feat: CI hardening and test improvements

[zensgit]

Summary

This PR implements comprehensive CI hardening and test improvements to enhance code quality, security, and maintainability.

Key Changes:

• Restored Rust Core Dual Mode Check to blocking mode (fail-fast: true)
• Added cargo-deny security and licensing checks (non-blocking initially)
• Added rustfmt formatting checks (non-blocking initially)
• Created comprehensive CSV export security tests
• Created currency manual rate cleanup tests
• Added Dependabot configuration for automated dependency updates
• Added CODEOWNERS file for code review matrix
• Updated README with comprehensive CI troubleshooting guide

CI Workflow Enhancements

🔒 Security & Quality Checks

• Cargo Deny: Validates dependencies for security vulnerabilities, licensing compliance, and version conflicts
• Rustfmt: Ensures consistent code formatting across the codebase
• Rust Core Check: Now blocks CI on failure (restored from continue-on-error mode)

📋 New Test Coverage

• CSV Export Security Tests (jive-api/tests/transactions_export_csv_test.rs):

  • Authentication and authorization validation
  • CSV injection prevention
  • Large dataset handling
  • Field sanitization tests

• Currency Rate Cleanup Tests (jive-api/tests/currency_manual_rate_cleanup_test.rs):

  • Old rate cleanup with retention policies
  • Used rate preservation logic
  • Bulk cleanup across currency pairs
  • Audit logging validation

Configuration Files

🤖 Dependabot Configuration (.github/dependabot.yml)

Automated dependency updates for:

• Rust dependencies (jive-api, jive-core)
• Flutter/Dart dependencies
• GitHub Actions
• Docker base images

Schedule: Weekly for code dependencies, monthly for infrastructure

🛡️ Cargo Deny Configuration (deny.toml)

• Security vulnerability scanning
• License compliance (allows MIT, Apache-2.0, BSD variants; denies GPL, AGPL)
• Dependency version conflict detection
• Banned crate detection

👥 Code Review Matrix (.github/CODEOWNERS)

Comprehensive ownership mapping for:

• Security-sensitive files (auth, middleware)
• CI/CD configurations
• Database migrations
• API routes and models
• UI components and themes

Documentation Improvements

🚨 CI Troubleshooting Guide

Added comprehensive troubleshooting section in README covering:

1. SQLx Cache Issues: Three-step fix method for the most common CI failure
2. Port Configuration: Clear mapping of development vs CI ports
3. Common Errors: Solutions for 7 most frequent CI failures
4. Local Testing: Commands to validate changes before pushing
5. CI Configuration Overview: Current blocking vs non-blocking checks

Test Plan

• Verify CI workflow syntax is valid
• Ensure new test files compile and have proper structure
• Validate configuration files follow proper formats
• Test README formatting and content accuracy
• Run CI pipeline to verify all checks work as expected
• Verify Dependabot configuration is recognized by GitHub

Breaking Changes

None. All new checks are initially non-blocking except for the Rust Core Check restoration.

Migration Notes

• The Rust Core Dual Mode Check is now blocking again - ensure jive-core builds in both default and server modes
• Developers should run cargo fmt --all before committing to pass rustfmt checks
• Review deny.toml if using new dependencies with restrictive licenses

🤖 Generated with Claude Code

[Copilot]

Pull Request Overview

This PR implements comprehensive CI hardening and test improvements to enhance code quality, security, and maintainability. The changes focus on strengthening the development workflow while establishing robust testing coverage for core functionalities.

Key changes include:

• Restored Rust Core Dual Mode Check to blocking mode with fail-fast configuration
• Added cargo-deny security checks and rustfmt formatting validation as non-blocking CI steps
• Created comprehensive test suites for CSV export security and currency manual rate cleanup
• Added Dependabot automation, CODEOWNERS configuration, and comprehensive CI troubleshooting documentation

Reviewed Changes

Copilot reviewed 75 out of 446 changed files in this pull request and generated 4 comments.

File	Description
README.md	Added CI troubleshooting guide with SQLx cache fixes and port configuration
Makefile	Updated cargo commands to use server features and added API-specific lint targets
Multiple test report files	Added comprehensive documentation of testing progress and service implementations
Multiple analysis files	Provided detailed Flutter analyzer cleanup reports and CI execution summaries

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The test date '2025-08-22' appears to be in the future. This should likely be a past date or the current date when the testing was actually performed.

Suggested change

	**测试时间**: 2025-08-22
	**测试时间**: 2024-06-01

[Copilot]

The new Makefile target 'api-lint' is referenced but not documented in the main help section. Consider adding it to the 'make help' output for discoverability.

[Copilot]

The build command now requires explicit feature flags. This could break existing workflows that expect default features. Consider documenting this breaking change or providing backward compatibility.

[Copilot]

The hardcoded default port 5433 appears in multiple places. Consider defining it as a variable at the top of the Makefile to avoid duplication and make it easier to maintain.

[gemini-code-assist]

Summary of Changes

Hello @zensgit, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the project's continuous integration pipeline and overall code quality. It introduces new automated checks for security, licensing, and formatting, expands test coverage for key API features, and streamlines developer workflows through improved automation and comprehensive documentation. The changes aim to catch issues earlier in the development cycle and ensure a more robust and maintainable codebase.

Highlights

• CI Hardening: The Rust Core Dual Mode Check has been restored to a blocking (fail-fast) mode, ensuring critical compilation checks prevent merges. New non-blocking checks for cargo-deny (security and licensing) and rustfmt (code formatting) have been integrated, with plans to make them blocking after an observation period.
• Test Improvements: Comprehensive CSV export security tests and currency manual rate cleanup tests have been created, enhancing coverage for critical API functionalities. The AGENTS.md file has been updated with detailed guidance on SQLx offline metadata and API developer shortcuts.
• Automation and Code Governance: Dependabot has been configured for automated weekly/monthly dependency updates across Rust, Flutter/Dart, GitHub Actions, and Docker. A CODEOWNERS file has been added to establish clear code review assignments, and a pre-commit hook has been introduced to enforce local API linting (SQLx check + Clippy).
• Documentation Consolidation: This pull request consolidates a significant amount of project documentation, including detailed reports on Flutter analyzer cleanup, CI status, exchange rate fixes, and functional comparisons, providing a comprehensive knowledge base for the project.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This is an excellent pull request that significantly hardens the CI/CD pipeline, improves the testing strategy, and enhances developer experience with better documentation and local tooling. The introduction of cargo-deny, rustfmt, dual-mode checks, and a comprehensive Dependabot configuration are all valuable additions. The new tests for CSV export and currency rate cleanup improve code quality and security. My main concern is the large number of committed report files (e.g., ANALYZER_CLEANUP_*.md, DATABASE_SCHEMA (2).sql, etc.). These appear to be generated artifacts and are generally not committed to a repository. I'd recommend removing them and adding their patterns to .gitignore.

[gemini-code-assist]

The glob pattern /*docker* might not behave as expected. It only matches files in the immediate subdirectories of the root, not in the root directory itself (e.g., it would match foo/docker-compose.yml but not /docker-compose.yml).

To ensure all Docker-related files are covered, you might want to use a more general pattern like *docker* or be more specific with patterns like /docker-compose*.yml and /Dockerfile* (which you've already done elsewhere). Using *docker* would be a catch-all for any file or directory containing "docker" in its name, which might be what you intend.

*docker* @huazhou

[gemini-code-assist]

This file and many others in this PR (e.g., DATABASE_SCHEMA (2).sql, CI_MONITORING_REPORT.md) appear to be generated reports or downloaded artifacts. It's generally not recommended to commit such files to the source repository as they can clutter the git history and lead to merge conflicts.

Consider adding these file patterns (e.g., *.md in the root, or specific report names) to your .gitignore file. If these reports are valuable, they can be attached to pull requests or stored in a separate documentation system.