chore: set up branching, CI, and PR workflow
Prepares the repo for parallel agent work. No application code. - CLAUDE.md: conventions, branch naming, and the six non-negotiable invariants from the design (immutable raw bytes, no stored odometers, SI integers, dual-layer user isolation, secret containment, single ingestion path). Also records a model-allocation policy: the orchestrator runs Opus 5, workers default to Sonnet, and Opus is reserved for review plus the areas where a mistake is silent and expensive (ingest, wear SQL, auth/RLS, the Bryton protocol client). And the Gitea Actions gotchas, so nobody rediscovers them: GITEA_TOKEN cannot push to the container registry, jobs.*.environment is ignored, and cron needs a workflow_dispatch pair. - CONTRIBUTING.md: day-to-day flow, worktrees for parallel branches, review expectations. - .gitea/workflows/ci.yml: repo hygiene (branch naming, secret scan, no ride data in git), plus API/web/migration jobs that guard on whether the code exists yet, so CI is meaningful now and grows into the real thing rather than being rewritten. - .gitea/PULL_REQUEST_TEMPLATE.md: forces an honest "how this was verified" and an invariant checklist. - scripts/pr.sh, scripts/review.sh: open and inspect PRs via the Gitea API. - Directory scaffold with placeholder READMEs. Agents open PRs; humans merge them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -0,0 +1,204 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ci-${{ gitea.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
meta:
|
||||
name: Repo hygiene
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Branch name follows convention
|
||||
if: gitea.event_name == 'pull_request'
|
||||
run: |
|
||||
BRANCH="${{ gitea.head_ref }}"
|
||||
echo "Branch: $BRANCH"
|
||||
if echo "$BRANCH" | grep -Eq '^(feat|fix|refactor|test|docs|chore|ci)/[a-z0-9._-]+$'; then
|
||||
echo "OK"
|
||||
else
|
||||
echo "::error::Branch '$BRANCH' does not match <type>/<desc>."
|
||||
echo "Valid types: feat fix refactor test docs chore ci"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: No secrets committed
|
||||
run: |
|
||||
# Deliberately narrow: high-signal patterns only, so this never cries wolf.
|
||||
PATTERN='BEGIN (RSA|OPENSSH|EC|PGP) PRIVATE KEY|xoxb-[0-9A-Za-z-]{10,}|AKIA[0-9A-Z]{16}'
|
||||
if git grep -nIE "$PATTERN" -- . ':!.gitea/workflows/*' ; then
|
||||
echo "::error::Possible secret committed (see matches above)."
|
||||
exit 1
|
||||
fi
|
||||
echo "No secret patterns found."
|
||||
|
||||
- name: No ride data committed
|
||||
run: |
|
||||
if git ls-files | grep -E '\.(fit|gpx|tcx)$' | grep -v '^apps/api/tests/fixtures/fit/'; then
|
||||
echo "::error::Ride files belong in the blob store, not git."
|
||||
echo "Only apps/api/tests/fixtures/fit/ may contain .fit files (golden fixtures)."
|
||||
exit 1
|
||||
fi
|
||||
echo "Clean."
|
||||
|
||||
api:
|
||||
name: API (lint, types, tests)
|
||||
runs-on: ubuntu-latest
|
||||
services:
|
||||
postgres:
|
||||
image: postgis/postgis:16-3.4
|
||||
env:
|
||||
POSTGRES_USER: velodrome
|
||||
POSTGRES_PASSWORD: velodrome
|
||||
POSTGRES_DB: velodrome_test
|
||||
options: >-
|
||||
--health-cmd pg_isready
|
||||
--health-interval 10s
|
||||
--health-timeout 5s
|
||||
--health-retries 10
|
||||
env:
|
||||
DATABASE_URL: postgresql+asyncpg://velodrome:velodrome@postgres:5432/velodrome_test
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Is there API code yet?
|
||||
id: guard
|
||||
run: |
|
||||
if [ -n "$(find apps/api -name '*.py' -not -path '*/.*' 2>/dev/null | head -1)" ]; then
|
||||
echo "present=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "present=false" >> "$GITHUB_OUTPUT"
|
||||
echo "No Python sources under apps/api yet — skipping."
|
||||
fi
|
||||
|
||||
- uses: actions/setup-python@v5
|
||||
if: steps.guard.outputs.present == 'true'
|
||||
with:
|
||||
python-version: '3.12'
|
||||
|
||||
- name: Cache uv
|
||||
if: steps.guard.outputs.present == 'true'
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: ~/.cache/uv
|
||||
key: uv-${{ runner.os }}-${{ hashFiles('apps/api/pyproject.toml') }}
|
||||
restore-keys: uv-${{ runner.os }}-
|
||||
|
||||
- name: Install
|
||||
if: steps.guard.outputs.present == 'true'
|
||||
working-directory: apps/api
|
||||
run: |
|
||||
curl -LsSf https://astral.sh/uv/install.sh | sh
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
uv sync --all-extras
|
||||
|
||||
- name: Lint (ruff)
|
||||
if: steps.guard.outputs.present == 'true'
|
||||
working-directory: apps/api
|
||||
run: |
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
uv run ruff check .
|
||||
uv run ruff format --check .
|
||||
|
||||
- name: Types (mypy --strict)
|
||||
if: steps.guard.outputs.present == 'true'
|
||||
working-directory: apps/api
|
||||
run: |
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
uv run mypy --strict velodrome
|
||||
|
||||
- name: Tests
|
||||
if: steps.guard.outputs.present == 'true'
|
||||
working-directory: apps/api
|
||||
run: |
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
uv run pytest -q
|
||||
|
||||
web:
|
||||
name: Web (lint, typecheck, build)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Is there web code yet?
|
||||
id: guard
|
||||
run: |
|
||||
if [ -f apps/web/package.json ]; then
|
||||
echo "present=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "present=false" >> "$GITHUB_OUTPUT"
|
||||
echo "No apps/web/package.json yet — skipping."
|
||||
fi
|
||||
|
||||
- uses: actions/setup-node@v4
|
||||
if: steps.guard.outputs.present == 'true'
|
||||
with:
|
||||
node-version: '22'
|
||||
|
||||
- name: Install, lint, build
|
||||
if: steps.guard.outputs.present == 'true'
|
||||
working-directory: apps/web
|
||||
run: |
|
||||
corepack enable
|
||||
pnpm install --frozen-lockfile
|
||||
pnpm run lint
|
||||
pnpm run check
|
||||
pnpm run build
|
||||
|
||||
migrations:
|
||||
name: Migrations reversible
|
||||
runs-on: ubuntu-latest
|
||||
services:
|
||||
postgres:
|
||||
image: postgis/postgis:16-3.4
|
||||
env:
|
||||
POSTGRES_USER: velodrome
|
||||
POSTGRES_PASSWORD: velodrome
|
||||
POSTGRES_DB: velodrome_mig
|
||||
options: >-
|
||||
--health-cmd pg_isready
|
||||
--health-interval 10s
|
||||
--health-timeout 5s
|
||||
--health-retries 10
|
||||
env:
|
||||
DATABASE_URL: postgresql+asyncpg://velodrome:velodrome@postgres:5432/velodrome_mig
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Are there migrations yet?
|
||||
id: guard
|
||||
run: |
|
||||
if [ -d apps/api/alembic/versions ] && [ -n "$(ls -A apps/api/alembic/versions/*.py 2>/dev/null)" ]; then
|
||||
echo "present=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "present=false" >> "$GITHUB_OUTPUT"
|
||||
echo "No migrations yet — skipping."
|
||||
fi
|
||||
|
||||
- uses: actions/setup-python@v5
|
||||
if: steps.guard.outputs.present == 'true'
|
||||
with:
|
||||
python-version: '3.12'
|
||||
|
||||
- name: upgrade -> downgrade -> upgrade, and check for model drift
|
||||
if: steps.guard.outputs.present == 'true'
|
||||
working-directory: apps/api
|
||||
run: |
|
||||
curl -LsSf https://astral.sh/uv/install.sh | sh
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
uv sync --all-extras
|
||||
uv run alembic upgrade head
|
||||
uv run alembic downgrade -1
|
||||
uv run alembic upgrade head
|
||||
# Fails if the models have drifted from the migrations.
|
||||
uv run alembic check
|
||||
Reference in New Issue
Block a user