chore: sync with upstream main

Author: Jai-Shankar1033

.env.example

@@ -32,4 +32,7 @@ MOBILE_REDIRECT_URI=devcard://oauth/callback
 
 # ─── Server ───
 PORT=3000
-NODE_ENV=development
+NODE_ENV=development
+
+# ─── Refresh Token Cleanup ───
+REFRESH_TOKEN_CLEANUP_INTERVAL_MS=86400000

.github/pull_request_template.md

@@ -43,10 +43,10 @@ Closes #
 
 ## Checklist
 
-- [ ] My code follows the project's coding style (`pnpm -r run lint` passes).
-- [ ] TypeScript compiles without errors (`pnpm -r run typecheck`).
+- [ ] My code follows the project's coding style (`npm run lint` passes).
+- [ ] TypeScript compiles without errors (`npm run typecheck --workspaces --if-present`).
 - [ ] I have added or updated tests for the changes I made.
-- [ ] All tests pass locally (`pnpm -r run test`).
+- [ ] All tests pass locally (`npm run test --workspaces --if-present`).
 - [ ] I have updated documentation where necessary.
 - [ ] No new `console.log` or debug statements left in the code.
 - [ ] Breaking changes are documented in this PR description.

.github/scripts/commentResults.js

@@ -9,7 +9,6 @@ module.exports = async ({
   backendTypecheck,
   mobileLint,
   mobileTest,
-  webCheck,
   webBuild,
   backendLintOutput,
   mobileLintOutput,
@@ -57,7 +56,6 @@ ${mobileLint === 'failure' ? lintDetails(mobileLintOutput) : ''}
 
 | Check | Result |
 |---|---|
-| Check | ${status(webCheck)} |
 | Build | ${status(webBuild)} |
 
 ---

.github/scripts/generateLeaderboard.js

@@ -0,0 +1,130 @@
+module.exports = async ({ github, context }) => {
+    const owner = context.repo.owner;
+    const repo = context.repo.repo;
+
+    const EXCLUDED = new Set([
+        'shantkhatri',
+        'harxhit',
+        'blankirigaya'
+    ]);
+
+    const contributors = new Map();
+
+    const ensure = (login, avatarUrl, profileUrl) => {
+        if (!contributors.has(login)) {
+            contributors.set(login, {
+                login,
+                avatarUrl,
+                profileUrl,
+                mergedPrs: 0,
+                openPrs: 0,
+                issues: 0
+            });
+        }
+
+        return contributors.get(login);
+    };
+
+    const mergedPrs = await github.paginate(
+        github.rest.pulls.list,
+        {
+            owner,
+            repo,
+            state: 'closed',
+            per_page: 100
+        }
+    );
+
+    for (const pr of mergedPrs) {
+        if (!pr.merged_at || !pr.user) continue;
+
+        const login = pr.user.login;
+
+        if (EXCLUDED.has(login.toLowerCase())) continue;
+
+        const user = ensure(
+            login,
+            pr.user.avatar_url,
+            pr.user.html_url
+        );
+
+        user.mergedPrs++;
+    }
+
+    const openPrs = await github.paginate(
+        github.rest.pulls.list,
+        {
+            owner,
+            repo,
+            state: 'open',
+            per_page: 100
+        }
+    );
+
+    for (const pr of openPrs) {
+        if (!pr.user) continue;
+
+        const login = pr.user.login;
+
+        if (EXCLUDED.has(login.toLowerCase())) continue;
+
+        const user = ensure(
+            login,
+            pr.user.avatar_url,
+            pr.user.html_url
+        );
+
+        user.openPrs++;
+    }
+
+    const issues = await github.paginate(
+        github.rest.issues.listForRepo,
+        {
+            owner,
+            repo,
+            state: 'all',
+            per_page: 100
+        }
+    );
+
+    for (const issue of issues) {
+        if (issue.pull_request || !issue.user) continue;
+
+        const login = issue.user.login;
+
+        if (EXCLUDED.has(login.toLowerCase())) continue;
+
+        const user = ensure(
+            login,
+            issue.user.avatar_url,
+            issue.user.html_url
+        );
+
+        user.issues++;
+    }
+
+    const leaderboard = [...contributors.values()].sort(
+        (a, b) =>
+            b.mergedPrs - a.mergedPrs ||
+            b.issues - a.issues ||
+            b.openPrs - a.openPrs ||
+            a.login.localeCompare(b.login)
+    );
+
+    const fs = require('fs');
+    const path = require('path');
+
+    const outputDir = path.join('apps', 'web', 'public');
+    const outputFile = path.join(outputDir, 'leaderboard.json');
+
+    fs.mkdirSync(outputDir, { recursive: true });
+
+    fs.writeFileSync(
+        outputFile,
+        JSON.stringify(leaderboard, null, 2),
+        'utf8'
+    );
+
+    console.log(`Generated ${leaderboard.length} contributors`);
+    console.log(`Leaderboard written to ${outputFile}`);
+};

.github/scripts/triagePr.js

@@ -10,7 +10,7 @@ module.exports = async ({github, context}) => {
     const mobileFiles = []; 
     const devopsFiles = []; 
 
-    const labels = []; 
+    const labels = ['gssoc:approved']; 
     let primaryArea = null;
     let reviewer = null; 
 

.github/workflows/ci.yml

@@ -93,7 +93,6 @@ jobs:
     runs-on: ubuntu-latest
 
     outputs:
-      check_result: ${{ steps.web_check.outcome }}
       build_result: ${{ steps.web_build.outcome }}
 
     steps:
@@ -108,19 +107,13 @@ jobs:
       - name: Install web dependencies
         run: npm --prefix apps/web install
 
-      - name: Web check
-        id: web_check
-        continue-on-error: true
-        run: npm --prefix apps/web run lint
-
       - name: Web build
         id: web_build
         continue-on-error: true
         run: npm --prefix apps/web run build
 
       - name: Fail job if any check failed
         if: >
-          steps.web_check.outcome == 'failure' ||
           steps.web_build.outcome == 'failure'
         run: exit 1
 
@@ -191,7 +184,6 @@ jobs:
               backendLint:      '${{ needs.backend-ci.outputs.lint_result }}',      
               backendTest:      '${{ needs.backend-ci.outputs.test_result }}',
               backendTypecheck: '${{ needs.backend-ci.outputs.typecheck_result }}',
-              webCheck:         '${{ needs.web-ci.outputs.check_result }}',
               webBuild:         '${{ needs.web-ci.outputs.build_result }}',
               mobileLint:       '${{ needs.mobile-ci.outputs.lint_result }}',
               mobileTest:       '${{ needs.mobile-ci.outputs.test_result }}',

.github/workflows/leaderboard.yml

@@ -0,0 +1,43 @@
+name: Update Leaderboard
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 * * * *'
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: read
+
+jobs:
+  leaderboard:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Generate leaderboard
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const script = require('./.github/scripts/generateLeaderboard.js');
+            await script({ github, context });
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "chore: update leaderboard"
+          title: "chore: update leaderboard"
+          body: "Automated update of contributor leaderboard data."
+          branch: "automation/leaderboard-update"
+          base: "main"
+          delete-branch: true

.github/workflows/uat.yml

@@ -0,0 +1,135 @@
+name: UAT Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  detect-changes:
+    runs-on: ubuntu-latest
+    outputs:
+      backend: ${{ steps.changes.outputs.backend }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dorny/paths-filter@v3
+        id: changes
+        with:
+          filters: |
+            backend:
+              - 'apps/backend/**'
+
+  backend-deploy:
+    needs: detect-changes
+    if: needs.detect-changes.outputs.backend == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout app repo
+        uses: actions/checkout@v4
+
+      - name: Checkout infra repo
+        uses: actions/checkout@v4
+        with:
+          repository: Dev-Card/devcard-infra
+          path: infra
+          token: ${{ secrets.INFRA_REPO_TOKEN }}
+
+      - name: Authenticate to GCP
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
+          service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}
+
+      - name: Setup gcloud
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Configure Docker for Artifact Registry
+        run: gcloud auth configure-docker asia-south1-docker.pkg.dev
+
+      - name: Set image tag
+        id: tag
+        run: echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: apps/backend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: apps/backend
+        run: npm ci
+
+      # TODO: Once tests are fixed, uncomment the following lines
+      # - name: Run tests
+      #   working-directory: apps/backend
+      #   run: npm test
+
+      - name: Build and push Docker image
+        run: |
+          docker build \
+            -f docker/backend.Dockerfile \
+            -t asia-south1-docker.pkg.dev/devcard-prod/devcard/backend:${{ steps.tag.outputs.sha }} \
+            .
+          docker push asia-south1-docker.pkg.dev/devcard-prod/devcard/backend:${{ steps.tag.outputs.sha }}
+
+      - name: Get GKE credentials
+        uses: google-github-actions/get-gke-credentials@v2
+        with:
+          cluster_name: devcard-cluster
+          location: asia-south1
+
+      - name: Run Prisma migrations
+        run: |
+          cat <<EOF | kubectl apply -f -
+          apiVersion: batch/v1
+          kind: Job
+          metadata:
+            name: prisma-migrate-${{ steps.tag.outputs.sha }}
+            namespace: uat
+          spec:
+            ttlSecondsAfterFinished: 300
+            template:
+              spec:
+                restartPolicy: Never
+                containers:
+                  - name: migrate
+                    image: asia-south1-docker.pkg.dev/devcard-prod/devcard/backend:${{ steps.tag.outputs.sha }}
+                    command: ["npx", "prisma", "migrate", "deploy"]
+                    env:
+                      - name: DATABASE_URL
+                        valueFrom:
+                          secretKeyRef:
+                            name: devcard-secret
+                            key: database-url
+          EOF
+          kubectl wait --for=condition=complete \
+            job/prisma-migrate-${{ steps.tag.outputs.sha }} \
+            -n uat --timeout=120s
+
+      - name: Update image tag in kustomize
+        run: |
+          cd infra/k8s/overlays/uat
+          kustomize edit set image IMAGE_TAG_PLACEHOLDER=asia-south1-docker.pkg.dev/devcard-prod/devcard/backend:${{ steps.tag.outputs.sha }}
+
+      - name: Commit and push image tag to infra repo
+        run: |
+          cd infra
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add k8s/overlays/uat/kustomization.yaml
+          git commit -m "chore: update uat backend image to ${{ steps.tag.outputs.sha }}"
+          git push
+
+      - name: Deploy to UAT
+        run: kubectl apply -k infra/k8s/overlays/uat
+
+      - name: Wait for rollout
+        run: |
+          kubectl rollout status deployment/backend \
+            -n uat --timeout=5m