WIP: DONOT MERGE Staging to Production merge

.claude/settings.json

@@ -0,0 +1,18 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(grep -rln *)",
+      "Bash(grep -nA12 '\\\\[project.optional-dependencies\\\\]\\\\|optional-dependencies\\\\|\\\\[dependency-groups\\\\]' pyproject.toml)",
+      "Bash(grep -vE \"^$\")",
+      "Bash(git ls-tree *)",
+      "Bash(grep -E '\\\\.py$')",
+      "Bash(grep -v '\\\\.sample$')",
+      "Bash(git config *)",
+      "Bash(command -v gh)",
+      "Bash(gh api *)",
+      "Bash(python3 -c \"import sys,json; d=json.load\\(sys.stdin\\); print\\('protected:', d.get\\('protected'\\)\\); p=d.get\\('protection',{}\\); print\\('required_pull_request_reviews:', 'yes' if p.get\\('required_pull_request_reviews'\\) else 'no'\\); print\\('enforce_admins:', \\(p.get\\('enforce_admins'\\) or {}\\).get\\('enabled'\\)\\)\")",
+      "Bash(grep -nA6 \"TENANT_BYPASSES: list\" api/main.py)",
+      "Bash(grep -nA10 \"STRIP_REQUEST_HEADERS = \" api/main.py)"
+    ]
+  }
+}

.github/workflows/ci.yml

@@ -2,81 +2,41 @@ name: CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [ develop ]
   pull_request:
-    branches: [ main ]
+    branches: [ develop ]
+
+# Cancel any in-progress run for the same branch/PR when a newer commit lands.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  lint:
+  ci:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: ["3.12"]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v4
+      uses: astral-sh/setup-uv@v6
       with:
         version: "0.5.8"
-
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: "3.12"
-
-    - name: Install the project
-      run: uv sync --all-extras
-
-    - name: Check imports with isort
-      run: uv run isort --check-only --diff .
-
-    - name: Check code formatting with black
-      run: uv run black --check .
+        enable-cache: true
 
-  test:
-    needs: lint
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ["3.12"]
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Install uv
-      uses: astral-sh/setup-uv@v4
-      with:
-        version: "0.5.8"
-
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
-        python-version: "3.12"
-
-    - name: Install the project
-      run: uv sync --all-extras
-
-    - name: Run tests
-      run: uv run pytest tests
-      env:
-        TASK_DATABASE_URL: "postgresql+asyncpg://postgres:postgres@localhost:5432/test_db"
-        OSM_DATABASE_URL: "postgresql+asyncpg://postgres:postgres@localhost:5432/test_db"
-        JWT_SECRET: "test_secret_key"
-        JWT_ALGORITHM: "HS256"
-
-    services:
-      postgres:
-        image: postgres:16
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: test_db
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+        python-version: ${{ matrix.python-version }}
+
+    # Runs the same checks locals get from scripts/ci.sh: uv sync, isort,
+    # black, pyright, and pytest. `--integration` additionally runs the
+    # PostGIS/testcontainers suite (`pytest -m integration`); the ubuntu-latest
+    # runner ships a running Docker daemon, which testcontainers needs to boot
+    # the database. The script runs every check and exits non-zero if any fail,
+    # so a single red step still lists all failures.
+    - name: Run CI checks
+      run: ./scripts/ci.sh --integration

.github/workflows/push-docker-image.yml

@@ -0,0 +1,64 @@
+name: Push Docker Image to Azure Container Registry
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Environment to deploy to'
+        required: true
+        default: 'develop'
+        type: choice
+        options:
+          - develop
+          - staging
+          - production
+          - testing
+
+jobs:
+  set-github-environment:
+        runs-on: ubuntu-latest
+        outputs:
+            environment: ${{ steps.set-env.outputs.target_env }}
+        steps:
+            - name: Set Environment
+              id: set-env
+              run: |
+                case "${{ inputs.environment }}" in
+                    testing)     echo "target_env=test" >> $GITHUB_OUTPUT ;;
+                    develop) echo "target_env=dev" >> $GITHUB_OUTPUT ;;
+                    staging)     echo "target_env=stage" >> $GITHUB_OUTPUT ;;
+                    production)  echo "target_env=prod" >> $GITHUB_OUTPUT ;;
+                esac
+  build:
+    runs-on: ubuntu-latest
+    name: "Build"
+    needs: set-github-environment
+    concurrency:
+      group: build
+      cancel-in-progress: true
+    steps:
+        - uses: actions/checkout@v4
+          with:
+            ref:  ${{ github.event.inputs.environment }}
+
+        - uses: docker/login-action@v3
+          with:
+            registry: ${{ vars.DOCKERHUB_REGISTRY }}
+            username: ${{ vars.DOCKERHUB_USERNAME }}
+            password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+        - name: Set up QEMU
+          uses: docker/setup-qemu-action@v3
+
+        - name: Set up Docker Buildx
+          uses: docker/setup-buildx-action@v3
+
+        - name: Build and push
+          uses: docker/build-push-action@v5
+          with:
+            context: .
+            push: true
+            platforms: linux/amd64
+            tags: ${{ vars.DOCKERHUB_REGISTRY }}/workspaces-backend-v2:${{ needs.set-github-environment.outputs.environment }},
+                  ${{ vars.DOCKERHUB_REGISTRY }}/workspaces-backend-v2:${{github.sha}}
+

.github/workflows/tag.yml

@@ -0,0 +1,42 @@
+# Whenever there is a pull request merged into the branches, create tag
+name: Update Environment Tag
+on:
+   pull_request:
+     types: [closed]
+     branches:
+       - develop
+       - staging
+       - production
+jobs:
+  update-tag:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+        - name: Checkout code
+          uses: actions/checkout@v4
+          with:
+            fetch-depth: 1
+        - name: Get the current branch name
+          id: get_branch
+          run: |
+            TARGET_BRANCH="${{ github.event.pull_request.base.ref }}"
+
+            if [ "$TARGET_BRANCH" = "develop" ]; then
+                echo "ENV_TAG=dev" >> $GITHUB_ENV
+            elif [ "$TARGET_BRANCH" = "staging" ]; then
+                echo "ENV_TAG=stage" >> $GITHUB_ENV
+            elif [ "$TARGET_BRANCH" = "production" ]; then
+                echo "ENV_TAG=prod" >> $GITHUB_ENV
+            else
+                echo "ENV_TAG=" >> $GITHUB_ENV
+            fi
+        - name: Force update tag
+          if: ${{ env.ENV_TAG != '' }}
+          run: |
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            echo "Targeting tag: ${{ env.ENV_TAG }}"
+            git tag -f $ENV_TAG
+            git push origin $ENV_TAG --force

.github/workflows/trigger-deploy-on-merge.yml

@@ -0,0 +1,36 @@
+name: Trigger Deployment on Pull Request Merge
+on:
+    pull_request:
+        types: [closed]
+        branches: [ develop, staging, production]
+permissions:
+    contents: read
+    actions: write
+jobs:
+    on-merge:
+        if: github.event.pull_request.merged == true
+        runs-on: ubuntu-latest
+        outputs:
+            environment: ${{ steps.set-environment.outputs.environment }}
+        steps:
+            - name: Set Environment
+              id: set-environment
+              run: |
+                case "${{ github.base_ref }}" in
+                    develop)    echo "environment=develop" >> $GITHUB_OUTPUT ;;
+                    staging)    echo "environment=staging" >> $GITHUB_OUTPUT ;;
+                    production) echo "environment=production" >> $GITHUB_OUTPUT ;;
+                    testing)    echo "environment=testing" >> $GITHUB_OUTPUT ;;
+                esac
+    deploy:
+        needs: on-merge
+        runs-on: ubuntu-latest
+        env:
+            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        steps:
+            - name: Trigger Deployment Workflow
+              run: |
+                gh workflow run push-docker-image.yml \
+                    --repo ${{ github.repository }} \
+                    --ref ${{ github.base_ref }} \
+                    --field environment=${{ needs.on-merge.outputs.environment }}

.gitignore

@@ -163,4 +163,11 @@ alembic/versions/.DS_Store
 /workspaces-openstreetmap-website
 pg_user_cache.sqlite
 
-.env**
+.env**
+integration-report.html
+docs/tasking-mvp/tasking-mvp.postman_collection.json
+docs/tasking-mvp/tasking-mvp.postman_environment.json
+docs/tasking-mvp/_enrich_postman.py
+docs/tasking-mvp/feature-coverage.md
+.idea/
+data/

.pre-commit-config.yaml

@@ -12,7 +12,7 @@ repos:
         name: isort (python)
 
 -   repo: https://github.com/psf/black
-    rev: 24.1.1
+    rev: 24.10.0
     hooks:
     -   id: black
         language_version: python3.12

.vscode/extensions.json

@@ -0,0 +1,6 @@
+{
+    "recommendations": [
+        "ms-python.python",
+        "ms-python.vscode-pylance"
+    ]
+}

.vscode/settings.json

@@ -3,5 +3,16 @@
         "alembic"
     ],
     "python.testing.unittestEnabled": false,
-    "python.testing.pytestEnabled": true
+    "python.testing.pytestEnabled": true,
+    "[python]": {
+        "editor.defaultFormatter": "ms-python.black-formatter",
+        "editor.formatOnSave": true,
+        "editor.codeActionsOnSave": {
+            "source.organizeImports": "explicit"
+        }
+    },
+    "isort.args": [
+        "--profile",
+        "black"
+    ]
 }