Wire free production readiness stack

.github/workflows/free-production-readiness.yml

@@ -0,0 +1,107 @@
+name: Free Production Readiness
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  business-contracts:
+    name: Business contracts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run low-gray business contracts
+        run: npm run verify:business
+
+      - name: Run advisory source-shape contracts
+        run: npm run test:business:advisory
+        continue-on-error: true
+
+  route-hygiene:
+    name: Route Hygiene P0/P1
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check route hygiene
+        run: npm run routes:check
+
+      - name: Upload route hygiene reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: route-hygiene-reports
+          path: docs/operations/generated/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  static-radar:
+    name: Static radar advisory
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Semgrep CE
+        run: python -m pip install semgrep
+
+      - name: Run Semgrep Helm rules
+        run: npm run analyze:semgrep
+        continue-on-error: true
+
+      - name: Run dependency-cruiser
+        run: npm run analyze:deps
+        continue-on-error: true
+
+      - name: Run duplicate-code radar
+        run: npm run analyze:duplicates
+        continue-on-error: true
+
+      - name: Run Helm auditor
+        if: always()
+        run: npm run auditor:all
+
+      - name: Upload static radar reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: static-radar-reports
+          path: |
+            docs/operations/generated/
+            docs/operations/revealed-bugs/production-readiness/
+          if-no-files-found: ignore
+          retention-days: 14

.gitignore

@@ -139,6 +139,10 @@ scripts/rotate-demo-passwords.mjs
 /test-results/
 /playwright-report/
 
+# Production-readiness generated reports.
+/docs/operations/generated/
+/.stryker-tmp/
+
 # Large generated showcase binaries (repo already ignores GolfHelm-Prospect-Deck.pptx).
 GolfHelm-CoachHelm-Showcase.pdf
 GolfHelm-Fairway-Guide.pdf

.semgrep/helm-rules.yml

@@ -0,0 +1,89 @@
+rules:
+  - id: helm-service-role-in-client-code
+    severity: ERROR
+    languages: [typescript, javascript]
+    message: Service-role/admin Supabase client must not be imported from client-facing code.
+    paths:
+      include:
+        - /src/**/*.ts
+        - /src/**/*.tsx
+      exclude:
+        - /src/lib/supabase/admin.ts
+        - /src/**/*.test.ts
+        - /src/**/*.test.tsx
+        - /src/contracts/**
+    patterns:
+      - pattern-either:
+          - pattern: import $X from '@/lib/supabase/admin'
+          - pattern: import { $X } from '@/lib/supabase/admin'
+          - pattern: createAdminClient(...)
+      - pattern-not-inside: |
+          "use server";
+          ...
+
+  - id: helm-golf-file-links-baseball-auth-or-dashboard
+    severity: ERROR
+    languages: [typescript]
+    message: Golf files must not link or redirect to Baseball auth/dashboard routes.
+    patterns:
+      - pattern-either:
+          - pattern: '"/baseball/$PATH"'
+          - pattern: "'/baseball/$PATH'"
+    paths:
+      include:
+        - /src/app/golf/**/*.ts
+        - /src/app/golf/**/*.tsx
+
+  - id: helm-baseball-file-links-golf-auth-or-dashboard
+    severity: ERROR
+    languages: [typescript]
+    message: Baseball files must not link or redirect to Golf auth/dashboard routes.
+    patterns:
+      - pattern-either:
+          - pattern: '"/golf/$PATH"'
+          - pattern: "'/golf/$PATH'"
+      - metavariable-regex:
+          metavariable: $PATH
+          regex: ^(login|signup|dashboard).*
+    paths:
+      include:
+        - /src/app/baseball/**/*.ts
+        - /src/app/baseball/**/*.tsx
+
+  - id: helm-success-true-inside-catch
+    severity: ERROR
+    languages: [typescript, javascript]
+    message: Catch blocks must not return success:true.
+    pattern: |
+      catch ($ERR) {
+        ...
+        return { ..., success: true, ... };
+      }
+
+  - id: helm-llm-call-in-client-component
+    severity: ERROR
+    languages: [typescript]
+    message: LLM generation must stay server-side.
+    patterns:
+      - pattern-either:
+          - pattern: generateText(...)
+          - pattern: streamText(...)
+      - pattern-inside: |
+          "use client";
+          ...
+
+  - id: helm-catch-collapses-error-to-empty
+    severity: WARNING
+    languages: [typescript, javascript]
+    message: Catch block collapses a failure to []/null; prefer an explicit error state.
+    pattern-either:
+      - pattern: |
+          catch ($ERR) {
+            ...
+            return [];
+          }
+      - pattern: |
+          catch ($ERR) {
+            ...
+            return null;
+          }