ci: fork verification pipeline, deploy gate, secret placeholders, audit Round 4

.github/workflows/check-types.yml

@@ -16,6 +16,9 @@ jobs:
           sparse-checkout: .github
       - uses: ./.github/actions/cache-checkout
       - uses: ./.github/actions/yarn-install
+      # The fork untracks app-store generated files (audit MD-02); regenerate
+      # them after install or every type-check dies on missing imports.
+      - run: yarn app-store:build
       - name: Show info
         run: node -e "console.log(require('v8').getHeapStatistics())"
       - name: Configure TSC problem matcher

.github/workflows/deploy-docker.yml

@@ -12,7 +12,15 @@ permissions:
   packages: write
 
 jobs:
+  # Why: this workflow publishes :latest on every push. Without a gate the image
+  # ships untested code straight to the registry (audit finding HI-09).
+  ci-gate:
+    name: CI gate (type check)
+    uses: ./.github/workflows/check-types.yml
+    secrets: inherit
+
   build-and-push:
+    needs: ci-gate
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository

.github/workflows/fork-ci.yml

@@ -0,0 +1,39 @@
+name: Fork CI
+
+# Crove-Cal's own verification pipeline. The upstream "All checks" workflow only
+# fires on merge_group and is guarded to calcom/cal.diy, so without this file
+# nothing verifies pushes/PRs on DOS/Crove-Cal (audit finding HI-09).
+#
+# Why explicit permissions: lint.yml (called below) requires "actions: write";
+# without this block the called workflow asks for more than the default
+# GITHUB_TOKEN grant and every run dies as a startup_failure with no jobs.
+permissions:
+  actions: write
+  contents: read
+
+on:
+  pull_request:
+    branches:
+      - dev
+      - main
+  push:
+    branches:
+      - dev
+      - main
+  workflow_dispatch:
+
+jobs:
+  type-check:
+    name: Type check
+    uses: ./.github/workflows/check-types.yml
+    secrets: inherit
+
+  lint:
+    name: Linters
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
+
+  unit-test:
+    name: Unit tests
+    uses: ./.github/workflows/unit-tests.yml
+    secrets: inherit

.github/workflows/unit-tests.yml

@@ -16,6 +16,9 @@ jobs:
           sparse-checkout: .github
       - uses: ./.github/actions/cache-checkout
       - uses: ./.github/actions/yarn-install
+      # The fork untracks app-store generated files (audit MD-02); regenerate
+      # them after install or the test suite dies on missing imports.
+      - run: yarn app-store:build
       - run: yarn prisma generate
       - run: yarn test -- --no-isolate
       # We could add different timezones here that we need to run our tests in

apps/api/v2/.env.example

@@ -11,21 +11,21 @@ DATABASE_WRITE_URL="postgresql://postgres:@localhost:5450/calendso"
 LOG_LEVEL=DEBUG
 # the same value as in the root .env - it is used by api-auth.strategy.ts to validate requests authenticated with next token. If you already have a value
 # in the root .env then you can paste it here. It is important that they are the same. 
-NEXTAUTH_SECRET="RbyBOfiZFt/IsBL2E2Zy2idcKRH+WclnHEiu1FmRdf0="
+NEXTAUTH_SECRET="change-me-generate-a-random-base64-value"
 DATABASE_URL="postgresql://postgres:@localhost:5450/calendso"
 DATABASE_DIRECT_URL="postgresql://postgres:@localhost:5450/calendso"
 # used by JwtService to sign and decode tokens
-JWT_SECRET="asjdijI1JIO12I3O89198jojioSAJDU"
+JWT_SECRET="change-me-generate-a-random-string"
 SENTRY_DSN=
 
 # mailhog setup. Make sure its running - see instructions in apps/api/v2/README.md
 EMAIL_SERVER_HOST='localhost'
 EMAIL_SERVER_PORT=1025
 
 # used to manage encrypt and decrypt third party tokens
-CALENDSO_ENCRYPTION_KEY="Lmqy57DlHKPvwwrtkwjL/8QtxJWxC/OV"
+CALENDSO_ENCRYPTION_KEY="change-me-generate-a-random-base64-value"
 # Service Account Encryption Key for encrypting/decrypting service account keys
-CALCOM_SERVICE_ACCOUNT_ENCRYPTION_KEY="LDBFYLEVICRZBYQZUZCSTZRJFZUKZMEI"
+CALCOM_SERVICE_ACCOUNT_ENCRYPTION_KEY="change-me-generate-a-random-base64-value"
 # url to redis instance running in Docker and used to cache data. Redis is setup in apps/api/v2/docker-compose.yaml
 REDIS_URL="redis://localhost:6379"
 

apps/api/v2/README-PLATFORM.md

@@ -47,7 +47,7 @@ Then in the `packages/platform/examples/base/.env` set the `NEXT_PUBLIC_OAUTH2_C
   {
     "id": "clxyyy21o0003sbk7yw5z6tzg",
     "name": "Acme",
-    "secret": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiQWNtZSAiLCJwZXJtaXNzaW9ucyI6MTAyMywicmVkaXJlY3RVcmlzIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NDMyMSJdLCJib29raW5nUmVkaXJlY3RVcmkiOiIiLCJib29raW5nQ2FuY2VsUmVkaXJlY3RVcmkiOiIiLCJib29raW5nUmVzY2hlZHVsZVJlZGlyZWN0VXJpIjoiIiwiYXJlRW1haWxzRW5hYmxlZCI6dHJ1ZSwiaWF0IjoxNzE5NTk1ODA4fQ.L5_jSS14fcKLCD_9_DAOgtGd6lUSZlU5CEpCPaPt41I",
+    "secret": "<generate-a-jwt-or-random-string-see-step-below>",
     "permissions": 1023,
     "logo": null,
     "redirectUris": "{http://localhost:4321}",

apps/web/app/api/health/__tests__/route.test.ts

@@ -36,7 +36,8 @@ describe("API /api/health Endpoint", () => {
     const json = await res.json();
     expect(json.status).toBe("unhealthy");
     expect(json.database.status).toBe("disconnected");
-    expect(json.database.error).toContain("Connection refused to database pooler");
+    // Raw database errors must not leak to anonymous callers (audit MD-15).
+    expect(json.database.error).toBeUndefined();
   });
 
   it("should support HEAD requests", async () => {