🧪 [test]: Testing & Production Launch Preparation

.dockerignore

@@ -1,12 +1,10 @@
 # Node & Frontend
 node_modules/
-# Keep apps/web for the build, but ignore other apps if any
-apps/*
+apps/
 !apps/web/
 apps/web/node_modules/
 apps/web/.next/
 .next/
-.turbo/
 
 # Chrome / NotebookLM browser profiles (~1GB)
 notebooklm_chrome_profile/

.github/dependabot.yml

@@ -6,9 +6,6 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
-    ignore:
-      - dependency-name: "eslint"
-        versions: [">=10"]
     groups:
       npm-minor-patch:
         update-types: ["minor", "patch"]
@@ -18,9 +15,6 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
-    ignore:
-      - dependency-name: "eslint"
-        versions: [">=10"]
 
   # Python backend dependencies.
   - package-ecosystem: "pip"

.github/workflows/ci.yml

@@ -11,40 +11,16 @@ permissions:
   actions: read
 
 jobs:
-  guards:
-    # Fail fast on the class of breakage that shipped to main un-caught:
-    # committed merge-conflict markers and import-time Python SyntaxErrors.
-    # (main previously carried unresolved markers in 10 files because the
-    # pipeline had no syntax gate — see PR #736.)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - name: No committed merge-conflict markers
-        run: |
-          # Opening/closing conflict sentinels always carry a label after the
-          # space, so this never matches decorative "=======" underlines.
-          if git grep -nE '^(<<<<<<<|>>>>>>>) ' -- . ':(exclude).github/workflows/ci.yml'; then
-            echo "::error::Committed merge-conflict markers found (see matches above)."
-            exit 1
-          fi
-          echo "No conflict markers found."
-      - uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-      - name: Python source compiles (no import-time SyntaxErrors)
-        run: python -m compileall -q src/
-
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: "npm"
       - run: npm install --legacy-peer-deps
       - name: TypeScript type-check (apps/web)
-        continue-on-error: true
         run: cd apps/web && npm run type-check
       - name: ESLint (apps/web)
         run: cd apps/web && npm run lint
@@ -73,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: "npm"

.github/workflows/codeql-analysis.yml

@@ -32,14 +32,14 @@ jobs:
 
     - name: Cache dependencies (Python)
       if: matrix.language == 'python'
-      uses: actions/cache@v6
+      uses: actions/cache@v5
       with:
         path: ~/.cache/pip
         key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
 
     - name: Cache dependencies (Node)
       if: matrix.language == 'javascript'
-      uses: actions/cache@v6
+      uses: actions/cache@v5
       with:
         # Cache the npm download cache, not node_modules: this is an npm
         # workspaces repo, so deps hoist to the root and apps/web/node_modules

.github/workflows/dependabot-auto-merge.yml

@@ -28,7 +28,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v3
+        uses: dependabot/fetch-metadata@v2
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - uses: actions/github-script@v9

.github/workflows/deploy-cloud-run.yml

@@ -186,7 +186,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
           scan-type: 'fs'
           scan-ref: '.'

.github/workflows/e2e-tests.yml

@@ -48,7 +48,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
           cache: 'npm'
@@ -138,7 +138,7 @@ jobs:
           echo "failed=$FAILED" >> $GITHUB_OUTPUT
 
       - name: Post PR comment with results
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+        if: github.event_name == 'pull_request'
         uses: actions/github-script@v9
         with:
           script: |

.github/workflows/security.yml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: '22'
           cache: 'npm'
@@ -76,7 +76,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Cache Trivy DB
-        uses: actions/cache@v6
+        uses: actions/cache@v5
         with:
           path: ~/.cache/trivy
           key: trivy-db-${{ github.run_id }}
@@ -86,7 +86,7 @@ jobs:
       - name: Build image for scanning
         run: docker build -t eventrelay:test -f Dockerfile .
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
           image-ref: 'eventrelay:test'
           format: 'sarif'
@@ -102,7 +102,7 @@ jobs:
         with:
           sarif_file: 'trivy-results.sarif'
       - name: Generate human-readable report
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         if: always()
         with:
           image-ref: 'eventrelay:test'

.github/workflows/verification.yml

@@ -37,7 +37,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -81,7 +81,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Set up Python 3.11
         uses: actions/setup-python@v6
@@ -145,7 +145,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Set up Python 3.11
         uses: actions/setup-python@v6
@@ -215,7 +215,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Check for blocking sleep in async functions
         run: |