Add comprehensive security enhancements and audit logging (v1.5.2 → v1.6.3)

.dialyzer_ignore.exs

@@ -58,7 +58,12 @@
   ~r/lib\/phoenix_kit\/emails\/archiver\.ex:.*pattern_match/,
   ~r/lib\/phoenix_kit\/emails\/archiver\.ex:.*unused_fun/,
 
-  # Ecto.Multi opaque type false positives (Dialyzer limitation with opaque types in pipelines)
-  # Note: Code uses proper pipe syntax, but Dialyzer loses opaque type info
-  ~r/lib\/phoenix_kit\/users\/auth\.ex:.*call_without_opaque/
+  # Ecto.Multi opaque type false positives (code works correctly)
+  ~r/lib\/phoenix_kit\/users\/auth\.ex:.*call_without_opaque/,
+
+  # Exact comparison warnings for nil checks (legacy warning format - Dialyzer bug)
+  # (No current warnings - exact_compare issue in configure_aws_ses.ex was fixed by using pattern matching)
+
+  # Ignore all test files - library tests are meant for integration testing
+  ~r|^test/.*|
 ]

.github/workflows/ci.yml

@@ -0,0 +1,242 @@
+name: CI
+
+on:
+  push:
+    branches: [ main, dev ]
+  pull_request:
+    branches: [ main, dev ]
+
+env:
+  MIX_ENV: test
+  ELIXIR_VERSION: '1.18'
+  OTP_VERSION: '27.1'
+
+jobs:
+  quality:
+    name: Code Quality Checks
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Elixir
+        uses: erlef/setup-beam@v1
+        with:
+          elixir-version: ${{ env.ELIXIR_VERSION }}
+          otp-version: ${{ env.OTP_VERSION }}
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            deps
+            _build
+          key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-mix-
+
+      - name: Install dependencies
+        run: mix deps.get
+
+      - name: Check code formatting
+        run: mix format --check-formatted
+
+      - name: Run Credo (static analysis)
+        run: mix credo --strict
+
+  dialyzer:
+    name: Type Checking (Dialyzer)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Elixir
+        uses: erlef/setup-beam@v1
+        with:
+          elixir-version: ${{ env.ELIXIR_VERSION }}
+          otp-version: ${{ env.OTP_VERSION }}
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            deps
+            _build
+          key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-mix-
+
+      - name: Cache PLT files
+        uses: actions/cache@v4
+        with:
+          path: priv/plts
+          key: ${{ runner.os }}-plt-${{ env.OTP_VERSION }}-${{ env.ELIXIR_VERSION }}-${{ hashFiles('**/mix.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-plt-${{ env.OTP_VERSION }}-${{ env.ELIXIR_VERSION }}-
+
+      - name: Install dependencies
+        run: mix deps.get
+
+      - name: Create PLT directory
+        run: mkdir -p priv/plts
+
+      - name: Run Dialyzer
+        run: mix dialyzer
+
+  test:
+    name: Test Suite
+    runs-on: ubuntu-latest
+    continue-on-error: true  # Tests are optional for library modules
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: phoenix_kit_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Elixir
+        uses: erlef/setup-beam@v1
+        with:
+          elixir-version: ${{ env.ELIXIR_VERSION }}
+          otp-version: ${{ env.OTP_VERSION }}
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            deps
+            _build
+          key: ${{ runner.os }}-mix-test-${{ hashFiles('**/mix.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-mix-test-
+
+      - name: Install dependencies
+        run: mix deps.get
+
+      - name: Compile dependencies
+        run: mix deps.compile
+
+      - name: Compile application
+        run: mix compile
+
+      - name: Run tests (smoke tests only)
+        run: mix test
+        continue-on-error: true
+
+      - name: Generate coverage report
+        run: mix coveralls.json
+        continue-on-error: true
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        continue-on-error: true
+        with:
+          files: ./cover/excoveralls.json
+          fail_ci_if_error: false
+
+  dependencies:
+    name: Dependency Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Elixir
+        uses: erlef/setup-beam@v1
+        with:
+          elixir-version: ${{ env.ELIXIR_VERSION }}
+          otp-version: ${{ env.OTP_VERSION }}
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            deps
+            _build
+          key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-mix-
+
+      - name: Install dependencies
+        run: mix deps.get
+
+      - name: Check for unused dependencies
+        run: mix deps.unlock --check-unused
+        continue-on-error: true
+
+  compile-warnings:
+    name: Compilation Warnings
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Elixir
+        uses: erlef/setup-beam@v1
+        with:
+          elixir-version: ${{ env.ELIXIR_VERSION }}
+          otp-version: ${{ env.OTP_VERSION }}
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            deps
+            _build
+          key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-mix-
+
+      - name: Install dependencies
+        run: mix deps.get
+
+      - name: Compile with warnings as errors (production env)
+        run: MIX_ENV=prod mix compile --force --warnings-as-errors
+
+      - name: Compile test environment
+        run: MIX_ENV=test mix compile --force
+        continue-on-error: true
+
+  summary:
+    name: CI Summary
+    runs-on: ubuntu-latest
+    needs: [quality, dialyzer, test, dependencies, compile-warnings]
+    if: always()
+
+    steps:
+      - name: Check all jobs status
+        run: |
+          echo "Quality: ${{ needs.quality.result }}"
+          echo "Dialyzer: ${{ needs.dialyzer.result }}"
+          echo "Tests: ${{ needs.test.result }} (optional)"
+          echo "Dependencies: ${{ needs.dependencies.result }}"
+          echo "Compile Warnings: ${{ needs.compile-warnings.result }}"
+
+          # Tests are optional for library modules
+          if [ "${{ needs.quality.result }}" != "success" ] || \
+             [ "${{ needs.dialyzer.result }}" != "success" ] || \
+             [ "${{ needs.compile-warnings.result }}" != "success" ]; then
+            echo "❌ CI failed"
+            exit 1
+          else
+            echo "✅ CI passed"
+            echo "Note: Test suite is optional for library modules"
+          fi

.gitignore

@@ -10,7 +10,6 @@
 # Where third-party dependencies like ExDoc output generated docs.
 /doc/
 /docs/
-/test/
 /test_projects/
 /scripts/
 /scripts_backup/