Merge branch 'main' into main

Author: mikewheeleer

.env.example

@@ -0,0 +1,18 @@
+# =============================================================================
+# TalentTrust Backend — Environment Variables
+# =============================================================================
+# Copy this file to .env and fill in the values for your environment.
+# See docs/backend/config.md for detailed documentation.
+# =============================================================================
+
+# Server
+PORT=3001
+NODE_ENV=development
+
+# Stellar Network
+STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
+STELLAR_NETWORK_PASSPHRASE=Test SDF Network ; September 2015
+
+# Soroban Smart Contracts
+SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
+SOROBAN_CONTRACT_ID=

.eslintrc.js

@@ -0,0 +1,13 @@
+module.exports = {
+  parser: '@typescript-eslint/parser',
+  extends: ['plugin:@typescript-eslint/recommended'],
+  env: {
+    node: true,
+    jest: true,
+  },
+  ignorePatterns: ['dist', 'node_modules'],
+  rules: {
+    '@typescript-eslint/no-explicit-any': 'off',
+    '@typescript-eslint/no-unused-vars': ['warn', { argsIgnorePattern: '^_' }]
+  },
+};

.eslintrc.json

@@ -0,0 +1,22 @@
+{
+  "root": true,
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "project": "./tsconfig.json",
+    "ecmaVersion": 2022,
+    "sourceType": "module"
+  },
+  "plugins": ["@typescript-eslint"],
+  "extends": [
+    "eslint:recommended",
+    "plugin:@typescript-eslint/recommended",
+    "plugin:@typescript-eslint/recommended-requiring-type-checking"
+  ],
+  "rules": {
+    "@typescript-eslint/no-unused-vars": ["error", { "argsIgnorePattern": "^_" }],
+    "@typescript-eslint/explicit-function-return-type": "off",
+    "@typescript-eslint/no-explicit-any": "warn",
+    "no-console": "off"
+  },
+  "ignorePatterns": ["dist/", "node_modules/", "jest.config.js", "coverage/"]
+}

.github/workflows/ci.yml

@@ -1,3 +1,16 @@
+##
+# CI Pipeline — TalentTrust Backend
+#
+# Gates (all must pass before merge):
+#   1. lint      — ESLint with TypeScript rules
+#   2. test      — Jest with ≥95% line/function/statement coverage
+#   3. build     — TypeScript compilation (strict)
+#   4. security  — npm audit (fails on HIGH or CRITICAL vulnerabilities)
+#
+# Branch protection: configure GitHub to require all four status checks
+# before merging into `main`. See docs/backend/branch-protection.md.
+##
+
 name: CI
 
 on:
@@ -6,9 +19,63 @@ on:
   pull_request:
     branches: [main]
 
+# Cancel in-progress runs for the same branch to save CI minutes.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
+  # ── 1. Lint ────────────────────────────────────────────────────────────────
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run ESLint
+        run: npm run lint
+
+  # ── 2. Test (with coverage) ────────────────────────────────────────────────
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests with coverage
+        run: npm run test:ci
+
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: coverage-report
+          path: coverage/
+          retention-days: 14
+
+  # ── 3. Build ───────────────────────────────────────────────────────────────
   build:
+    name: Build
     runs-on: ubuntu-latest
+    needs: [lint, test]
     steps:
       - uses: actions/checkout@v4
 
@@ -21,8 +88,31 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Build
+      - name: Compile TypeScript
         run: npm run build
 
-      - name: Run tests
-        run: npm test
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+  # ── 4. Security audit ─────────────────────────────────────────────────────
+  security:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: npm audit (HIGH + CRITICAL)
+        run: npm run audit:ci

.github/workflows/dependency-scan.yml

@@ -0,0 +1,41 @@
+name: Dependency Scan
+
+on:
+  schedule:
+    - cron: '0 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-scan:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Policy gate (production dependencies)
+        run: npm run security:audit
+
+      - name: Generate JSON report artifact
+        run: npm run security:audit:json > audit-report.json
+
+      - name: Dry-run remediation
+        run: npm run security:remediate:dry
+
+      - name: Upload audit report
+        uses: actions/upload-artifact@v4
+        with:
+          name: dependency-audit-report
+          path: audit-report.json
+