Claude/repo potential review 25d776

.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck server
+        run: npm run typecheck
+
+      - name: Run tests
+        run: npm run test:run
+
+      - name: Build frontend
+        run: npm run build
+
+      - name: Lint (informational - repo has pre-existing lint issues)
+        run: npm run lint
+        continue-on-error: true
+
+      - name: Typecheck frontend (informational - unverified)
+        run: npx tsc --noEmit -p tsconfig.app.json
+        continue-on-error: true
+
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build Docker image
+        run: docker build -t clientflow .

Dockerfile

@@ -43,8 +43,13 @@ EXPOSE 3001
 ENV NODE_ENV=production
 ENV API_PORT=3001
 ENV DATABASE_PATH=/app/data/app.db
-ENV JWT_SECRET=change-me-in-production
-ENV CORS_ORIGIN=*
+# JWT_SECRET is REQUIRED at runtime - the operator must supply a strong,
+# unique value (e.g. `docker run -e JWT_SECRET=...`). There is no baked-in
+# default: the server refuses to start in production without one (see
+# server/index.ts). Do not set a placeholder value here.
+# CORS_ORIGIN must be supplied by the operator (comma-separated list of
+# trusted origins). It intentionally has no default here - defaulting to
+# "*" would allow requests from any origin.
 
 # Start the server using tsx
 CMD ["npx", "tsx", "server/index.ts"]