Code Review and Commit Conventions

<type>[optional scope]: <description>
 
[optional body]
 
[optional footer(s)]

feat(auth)!: change token format to JWT v5
 
BREAKING CHANGE: Token format changed from HS256 to ES256.
All existing tokens will be invalidated.
Migration guide: docs/migration/token-v5.md

# new feature
feat(payment): add cryptocurrency payment support
 
Implement Bitcoin and Ethereum payment processing
using CoinGate API integration.
 
Closes #234
 
# bug fix
fix(auth): resolve JWT refresh token race condition
 
Multiple concurrent refresh requests could generate
duplicate tokens. Added mutex lock to token refresh handler.
 
Fixes #567
 
# refactoring
refactor(order): extract validation logic to separate service
 
Move order validation from OrderController to
OrderValidationService for better testability and reuse.
 
# performance
perf(query): optimize user search with database index
 
Add composite index on (email, created_at) to users table.
Query time reduced from 450ms to 12ms for 1M records.

1.0.0-alpha.1     <- alpha
1.0.0-beta.1      <- beta
1.0.0-rc.1        <- release candidate
1.0.0             <- general availability

{
  "dependencies": {
    "express": "^4.18.0",  // 4.x.x (MINOR and PATCH updates allowed)
    "lodash": "~4.17.0",   // 4.17.x (PATCH updates only)
    "react": "18.2.0"      // exactly this version
  }
}

analyze commit history
    |
    +-- feat: -> MINOR bump
    +-- fix: -> PATCH bump
    +-- BREAKING CHANGE -> MAJOR bump
    |
    v
update version in package.json
    |
    v
generate CHANGELOG.md
    |
    v
create Git tag (v2.1.0)
    |
    v
create GitHub Release
    |
    v
publish package to npm/PyPI/etc.

# GitHub Actions example
name: Release
on:
  push:
    branches: [main]
 
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # full history required
      - uses: actions/setup-node@v4
      - run: npm ci
      - run: npm test
      - run: npx semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

# Changelog
 
## [2.1.0] - 2026-02-10
 
### Features
- **payment**: add cryptocurrency payment support (#234)
- **auth**: implement OAuth 2.1 PKCE flow (#245)
 
### Bug Fixes
- **auth**: resolve JWT refresh token race condition (#567)
- **order**: fix decimal precision in total calculation (#571)
 
### Performance
- **query**: optimize user search with database index (#580)

# install
npm install --save-dev husky lint-staged
 
# initialize Husky
npx husky init

// package.json
{
  "lint-staged": {
    "*.{ts,tsx}": [
      "eslint --fix",
      "prettier --write"
    ],
    "*.{json,md}": [
      "prettier --write"
    ],
    "*.test.{ts,tsx}": [
      "jest --bail --findRelatedTests"
    ]
  }
}

# .husky/pre-commit
npx lint-staged

# install
npm install --save-dev @commitlint/cli @commitlint/config-conventional

// commitlint.config.js
module.exports = {
  extends: ['@commitlint/config-conventional'],
  rules: {
    'type-enum': [2, 'always', [
      'feat', 'fix', 'docs', 'style', 'refactor',
      'perf', 'test', 'build', 'ci', 'chore', 'revert'
    ]],
    'subject-max-length': [2, 'always', 72],
    'body-max-line-length': [2, 'always', 100]
  }
};

# .husky/commit-msg
npx --no -- commitlint --edit $1

# .github/CODEOWNERS
 
# global default owners
* @team-lead @senior-dev
 
# owners per service
/services/auth-service/    @auth-team
/services/payment-service/ @payment-team @security-team
/services/notification/    @platform-team
 
# infrastructure code
/infrastructure/           @devops-team
/terraform/                @devops-team @security-team
/.github/                  @devops-team
 
# security-sensitive files
/services/*/security/      @security-team
*.env.example              @security-team
 
# shared libraries
/packages/shared-utils/    @platform-team
/packages/api-client/      @api-team
 
# documentation
/docs/                     @tech-writer @team-lead

## Summary
<!-- summary of the change (1-3 sentences) -->
 
## Motivation
<!-- why is this change needed? (link the related issue) -->
 
## Changes
<!-- list of major changes -->
 
## Test Plan
<!-- how it was tested and the results -->
 
## Screenshots
<!-- screenshots if the UI changed -->
 
## Checklist

# generate a GPG key
gpg --full-generate-key
 
# list keys
gpg --list-secret-keys --keyid-format=long
 
# configure the GPG key in Git
git config --global user.signingkey ABC123DEF456
git config --global commit.gpgsign true
 
# signed commit
git commit -S -m "feat: add secure payment"
 
# verify the signature
git log --show-signature

# sign with an SSH key (simpler than GPG)
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
 
# signed commit (automatic)
git commit -m "feat: add secure payment"