CI, production Docker, and hardening fixes (rebased on upstream main)

.dockerignore

@@ -1,10 +1,41 @@
-.BC.*
-tmp*
-*~
-OLD*
-*.pyc
-.DS_Store
-.env
-.venv
-.aider.*
+# VCS / metadata
+# NOTE: keep .git in the build context — setuptools_scm derives the package
+# version from git history, and docker-release.yml relies on it. The build's
+# final `rm -rf /tmp/aider` removes it from the image, so it is not shipped.
+.gitignore
+.github
+
+# Python caches / build artifacts
+__pycache__
+*.py[cod]
+.mypy_cache
+.pytest_cache
+.ruff_cache
+*.egg-info
 build
+dist
+.coverage
+htmlcov
+
+# Virtualenvs (including the dev venv created during local testing)
+.venv
+venv
+env
+UsersaayusDownloadsaider-work.venv
+
+# Secrets / local config — never bake these into the image
+.env
+.env.*
+*.log
+.refact
+
+# Local working copy of aider (nested git repo used for testing)
+aider-work
+
+# Docs / website / heavy fixtures not needed at runtime
+aider/website
+docs
+README.md
+HISTORY.md
+tests/fixtures
+tests/browser

.github/workflows/check_pypi_version.yml

@@ -15,7 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        # Must match aider-chat's Requires-Python on PyPI (<3.13); widen when a
+        # release supporting newer Python is published.
+        python-version: ["3.10", "3.11", "3.12"]
 
     steps:
       - name: Set up Python ${{ matrix.python-version }}

.github/workflows/docker-build-test.yml

@@ -63,6 +63,26 @@ jobs:
         tags: ${{ secrets.DOCKERHUB_USERNAME }}/aider:dev
         target: aider
 
+    - name: Build image for smoke test (PR)
+      if: ${{ github.event_name == 'pull_request' }}
+      uses: docker/build-push-action@v5
+      with:
+        context: .
+        file: ./docker/Dockerfile
+        platforms: linux/amd64
+        push: false
+        load: true
+        tags: aider:smoke
+        target: aider
+
+    - name: Smoke test built image (PR)
+      if: ${{ github.event_name == 'pull_request' }}
+      run: |
+        docker run --rm aider:smoke --help
+        docker run --rm aider:smoke --version
+        # Fail if any secret-like value is present in the container environment.
+        docker run --rm aider:smoke printenv | grep -iE 'key|token|secret' && exit 1 || true
+
     - name: Build Docker full image (PR)
       if: ${{ github.event_name == 'pull_request' }}
       uses: docker/build-push-action@v5

.github/workflows/integration-tests.yml

@@ -0,0 +1,67 @@
+name: Integration Tests (manual)
+
+# Optional, manually-triggered integration suite.
+#
+# Runs the network/real-model tests (gated behind the `network` marker, enabled
+# with --run-network). These hit live model endpoints and therefore require
+# API key secrets to be configured in the repository / environment.
+#
+# Do NOT enable this on every PR: it depends on paid APIs. Trigger it manually
+# (Actions -> Integration Tests (manual) -> Run workflow) once secrets are set.
+#
+# Required secrets (configure as needed for the models under test):
+#   OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY, etc.
+
+on:
+  workflow_dispatch:
+    inputs:
+      extra_pytest_args:
+        description: 'Additional pytest arguments'
+        required: false
+        default: ''
+
+permissions:
+  contents: read
+
+concurrency:
+  group: integration-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  integration:
+    # Only run when at least one model key is present, otherwise skip cleanly.
+    if: ${{ secrets.OPENAI_API_KEY != '' || secrets.ANTHROPIC_API_KEY != '' || secrets.GEMINI_API_KEY != '' }}
+    runs-on: ubuntu-latest
+    env:
+      AIDER_ANALYTICS: false
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: 'requirements/requirements-dev.txt'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install ".[dev]"
+
+      - name: Run network/integration tests
+        run: |
+          pytest -q --run-network --junitxml=integration-results.xml ${{ github.event.inputs.extra_pytest_args }}
+
+      - name: Upload integration results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: integration-results
+          path: integration-results.xml
+          retention-days: 7