chore(deps): bump transformers from 4.57.6 to 5.0.0rc3 in /backend

.github/workflows/ci.yml

@@ -0,0 +1,108 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+    paths:
+      - "backend/**"
+      - "frontend/**"
+      - ".github/workflows/ci.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "backend/**"
+      - "frontend/**"
+
+env:
+  PYTHON_VERSION: "3.12"
+  WORKING_DIR: backend
+
+jobs:
+  frontend-ci:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run build
+
+  lint-and-test:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: none
+
+    defaults:
+      run:
+        working-directory: ${{ env.WORKING_DIR }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Cache pip
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements-lock.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Install dependencies
+        env:
+          PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-lock.txt
+          pip install pytest pytest-asyncio ruff
+
+      - name: Lint with ruff
+        run: ruff check app/
+
+      # Compile check — verify all .py files parse
+      - name: Compile check
+        run: |
+          python -c "
+          import ast, os, sys
+          errors = []
+          for root, dirs, files in os.walk('app'):
+              for f in files:
+                  if f.endswith('.py'):
+                      path = os.path.join(root, f)
+                      try:
+                          ast.parse(open(path, encoding='utf-8').read())
+                      except SyntaxError as e:
+                          errors.append(f'{path}: {e}')
+          if errors:
+              for e in errors:
+                  print(f'FAIL: {e}')
+              sys.exit(1)
+          print(f'All Python files compiled OK')
+          "
+
+      # Run unit tests (no server needed)
+      - name: Run unit tests
+        run: |
+          python -m pytest tests/ -v --tb=short --disable-warnings
+
+      # Check for common issues
+      - name: Check env template
+        run: |
+          if [ -f .env.example ]; then
+            echo ".env.example exists — good"
+          else
+            echo "WARNING: no .env.example found"
+          fi

.github/workflows/deploy-azure.yml

@@ -0,0 +1,139 @@
+name: Deploy to Azure Container Apps
+
+on:
+  push:
+    branches: [main, staging]
+    paths:
+      - "backend/**"
+      - "infrastructure/azure/**"
+      - ".github/workflows/deploy-azure.yml"
+
+env:
+  AZURE_RESOURCE_GROUP: rankroute-prod
+  AZURE_CONTAINER_APP: rankroute-api
+  ACR_NAME: rankrouteacrind
+  WORKING_DIR: backend
+
+jobs:
+  test-and-deploy:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Cache pip
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+
+      - name: Install dependencies
+        env:
+          PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
+        run: |
+          pip install -r requirements.txt
+          pip install pytest pytest-asyncio
+        working-directory: ${{ env.WORKING_DIR }}
+
+      - name: Run tests
+        run: python -m pytest tests/ -v --tb=short --disable-warnings
+        working-directory: ${{ env.WORKING_DIR }}
+
+      - name: Debug Secrets
+        run: |
+          if [ -n "${{ secrets.AZURE_CREDENTIALS }}" ]; then
+            echo "AZURE_CREDENTIALS is set."
+          else
+            echo "AZURE_CREDENTIALS is EMPTY! GitHub cannot see the secret."
+          fi
+
+      - name: Azure Login
+        uses: azure/login@v1
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: Build and push to ACR
+        run: |
+          az acr build \
+            --registry ${{ env.ACR_NAME }} \
+            --image rankroute-api:${{ github.sha }} \
+            --image rankroute-api:latest \
+            .
+          az acr build \
+            --registry ${{ env.ACR_NAME }} \
+            --image rankroute-caddy:${{ github.sha }} \
+            --image rankroute-caddy:latest \
+            --file Dockerfile.caddy \
+            .
+        working-directory: ${{ env.WORKING_DIR }}
+
+      - name: Run database migrations
+        run: |
+          sudo apt-get update && sudo apt-get install -y postgresql-client
+          for f in app/db/migrations/V*__*.sql; do
+            echo "Applying $f..."
+            PGPASSWORD=${{ secrets.SUPABASE_DB_PASSWORD }} psql \
+              "${{ secrets.SUPABASE_DB_URL }}" \
+              -f "$f"
+          done
+        working-directory: ${{ env.WORKING_DIR }}
+
+      - name: Deploy API to Container Apps
+        run: |
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "Deploying to Production (100% Traffic)..."
+            az containerapp update \
+              --name ${{ env.AZURE_CONTAINER_APP }} \
+              --resource-group ${{ env.AZURE_RESOURCE_GROUP }} \
+              --image ${{ env.ACR_NAME }}.azurecr.io/rankroute-api:${{ github.sha }}
+          else
+            echo "Deploying to Staging (0% Public Traffic)..."
+            az containerapp update \
+              --name ${{ env.AZURE_CONTAINER_APP }} \
+              --resource-group ${{ env.AZURE_RESOURCE_GROUP }} \
+              --image ${{ env.ACR_NAME }}.azurecr.io/rankroute-api:${{ github.sha }} \
+              --revision-suffix stg-${{ github.sha }}
+            # Note: For true traffic splitting, the ACA environment must be in multiple revision mode.
+          fi
+
+      - name: Deploy Caddy Gateway
+        run: |
+          az containerapp update \
+            --name rankroute-caddy \
+            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} \
+            --image ${{ env.ACR_NAME }}.azurecr.io/rankroute-caddy:${{ github.sha }}
+
+      - name: Deploy Worker
+        if: github.ref == 'refs/heads/main'
+        run: |
+          az containerapp update \
+            --name rankroute-worker \
+            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} \
+            --image ${{ env.ACR_NAME }}.azurecr.io/rankroute-api:${{ github.sha }}
+
+      - name: Deploy Beat
+        if: github.ref == 'refs/heads/main'
+        run: |
+          az containerapp update \
+            --name rankroute-beat \
+            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} \
+            --image ${{ env.ACR_NAME }}.azurecr.io/rankroute-api:${{ github.sha }}
+
+      - name: Verify deployment health
+        if: github.ref == 'refs/heads/main'
+        run: |
+          sleep 30
+          FQDN=$(az containerapp show \
+            --name rankroute-caddy \
+            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} \
+            --query "properties.configuration.ingress.fqdn" -o tsv)
+          curl --fail --retry 10 --retry-delay 10 \
+            "https://$FQDN/api/v1/health"

.github/workflows/migration-check.yml

@@ -0,0 +1,46 @@
+name: Migration Safety Check
+
+on:
+  pull_request:
+    paths:
+      - 'backend/app/db/migrations/**.sql'
+
+jobs:
+  check-backward-compatibility:
+    name: Enforce Zero-Downtime Migrations
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout PR Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Scan for destructive SQL
+        run: |
+          echo "Scanning added/modified SQL migration files for destructive operations..."
+
+          # Get list of changed SQL files in the migrations directory
+          CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }} HEAD | grep '^backend/app/db/migrations/.*\.sql$' || true)
+
+          if [ -z "$CHANGED_FILES" ]; then
+            echo "No migrations changed."
+            exit 0
+          fi
+
+          DESTRUCTIVE_FOUND=false
+
+          for file in $CHANGED_FILES; do
+            echo "Checking $file..."
+            # Look for DROP or RENAME case-insensitively
+            if egrep -i 'DROP TABLE|DROP COLUMN|RENAME COLUMN' "$file"; then
+              echo "::error file=$file::Destructive operation found! You cannot DROP or RENAME columns in a single deployment. See docs/MIGRATION_POLICY.md"
+              DESTRUCTIVE_FOUND=true
+            fi
+          done
+
+          if [ "$DESTRUCTIVE_FOUND" = true ]; then
+            echo "Migration Safety Check FAILED. Destructive operations cause downtime in Azure Container Apps."
+            exit 1
+          fi
+
+          echo "✅ Migrations look backward-compatible!"

.github/workflows/security.yml

@@ -0,0 +1,55 @@
+name: Automated Security Gates
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '0 2 * * *' # Run nightly at 2 AM UTC
+
+permissions:
+  contents: read
+
+jobs:
+  security-scans:
+    name: Dependency & Secret Scans
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Trufflehog requires deep fetch to scan commit history
+
+      # ── Secret Scanning ──────────────────────────────────────────────
+      - name: TruffleHog Secret Scanner
+        uses: trufflesecurity/trufflehog@main
+        with:
+          path: ./
+          base: ${{ github.event.repository.default_branch }}
+          head: HEAD
+          extra_args: --debug --only-verified
+        # We allow this to fail without breaking the PR deployment 
+        # so developers can review findings non-blockingly.
+        continue-on-error: true
+
+      # ── Dependency Auditing ──────────────────────────────────────────
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+
+      - name: Install pip-audit
+        run: python -m pip install pip-audit
+
+      - name: Audit Backend Dependencies (pip-audit)
+        working-directory: backend
+        run: |
+          # We explicitly ignore CVE-2026-45829 (ChromaDB) as our architecture
+          # uses the embedded client and is immune to the HTTP server RCE.
+          pip-audit -r requirements-lock.txt --ignore-vuln CVE-2026-45829
+        # Even with the ignore list, we set this to non-blocking so a 
+        # newly disclosed zero-day doesn't randomly halt production hotfixes.
+        continue-on-error: true