Gate deploy on CI checks and fix all checks

.github/workflows/checks.yml

@@ -1,9 +1,13 @@
 name: Checks
 
 on:
-  pull_request_target:
+  pull_request:
     branches:
       - '**'
+  # Allow the Deploy workflow to run this exact same suite as a required gate
+  # before it builds and ships (see deploy.yml). Defining the checks once, here,
+  # keeps the pull-request run and the pre-deploy gate from drifting apart.
+  workflow_call:
 
 jobs:
   backend-checks:
@@ -14,9 +18,6 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
       - name: Set up Python 3.10
         uses: actions/setup-python@v5
         with:
@@ -31,7 +32,11 @@ jobs:
           black --check .
       - name: Tests
         env:
-          SECRET_KEY: ${{ secrets.CI_SECRET_KEY }}
+          # The CI settings only need *a* valid Django key to boot — it signs
+          # nothing that outlives the test run — so we use a throwaway value
+          # rather than the production SECRET_KEY. This keeps the real key out
+          # of CI and lets these checks run on pull requests from forks.
+          SECRET_KEY: django-insecure-ci-not-a-real-secret
           DEBUG: 0
         run: python manage.py test --settings=hackathon_site.settings.ci
 
@@ -43,15 +48,14 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
       - name: Use Node.js 16.x
         uses: actions/setup-node@v4
         with:
           node-version: '16.x'
       - name: Install dependencies
         run: yarn install
+      - name: Formatting check
+        run: yarn run prettier-check
 
   dashboard-checks:
     runs-on: ubuntu-latest
@@ -61,9 +65,6 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
       - name: Use Node.js 16.x
         uses: actions/setup-node@v4
         with:
@@ -76,3 +77,5 @@ jobs:
         run: yarn run tsc
       - name: Tests
         run: yarn test --watchAll=false
+      - name: Build frontend
+        run: yarn run build

.github/workflows/deploy.yml

@@ -11,8 +11,17 @@ env:
   STACK_NAME: makeuoft
 
 jobs:
+  # Required gate: run the full suite (Black, Django tests, prettier, tsc, jest,
+  # frontend build) before anything is built or shipped. build/deploy depend on
+  # this job, so a red commit on develop never reaches production — even one
+  # pushed directly, bypassing PR review. The checks are defined in checks.yml so
+  # this gate and the pull-request run can never drift apart.
+  checks:
+    uses: ./.github/workflows/checks.yml
+
   build:
     runs-on: ubuntu-latest
+    needs: [ checks ]
     outputs:
       GITHUB_SHA_SHORT: ${{ steps.sha7.outputs.GITHUB_SHA_SHORT }}
 

hackathon_site/event/api_filters.py

@@ -25,5 +25,7 @@ class TeamFilter(filters.FilterSet):
     )
 
     team_code = filters.CharFilter(
-        field_name="team_code", label="Team code", help_text="Team code",
+        field_name="team_code",
+        label="Team code",
+        help_text="Team code",
     )

hackathon_site/event/api_views.py

@@ -163,7 +163,10 @@ def post(self, request, *args, **kwargs):
         # Construct response data
         response_serializer = TeamSerializer(profile.team)
         response_data = response_serializer.data
-        return Response(data=response_data, status=status.HTTP_201_CREATED,)
+        return Response(
+            data=response_data,
+            status=status.HTTP_201_CREATED,
+        )
 
 
 class JoinTeamView(generics.GenericAPIView, mixins.RetrieveModelMixin):
@@ -200,7 +203,10 @@ def post(self, request, *args, **kwargs):
             current_team.delete()
         response_serializer = TeamSerializer(profile.team)
         response_data = response_serializer.data
-        return Response(data=response_data, status=status.HTTP_200_OK,)
+        return Response(
+            data=response_data,
+            status=status.HTTP_200_OK,
+        )
 
 
 class TeamIncidentListView(
@@ -295,7 +301,9 @@ def get(self, request, *args, **kwargs):
     def delete(self, request, *args, **kwargs):
         team = self.get_object()
         active_orders = Order.objects.filter(
-            Q(team=team), ~Q(status="Cancelled"), ~Q(status="Returned"),
+            Q(team=team),
+            ~Q(status="Cancelled"),
+            ~Q(status="Returned"),
         )
         if active_orders.exists():
             raise ValidationError(

hackathon_site/event/forms.py

@@ -79,9 +79,7 @@ def __init__(self, *args, **kwargs):
 
     def save(self, commit=True):
         self.instance = super().save(commit=False)
-        self.instance.phone_number = re.sub(
-            "[^0-9]", "", self.instance.phone_number
-        )
+        self.instance.phone_number = re.sub("[^0-9]", "", self.instance.phone_number)
         if commit:
             self.instance.save()
         return self.instance

hackathon_site/event/migrations/0003_remove_profile_status.py

@@ -10,5 +10,8 @@ class Migration(migrations.Migration):
     ]
 
     operations = [
-        migrations.RemoveField(model_name="profile", name="status",),
+        migrations.RemoveField(
+            model_name="profile",
+            name="status",
+        ),
     ]

hackathon_site/event/migrations/0006_profile_phone_number.py

@@ -13,7 +13,10 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name="profile",
             name="phone_number",
-            field=models.CharField(default="8022818076", max_length=20,),
+            field=models.CharField(
+                default="8022818076",
+                max_length=20,
+            ),
             preserve_default=False,
         ),
     ]

hackathon_site/event/migrations/0010_team_credits.py

@@ -11,6 +11,8 @@ class Migration(migrations.Migration):
 
     operations = [
         migrations.AddField(
-            model_name="team", name="credits", field=models.IntegerField(default=300),
+            model_name="team",
+            name="credits",
+            field=models.IntegerField(default=300),
         ),
     ]