fix: update CI workflow for Node.js 24 + fix better-sqlite3 compilation

.github/workflows/test.yml

@@ -6,32 +6,47 @@ on:
   pull_request:
     branches: [main, develop]
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   test:
     name: Run tests
     runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
 
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4
         with:
-          node-version: '22'
+          version: 9
 
-      - uses: pnpm/action-setup@v3
+      - uses: actions/setup-node@v4.4.0
         with:
-          version: 9
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Install system dependencies for better-sqlite3
+        run: sudo apt-get install -y python3 make g++
 
-      - run: pnpm install --build-from-source
+      - name: Install dependencies
+        run: pnpm install
 
-      - run: pnpm typecheck
+      - name: Rebuild better-sqlite3 for CI environment
+        run: pnpm rebuild better-sqlite3
 
-      - run: pnpm test
+      - name: Type check
+        run: pnpm typecheck
+
+      - name: Run tests
+        run: pnpm test
 
   privacy-audit:
     name: Privacy constraint check
     runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
 
       - name: Check for forbidden patterns
         run: |
@@ -48,4 +63,4 @@ jobs:
             echo "Privacy check FAILED"
             exit 1
           fi
-          echo "✅ Privacy check passed"
+          echo "✅ Privacy check passed"

package.json

@@ -41,6 +41,7 @@
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
+    "typescript": "~5.4.5",
     "vitest": "^4.1.8"
   }
 }

src/privacy/audit-log.ts

@@ -125,15 +125,15 @@ export class AuditLog {
    * This can be called by the user from the Privacy Dashboard to prove
    * that no historical records have been modified.
    */
-  verifyChain(): { valid: boolean; broken_at?: number; total_records: number } {
+  verifyChain(): { valid: boolean; broken_at: number | undefined; total_records: number } {
     const rows = this.db.prepare(`
       SELECT * FROM audit_log ORDER BY id ASC
     `).all() as AuditEntry[]
 
     let prevHash: string | null = null
 
     for (const row of rows) {
-      const content = [
+      const content: string = [
         row.timestamp,
         row.event_type,
         row.app_name,
@@ -143,8 +143,7 @@ export class AuditLog {
         row.details,
         prevHash,
       ].join('|')
-
-      const expectedHash = createHash('sha256').update(content).digest('hex')
+      const expectedHash: string = createHash('sha256').update(content).digest('hex')
 
       if (expectedHash !== row.record_hash) {
         return { valid: false, broken_at: row.id, total_records: rows.length }
@@ -153,7 +152,7 @@ export class AuditLog {
       prevHash = row.record_hash
     }
 
-    return { valid: true, total_records: rows.length }
+    return { valid: true, broken_at: undefined, total_records: rows.length }
   }
 
   /**