ridho-arachman-portfolio 0.1.1

package/.dockerignore

@@ -0,0 +1,10 @@
+# .dockerignore
+node_modules
+.next
+.git
+.gitignore
+docker/
+*.md
+.env
+.env.local
+.DS_Store

package/.gitattributes

@@ -0,0 +1,21 @@
+# Normalize all text files to LF in the repository and working tree.
+# Required: Docker / nginx / Linux containers break with CRLF.
+* text=auto eol=lf
+
+# Explicit binary assets (never normalize)
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.webp binary
+*.avif binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.eot binary
+*.otf binary
+*.pdf binary
+*.mp4 binary
+*.webm binary
+*.mp3 binary

package/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @Ridho-arachman

package/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,80 @@
+name: Bug Report
+description: Report a bug or unexpected behavior
+labels: ["bug"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: A clear and concise summary of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: Minimal steps to trigger the bug.
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: What should have happened instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behavior
+      description: What actually happened?
+    validations:
+      required: true
+
+  - type: input
+    id: route
+    attributes:
+      label: Affected Route
+      description: Which route shows the bug? Include the locale prefix.
+      placeholder: e.g. /en/projects, /id/about, /admin/login
+    validations:
+      required: false
+
+  - type: input
+    id: os
+    attributes:
+      label: Operating System
+      placeholder: e.g. Windows 11, macOS 15, Ubuntu 24.04
+    validations:
+      required: false
+
+  - type: input
+    id: browser
+    attributes:
+      label: Browser
+      placeholder: e.g. Chrome 130, Firefox 133, Safari 18
+    validations:
+      required: false
+
+  - type: input
+    id: node
+    attributes:
+      label: Node.js Version
+      placeholder: e.g. 24.0.0
+    validations:
+      required: false
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: If applicable, add screenshots to help explain the problem.
+    validations:
+      required: false

package/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question
+    url: https://github.com/Ridho-arachman/portfolio/discussions
+    about: Ask questions and discuss ideas

package/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,35 @@
+name: Feature Request
+description: Suggest a new feature or improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem does this feature solve? Is it related to a frustration?
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: How should this feature work?
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Have you considered any other approaches?
+    validations:
+      required: false
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Any other context, mockups, or screenshots.
+    validations:
+      required: false

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+## Description
+
+<!-- Briefly describe what this PR does and why. -->
+
+## Type of Change
+
+- [ ] `feat` — New feature
+- [ ] `fix` — Bug fix
+- [ ] `refactor` — Code refactor (no behavior change)
+- [ ] `chore` — Tooling, config, or dependency update
+- [ ] `docs` — Documentation only
+
+## Checklist
+
+- [ ] `npm run lint` passes (0 errors)
+- [ ] `npx tsc --noEmit` passes
+- [ ] `npm run build` passes (incl. `[lang]` routes EN/ID)
+- [ ] `npm run test:unit` passes
+- [ ] `npm run test:integration` passes (if API/DB touched)
+- [ ] `npm run test:e2e` passes (if user flow touched)
+- [ ] Commit message follows Conventional Commits (`feat:` / `fix:` / ...)
+- [ ] Self-reviewed the diff
+
+## Screenshots (if UI change)
+
+<!-- Before/after screenshots, or "N/A" -->

package/.github/SECURITY.md

@@ -0,0 +1,43 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.1.x   | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it responsibly.
+
+**Do NOT open a public GitHub issue.**
+
+Instead, please email: **ridho.arachman22@gmail.com**
+
+Include:
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+
+You should receive a response within **48 hours**. We will work with you to understand and address the issue before any public disclosure.
+
+## Enforced Controls
+
+- Cloudflare Turnstile is fail-closed in production (`TURNSTILE_SECRET_KEY` is required at boot; CI/build uses the official test keys).
+- Test bypasses (`DISABLE_RATE_LIMIT`, empty captcha) are ignored when `NODE_ENV=production`.
+- Admin API requires an `ADMIN` session; destructive actions (purge, settings reset) need explicit confirmation and emit a JSON audit line to stdout.
+- Rate limiting is atomic (DB transaction) and keyed by validated client IP.
+- Public API returns explicit selects only — no internal columns (`deletedAt`, ordering, timestamps).
+
+## Scope
+
+This policy applies to vulnerabilities found in:
+
+- The portfolio web application
+- API routes and authentication flows
+- Docker and deployment configurations
+
+## Disclosure
+
+We follow responsible disclosure. Once a fix is released, we will credit the reporter (unless they prefer to remain anonymous).

package/.github/dependabot.yml

@@ -0,0 +1,47 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    # 0 = Dependabot proposes no version updates. The weekly run kept refilling
+    # open-pull-requests-limit slots from a backlog deeper than it looked, so
+    # merging never reached an empty queue. To resume updates, change 0 back to
+    # a number (5-10) — the ignore/groups rules below stay ready.
+    open-pull-requests-limit: 0
+    ignore:
+      # eslint-plugin-react has no ESLint 10 release (latest peer stops at ^9.7),
+      # so `npm run lint` dies on 'react/display-name' (PR #37). Lift when it
+      # adds ^10 to its peer range.
+      - dependency-name: "eslint"
+        versions: [">=10.0.0"]
+    groups:
+      react:
+        patterns:
+          - "react"
+          - "react-dom"
+      # @vitest/coverage-v8 pins an exact peer on vitest; splitting them makes
+      # `npm ci` fail with ERESOLVE (PR #34).
+      vitest:
+        patterns:
+          - "vitest"
+          - "@vitest/coverage-v8"
+      dev-dependencies:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"
+    labels:
+      - "dependencies"
+      - "chore"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 0
+    labels:
+      - "dependencies"
+      - "ci"

package/.github/workflows/ci.yml

@@ -0,0 +1,171 @@
+name: CI Pipeline
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main", "develop"]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci-test:
+    name: Lint, Typecheck, Build, Unit & Docker Test
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: portfolio_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d portfolio_test"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: 📂 Checkout repository
+        uses: actions/checkout@v7
+
+      - name: 🟢 Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - name: 📦 Install dependencies
+        run: npm ci
+
+      - name: 🗄️ Generate Prisma Client
+        run: npx prisma generate
+
+      - name: 🔍 Run Linter
+        run: npm run lint
+
+      - name: 🧠 Type Checking
+        run: npx tsc --noEmit
+
+      - name: 🧪 Unit Tests
+        run: npm run test:unit
+
+      - name: 🏗️ Build Next.js App
+        env:
+          DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/portfolio_test"
+          BETTER_AUTH_SECRET: "ci-build-secret-1234567890abcdefghijklmnop"
+          BETTER_AUTH_URL: "http://localhost:3000"
+          NEXT_PUBLIC_SUPABASE_URL: "https://placeholder.supabase.co"
+          NEXT_PUBLIC_SUPABASE_ANON_KEY: "placeholder-anon-key"
+          SUPABASE_SERVICE_ROLE_KEY: "placeholder-service-key"
+          # Wajib sejak validasi env fail-closed prod (env.ts): Cloudflare test keys resmi, selalu lolos.
+          NEXT_PUBLIC_TURNSTILE_SITE_KEY: "1x00000000000000000000AA"
+          TURNSTILE_SECRET_KEY: "1x0000000000000000000000000000000AA"
+        run: |
+          npx prisma db push
+          npm run build
+
+      - name: 🐳 Test Docker Build (PENTING!)
+        run: |
+          echo "Validasi Dockerfile (deps stage only)..."
+          docker build -f docker/Dockerfile.prod -t nextjs-app:ci-test --target deps .
+          echo "✅ Docker build berhasil! File .dockerignore dan Dockerfile aman."
+
+  test-integration:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: portfolio_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d portfolio_test"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/portfolio_test
+      BETTER_AUTH_SECRET: ci-integration-test-secret-1234567890abcdef
+      BETTER_AUTH_URL: http://localhost:3000
+
+    steps:
+      - name: 📂 Checkout repository
+        uses: actions/checkout@v7
+
+      - name: 🟢 Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - name: 📦 Install dependencies
+        run: npm ci
+
+      - name: 🗄️ Generate Prisma Client
+        run: npx prisma generate
+
+      - name: 🗄️ Push schema to test database
+        run: npx prisma db push
+
+      - name: 🧪 Integration Tests
+        run: npx vitest run --config vitest.integration.config.ts
+
+  e2e:
+    name: End-to-End Tests
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: portfolio_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d portfolio_test"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/portfolio_test
+
+    steps:
+      - name: 📂 Checkout repository
+        uses: actions/checkout@v7
+
+      - name: 🟢 Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - name: 📦 Install dependencies
+        run: npm ci
+
+      - name: 🗄️ Push schema to test database
+        run: npx prisma db push
+
+      - name: 🖥️ Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+
+      - name: 🧬 Generate Prisma Client
+        run: npx prisma generate
+
+      - name: 🧪 End-to-End Tests
+        run: npm run test:e2e

package/.github/workflows/publish.yml

@@ -0,0 +1,68 @@
+name: Publish to npm
+
+# Every push to main publishes a new patch version to npm, so the
+# registry copy is always fresh. Requires repo secret NPM_TOKEN
+# (npmjs.com -> Access Tokens -> publish permission).
+
+on:
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+
+# Serialize publishes; never cancel a publish in flight (avoids
+# duplicate-version races when pushes land close together).
+concurrency:
+  group: npm-publish
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    # The version-bump commit this workflow pushes itself must not
+    # trigger another publish (infinite loop guard).
+    if: "!contains(github.event.head_commit.message, '[skip ci]')"
+    name: Bump patch and publish
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: 📂 Checkout repository
+        uses: actions/checkout@v7
+
+      - name: 🟢 Setup Node.js with npm registry
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: "npm"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: 🔧 Git identity for version commit
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: 📦 Install dependencies
+        run: npm ci
+
+      - name: 🗄️ Generate Prisma Client (no DB needed)
+        run: npx prisma generate
+
+      - name: 🧠 Typecheck gate (do not publish broken code)
+        run: npx tsc --noEmit
+
+      - name: 🔢 Bump patch version ([skip ci] avoids re-trigger)
+        run: |
+          npm version patch --no-git-tag-version
+          VERSION=$(node -p "require('./package.json').version")
+          git add package.json
+          git commit -m "chore(release): $VERSION [skip ci]"
+          git tag "v$VERSION"
+
+      - name: 🚀 Publish to npm
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: 🏷️ Push version commit and tag
+        run: git push --follow-tags

package/.husky/commit-msg

@@ -0,0 +1 @@
+npx --no -- commitlint --edit $1

package/.husky/pre-commit

@@ -0,0 +1 @@
+echo "tunggu!!!"