Implemented 4 feature issues (#637-#640) to enhance deployment pipeline, infrastructure validation, and real-time capabilities

[favourawaku]

Summary

Implemented 4 feature issues (#637-#640) to enhance deployment pipeline, infrastructure validation, and real-time capabilities.

Issues Addressed

• Architect Vercel Project Environment Variable Synchronization with Stellar Config #637: Vercel environment variable synchronization with Stellar config
• Engineer GitHub Actions Workflow Validation for Template Repository CI/CD Pipelines #638: GitHub Actions workflow validation for template repositories
• Build Stripe Subscription State Machine Reconciliation for Webhook-Out-of-Order Events #639: Stripe subscription state machine reconciliation for out-of-order events
• Implement Supabase Realtime Subscription for Live Deployment Status Updates #640: Supabase Realtime subscription for live deployment status updates

closes #637
closes #638
closes #639
closes #640

Changes

Issue #637 — Vercel Environment Variable Sync

Commit: feat(vercel): synchronize project environment variables with Stellar config

• Added environment variable management methods to VercelService:

  • listEnvVars() — retrieve all project env vars
  • createEnvVar() — create new env var
  • updateEnvVar() — update existing env var with new value/type
  • deleteEnvVar() — remove env var from project

• Created EnvSyncService with:

  • Automatic sync of desired env vars to Vercel projects
  • Detection and update of changed values
  • Cleanup of stale variables not in desired set
  • Retry logic with exponential backoff (4 attempts, 300-10000ms range)
  • Support for sensitive variables as Vercel secrets
  • Clear error messages when retries exhausted

Files:

• apps/backend/src/services/env-sync.service.ts (new)
• apps/backend/src/services/vercel.service.ts (modified)

---

Issue #638 — GitHub Actions Workflow Validation

Commit: feat(github): add GitHub Actions workflow validation for template repos

• Created GitHubWorkflowValidator service:

  • YAML syntax validation (detects tabs, missing colons, empty content)
  • Parses workflow job structure from YAML
  • Enforces required workflow steps: build, test, deploy
  • Returns specific error codes and messages for each failure type:
    • INVALID_YAML — syntax errors in workflow YAML
    • MISSING_STEP — required step not found (includes step name)
    • EMPTY_CONTENT — workflow YAML is empty

• Validation happens before deployment attempt, preventing invalid workflows from being pushed

Files:

• apps/backend/src/services/github-workflow-validator.service.ts (new)

---

Issue #639 — Stripe Subscription State Reconciliation

Commit: feat(payments): add Stripe subscription state reconciliation for out-of-order events

• Created StripeSubscriptionReconciler service:

  • Tracks event_timestamp (in Unix milliseconds) on each subscription state record
  • Ignores stale webhook events (timestamp older than current state)
  • Detects state conflicts when timestamps match but status differs
  • Auto-reconciles conflicts by fetching subscription from Stripe API
  • Uses Stripe as source of truth for authoritative state

• Ordering strategy:

  1. Compare incoming webhook timestamp against stored event_timestamp
  2. Reject if older (stale event)
  3. Accept if newer (normal progression)
  4. On timestamp tie with status mismatch: fetch from Stripe, overwrite local state

Files:

• apps/backend/src/services/stripe-subscription-reconciler.service.ts (new)

---

Issue #640 — Supabase Realtime for Live Deployment Status

Commit: feat(deployments): add Supabase Realtime subscription for live status updates

• Created SupabaseRealtimeSubscriptionService:

  • Subscribes to deployment table changes on mount
  • Pushes status updates to frontend in real-time
  • Automatic connection lifecycle management

• Connection states:

  • connected — realtime subscription active
  • reconnecting — connection lost, attempting restore
  • polling — fallback mode active
  • disconnected — permanently disconnected

• Failure handling:

  • Attempts reconnection up to 5 times (configurable) with exponential backoff
  • Falls back to polling at 5-second intervals (configurable) when reconnect exhausted
  • Resumes realtime when connection recovers

• Row Level Security (RLS) applied per user via userId parameter on subscription

[drips-wave]

@favourawaku Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits