Promote uat to main - #236
Open
github-actions[bot] wants to merge 32 commits into
Open
Conversation
* Adopt tripbot's uat-first CI/CD workflow and repo best practices Mirrors the tripbot repo's branching model and tooling: - uat becomes the integration branch; GuardMainSource enforces that PRs into main can only come from uat. - PullRequestOpenAll now gates PRs into both main and uat with lint, a production build (next build, which also type-checks), and CodeQL. - PushToUat adds lint/build/docker-build/CodeQL/Sonar validation so a uat push is confirmed to build correctly before it can reach main. - PushToMain drops the redundant pre-merge lint/build (already gated at PR/UAT time) and instead validates the production Docker image. - .drone.yml gains a "Deploy Website UAT" pipeline targeting the uat branch, and fixes a duplicate `trigger:` YAML key in the main pipeline that was silently discarding the branch restriction. - Husky + lint-staged run eslint --fix on staged files pre-commit. - VS Code file nesting collapses config files under package.json. - Adds CODEOWNERS, PR/issue templates, CONTRIBUTING.md, .nvmrc, .editorconfig, and .gitattributes for parity with tripbot. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Fix production Docker build broken by the husky prepare script npm ci --omit=dev still runs the prepare lifecycle script, but husky (a devDependency) gets its binary omitted, so it fails with "sh: husky: not found" (exit 127). Drop scripts.prepare before the production-only install, per husky's own documented fix for this. Verified by reproducing `npm ci --omit=dev` against the built node_modules outside Docker: failed with the exact same error before the fix, succeeded (exit 0) after. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* Revamp design: new header, index page, tailwind styles * Simplify homepage: drop dead subreddit fetch, dedupe link/card markup, remove stray bun.lock * UI: Fix header link truncation by preventing wrapping * Refactor ProfileButton: replace legacy CSS-in-JSX with Tailwind classes and inline fallbacks * Redesign Footer: convert to component-driven layout, add link data and accessibility tweaks * Make hero section fill viewport and center content; update CTA button styling * Add contributor link for Sympact06 to site footer * Auto stash before rebase of "revamp/design" * Address review feedback - Add a 3s timeout to the Discord guild fetch so a slow API can't stall SSR, and hoist the guild id/url into constants - Guard the header click-outside handler with instanceof Element instead of a type cast that could crash on non-Element targets - Replace the footer heart emoji with the boxicons heart and an sr-only label * Update footer to dynamically display credits Refactor footer credits to use a dynamic mapping for contributors. * Add credits section to Footer component Added credits section with contributors' names and links. * Footer formatting * Footer formatting --------- Co-authored-by: silent-decibel <276324116+silent-decibel@users.noreply.github.com> Co-authored-by: Julia Jeanne Dowejko <julia@agatha.co.za>
The env:uat runner's DRONE_RUNNER_VOLUMES mounts the host's UAT compose file into every pipeline's working dir as docker-compose.website-prod.yml, not docker-compose.website.yml. Referencing docker-compose.website.yml was silently falling through to the repo's own dev-target file (bind-mounted src/public, next dev with --inspect) instead of the actual UAT deploy config. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…in-jest (#219) * Bump prettier, swiper, typescript-eslint, eslint-plugin-jest Applies the dependency updates from dependabot PRs #211, #212, #213, #215. #213/#215's targeted versions (typescript-eslint 8.x, eslint-plugin-jest 29.x) require eslint-config-airbnb-typescript peer support that doesn't exist yet, so those land at the highest versions still compatible with the current airbnb-based ESLint config (7.18.0 / 28.14.0) instead of dependabot's exact targets. eslint-config-next's bump to 16.x (#214) is excluded entirely: it's flat-config-only and requires ESLint >=9, which is incompatible with eslint-config-airbnb-base/airbnb-typescript as currently used. That needs a dedicated ESLint 9 flat-config migration, tracked separately. * Add dependabot.yml targeting uat PRs into main now require the uat branch as their source (GuardMainSource.yml, added in #217). Dependabot always opens PRs against the default branch, so without this config every future Dependabot PR against main would be permanently blocked by that check, same as #211-#215.
# Conflicts: # package-lock.json # package.json
The lockfile from local npm 11.6.2 resolved optional/platform-specific packages differently than the npm 10.9.2 bundled with the Node version pinned in .nvmrc, so `npm ci` failed in CI with EUSAGE (lock file out of sync). Regenerated with npm 10.9.2 and verified `npm ci` matches CI's install exactly.
The production Docker build was running a full second npm ci to strip devDependencies after next build, ~doubling install time, and had no persistent cache for npm or Next's compiler between builds. - next.config.js: enable output: "standalone" so next build traces each page's real dependencies instead of needing the full node_modules tree - Dockerfile: drop the redundant npm ci --omit=dev pass, copy the traced .next/standalone output instead (80MB vs 1.1GB), add BuildKit cache mounts for the npm and Next build caches - .dockerignore: exclude .git, .next, .github, docs, etc. (previously only node_modules/), shrinking build context and preventing needless cache busts - .drone.yml: drop apk update && apk upgrade in both pipelines - was upgrading a throwaway CI container's unrelated system packages on every deploy - .npmrc: skip audit/funding network calls during npm ci Verified locally: next build with standalone output completes and produces .next/standalone/server.js; docker build --target production succeeds and the resulting image serves HTTP 200 on first request. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
GuardMainSource already requires PRs into main to come from uat, but promoting uat to main was still a manual step. This adds a workflow that opens that PR automatically after a push to uat (skipping it if one is already open, and failing harmlessly if there's no diff to promote). Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
The Drone runner's docker compose build uses the legacy builder, not
BuildKit, regardless of the DOCKER_BUILDKIT secret - so `RUN --mount=
type=cache` failed outright ("the --mount option requires BuildKit").
Removing the cache mounts loses the cross-build npm/Next cache, but
the bigger win (standalone output removing the second npm ci) doesn't
need BuildKit at all - already verified that combination builds and
serves correctly under the legacy builder.
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* Drop BuildKit-only cache mounts breaking the UAT build
The Drone runner's docker compose build uses the legacy builder, not
BuildKit, regardless of the DOCKER_BUILDKIT secret - so `RUN --mount=
type=cache` failed outright ("the --mount option requires BuildKit").
Removing the cache mounts loses the cross-build npm/Next cache, but
the bigger win (standalone output removing the second npm ci) doesn't
need BuildKit at all - already verified that combination builds and
serves correctly under the legacy builder.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* Truncate commit message in prod Discord notification
The Deploy Website pipeline sent the full untruncated commit.message
to Discord, which rejects payloads over 2000 chars with a 400 the
appleboy/drone-discord plugin can't parse into a readable error.
Apply the same truncate(500) fix already used in Deploy Website UAT.
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* Migrate to ESLint 10 flat config, drop airbnb
Replaces .eslintrc/.eslintignore with eslint.config.mjs built on
next/core-web-vitals, next/typescript, sonarjs recommended, and
prettier recommended. Drops eslint-config-airbnb-base/-typescript and
the unused eslint-plugin-jest/eslint-plugin-import direct deps in
favor of the unified typescript-eslint package and what
eslint-config-next already pulls in.
Fixes the real issues the new rule set surfaced: dead stores, an
ignored exception, an impure Date.now() call in a useState
initializer, an insecure Math.random() usage, plaintext http:// links,
an unsafe {} type, and a few other small correctness/style fixes.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* Fix modulo bias in randomString CSPRNG usage
CodeQL flagged crypto.getRandomValues()[0] % N as biased since 256
isn't evenly divisible by 10 or 94. Use rejection sampling instead so
the modulo only ever applies to a uniformly-sized subrange.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* Untrack another session's Jest work accidentally swept into this branch
A concurrent session sharing this working directory was adding a Jest
test suite (jest.config.ts, jest.setup.ts, test files, CI wiring,
testing-library deps). It got picked up by a broad `git add -A` on the
previous commit. This reverts package.json, package-lock.json, and
the workflow file to their state before that commit, and untracks
(without deleting from disk) the Jest files so that work isn't lost
and can be committed properly on its own branch.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* Add Jest test suite Adds jest + next/jest config, testing-library, and unit tests for addDictionaryDefs, ComboCard, Legend, combo data helpers, queryString, and randomString. Wires the pre-existing commented-out CI test job back on. Fixed two airbnb lint violations picked up along the way: the next/jest.js import needs its extension (that's the only path in next's package exports) so it gets a scoped import/extensions disable, and the character-range test used an array iteration instead of a bare for...of loop. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Regenerate package-lock.json to fix npm ci The lockfile was missing optional platform packages (@emnapi/core, @emnapi/runtime), which made npm ci fail in CI even though npm install worked fine locally. Regenerated from a clean node_modules. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Add ts-node so Jest can load jest.config.ts on Node 22 .nvmrc pins Node 22.14.0 for CI, which lacks the native TS type-stripping that let this work unnoticed on newer local Node versions. Jest's loader needs ts-node to parse a .ts config file without it. Also regenerated package-lock.json from scratch again — the wasm32-wasi optional fallback packages (tailwindcss oxide, @unrs resolver) pull in @emnapi/* sub-dependencies that drift between incremental npm installs; a from-scratch install is what stays in sync with npm ci. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 24.13.3 to 26.2.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
# Conflicts: # package-lock.json # package.json
…s/node-26.2.0 Bump @types/node from 24.13.3 to 26.2.0
Fixes button color and adds GitHub social link
Fix UI issues on front page
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-opened by the OpenUatToMainPR workflow after a push to
uat. Merge to release these changes to production.