feat(stability): unify readiness and recovery

.gitea/workflows/ci.yaml

@@ -35,6 +35,14 @@ jobs:
       - name: Build
         run: dotnet build backend-tests/Nexus.Api.Tests.csproj --no-restore --configuration Release
 
+      - name: Block high or critical backend vulnerabilities
+        run: |
+          dotnet list backend/Nexus.Api.csproj package --vulnerable --include-transitive --format json > /tmp/nexus-dotnet-vulnerabilities.json
+          if grep -Eiq '"severity"[[:space:]]*:[[:space:]]*"(high|critical)"' /tmp/nexus-dotnet-vulnerabilities.json; then
+            cat /tmp/nexus-dotnet-vulnerabilities.json
+            exit 1
+          fi
+
       - name: Verify OpenAPI contract
         run: |
           test -f backend/openapi/Nexus.Api.json
@@ -43,17 +51,36 @@ jobs:
       - name: Test
         run: dotnet test backend-tests/Nexus.Api.Tests.csproj --no-build --configuration Release --verbosity normal
 
-      - name: Docker integration tests
-        if: ${{ vars.NEXUS_RUN_DOCKER_INTEGRATION_TESTS == 'true' }}
-        timeout-minutes: 15
-        env:
-          NEXUS_RUN_DOCKER_INTEGRATION_TESTS: "true"
-          NEXUS_RUN_TOXIPROXY_INTEGRATION_TESTS: ${{ vars.NEXUS_RUN_TOXIPROXY_INTEGRATION_TESTS }}
+  backend-integration:
+    name: Backend integration (PostgreSQL/Toxiproxy)
+    runs-on: linux
+    timeout-minutes: 20
+    env:
+      NEXUS_RUN_DOCKER_INTEGRATION_TESTS: "true"
+      NEXUS_RUN_TOXIPROXY_INTEGRATION_TESTS: "true"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Verify Docker endpoint
+        run: docker info
+
+      - name: Restore and build
+        run: |
+          dotnet restore backend-tests/Nexus.Api.Tests.csproj
+          dotnet build backend-tests/Nexus.Api.Tests.csproj --no-restore --configuration Release
+
+      - name: Run all container-backed contracts
         run: >-
           dotnet test backend-tests/Nexus.Api.Tests.csproj
           --no-build
           --configuration Release
-          --filter "Category=DockerIntegration"
+          --filter "Category=DockerIntegration|Category=ToxiproxyIntegration"
           --verbosity normal
 
   # ─── Frontend ──────────────────────────────────
@@ -78,6 +105,14 @@ jobs:
         run: pnpm install --frozen-lockfile
         working-directory: frontend
 
+      - name: Verify release version
+        run: test "$(node -p "require('./package.json').version")" = "$(tr -d '[:space:]' < ../VERSION)"
+        working-directory: frontend
+
+      - name: Block high or critical production vulnerabilities
+        run: pnpm audit --prod --audit-level high
+        working-directory: frontend
+
       - name: Type check
         run: pnpm typecheck
         working-directory: frontend
@@ -112,31 +147,22 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
-      - name: Check for .env leaks
+      - name: Gitleaks v8.30.1
+        env:
+          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
         run: |
-          echo "🔍 Scanning for potential secrets in source code..."
-          HITS=$(grep -rPn "(API_KEY|SECRET|PASSWORD|TOKEN)\s*[:=]\s*['\"][^'\"]{8,}" --include="*.cs" --include="*.ts" --include="*.vue" backend/ frontend/src/ 2>/dev/null || true)
-          if [ -n "$HITS" ]; then
-            echo "❌ SECRET LEAK DETECTED — the following lines look like hardcoded credentials:"
-            echo "$HITS"
-            echo ""
-            echo "Remove these values and use environment variables or a secrets manager instead."
-            exit 1
-          fi
-          # Secondary pass: catch bare assign patterns that are suspicious regardless of length
-          LOOSE=$(grep -rPn "(API_KEY|SECRET|PASSWORD|TOKEN)\s*[:=]\s*['\"]" --include="*.cs" --include="*.ts" --include="*.vue" backend/ frontend/src/ 2>/dev/null || true)
-          if [ -n "$LOOSE" ]; then
-            echo "⚠️  WARNING — potential secrets found (short values may be false positives, review manually):"
-            echo "$LOOSE"
-          else
-            echo "✅ No obvious secrets found"
-          fi
+          curl -fsSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz -o /tmp/gitleaks.tar.gz
+          echo "$GITLEAKS_SHA256  /tmp/gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
+          /tmp/gitleaks git --redact --no-banner --exit-code 1 .
 
   deploy:
     name: Deploy Nexus
     runs-on: linux
-    needs: [backend, frontend, security]
+    needs: [backend, backend-integration, frontend, security]
     concurrency:
       group: deploy-production
       cancel-in-progress: false

.gitea/workflows/rollback.yaml

@@ -188,8 +188,16 @@ jobs:
           WAIT=1
           while [ $RETRY -lt $MAX ]; do
             RETRY=$((RETRY + 1))
+            READY_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 https://nexus.noveria.net/health/ready || true)
             HEALTH_BODY=$(curl -sf --max-time 10 https://nexus.noveria.net/health || true)
-            if printf '%s' "$HEALTH_BODY" | grep -Eq '^[[:space:]]*\{[[:space:]]*"status"[[:space:]]*:[[:space:]]*"Healthy"'; then
+            # Releases before v0.2.60 have no readiness endpoint; retain a
+            # visible compatibility fallback for emergency rollback only.
+            if [ "$READY_CODE" = "200" ] || [ "$READY_CODE" = "404" ]; then
+              READY_OK=true
+            else
+              READY_OK=false
+            fi
+            if [ "$READY_OK" = "true" ] && printf '%s' "$HEALTH_BODY" | grep -Eq '^[[:space:]]*\{[[:space:]]*"status"[[:space:]]*:[[:space:]]*"Healthy"'; then
               echo ""
               echo "✅ Health check passed with Healthy runtime and database state (attempt $RETRY/$MAX)"
               exit 0
@@ -227,11 +235,12 @@ jobs:
           }
 
           check_health() {
-            local body
+            local body ready_code
+            ready_code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "${BASE}/health/ready" || true)
             body=$(curl -sf --max-time 10 "${BASE}/health" || true)
             printf "  %-25s" "Health API:"
-            if printf '%s' "$body" | grep -Eq '^[[:space:]]*\{[[:space:]]*"status"[[:space:]]*:[[:space:]]*"Healthy"'; then
-              echo " HTTP 200 Healthy ✅"
+            if { [ "$ready_code" = "200" ] || [ "$ready_code" = "404" ]; } && printf '%s' "$body" | grep -Eq '^[[:space:]]*\{[[:space:]]*"status"[[:space:]]*:[[:space:]]*"Healthy"'; then
+              echo " ready=${ready_code} full=Healthy ✅"
               PASS=$((PASS + 1))
             else
               echo " not healthy ❌"