feat(pipeline): add artifact signing and verification step (#496)

[Favourejiro]

• Add ArtifactSigningService with signArtifact (SHA-256 + HMAC-SHA256) and verifyArtifact (timingSafeEqual) — secret from env, never hardcoded
• Add 'signing' stage to DeploymentStatusType
• Update DeploymentPipelineService: sign artifact after validation, verify before push, abort with error on mismatch, log checksum in deployment_logs metadata
• Add ARTIFACT_SIGNING_SECRET to .env.example with generation instructions
• Add vitest env var for test environment
• Add 6 pipeline tests covering valid/tampered/missing-signature cases and checksum presence in deployment_logs metadata

Closes #496

Integrates artifact signing and verification into the deployment pipeline (issue #496).

Changes

New: ArtifactSigningService

• signArtifact(artifact) — computes SHA-256 checksum and HMAC-SHA256 signature using process.env.ARTIFACT_SIGNING_SECRET
• verifyArtifact(artifact, checksum, signature) — recomputes both values and compares using crypto.timingSafeEqual to prevent timing attacks
• Secret is never hardcoded; throws if env var is missing

Updated: DeploymentPipelineService

• After syntax validation: signs the generated artifact, sets status signing, logs the checksum
• Before pushGeneratedCode: verifies the artifact; aborts the pipeline with a descriptive error if verification fails
• Checksum stored in deployment_logs metadata for audit: { checksum: "sha256:...", timestamp: "...", deploymentId: "..." }

Updated: DeploymentStatusType

• Added 'signing' stage between 'validating' and 'creating_repo'

Updated: .env.example

ARTIFACT_SIGNING_SECRET=your-signing-secret-here

Used to sign and verify generated artifacts before deployment.

Generate with: openssl rand -hex 32

Updated: vitest.config.ts

• Added ARTIFACT_SIGNING_SECRET test env value so all existing pipeline tests continue to pass

Tests

• 28 existing artifact-verification tests ✅
• 32 existing pipeline tests ✅
• 6 new pipeline tests covering:
  • Valid artifact proceeds to push
  • Tampered artifact aborts pipeline before push
  • Missing/invalid signature aborts pipeline
  • Checksum present in deployment_logs metadata
  • signing stage appears in correct position in status sequence
  • verifyArtifact receives same content and credentials as signArtifact

All 66 tests pass.

Security

• No secrets hardcoded anywhere
• timingSafeEqual used for all comparisons
• Pipeline is hard-blocked from pushing tampered artifacts

[drips-wave]

@Favourejiro Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits