Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
name: ci
|
|
|
|
|
|
|
|
|
|
on:
|
|
|
|
|
push:
|
|
|
|
|
pull_request:
|
|
|
|
|
|
|
|
|
|
jobs:
|
|
|
|
|
test:
|
|
|
|
|
# Adjust to match the labels of your Forgejo runner.
|
|
|
|
|
runs-on: docker
|
|
|
|
|
steps:
|
2026-10-27 08:42:19 -04:00
|
|
|
# Actions are pinned to commits so a moved tag can't change what runs here.
|
|
|
|
|
- uses: https://data.forgejo.org/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
|
|
|
- uses: https://github.com/astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
|
Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
with:
|
|
|
|
|
version: "0.13.6"
|
|
|
|
|
- run: uv sync --locked
|
|
|
|
|
- run: uv run ruff check .
|
|
|
|
|
- run: uv run ruff format --check .
|
Harden for launch: limits, CSP, moderation, admin 2FA (Phase 5)
- Rate limits in the shared cache for comments, issues, uploads and
invites; a limited HTMX reply keeps the draft.
- Content-Security-Policy (self only, no inline script or style, bucket
origin for images and frames) and Permissions-Policy on every page.
htmx configured not to inject styles or eval.
- Moderation: deactivating a user ends their sessions and keeps their
content; deleted accounts show as "ghost"; reserved usernames; the
admin won't delete an org's last owner.
- Admin requires a TOTP code (django-otp), with add_admin_totp to enrol.
- Email provider chosen by environment through django-anymail.
- Playwright browser tests: axe WCAG 2.1 AA on every page in light and
dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit
Canvas/CanvasText on :root fixes dark-mode contrast detection.
- bin/start creates the data dir if missing; docs/operations.md runbook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 10:51:06 -04:00
|
|
|
# Browser for the accessibility, CSP and keyboard tests in tests/browser.
|
|
|
|
|
- run: uv run playwright install --with-deps chromium
|
Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
- run: uv run pytest
|
|
|
|
|
|
|
|
|
|
deploy:
|
|
|
|
|
needs: test
|
|
|
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
|
|
|
|
runs-on: docker
|
|
|
|
|
steps:
|
2026-10-27 08:42:19 -04:00
|
|
|
- uses: https://data.forgejo.org/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
|
|
|
- uses: https://github.com/superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # master, 2026-10
|
Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
- run: flyctl deploy --remote-only
|
|
|
|
|
env:
|
|
|
|
|
FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
|