Refactor frontend layout, enhance landing content, and improve documentation

.github/workflows/ci.yml → .github/workflows/backend-ci.yml

@@ -1,7 +1,11 @@
-name: CI
+name: Backend CI
 
+# Validation-only workflow; deployment and provider secrets are intentionally
+# outside GitHub Actions for this prototype.
 on:
   pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
@@ -10,12 +14,15 @@ permissions:
   contents: read
 
 jobs:
-  backend:
-    name: Backend
+  backend-ci:
+    name: backend-ci
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: backend
+    env:
+      # Tests mock provider behavior, so CI does not need a real provider key.
+      OPENAI_API_KEY: ""
     steps:
       - uses: actions/checkout@v4
 
@@ -27,27 +34,13 @@ jobs:
 
       - run: python -m pip install --upgrade pip
       - run: python -m pip install -r requirements.txt
-      - run: python -m pytest
+      - run: python -m pytest --cov=app --cov-report=term-missing --cov-report=xml
       - run: python -m ruff check app
       - run: python -c "from app.main import app; print(app.title)"
 
-  frontend:
-    name: Frontend
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: frontend
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
+      - uses: actions/upload-artifact@v4
+        if: always()
         with:
-          node-version: "20"
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
-
-      - run: npm ci
-      - run: npm run lint
-      - run: npm run typecheck
-      - run: npm test
-      - run: npm run build
+          name: backend-coverage
+          path: backend/coverage.xml
+          if-no-files-found: ignore

.github/workflows/frontend-ci.yml

@@ -0,0 +1,43 @@
+name: Frontend CI
+
+# Validation-only workflow for the Vite frontend; deployment remains with the
+# Vercel project configuration.
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  frontend-ci:
+    name: frontend-ci
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm run test:coverage -- --run
+      - run: npm run build
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: frontend-coverage
+          path: frontend/coverage
+          if-no-files-found: ignore

.github/workflows/repo-hygiene.yml

@@ -0,0 +1,89 @@
+name: Repo Hygiene
+
+# Repository safety checks that complement backend and frontend test workflows.
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  repo-hygiene:
+    name: repo-hygiene
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check whitespace
+        shell: bash
+        run: |
+          set -euo pipefail
+          zero_sha="0000000000000000000000000000000000000000"
+          empty_tree="$(git hash-object -t tree /dev/null)"
+
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            git fetch --no-tags origin "${{ github.base_ref }}:refs/remotes/origin/${{ github.base_ref }}"
+            git diff --check "origin/${{ github.base_ref }}...HEAD"
+          else
+            before="${{ github.event.before }}"
+            if [[ -n "${before}" && "${before}" != "${zero_sha}" ]] && git cat-file -e "${before}^{commit}" 2>/dev/null; then
+              git diff --check "${before}" HEAD
+            else
+              git diff --check "${empty_tree}" HEAD
+            fi
+          fi
+
+      - name: Check tracked generated files
+        shell: bash
+        run: |
+          set -euo pipefail
+          generated_path_pattern='(^|/)(node_modules|[.]venv|dist|build|coverage|__pycache__|[.]pytest_cache|[.]ruff_cache)(/|$)'
+          if git ls-files | grep -E "${generated_path_pattern}"; then
+            echo "Generated dependency, build, or cache artifacts must not be tracked."
+            exit 1
+          fi
+
+      - name: Check secret-looking strings
+        shell: bash
+        run: |
+          set -euo pipefail
+          provider_key_pattern='sk-[A-Za-z0-9_-]{20,}'
+          provider_env_assignment_pattern='OPENAI''_API_KEY=.+'
+          if git grep -n -E "${provider_key_pattern}|${provider_env_assignment_pattern}" -- . ':!backend/.env.example' ':!docs/**' ':!README.md'; then
+            echo "Secret-looking values must not be committed."
+            exit 1
+          fi
+
+      - name: Check skipped tests
+        shell: bash
+        run: |
+          set -euo pipefail
+          skipped_test_pattern='it[.]skip|describe[.]skip|(^|[^[:alnum:]_])xit[[:space:]]*[(]|pytest[.]mark[.]skip'
+          if git grep -n -E "${skipped_test_pattern}" -- frontend backend; then
+            echo "Skipped tests must be removed or explicitly approved before merge."
+            exit 1
+          fi
+
+      - name: Report task markers
+        shell: bash
+        run: |
+          todo_pattern='TO''DO|FIX''ME'
+          git grep -n -E "${todo_pattern}" -- frontend backend .github docs || true
+
+      - name: Check public text guard
+        shell: bash
+        run: |
+          set -euo pipefail
+          blocked_term_one="$(printf '\103\157\144\145\170')"
+          blocked_term_two="$(printf '\101\107\105\116\124\123')"
+          if git grep -n -E "${blocked_term_one}|${blocked_term_two}" -- . ':!.github/workflows/repo-hygiene.yml'; then
+            echo "Internal assistant references must not be committed."
+            exit 1
+          fi

.gitignore

@@ -15,6 +15,8 @@ frontend/.env
 frontend/dist/
 .vite/
 coverage/
+coverage.xml
+.coverage
 .pytest_cache/
 .ruff_cache/
 *.log