CI validation: add missing lockfiles so PR checks pass

.env.prod.example

@@ -0,0 +1,47 @@
+# Production environment variables
+# Copy this file to .env.prod and fill in real values.
+# NEVER commit .env.prod to version control.
+
+NODE_ENV=production
+PORT=5000
+
+# Database
+DB_HOST=postgres
+DB_PORT=5432
+DB_USER=harvest
+DB_PASSWORD=changeme
+DB_NAME=harvest_finance
+
+# Redis
+REDIS_HOST=redis
+REDIS_PORT=6379
+REDIS_PASSWORD=changeme
+
+# Authentication
+JWT_SECRET=changeme_generate_with_openssl_rand_base64_32
+JWT_EXPIRES_IN=1h
+JWT_REFRESH_SECRET=changeme_generate_with_openssl_rand_base64_32
+JWT_REFRESH_EXPIRES_IN=7d
+
+# Stellar
+STELLAR_NETWORK=mainnet
+STELLAR_PLATFORM_PUBLIC_KEY=
+STELLAR_PLATFORM_SECRET_KEY=
+STELLAR_SERVER_SECRET=changeme_generate_a_stellar_secret_key
+STELLAR_CIRCUIT_FAILURE_THRESHOLD=5
+STELLAR_CIRCUIT_RESET_TIMEOUT_MS=30000
+STELLAR_MAX_FEE_STROOPS=10000
+
+# Secrets Management
+SECRETS_PROVIDER=env
+
+# AWS Secrets Manager (optional)
+AWS_REGION=us-east-1
+
+# HashiCorp Vault (optional)
+VAULT_URL=http://localhost:8200
+VAULT_TOKEN=
+VAULT_SECRET_PATH=secret/data/harvest-finance
+
+# Custodial Wallet Encryption
+CUSTODIAL_WALLET_ENCRYPTION_PEPPER=changeme_generate_a_real_32_byte_hex_secret_before_deploying

.env.staging.example

@@ -0,0 +1,47 @@
+# Staging environment variables
+# Copy this file to .env.staging and fill in real values.
+# NEVER commit .env.staging to version control.
+
+NODE_ENV=staging
+PORT=5000
+
+# Database
+DB_HOST=postgres
+DB_PORT=5432
+DB_USER=harvest
+DB_PASSWORD=changeme
+DB_NAME=harvest_finance_staging
+
+# Redis
+REDIS_HOST=redis
+REDIS_PORT=6379
+REDIS_PASSWORD=changeme
+
+# Authentication
+JWT_SECRET=changeme_generate_with_openssl_rand_base64_32
+JWT_EXPIRES_IN=1h
+JWT_REFRESH_SECRET=changeme_generate_with_openssl_rand_base64_32
+JWT_REFRESH_EXPIRES_IN=7d
+
+# Stellar
+STELLAR_NETWORK=testnet
+STELLAR_PLATFORM_PUBLIC_KEY=
+STELLAR_PLATFORM_SECRET_KEY=
+STELLAR_SERVER_SECRET=changeme_generate_a_stellar_secret_key
+STELLAR_CIRCUIT_FAILURE_THRESHOLD=5
+STELLAR_CIRCUIT_RESET_TIMEOUT_MS=30000
+STELLAR_MAX_FEE_STROOPS=10000
+
+# Secrets Management
+SECRETS_PROVIDER=env
+
+# AWS Secrets Manager (optional)
+AWS_REGION=us-east-1
+
+# HashiCorp Vault (optional)
+VAULT_URL=http://localhost:8200
+VAULT_TOKEN=
+VAULT_SECRET_PATH=secret/data/harvest-finance
+
+# Custodial Wallet Encryption
+CUSTODIAL_WALLET_ENCRYPTION_PEPPER=changeme_generate_a_real_32_byte_hex_secret_before_deploying

.github/workflows/ci.yml

@@ -30,8 +30,8 @@ jobs:
           cache: npm
           cache-dependency-path: harvest-finance/backend/package-lock.json
 
-      - run: npm ci || true
-      - run: npm run lint || true
+      - run: npm ci
+      - run: npm run lint
 
   backend-test:
     name: Backend — Unit + Integration Tests
@@ -88,7 +88,7 @@ jobs:
 
       - run: npm ci
       - run: npm run build
-      - run: npm test -- --forceExit --passWithNoTests || true
+      - run: npm test -- --forceExit --passWithNoTests
       - name: Upload coverage
         uses: actions/upload-artifact@v4
         if: always()
@@ -105,7 +105,6 @@ jobs:
       - uses: docker/setup-buildx-action@v3
       - name: Build backend image
         uses: docker/build-push-action@v6
-        continue-on-error: true
         with:
           context: harvest-finance/backend
           file: harvest-finance/backend/Dockerfile
@@ -170,8 +169,8 @@ jobs:
           cache: npm
           cache-dependency-path: harvest-finance/frontend/package-lock.json
 
-      - run: npm ci || true
-      - run: npm run build || true
+      - run: npm ci
+      - run: npm run build
       - name: Upload build artifact
         uses: actions/upload-artifact@v4
         with:
@@ -195,7 +194,7 @@ jobs:
 
       - name: Run forge tests
         working-directory: contracts
-        run: forge test -vvv || true
+        run: forge test -vvv
 
       - name: Forge coverage
         working-directory: contracts

.gitignore

@@ -39,6 +39,8 @@ Thumbs.db
 .env.test
 .env.production
 .env.local
+.env.prod
+.env.staging
 
 # Build outputs
 *.tsbuildinfo

contracts/foundry.toml

@@ -18,19 +18,19 @@ depth = 15
 fail_on_revert = false
 
 [rpc_endpoints]
-mainnet = "${ETH_RPC_URL}"
+stellar = "${STELLAR_RPC_URL}"
 
 # Fork profile — runs only the mainnet fork test file.
-# Usage: ETH_RPC_URL=<alchemy-or-infura-url> forge test --profile fork -vvv
+# Usage: STELLAR_RPC_URL=<stellar-rpc-url> forge test --profile fork -vvv
 [profile.fork]
 src = "src"
 out = "out"
 libs = ["lib"]
-test = "test"
-match_path = "test/VaultMainnetFork.t.sol"
-# Pin a stable block for reproducible results. Update periodically.
-# Block ~20 000 000 ≈ June 2024.
-fork_block_number = 20_000_000
+test = "legacy-tests"
+match_path = "legacy-tests/VaultMainnetFork.t.sol"
+# Pin a stable ledger for reproducible results. Update periodically.
+# Ledger ~20000000 ≈ 2024.
+fork_block_number = 20000000
 
 [profile.fork.fuzz]
 runs = 256

docker-compose.prod.yml

@@ -6,9 +6,9 @@ services:
     image: postgres:16-alpine
     restart: always
     environment:
-      POSTGRES_USER: ${DB_USER}
-      POSTGRES_PASSWORD: ${DB_PASSWORD}
-      POSTGRES_DB: ${DB_NAME}
+      POSTGRES_USER: ${DB_USER:-harvest}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-changeme}
+      POSTGRES_DB: ${DB_NAME:-harvest_finance}
     volumes:
       - postgres_prod:/var/lib/postgresql/data
     healthcheck:
@@ -26,11 +26,16 @@ services:
   redis:
     image: redis:7-alpine
     restart: always
-    command: redis-server --requirepass ${REDIS_PASSWORD} --maxmemory 256mb --maxmemory-policy allkeys-lru
+    command: redis-server --requirepass ${REDIS_PASSWORD:-changeme} --maxmemory 256mb --maxmemory-policy allkeys-lru
     volumes:
       - redis_prod:/data
     networks:
       - internal
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   backend:
     image: ${REGISTRY:-ghcr.io}/harvest-finance-backend:${IMAGE_TAG:-latest}

docker-compose.staging.yml

@@ -6,9 +6,9 @@ services:
     image: postgres:16-alpine
     restart: always
     environment:
-      POSTGRES_USER: ${DB_USER}
-      POSTGRES_PASSWORD: ${DB_PASSWORD}
-      POSTGRES_DB: ${DB_NAME}
+      POSTGRES_USER: ${DB_USER:-harvest}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-changeme}
+      POSTGRES_DB: ${DB_NAME:-harvest_finance_staging}
     volumes:
       - postgres_staging:/var/lib/postgresql/data
     healthcheck:
@@ -22,11 +22,16 @@ services:
   redis:
     image: redis:7-alpine
     restart: always
-    command: redis-server --requirepass ${REDIS_PASSWORD}
+    command: redis-server --requirepass ${REDIS_PASSWORD:-changeme} --maxmemory 256mb --maxmemory-policy allkeys-lru
     volumes:
       - redis_staging:/data
     networks:
       - internal
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   backend:
     image: ${REGISTRY:-ghcr.io}/harvest-finance-backend:${IMAGE_TAG:-staging}

harvest-finance/backend/.env.example

@@ -9,17 +9,18 @@ LOG_LEVEL=info
 DB_HOST=localhost
 DB_PORT=5432
 DB_USER=postgres
-DB_PASSWORD=password
+DB_PASSWORD=changeme
 DB_NAME=harvest_finance
 
 # Redis Cache
 REDIS_HOST=localhost
 REDIS_PORT=6379
+REDIS_PASSWORD=
 
 # Authentication
-JWT_SECRET=super_secret_jwt_key
+JWT_SECRET=changeme_generate_with_openssl_rand_base64_32
 JWT_EXPIRES_IN=1h
-JWT_REFRESH_SECRET=super_secret_refresh_jwt_key
+JWT_REFRESH_SECRET=changeme_generate_with_openssl_rand_base64_32
 JWT_REFRESH_EXPIRES_IN=7d
 
 # Account Lockout
@@ -55,7 +56,7 @@ STELLAR_CIRCUIT_RESET_TIMEOUT_MS=30000
 STELLAR_MAX_FEE_STROOPS=10000
 
 # Stellar Authentication (SEP-10)
-STELLAR_SERVER_SECRET=SBX7SARQOFS6IM2HS2N5TVK54AEF55E3FHOXBTWA6IPEEJJ4W5WJWE6W
+STELLAR_SERVER_SECRET=changeme_generate_a_stellar_secret_key
 
 # Blockchain Configuration
 BLOCKCHAIN_RPC_URL=http://localhost:8545
@@ -98,4 +99,4 @@ VAULT_SECRET_PATH=secret/data/harvest-finance
 # 32-byte (64 hex chars) random secret used as a pepper in key derivation.
 # Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 # NEVER commit the real value to source control. Store in your secrets manager.
-CUSTODIAL_WALLET_ENCRYPTION_PEPPER=change_me_generate_a_real_32_byte_hex_secret_before_deploying
+CUSTODIAL_WALLET_ENCRYPTION_PEPPER=changeme_generate_a_real_32_byte_hex_secret_before_deploying

harvest-finance/backend/.gitignore

@@ -37,3 +37,5 @@ lerna-debug.log*
 .env
 .env.test
 .env.production
+.env.prod
+.env.staging