Add CI gates, OpenAPI & RLS validation, VPS deploy, logger redaction and idempotency support

.dockerignore

@@ -0,0 +1,18 @@
+.git
+.github
+.husky
+node_modules
+dist
+coverage
+playwright-report
+test-results
+.vscode
+.idea
+*.log
+.env
+.env.*
+!.env.example
+Dockerfile*
+docker-compose*.yml
+README.md
+docs/auditorias

.github/workflows/ci.yml

@@ -16,12 +16,32 @@ jobs:
       - name: Install dependencies
         run: bun install
 
+      - name: Typecheck
+        run: bun run typecheck
+
+      - name: Strict core typecheck
+        run: bun run typecheck:strict:core
+
       - name: Lint
         run: bun run lint
-
+
+      - name: Domain boundary checks
+        run: |
+          bun run check:domain
+          bun run check:barrels
+
+      - name: API contract validation
+        run: bun run api:validate
+
+      - name: VPS readiness checks
+        run: bun run vps:check
+
       - name: Build
         run: bun run build
-
+
+      - name: Performance budget
+        run: bun run perf:budget
+
       - name: Vitest (Unit & Fuzz)
         run: bunx vitest run --coverage
 

.github/workflows/deploy-vps.yml

@@ -0,0 +1,102 @@
+name: Deploy VPS
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: "Target environment"
+        required: true
+        default: "staging"
+        type: choice
+        options:
+          - staging
+          - production
+      image_tag:
+        description: "Optional image tag override"
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: deploy-vps-${{ inputs.environment }}
+  cancel-in-progress: false
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}/zapp-web
+
+jobs:
+  build-and-push:
+    name: Build and push image
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    outputs:
+      image: ${{ steps.meta.outputs.image }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute image metadata
+        id: meta
+        run: |
+          TAG="${{ inputs.image_tag }}"
+          if [ -z "$TAG" ]; then TAG="${{ inputs.environment }}-${GITHUB_SHA::12}"; fi
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${TAG}"
+          echo "image=$IMAGE" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.image }}
+          build-args: |
+            VITE_SUPABASE_URL=${{ secrets.VITE_SUPABASE_URL }}
+            VITE_SUPABASE_ANON_KEY=${{ secrets.VITE_SUPABASE_ANON_KEY }}
+            VITE_EXTERNAL_SUPABASE_URL=${{ secrets.VITE_EXTERNAL_SUPABASE_URL }}
+            VITE_EXTERNAL_SUPABASE_ANON_KEY=${{ secrets.VITE_EXTERNAL_SUPABASE_ANON_KEY }}
+            VITE_SENTRY_DSN=${{ secrets.VITE_SENTRY_DSN }}
+            VITE_SENTRY_ENVIRONMENT=${{ inputs.environment }}
+            VITE_APP_ENV=${{ inputs.environment }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy:
+    name: Restart on VPS
+    runs-on: ubuntu-latest
+    needs: build-and-push
+    environment: ${{ inputs.environment }}
+    if: ${{ vars.VPS_DEPLOY_ENABLED == 'true' }}
+    steps:
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1.2.0
+        env:
+          ZAPP_WEB_IMAGE: ${{ needs.build-and-push.outputs.image }}
+          ZAPP_WEB_HOST: ${{ vars.ZAPP_WEB_HOST }}
+          ZAPP_WEB_DEPLOY_DIR: ${{ vars.ZAPP_WEB_DEPLOY_DIR }}
+        with:
+          host: ${{ secrets.VPS_HOST }}
+          username: ${{ secrets.VPS_USER }}
+          key: ${{ secrets.VPS_SSH_KEY }}
+          envs: ZAPP_WEB_IMAGE,ZAPP_WEB_HOST,ZAPP_WEB_DEPLOY_DIR
+          script: |
+            set -euo pipefail
+            cd "/opt/zapp-web"
+            export ZAPP_WEB_IMAGE="$ZAPP_WEB_IMAGE"
+            export ZAPP_WEB_HOST="${ZAPP_WEB_HOST:-zapp.atomicabr.com.br}"
+            docker compose pull zapp-web || true
+            docker compose up -d zapp-web
+            docker image prune -f

.github/workflows/security.yml

@@ -35,25 +35,33 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_ENABLE_SUMMARY: "false"
 
-  rls-audit:
-    name: RLS & Compliance Weekly Report
+  dependency-review:
+    name: Dependency Review
     runs-on: ubuntu-latest
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'pull_request'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
         with:
-          node-version: '20'
+          fail-on-severity: high
+
+  rls-audit:
+    name: RLS & Compliance Report
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
       - name: Install dependencies
-        run: npm install --no-audit --no-fund
+        run: bun install --frozen-lockfile
       - name: Generate RLS Report
-        run: bun scripts/verify_rls_compliance.ts > rls-compliance-report.md
-      - name: Publish Weekly Compliance
+        run: bun run security:rls | tee rls-compliance-report.md
+      - name: Publish RLS Compliance
         uses: actions/upload-artifact@v4
+        if: always()
         with:
-          name: weekly-security-compliance-report
+          name: rls-compliance-report
           path: rls-compliance-report.md

CHANGELOG.md

@@ -1,5 +1,22 @@
 # 📜 Changelog — ZAPP WEB
 
+## [Unreleased] - 2026-05-13
+### Adicionado
+- Gate estático de compliance RLS (`scripts/verify_rls_compliance.ts`) integrado ao workflow de segurança.
+- Budget de performance pós-build (`scripts/check-performance-budget.mjs`) integrado ao CI.
+- Baseline de autenticação privilegiada e SLOs operacionais iniciais.
+- Redaction central de PII/secrets para o logger do frontend.
+- Contrato OpenAPI mínimo para Edge Functions críticas com validação automatizada.
+- Idempotência por `x-idempotency-key` no endpoint `public-api` para evitar envios duplicados em retries.
+
+### Alterado
+- Pipeline de CI agora executa typecheck, typecheck strict do core, boundaries de domínio, validação de barrels, contrato OpenAPI e performance budget.
+- Workflow de segurança agora publica relatório RLS em PR/push/schedule e adiciona dependency review em PRs.
+
+### Corrigido
+- Dependência `lint-staged` ausente no Husky pre-commit.
+- Gaps de RLS/policies em tabelas operacionais detectadas pela auditoria estática.
+
 ## [2.0.1] - 2026-05-06
 ### Adicionado
 - Schemas de validação **Zod** para contatos e boundaries.

Dockerfile

@@ -0,0 +1,36 @@
+# syntax=docker/dockerfile:1.7
+
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+
+FROM deps AS builder
+WORKDIR /app
+COPY . .
+
+ARG VITE_SUPABASE_URL
+ARG VITE_SUPABASE_ANON_KEY
+ARG VITE_EXTERNAL_SUPABASE_URL
+ARG VITE_EXTERNAL_SUPABASE_ANON_KEY
+ARG VITE_SENTRY_DSN
+ARG VITE_SENTRY_ENVIRONMENT=production
+ARG VITE_APP_ENV=production
+
+ENV VITE_SUPABASE_URL=${VITE_SUPABASE_URL}
+ENV VITE_SUPABASE_ANON_KEY=${VITE_SUPABASE_ANON_KEY}
+ENV VITE_EXTERNAL_SUPABASE_URL=${VITE_EXTERNAL_SUPABASE_URL}
+ENV VITE_EXTERNAL_SUPABASE_ANON_KEY=${VITE_EXTERNAL_SUPABASE_ANON_KEY}
+ENV VITE_SENTRY_DSN=${VITE_SENTRY_DSN}
+ENV VITE_SENTRY_ENVIRONMENT=${VITE_SENTRY_ENVIRONMENT}
+ENV VITE_APP_ENV=${VITE_APP_ENV}
+
+RUN bun run build
+
+FROM nginx:1.27-alpine AS runtime
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=builder /app/dist /usr/share/nginx/html
+EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD wget -q -O - http://127.0.0.1/healthz >/dev/null || exit 1
+CMD ["nginx", "-g", "daemon off;"]