Enforce backend authentication, add /health, drift guardrail, and lint gate

.github/dependabot.yml

@@ -4,3 +4,9 @@ updates:
     directory: /
     schedule:
       interval: weekly
+  # The CAP app's own dependencies live in src/ (@sap/cds, jest, mbt, …); the
+  # published app lock is regenerated from here, so keep this manifest current.
+  - package-ecosystem: npm
+    directory: /src
+    schedule:
+      interval: weekly

.github/workflows/test.yml

@@ -24,8 +24,9 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: 22
-      # the builder's own dev deps (jest for the script tests)
+      # the builder's own dev deps (jest for the script tests, eslint)
       - run: npm ci
+      - run: npm run lint
       - run: npm run assemble
       # one install covers the app AND the vendored core (its deps are part
       # of the app lock, placed under core/node_modules/)

.github/workflows/update_cap.yml

@@ -44,6 +44,16 @@ jobs:
       # the builder's own dev deps (jest for the script tests, run by `npm test`)
       - run: npm ci
       - run: npm run mirror_core
+      - run: npm run assemble
+      # one install covers the app AND the vendored core (its deps are part
+      # of the app lock, placed under core/node_modules/)
+      - run: npm ci
+        working-directory: run/output/cap2UI5
+      - run: npm test
+      # Commit the refreshed mirror ONLY after assemble + the app's jest suite
+      # pass. Committing earlier would land a broken upstream core on main
+      # permanently even though the publish is correctly gated; gating the
+      # mirror commit on the same green keeps main buildable.
       - name: commit refreshed mirror
         run: |
           git config user.name "github-actions[bot]"
@@ -66,12 +76,6 @@ jobs:
               sleep $((i * 2))
             done
           fi
-      - run: npm run assemble
-      # one install covers the app AND the vendored core (its deps are part
-      # of the app lock, placed under core/node_modules/)
-      - run: npm ci
-        working-directory: run/output/cap2UI5
-      - run: npm test
       - name: publish built app to cap2UI5/cap2UI5
         env:
           ACTION_KEY_APP: ${{ secrets.ACTION_KEY_APP }}

eslint.config.js

@@ -0,0 +1,72 @@
+// ESLint flat config for the builder's own hand-written code: the build
+// scripts (mirror/assemble/publish), the builder tests, and the CAP app
+// source in src/srv + src/test. Generated/assembled trees (run/), the mirror
+// (run/input), node_modules and the upstream UI5 webapp (src/app, browser
+// globals) are excluded.
+"use strict";
+
+const js = require("@eslint/js");
+
+module.exports = [
+  {
+    ignores: [
+      "run/**",
+      "node_modules/**",
+      "src/app/**",
+      "src/gen/**",
+      "coverage/**",
+    ],
+  },
+  js.configs.recommended,
+  {
+    files: ["scripts/**/*.js", "test/**/*.js", "src/srv/**/*.js", "src/test/**/*.js"],
+    languageOptions: {
+      ecmaVersion: 2023,
+      sourceType: "commonjs",
+      globals: {
+        require: "readonly",
+        module: "writable",
+        exports: "writable",
+        process: "readonly",
+        __dirname: "readonly",
+        __filename: "readonly",
+        console: "readonly",
+        Buffer: "readonly",
+        setInterval: "readonly",
+        clearInterval: "readonly",
+        setTimeout: "readonly",
+        globalThis: "readonly",
+        // CAP globals used in the service/server code and tests.
+        SELECT: "readonly",
+        INSERT: "readonly",
+        UPDATE: "readonly",
+        DELETE: "readonly",
+        cds: "readonly",
+      },
+    },
+    rules: {
+      "no-unused-vars": ["warn", { argsIgnorePattern: "^_", varsIgnorePattern: "^_", caughtErrors: "none" }],
+      "no-empty": ["warn", { allowEmptyCatch: true }],
+    },
+  },
+  {
+    files: ["test/**/*.js", "src/test/**/*.js", "**/*.test.js"],
+    languageOptions: {
+      globals: {
+        describe: "readonly",
+        test: "readonly",
+        it: "readonly",
+        expect: "readonly",
+        beforeEach: "readonly",
+        afterEach: "readonly",
+        beforeAll: "readonly",
+        afterAll: "readonly",
+        jest: "readonly",
+      },
+    },
+  },
+  {
+    files: ["*.config.js"],
+    languageOptions: { globals: { require: "readonly", module: "writable" } },
+  },
+];