RayVerify platform foundation: schema, engines, dashboard, infrastructure & documentation

.github/workflows/ci.yml

@@ -0,0 +1,74 @@
+name: CI
+
+on:
+  push:
+    branches: ['**']
+  pull_request:
+    branches: [main, develop]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  backend:
+    name: Backend (lint · typecheck · test · build)
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: rayverify
+          POSTGRES_PASSWORD: rayverify
+          POSTGRES_DB: rayverify_test
+        ports: ['5432:5432']
+        options: >-
+          --health-cmd "pg_isready -U rayverify"
+          --health-interval 5s --health-timeout 5s --health-retries 10
+      redis:
+        image: redis:7-alpine
+        ports: ['6379:6379']
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s --health-timeout 5s --health-retries 10
+    env:
+      DATABASE_URL: postgresql://rayverify:rayverify@localhost:5432/rayverify_test?schema=public
+      REDIS_URL: redis://localhost:6379
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - name: Generate Prisma client
+        run: npm run prisma:generate --workspace @rayverify/backend
+      - name: Lint
+        run: npm run lint --workspace @rayverify/backend
+      - name: Typecheck (shared + backend)
+        run: |
+          npm run typecheck --workspace @rayverify/shared
+          npm run typecheck --workspace @rayverify/backend
+      - name: Unit tests
+        run: npm run test --workspace @rayverify/backend
+      - name: Apply schema (migrations + physical SQL)
+        run: |
+          npm run prisma:migrate:dev --workspace @rayverify/backend -- --name ci --skip-seed || true
+          node packages/backend/scripts/apply-sql.js || true
+      - name: Build
+        run: npm run build --workspace @rayverify/backend
+
+  frontend:
+    name: Frontend (typecheck · build)
+    runs-on: ubuntu-latest
+    env:
+      NEXT_TELEMETRY_DISABLED: '1'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck --workspace @rayverify/frontend
+      - run: npm run build --workspace @rayverify/frontend

.github/workflows/codeql.yml

@@ -0,0 +1,33 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    - cron: '23 4 * * 1' # weekly, Monday 04:23 UTC
+
+jobs:
+  analyze:
+    name: Analyze (javascript-typescript)
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['javascript-typescript']
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          language: ${{ matrix.language }}
+          queries: security-extended
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.github/workflows/deploy.yml

@@ -0,0 +1,73 @@
+name: Deploy
+
+# Build & push images to ECR, then deploy to ECS. Production requires manual
+# approval via a protected GitHub Environment. Auth to AWS uses OIDC — no
+# long-lived keys. Configure repo variables/secrets before enabling:
+#   vars:    AWS_REGION, ECR_REGISTRY, ECS_CLUSTER, API_SERVICE, WEB_SERVICE
+#   secrets: AWS_DEPLOY_ROLE_ARN  (IAM role trusting this repo via OIDC)
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Target environment
+        type: choice
+        options: [staging, production]
+        default: staging
+  push:
+    tags: ['v*.*.*']
+
+permissions:
+  id-token: write # OIDC
+  contents: read
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.meta.outputs.tag }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: meta
+        run: echo "tag=${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_REGION }}
+      - uses: aws-actions/amazon-ecr-login@v2
+      - name: Build & push backend
+        run: |
+          docker build -f packages/backend/Dockerfile \
+            -t ${{ vars.ECR_REGISTRY }}/rayverify-api:${{ steps.meta.outputs.tag }} .
+          docker push ${{ vars.ECR_REGISTRY }}/rayverify-api:${{ steps.meta.outputs.tag }}
+      - name: Build & push frontend
+        run: |
+          docker build -f packages/frontend/Dockerfile \
+            -t ${{ vars.ECR_REGISTRY }}/rayverify-web:${{ steps.meta.outputs.tag }} .
+          docker push ${{ vars.ECR_REGISTRY }}/rayverify-web:${{ steps.meta.outputs.tag }}
+
+  deploy:
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    # Protected environment ⇒ required reviewers gate production (separation of duties).
+    environment: ${{ github.event.inputs.environment || 'staging' }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_REGION }}
+      - name: Run DB migrations (one-off ECS task)
+        run: |
+          echo "Trigger 'rayverify-api migrate' task (prisma migrate deploy + apply-sql)."
+          echo "Migrations use the expand/contract pattern; partitions are pre-created."
+      - name: Deploy API (rolling / blue-green via CodeDeploy)
+        run: |
+          aws ecs update-service --cluster ${{ vars.ECS_CLUSTER }} \
+            --service ${{ vars.API_SERVICE }} --force-new-deployment
+      - name: Deploy Web
+        run: |
+          aws ecs update-service --cluster ${{ vars.ECS_CLUSTER }} \
+            --service ${{ vars.WEB_SERVICE }} --force-new-deployment
+      - name: Smoke test
+        run: echo "curl health endpoints, verify task health, then mark deploy complete."

.github/workflows/security-scan.yml

@@ -0,0 +1,68 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    - cron: '0 6 * * *' # daily
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  secrets:
+    name: Secret scan (gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: 8.30.1
+        run: |
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz
+          tar -xzf gitleaks.tar.gz gitleaks
+          chmod +x gitleaks
+      - name: Run gitleaks
+        run: ./gitleaks dir . --redact --verbose --exit-code 1 --report-format sarif --report-path gitleaks-results.sarif
+      - name: Upload gitleaks SARIF artifact
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: gitleaks-results.sarif
+          path: gitleaks-results.sarif
+          if-no-files-found: ignore
+
+  dependencies:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with: { node-version: 20, cache: npm }
+      - run: npm ci
+      - name: npm audit (high+)
+        run: npm audit --audit-level=high || true
+
+  filesystem:
+    name: Filesystem vuln scan (Trivy)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Trivy filesystem scan
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          format: sarif
+          output: trivy-results.sarif
+          limit-severities-for-sarif: true
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif

.gitignore

@@ -0,0 +1,57 @@
+# Dependencies
+node_modules/
+.pnp
+.pnp.js
+
+# Builds
+dist/
+build/
+.next/
+out/
+*.tsbuildinfo
+next-env.d.ts
+
+# Env & secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+secrets/
+
+# Prisma
+packages/backend/prisma/*.db
+packages/backend/prisma/migrations/dev.db*
+
+# Logs
+logs/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Test / coverage
+coverage/
+.nyc_output/
+test-results/
+playwright-report/
+
+# OS / editor
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/*
+!.vscode/extensions.json
+*.swp
+
+# Terraform
+infra/**/.terraform/
+infra/**/*.tfstate
+infra/**/*.tfstate.*
+infra/**/*.tfvars
+!infra/**/*.tfvars.example
+.terraform.lock.hcl
+
+# Misc
+tmp/
+.cache/

.prettierrc.json

@@ -0,0 +1,6 @@
+{
+  "singleQuote": true,
+  "trailingComma": "all",
+  "printWidth": 100,
+  "semi": true
+}