auth/env hardening and reliability updates

.github/workflows/ci.yml

@@ -25,6 +25,9 @@ jobs:
     - name: Type check
       run: bun run tsc --noEmit
 
+    - name: Run route tests
+      run: bun test tests/routes
+
     - name: Build frontend
       run: bun run build
 
@@ -71,16 +74,33 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
+    - name: Setup Bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: latest
+
+    - name: Install dependencies
+      run: bun install --frozen-lockfile
+
     - name: Run security audit
       run: |
-        bun audit || true  # Don't fail on audit issues for now
+        for attempt in 1 2 3; do
+          if bun audit; then
+            exit 0
+          fi
+          if [ "$attempt" -lt 3 ]; then
+            echo "bun audit failed (attempt $attempt), retrying..."
+            sleep 5
+          fi
+        done
+        echo "bun audit failed after retries"
+        exit 1
 
     - name: Check for secrets
       uses: trufflesecurity/trufflehog@main
       with:
         path: ./
         extra_args: --debug --only-verified
-      continue-on-error: true
 
   docker:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -73,6 +73,12 @@ jobs:
         echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
         echo "version_number=${NEW_VERSION#v}" >> $GITHUB_OUTPUT
 
+    - name: Type check
+      run: bun run typecheck
+
+    - name: Run backend tests
+      run: bun run test:unit
+
     - name: Build application
       run: bun run build
 

frontend/components/ui/peer-list.tsx

@@ -611,10 +611,11 @@ const PeerList: React.FC<PeerListProps> = ({
             <ChevronDown className="h-4 w-4 text-blue-400 flex-shrink-0" />
           }
           <span className="text-blue-200 text-sm font-medium select-none">Peer List</span>
-          <div onClick={e => e.stopPropagation()}>
+          <div onClick={e => e.stopPropagation()} onKeyDown={e => e.stopPropagation()}>
             <Tooltip
               position="right"
               width="w-64"
+              focusable
               trigger={<HelpCircle size={16} className="text-blue-400 cursor-pointer" />}
               content={
                 <p>Shows the signing peers in your FROSTR group with online/offline status and ping latency. Use the refresh button to ping all peers and update their status.</p>

frontend/types/index.ts

@@ -124,6 +124,7 @@ export interface UpdateInfo {
   updateAvailable: boolean;
   releaseUrl?: string;
   checkedAt?: string;
+  source?: 'github-release' | 'github-tags';
   error?: string;
 }