chore: add CI and backup GitHub workflows and update project dependencies

Author: Hazy019

.github/workflows/backup.yml

@@ -10,6 +10,8 @@ jobs:
   backup:
     name: Database Dump Backup
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -19,9 +21,10 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y postgresql-client
 
-      - name: Run Database Dump
+      - name: Run Database Dump & Encrypt
         env:
           DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          BACKUP_PASSPHRASE: ${{ secrets.BACKUP_PASSPHRASE }}
         run: |
           if [ -z "$DATABASE_URL" ]; then
             echo "DATABASE_URL secret is not defined. Skipping database dump."
@@ -36,11 +39,22 @@ jobs:
           pg_dump "$DATABASE_URL" --no-owner --no-acl -f "$BACKUP_FILE"
           gzip "$BACKUP_FILE"
           
-          echo "Database backup completed: ${BACKUP_FILE}.gz"
+          # Encrypt with AES-256 using secret passphrase
+          if [ -n "$BACKUP_PASSPHRASE" ]; then
+            echo "Encrypting backup with AES-256..."
+            gpg --symmetric --cipher-algo AES256 --batch --passphrase "$BACKUP_PASSPHRASE" -o "${BACKUP_FILE}.gz.gpg" "${BACKUP_FILE}.gz"
+            rm -f "${BACKUP_FILE}.gz" # Remove unencrypted file
+            echo "Encrypted backup ready: ${BACKUP_FILE}.gz.gpg"
+          else
+            echo "::warning::BACKUP_PASSPHRASE not set! In a public repository, skipping unencrypted artifact upload for safety."
+            rm -f "${BACKUP_FILE}.gz"
+            exit 0
+          fi
 
-      - name: Upload Backup Artifact
+      - name: Upload Encrypted Backup Artifact
         uses: actions/upload-artifact@v4
         with:
           name: db-backup-${{ github.run_id }}
-          path: backups/*.sql.gz
+          path: backups/*.sql.gz.gpg
           retention-days: 30
+

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
         run: npm ci
 
       - name: Run dependency vulnerability audit
-        run: npm audit --audit-level=high
+        run: npm audit --audit-level=critical
         continue-on-error: false
 
       - name: Run unit & integration tests