uses: actions/checkout@v4
 
+      - name: Validate package.json files
+        run: |
+          node -e "const fs=require('fs'); require('child_process').execSync('git ls-files \"*package.json\"',{encoding:'utf8'}).trim().split('\\n').filter(Boolean).forEach(p=>{JSON.parse(fs.readFileSync(p,'utf8')); console.log('OK',p)})"
+
       - name: Install pnpm
         uses: pnpm/action-setup@v2
         with:
@@ -34,19 +61,34 @@ jobs:
       - name: Lint
         run: pnpm --filter backend run lint
 
-      - name: Test
-        run: pnpm --filter backend run test
+      - name: Prepare coverage database
+        working-directory: app/backend
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/chainforge_test?schema=public
+        run: pnpm exec prisma db push --skip-generate
+
+      - name: Test with coverage
+        env:
+          API_KEY: test-api-key-123
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/chainforge_test?schema=public
+          NODE_ENV: test
+          REDIS_HOST: 127.0.0.1
+          REDIS_PORT: '6379'
+        run: pnpm --filter backend run test:cov
 
       - name: Build
         run: pnpm --filter backend run build
 
       - name: Export OpenAPI spec
         working-directory: app/backend
         env:
-          DATABASE_URL: file:./prisma/dev.db
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/chainforge_test?schema=public
           NODE_ENV: development
         run: npm run spec:export
 
+      - name: Check for Prisma schema without migration
+        run: chmod +x app/backend/scripts/check-prisma-migration.sh && app/backend/scripts/check-prisma-migration.sh
+
       - name: Check for OpenAPI spec drift
         run: |
           git diff --exit-code app/frontend/openapi.json || \

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript-typescript', 'rust', 'python' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v3
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/contract-ci.yml

@@ -33,6 +33,19 @@ jobs:
         with:
           workspaces: "app/onchain"
 
+      - name: Enforce locked dependencies
+        run: cargo check --locked
+
+      - name: Ensure Cargo.lock is updated when Cargo.toml changes
+        if: github.event_name == 'pull_request'
+        run: |
+          git fetch origin "${{ github.base_ref }}" --depth=1
+          changed_files="$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" -- app/onchain/Cargo.toml app/onchain/Cargo.lock)"
+          if echo "$changed_files" | grep -q '^app/onchain/Cargo.toml$' && ! echo "$changed_files" | grep -q '^app/onchain/Cargo.lock$'; then
+            echo "Cargo.toml changed without updating Cargo.lock."
+            exit 1
+          fi
+
       - name: Check formatting
         run: cargo fmt --all -- --check
 

.github/workflows/frontend-ci.yml

@@ -0,0 +1,46 @@
+name: Frontend CI
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'app/frontend/**'
+      - '.github/workflows/frontend-ci.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - 'app/frontend/**'
+      - '.github/workflows/frontend-ci.yml'
+
+jobs:
+  lint-and-test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v2
+        with:
+          version: 9
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile --engine-strict=false
+
+      # Non-blocking until the pre-existing lint errors on main are fixed
+      # (tracked in docs/accessibility/audit-2026.md ticket backlog).
+      - name: Lint
+        continue-on-error: true
+        run: pnpm --filter chainforge-frontend run lint
+
+      - name: Type check
+        run: pnpm --filter chainforge-frontend run type-check
+
+      - name: Test (includes axe accessibility suite)
+        run: pnpm --filter chainforge-frontend run test

.github/workflows/testnet-smoke.yml

@@ -13,11 +13,29 @@ on:
       - 'release/**'
 
 jobs:
+  check-configuration:
+    runs-on: ubuntu-latest
+    outputs:
+      configured: ${{ steps.check.outputs.configured }}
+    steps:
+      - name: Check testnet configuration
+        id: check
+        env:
+          SOROBAN_CONTRACT_ID: ${{ secrets.SOROBAN_CONTRACT_ID }}
+          SOROBAN_RPC_URL: ${{ secrets.SOROBAN_RPC_URL }}
+        run: |
+          if [[ -n "$SOROBAN_CONTRACT_ID" && -n "$SOROBAN_RPC_URL" ]]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+          fi
+
   integration-harness:
     name: Testnet Integration Harness
     runs-on: ubuntu-latest
+    needs: check-configuration
     if: >
-      github.event_name == 'workflow_dispatch' || (secrets.SOROBAN_CONTRACT_ID != '' && secrets.SOROBAN_RPC_URL != '')
+      github.event_name == 'workflow_dispatch' || needs.check-configuration.outputs.configured == 'true'
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.gitignore

@@ -154,5 +154,6 @@ GEMINI.md
 # Local planning/spec docs (not committed)
 docs/superpowers/
 plan.md
+tasks/
 .playwright-mcp/
 dump.rdb

PR_DESCRIPTION.md

@@ -0,0 +1,23 @@
+## Problem
+Resolves #295
+
+Field operators using assistive technology may miss status updates because there are no `aria-live` regions set up in the app. Status transitions in campaigns and claim receipts need to be explicitly announced to screen readers.
+
+## What was implemented
+- Created a `<LiveRegion>` component in `app/frontend/src/components/LiveRegion.tsx` that uses `aria-live="polite"` and `role="status"` to announce message changes. It includes a small debounce queue (50ms) to ensure consecutive rapid updates are announced clearly.
+- Created `getStatusTransitionMessage` utility in `app/frontend/src/lib/status-messages.ts` to map raw status values to verbose, human-readable text (e.g. "Campaign status changed from Active to Paused.").
+- Integrated `<LiveRegion>` into `app/frontend/src/app/[locale]/campaigns/page.tsx` and `app/frontend/src/app/[locale]/claim-receipt/page.tsx`, storing previous state with a `useRef` and detecting status transitions to trigger announcements.
+- Added `jest-axe` tests for `<LiveRegion>` in `app/frontend/test/live-region.spec.tsx` to verify standard accessibility compliance and ensure text transitions correctly.
+
+## Assumptions made during Phase 1
+- `claim-receipt/page.tsx` is the intended target for the "claim-status / claim detail page" mentioned in the requirements, as it's the primary location for viewing a claim's status.
+- Campaign transitions happen via optimistic mutation and derive status from the local component list, so `useRef` was used to detect status changes cleanly without modifying the global store or mutation logic.
+
+## How to manually verify
+1. Run the application (`pnpm run dev`).
+2. Turn on a screen reader (VoiceOver, NVDA, or JAWS).
+3. Navigate to the NGO Campaigns page and perform an action like "Pause" or "Resume" on a campaign. The screen reader should announce "Campaign status changed from Active to Paused."
+4. Inspect the DOM to verify the visually hidden `aria-live` region updates its text content.
+
+## Follow-up work recommended
+- Extend this pattern to other dynamic status indicators in the application (like `VerificationReviewPage` queues or `ActivityCenter` toasts) to ensure universal accessibility coverage.

README.md

@@ -144,7 +144,11 @@ cd app/onchain && make test
 
 ## Contributing
 
-We welcome contributions that make humanitarian aid delivery more transparent and efficient. When submitting changes:
+We welcome contributions that make humanitarian aid delivery more transparent and efficient.
+
+Please read our [End-to-End Contributor Journey](docs/contributing/journey.md) for a complete walk-through of finding an issue, local setup, PR conventions, CI expectations, and the merge process.
+
+When submitting changes:
 
 1. Open an issue to discuss the proposed change before implementing
 2. Keep pull requests small and focused on a single concern