Harden Hafa Code for the FDMS classroom launch

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: bundler
+    directory: /api
+    schedule:
+      interval: weekly
+    groups:
+      ruby-security-and-maintenance:
+        patterns: ["*"]
+
+  - package-ecosystem: npm
+    directory: /web
+    schedule:
+      interval: weekly
+    groups:
+      frontend-security-and-maintenance:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,89 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: api
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: hafa_code_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U postgres"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
+    env:
+      RAILS_ENV: test
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432/hafa_code_test
+      RUBOCOP_CACHE_ROOT: tmp/rubocop
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.3.7"
+          bundler-cache: true
+          working-directory: api
+
+      - name: Prepare database
+        run: bin/rails db:prepare
+
+      - name: Test
+        run: bin/rails test
+
+      - name: Ruby style
+        run: bin/rubocop --format github
+
+      - name: Static security scan
+        run: bin/brakeman --no-pager
+
+      - name: Dependency security audit
+        run: bundle exec bundler-audit check --update
+
+  frontend:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Test
+        run: npm test
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Build
+        run: npm run build
+
+      - name: Dependency security audit
+        run: npm audit --audit-level=high

.node-version

@@ -0,0 +1 @@
+22.22.3

README.md

@@ -30,6 +30,7 @@ hafa-code/
 - [Security model](docs/SECURITY.md)
 - [Multi-file workspace plan](docs/MULTI_FILE_WORKSPACE.md)
 - [Classroom, orgs, sharing, accessibility, and runner plan](docs/CLASSROOM_ORGS_AND_SHARING_PLAN.md)
+- [FDMS classroom launch readiness and action plan](docs/FDMS_CLASSROOM_LAUNCH_PLAN.md)
 
 ## Security Model
 

api/.env.example

@@ -1,10 +1,16 @@
 DATABASE_URL=postgres://localhost/hafa_code_development
 FRONTEND_URL=http://localhost:5173
 ALLOWED_ORIGINS=http://localhost:5173
+SOLID_QUEUE_IN_PUMA=true
+JOB_CONCURRENCY=1
 
 CLERK_ISSUER=https://example.clerk.accounts.dev
 CLERK_JWKS_URL=https://example.clerk.accounts.dev/.well-known/jwks.json
 CLERK_AUDIENCE=
 CLERK_SECRET_KEY=sk_test_replace_me
 OWNER_ADMIN_EMAILS=
 ALLOW_OPEN_SIGNUPS=true
+ALLOWED_MEMBER_EMAIL_DOMAINS=
+ALLOW_ORGANIZATION_EXTERNAL_SHARING=false
+RESEND_API_KEY=
+RESEND_FROM_EMAIL=

api/Gemfile

@@ -39,3 +39,4 @@ gem "rack-cors"
 gem "dotenv-rails"
 gem "httparty"
 gem "resend", "~> 1.0"
+gem "solid_queue"