ci(api): enforce non-mutating lint gate in CI

.github/workflows/ci.yml

@@ -32,6 +32,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Lint
+        run: npm run lint:ci
+
       - name: Build
         run: npm run build
 

package.json

@@ -14,6 +14,7 @@
     "start:debug": "npx nest start --debug --watch",
     "start:prod": "node dist/main",
     "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
+    "lint:ci": "eslint \"{src,apps,libs,test}/**/*.ts\" --max-warnings=0",
     "test": "jest",
     "test:watch": "jest --watch",
     "test:cov": "jest --coverage",

src/common/interceptors/audit.interceptor.ts

@@ -16,8 +16,10 @@ export class AuditInterceptor implements NestInterceptor {
 
   constructor(private readonly reflector: Reflector) {}
 
-  intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
-    const actionMeta = this.reflector.get<any>(AUDIT_ACTION_KEY, context.getHandler());
+  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
+    const actionMeta = this.reflector.get<
+      string | { resource?: string; action?: string }
+    >(AUDIT_ACTION_KEY, context.getHandler());
 
     if (!actionMeta) {
       return next.handle();

src/jobs/transaction-status-checker/transaction-status-checker.processor.ts

@@ -221,12 +221,12 @@ export class TransactionStatusCheckerProcessor extends WorkerHost {
     return { found: false };
   }
 
-  private extractHorizonError(response: any): string | undefined {
-    if (!response) {
-      return undefined;
-    }
-
-    const codes = response.result_codes;
+  private extractHorizonError(response: unknown): string | undefined {
+    const codes = (
+      response as {
+        result_codes?: { transaction?: string } & Record<string, unknown>;
+      } | null
+    )?.result_codes;
     if (!codes) {
       return undefined;
     }
@@ -247,12 +247,15 @@ export class TransactionStatusCheckerProcessor extends WorkerHost {
       return true;
     }
 
-    const status = (error as any)?.response?.status;
-    if (status === 429 || status >= 500) {
+    const status = (error as { response?: { status?: number } })?.response
+      ?.status;
+    if (status === 429 || (typeof status === 'number' && status >= 500)) {
       return true;
     }
 
-    const message = String((error as any)?.message ?? '').toLowerCase();
+    const message = String(
+      (error as { message?: unknown })?.message ?? '',
+    ).toLowerCase();
     return (
       message.includes('timeout') ||
       message.includes('rate limit') ||
@@ -494,7 +497,18 @@ export class TransactionStatusCheckerProcessor extends WorkerHost {
         return null;
       }
 
-      const invocation = (operation.func as any)?._value?._attributes;
+      // Reach into the XDR wrapper's internal fields, which the SDK's public
+      // types do not surface, to recover the invoked contract function + args.
+      const invocation = (
+        operation.func as unknown as {
+          _value?: {
+            _attributes?: {
+              functionName?: { toString(): string };
+              args?: unknown;
+            };
+          };
+        }
+      )?._value?._attributes;
       if (!invocation) {
         return null;
       }
@@ -507,7 +521,7 @@ export class TransactionStatusCheckerProcessor extends WorkerHost {
 
       const nativeArgs = args.map((arg) => {
         try {
-          return StellarSdk.scValToNative(arg as any);
+          return StellarSdk.scValToNative(arg as StellarSdk.xdr.ScVal);
         } catch {
           return undefined;
         }