Release 1.0.0

.dockerignore

@@ -0,0 +1,12 @@
+.env
+.env.*
+.git
+.gitignore
+.venv
+__pycache__
+*.pyc
+staticfiles/
+media/
+.ruff_cache/
+.pytest_cache/
+.mypy_cache/

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+/.github/ @fragforce/web-team
+/Dockerfile @fragforce/web-team
+/Dockerfile.prod @fragforce/web-team
+/compose.yaml @fragforce/web-team
+/sonar-project.properties @fragforce/web-team
+/pyproject.toml @fragforce/web-team
+/uv.lock @fragforce/web-team

.github/workflows/codeql.yaml

@@ -0,0 +1,42 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches:
+      - dev
+      - main
+  push:
+    branches:
+      - dev
+      - main
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['python', 'javascript', 'actions']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@1a818fd5f97ed0ee9a823421bd5b171add01227f # v4.36.2
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@1a818fd5f97ed0ee9a823421bd5b171add01227f # v4.36.2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@1a818fd5f97ed0ee9a823421bd5b171add01227f # v4.36.2
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/coverage.yaml

@@ -0,0 +1,91 @@
+name: Coverage
+
+on:
+  push:
+    branches:
+      - dev
+      - master
+  pull_request:
+
+jobs:
+  coverage:
+    name: Lint and test with coverage
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    services:
+      postgres:
+        image: postgres:18.3
+        env:
+          POSTGRES_DB: fragforce_read_test
+          POSTGRES_PASSWORD: insecure
+          POSTGRES_HOST_AUTH_METHOD: trust
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+        ports:
+          - 5432:5432
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: '3.13'
+
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Lint with ruff
+        run: uv run --frozen ruff check .
+
+      - name: Django system check
+        env:
+          DATABASE_URL: postgres://postgres:insecure@localhost/fragforce_read_test
+          SECRET_KEY: insecure-test-key-not-used-in-production
+        run: uv run --frozen python manage.py check
+
+      - name: Run tests with coverage
+        continue-on-error: true
+        env:
+          DATABASE_URL: postgres://postgres:insecure@localhost/fragforce_read_test
+          SECRET_KEY: insecure-test-key-not-used-in-production
+        run: |
+          uv run --frozen coverage run -m pytest --junitxml=TEST-results.xml
+          uv run --frozen coverage xml
+
+      - name: Save PR metadata
+        env:
+          PR_NUMBER: ${{ github.event_name == 'pull_request' && github.event.number || '' }}
+          COMMIT_SHA: ${{ github.sha }}
+          BASE_REF: ${{ github.base_ref }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          echo "$PR_NUMBER" > pr_number.txt
+          echo "$COMMIT_SHA" > pr_sha.txt
+          echo "$BASE_REF" > pr_base_ref.txt
+          echo "$REF_NAME" > branch_name.txt
+
+      - name: Upload coverage and test artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: coverage-report
+          path: |
+            coverage.xml
+            TEST-*.xml
+            pr_number.txt
+            pr_sha.txt
+            pr_base_ref.txt
+            branch_name.txt
+          retention-days: 1

.github/workflows/create-release.yaml

@@ -0,0 +1,71 @@
+name: Create Release
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  release:
+    name: Create GitHub release and tag
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Extract version
+        id: version
+        run: |
+          VERSION=$(grep '^version = ' pyproject.toml | cut -d'"' -f2)
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Check if tag exists
+        id: tag-check
+        env:
+          TAG: ${{ steps.version.outputs.tag }}
+        run: |
+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists, skipping release"
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Tag $TAG does not exist, creating release"
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Extract changelog
+        if: steps.tag-check.outputs.exists == 'false'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          # Extract changelog section for this version
+          awk "/^## \[$VERSION\]/,/^## \[/" CHANGELOG.md | sed '$d' | tail -n +2 > changelog.txt
+
+          echo "### Release Notes for $VERSION" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          cat changelog.txt >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Create GitHub release
+        if: steps.tag-check.outputs.exists == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.version.outputs.tag }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          gh release create "$TAG" \
+            --title "Release $VERSION" \
+            --notes-file changelog.txt
+
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "✅ Created release $TAG" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Skip summary
+        if: steps.tag-check.outputs.exists == 'true'
+        env:
+          TAG: ${{ steps.version.outputs.tag }}
+        run: |
+          echo "### Release Skipped" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Tag $TAG already exists" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/dev-image.yaml

@@ -0,0 +1,52 @@
+name: Dev Image
+
+on:
+  push:
+    branches:
+      - dev
+
+jobs:
+  build:
+    name: Build & push dev image
+    if: github.repository == 'fragforce/read'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    env:
+      IMG_NAME: fragforce-read-dev
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+        with:
+          buildkitd-flags: --debug
+
+      - name: Docker metadata
+        id: metadata
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/${{ env.IMG_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=ref,event=branch
+            type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
+        with:
+          context: .
+          file: Dockerfile.prod
+          push: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}

.github/workflows/django-tests.yaml

@@ -0,0 +1,43 @@
+name: Django Tests
+
+on:
+  workflow_run:
+    workflows: ["Coverage"]
+    types:
+      - completed
+
+jobs:
+  report:
+    name: Django Tests
+    if: github.repository == 'fragforce/read'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
+
+    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        with:
+          client-id: ${{ secrets.FRAGFORCE_CI_APP_ID }}
+          private-key: ${{ secrets.FRAGFORCE_CI_PRIVATE_KEY }}
+
+      - name: Download coverage artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: coverage-report
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Report test results
+        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6.4.0
+        with:
+          report_paths: TEST-*.xml
+          check_name: Django Tests
+          commit: ${{ github.event.workflow_run.head_sha }}
+          token: ${{ steps.app-token.outputs.token }}
+          fail_on_failure: true
+          include_passed: true
+          detailed_summary: true

.github/workflows/prod-image.yaml

@@ -0,0 +1,52 @@
+name: Prod Image
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  build:
+    name: Build & push prod image
+    if: github.repository == 'fragforce/read'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    env:
+      IMG_NAME: fragforce-read-prod
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+        with:
+          buildkitd-flags: --debug
+
+      - name: Docker metadata
+        id: metadata
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/${{ env.IMG_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=ref,event=branch
+            type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
+        with:
+          context: .
+          file: Dockerfile.prod
+          push: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}