Promote dev to master for production

.circleci/config.yml

@@ -1,83 +1,112 @@
+# Deployment migration: see deploy/MIGRATION.md before enabling either environment.
 version: 2.1
-
-parameters:
-  reset-db:
-    type: boolean
-    default: false
-
-defaults: &defaults
-  docker:
-    - image: cimg/python:3.13.2-browsers
-
-install_dependency: &install_dependency
-  name: Installation of build and deployment dependencies.
-  command: |
-    sudo apt update
-    sudo apt install -y jq python3-pip
-    sudo pip3 install awscli --upgrade
-
-install_deploysuite: &install_deploysuite
-  name: Installation of deploy suite.
-  command: |
-    git clone --branch v1.4.19 https://github.com/topcoder-platform/tc-deploy-scripts ../buildscript
-    cp ./../buildscript/master_deploy.sh .
-    cp ./../buildscript/buildenv.sh .
-    cp ./../buildscript/awsconfiguration.sh .
-    cp ./../buildscript/psvar-processor.sh .
-
-builddeploy_steps: &builddeploy_steps
-  - checkout
-  - setup_remote_docker
-  - run: *install_dependency
-  - run: *install_deploysuite
-  - run: docker buildx build --no-cache=true --build-arg RESET_DB_ARG=<<pipeline.parameters.reset-db>> --build-arg SEED_DATA_ARG=${DEPLOYMENT_ENVIRONMENT} -t ${APPNAME}:latest .
-  - run:
-      name: Running MasterScript.
-      command: |
-        ./awsconfiguration.sh $DEPLOY_ENV
-        source awsenvconf
-        ./psvar-processor.sh -t appenv -p /config/${APPNAME}/deployvar
-        source deployvar_env
-        ./master_deploy.sh -d ECS -e $DEPLOY_ENV -t latest -j /config/${APPNAME}/appvar,/config/common/global-appvar -i ${APPNAME} -p FARGATE
-
+executors:
+  reviewed:
+    docker:
+    - image: cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5
+commands:
+  checkout-source:
+    steps:
+    - run:
+        name: Check out the exact public source commit over HTTPS
+        command: |
+          set -euo pipefail
+          [[ "$CIRCLE_SHA1" =~ ^[0-9a-f]{40}$ ]]
+          export GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0
+          git init --quiet .
+          git remote add origin https://github.com/topcoder-platform/projects-api-v6.git
+          git -c credential.helper= fetch --quiet --depth 1 origin "$CIRCLE_SHA1"
+          git checkout --quiet --detach FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "$CIRCLE_SHA1"
+  checkout-suite:
+    steps:
+    - run:
+        name: Verify deployment suite v2.0.6
+        command: |
+          set -euo pipefail
+          git init --quiet /tmp/tc-deploy-scripts
+          git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git
+          git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.6
+          git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD
+          test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = 26aaf607463d4a271c0099854c1731214215a9c5
 jobs:
-  build-dev:
-    <<: *defaults
+  build:
+    executor: reviewed
+    steps:
+    - checkout-source
+    - setup_remote_docker
+    - checkout-suite
+    - run:
+        name: Build committed source without AWS or broker credentials
+        command: |
+          set -euo pipefail
+          python3 -I /tmp/tc-deploy-scripts/build_image.py --dockerfile Dockerfile --image projects-api-v6:candidate
+          mkdir -p /tmp/release
+          docker save --output /tmp/release/image.tar projects-api-v6:candidate
+        no_output_timeout: 30m
+    - persist_to_workspace:
+        root: /tmp/release
+        paths:
+        - image.tar
+  deploy:
+    executor: reviewed
+    parameters:
+      environment:
+        type: enum
+        enum:
+        - dev
+        - prod
     environment:
-      DEPLOY_ENV: "DEV"
-      LOGICAL_ENV: "dev"
-      APPNAME: "projects-api-v6"
-      DEPLOYMENT_ENVIRONMENT: "dev"
-    steps: *builddeploy_steps
-
-  build-prod:
-    <<: *defaults
-    environment:
-      DEPLOY_ENV: "PROD"
-      LOGICAL_ENV: "prod"
-      APPNAME: "projects-api-v6"
-      DEPLOYMENT_ENVIRONMENT: "prod"
-    steps: *builddeploy_steps
-
+      DEPLOY_ENV: << parameters.environment >>
+    steps:
+    - checkout-source
+    - setup_remote_docker
+    - checkout-suite
+    - attach_workspace:
+        at: /tmp/release
+    - run:
+        name: Promote a scanned digest with repository-bound OIDC
+        command: |
+          set +x
+          set -euo pipefail
+          test -f "deploy/${DEPLOY_ENV}.json"
+          docker load --input /tmp/release/image.tar
+          python3 -I deploy/release.py "deploy/${DEPLOY_ENV}.json"
+        no_output_timeout: 45m
 workflows:
-  version: 2
-  build-dev:
-    jobs:
-      - build-dev:
-          context: org-global
-          filters:
-            branches:
-              only:
-                - dev
-                - security_july_2026
-            tags:
-              only: /^dev-.*/
-
-  build-prod:
+  release:
     jobs:
-      - build-prod:
-          context: org-global
-          filters:
-            branches:
-              only:
-                - master
+    - build
+    - deploy:
+        name: deploy-dev
+        environment: dev
+        requires:
+        - build
+        context: projects-api-v6-dev-deploy
+        serial-group: << pipeline.project.slug >>/deploy-dev
+        filters:
+          branches:
+            only: dev
+          tags:
+            ignore: /.*/
+    - approve-prod:
+        type: approval
+        requires:
+        - build
+        filters:
+          branches:
+            only: master
+          tags:
+            ignore: /.*/
+    - deploy:
+        name: deploy-prod
+        environment: prod
+        requires:
+        - approve-prod
+        context: projects-api-v6-prod-deploy
+        serial-group: << pipeline.project.slug >>/deploy-prod
+        filters:
+          branches:
+            only: master
+          tags:
+            ignore: /.*/

.gitignore

@@ -7,3 +7,7 @@ coverage/
 .DS_Store
 *.swp
 *.swo
+
+# Infrastructure definitions and detailed AWS inventories are maintained privately.
+/deploy/iam/
+/deploy/*-baseline.json

.nvmrc

@@ -1 +1 @@
-v26.5.1
+26.12.1

Dockerfile

@@ -1,11 +1,11 @@
 # syntax=docker/dockerfile:1
 
-ARG NODE_VERSION=26.5.1
+ARG NODE_VERSION=26.12.1
 ARG ALPINE_VERSION=3.24
 
-FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION} AS build
+FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION}@sha256:40cd011b55415bc894e45b02fdd5a5dfde056921b7d23a64c74f80497af48797 AS build
 
-ARG PNPM_VERSION=10.28.2
+ARG PNPM_VERSION=11.15.1
 
 ENV CI=true
 ENV PRISMA_CLI_BINARY_TARGETS=linux-musl-openssl-3.0.x
@@ -19,29 +19,32 @@ RUN apk upgrade --no-cache \
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml nest-cli.json tsconfig.json tsconfig.build.json \
   eslint.config.mjs .prettierrc ./
 COPY packages/projects-prisma-client/package.json ./packages/projects-prisma-client/package.json
-COPY patches ./patches
+COPY tools ./tools
 COPY prisma ./prisma
 RUN pnpm install --frozen-lockfile
 
 COPY . .
 RUN pnpm lint \
+  && pnpm test --runInBand \
+  && pnpm test:dependency-compat \
   && pnpm build \
   && pnpm prune --prod --ignore-scripts
 
-FROM alpine:${ALPINE_VERSION} AS production
+FROM alpine:${ALPINE_VERSION}@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS production
 
 ARG NODE_VERSION
-ARG RESET_DB_ARG=false
 ARG SEED_DATA_ARG=""
 
 ENV NODE_ENV=production
 ENV PRISMA_CLI_BINARY_TARGETS=linux-musl-openssl-3.0.x
-ENV RESET_DB=$RESET_DB_ARG
 ENV SEED_DATA=$SEED_DATA_ARG
 WORKDIR /app
 
+# Alpine replaces old APK patch versions. Keep the configured Node major while
+# accepting maintained patch releases and verify the selected runtime below.
 RUN apk upgrade --no-cache \
-  && apk add --no-cache bash nodejs-current="${NODE_VERSION}-r0" openssl \
+  && apk add --no-cache bash "nodejs-current~${NODE_VERSION%%.*}" openssl \
+  && test "$(node -p 'process.versions.node.split(".")[0]')" = "${NODE_VERSION%%.*}" \
   && addgroup --system --gid 10001 app \
   && adduser --system --disabled-password --no-create-home --uid 10001 --ingroup app app
 

README.md

@@ -3,8 +3,8 @@
 NestJS drop-in replacement for `tc-project-service`, serving the Topcoder platform at `/v6/projects`.
 
 [![CircleCI](https://img.shields.io/badge/CircleCI-build%20status-informational?logo=circleci)](https://circleci.com/)
-![Node](https://img.shields.io/badge/node-v26.5.1-339933?logo=node.js&logoColor=white)
-![pnpm](https://img.shields.io/badge/pnpm-10.28.2-F69220?logo=pnpm&logoColor=white)
+![Node](https://img.shields.io/badge/node-v26.12.1-339933?logo=node.js&logoColor=white)
+![pnpm](https://img.shields.io/badge/pnpm-11.15.1-F69220?logo=pnpm&logoColor=white)
 ![Audit](https://img.shields.io/badge/production%20audit-0%20findings-brightgreen)
 
 ## Table of Contents
@@ -419,8 +419,8 @@ Reference source: `.env.example`.
 
 ### Prerequisites
 
-- Node.js `v26.5.1` (`nvm use` in this project folder)
-- pnpm `10.28.2`
+- Node.js `v26.12.1` (`nvm use` in this project folder)
+- pnpm `11.15.1`
 - PostgreSQL
 
 ### Installation
@@ -486,7 +486,7 @@ Must pass before every commit per `AGENTS.md`.
 ## Deployment
 
 - CI/CD: CircleCI -> AWS ECS Fargate.
-- The multi-stage Docker image builds with Node 26.5.1 and copies only compiled
+- The multi-stage Docker image builds with Node 26.12.1 and copies only compiled
   output, production dependencies, and Prisma migration assets into its Alpine
   3.24 runtime. The runtime installs the dynamically linked Alpine Node package
   and does not contain npm or other package tooling.
@@ -517,8 +517,8 @@ Open findings are tracked inline with `TODO (security)` comments in source.
 Summary from `docs/DEPENDENCIES.md`:
 
 - Production audit: no known vulnerabilities.
-- Node 26.5.1, NestJS 11.1.28, Prisma 7.9.0, Axios 1.18.1,
-  Lodash 4.18.1, qs 6.15.3, and UUID 14.0.1 are locked in the
+- Node 26.12.1, NestJS 11.2.8, Prisma 7.10.1, Axios 1.21.0,
+  Lodash 4.18.1, qs 6.17.1, and UUID 14.0.3 are locked in the
   security candidate.
 - Security overrides for affected transitives are maintained in
   `pnpm-workspace.yaml` and captured in `pnpm-lock.yaml`.
@@ -572,3 +572,46 @@ Migration runbook (phased rollout, rollback, monitoring): `docs/MIGRATION_RUNBOO
 `Talent Manager` and `Topcoder Talent Manager` users can list and open all non-internal projects without membership, including read-only access to their members, invites, and attachments. Set `INTERNAL_BILLING_ACCOUNT_IDS` to the comma-separated positive billing account IDs used for internal projects before deploying this policy (for example, `123,456`); an empty value excludes no accounts, and invalid values reject requests rather than applying a partial list. Projects without a billing account remain visible.
 
 Internal projects are excluded from list results and totals and rejected on direct project and nested project routes unless the Talent Manager is an active project member. Explicit membership in any project role overrides the internal billing account exclusion; deleted memberships and pending invites alone do not. Administrators and machine tokens keep their existing authorization policies. `memberOnly=true` narrows the visible projects to existing membership/pending-invite associations, including internal projects with active membership; Work exposes this as **My Projects**.
+
+## Shared authentication and bus client (v6 refresh)
+
+This branch uses `tc-core-library-js` **4.0.0-rc.1**. Use its named
+`createJwtVerifier` / `createJwtAuthenticator`, `createM2MClient`, and
+`createBusApiClient` exports for shared authentication and bus API publishing.
+Service-specific roles, scopes, sessions and ownership checks remain in this service.
+The former bus wrapper dependency and local JWT cryptography must not be reintroduced.
+
+RSA verification requires an exact configured issuer and audience (`JWT_AUDIENCE`
+for client tokens, `AUTH0_AUDIENCE` for machine/API tokens, or this service's explicit
+issuer-policy settings). HMAC secrets must be at least 32 bytes; no default secret
+is supplied. Expiry is enforced. Machine identity comes from the shared verifier,
+not the presence of scopes. Supply real development credentials through the service's
+existing environment configuration before deployment.
+
+Bus publishers use `createBusApiClient(config).postEvent(event)` with the existing
+event envelope and optional key. Configure `BUSAPI_URL` for v6 and the existing
+OAuth credentials/token provider. The client uses bounded HTTPS requests and does
+not retry POSTs automatically. Application retry/outbox behavior remains local.
+
+See the [core migration guide](https://github.com/topcoder-platform/tc-core-library-js/blob/v4.0.0-rc.1/MIGRATION.md)
+for the API mapping, compatibility requirements, and rollout scope.
+
+## Alpine Node runtime packages
+
+Container stages that install Node through APK constrain `nodejs-current` to the
+major version in `NODE_VERSION`, rather than an exact Alpine package revision.
+Alpine replaces older patch packages in its repositories; the compatible pin
+allows current security patches while a build-time check rejects a different
+Node major. The runtime keeps Alpine's dynamically linked Node and system
+libraries. Existing non-root users and application entrypoints are preserved.
+Build stages using a versioned official Node image retain their configured
+version, and pnpm build arguments are explicitly declared in the consuming stage.
+
+## November 2026 security validation
+
+The dependency refresh updates the complete lockfile, pins the reviewed core
+library revision, and tests legacy minimatch consumers through
+`pnpm test:dependency-compat`. Patched Ajv 6 and 8 dependencies replace the
+obsolete ESLint patches that forced a different Ajv major. Salesforce fallback
+queries now log a fixed diagnostic message rather than SQL containing
+configuration fields or account identifiers.

deploy/MIGRATION.md

@@ -0,0 +1,37 @@
+# OIDC deployment migration
+
+This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.6](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.6), fetched by tag and verified against commit `26aaf607463d4a271c0099854c1731214215a9c5`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role.
+
+## Production target
+
+The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `tc-project-service-serverless`, service `projects-api-v6`, family `projects-api-v6`, and container `projects-api-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. [prod-baseline.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/projects-api-v6/deploy/prod-baseline.json) records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline.
+
+## Installed infrastructure and production cutover
+
+The dev deployment role/boundary, restricted empty CircleCI context, and immutable ECR tags are installed. Existing enhanced scanning is preserved. The production OIDC provider, deployment role/boundary and restricted context are also installed; production runtime and ECR changes remain gated on dev validation. Installation evidence and remaining service-specific steps are private in [PROVISIONING.txt](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/projects-api-v6/deploy/PROVISIONING.txt). Deploy roles have explicit secret-store and KMS-decryption denies. Runtime values are retrieved only by ECS using the execution role.
+
+At production cutover, stop legacy publishers, enable unconditional tag immutability, adopt missing task health checks with the reviewed image, and use the approval-gated `master` workflow. Preserve capacity, roles, secret references and rollback. Do not run production before dev validation.
+
+## Development acceptance
+
+This PR targets `dev`. Administrator-installed dev prerequisites are recorded in the private IaC repository. The reviewed task health check was submitted only after confirming the existing image serves the identical healthy load-balancer endpoint.
+
+- Dev infrastructure prerequisites are installed; merge to run the application deployment, then validate functionality.
+
+Run the shared offline suite, validate the CircleCI config and IAM policies, and test a dev release plus an unhealthy-image rollback. Verify CloudTrail contains no SSM/Secrets Manager calls from the deployment principal. Remove its old broker grants only after migration. Check the runtime secret references and roles stayed unchanged. Production requires the manual approval job and a passing digest/scan/health verification.
+
+The pinned executor is `cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5`. Python/AWS CLI/Buildx/Git compatibility was tested with the shared offline suite. No package installation or service build runs in the deployment job. The Dockerfile retains the existing in-image quality gates. This PR does not deploy, change IAM, rotate credentials, or claim a successful live rollout.
+
+## Infrastructure source
+
+IAM templates and detailed AWS baselines are maintained in the private [v6-services-iac service directory](https://github.com/topcoder-platform/v6-services-iac/tree/main/services/projects-api-v6). Provision infrastructure separately with an administrator identity; application CI does not fetch that repository or install IAM. Required application manifests and health-check proposals remain here.
+
+## Dev branch refresh
+
+This PR targets `dev` and preserves its current application/dependency fixes. The shared suite is v2.0.6 (92 offline tests); service-specific adapters and their tests remain part of review. Use the current readiness record above for the remaining merge/deployment gates. Updating these files does not provision AWS or CircleCI resources.
+
+Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts.
+
+## Reviewed health-check bootstrap
+
+The release wrapper passes the environment-specific health-check JSON to v2.0.6. A missing check is added with the new scanned image; the old image is not restarted with a new probe. An identical existing check is preserved, and a different existing check stops the release. Role, runtime-secret reference, scan, concurrency and healthy-digest checks remain enforced.

deploy/dev-healthcheck.json

@@ -0,0 +1,14 @@
+{
+  "projects-api-v6": {
+    "command": [
+      "CMD",
+      "node",
+      "-e",
+      "const r=require('node:http').get(\"http://127.0.0.1:3000/v6/projects/health\",r=>{r.resume();process.exit(r.statusCode>=200&&r.statusCode<300?0:1)});r.setTimeout(4000,()=>{r.destroy();process.exit(1)});r.on('error',()=>process.exit(1))"
+    ],
+    "interval": 30,
+    "timeout": 5,
+    "retries": 3,
+    "startPeriod": 120
+  }
+}