Git workflow, environments & CI/CD pipeline #1

Merged

cesnimda merged 6 commits from feature/git-workflow into develop 2026-07-01 11:44:35 +02:00

Conversation 0 Commits 6 Files Changed 16

+566 -16

cesnimda commented 2026-07-01 11:05:30 +02:00

Owner

Copy Link

Copy Source

Bootstraps the Git workflow, environment strategy, and CI/CD pipeline.

What is in here

• docs/WORKFLOW.md — branch model, Conventional Commits, SemVer, tagging, hotfix flow, 3-environment strategy.
• Staging environment — docker-compose.staging.yml (production-parity, isolated ports/volumes) + -Staging switch on deploy scripts + .env.staging.example.
• Git hooks — pre-commit (secret/format) + pre-push (build+test), installed via scripts/install-hooks.ps1.
• CI/CD — security.yml (gitleaks + NuGet/npm vuln gate), deploy-staging.yml (auto-redeploy local staging on develop), deploy-prod.yml (tag-gated prod promotion, inactive until server exists).
• VERSION (0.1.0) + CHANGELOG.md.

Follow-ups before the pipeline is fully live

• Register a self-hosted Gitea runner on the Windows box (labels: self-hosted, windows) so deploy-staging fires and CI actually runs.
• Once a runner reports checks, enable "require status checks" on main + develop.

🤖 Generated with Claude Code

Bootstraps the Git workflow, environment strategy, and CI/CD pipeline. ## What is in here - **docs/WORKFLOW.md** — branch model, Conventional Commits, SemVer, tagging, hotfix flow, 3-environment strategy. - **Staging environment** — `docker-compose.staging.yml` (production-parity, isolated ports/volumes) + `-Staging` switch on deploy scripts + `.env.staging.example`. - **Git hooks** — pre-commit (secret/format) + pre-push (build+test), installed via `scripts/install-hooks.ps1`. - **CI/CD** — `security.yml` (gitleaks + NuGet/npm vuln gate), `deploy-staging.yml` (auto-redeploy local staging on develop), `deploy-prod.yml` (tag-gated prod promotion, inactive until server exists). - **VERSION** (0.1.0) + **CHANGELOG.md**. ## Follow-ups before the pipeline is fully live - Register a self-hosted Gitea runner on the Windows box (labels: self-hosted, windows) so `deploy-staging` fires and CI actually runs. - Once a runner reports checks, enable "require status checks" on main + develop. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

cesnimda added 4 commits 2026-07-01 11:05:31 +02:00

docs: define Git workflow, versioning, and environment strategy ... 0d3a5fe2fe

Add the canonical workflow reference (docs/WORKFLOW.md): branch model
(main/develop + feature/fix/hotfix), Conventional Commits, SemVer, tagging,
and the three-environment strategy (native dev, Docker staging, Linux prod).
Seed VERSION (0.1.0) as the single source of truth and a Keep-a-Changelog
CHANGELOG.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

build: add production-parity staging environment on Docker ... 80fc813b61

Layer a staging overlay (docker-compose.staging.yml) on the base compose file:
same Linux images and Production runtime as prod, differing only in the dev
banner, capped sync, shifted ports (18080/18081), and an isolated project
namespace so it never touches prod data. Wire -Staging into deploy/up.ps1 and
deploy/down.ps1, add .env.staging.example, and track that template in git.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chore: add version-controlled git hooks + installer ... 101deb9546

pre-commit runs fast checks (block committed .env/secrets, verify dotnet
format); pre-push mirrors CI (Release build + tests + frontend build) to catch
failures before they leave the machine. install-hooks.ps1 wires core.hooksPath
so the hooks are shared and reviewable rather than living in un-tracked
.git/hooks. Bypass with --no-verify; CI still enforces the gate server-side.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ci: add secret/vuln scanning + staging & production deploy pipelines ... 87d44537b9

security.yml: gitleaks secret scan + NuGet/npm vulnerability gate on PRs and
pushes to main/develop (detective backstop to the pre-commit hook).
deploy-staging.yml: on merge to develop, re-verify then rebuild the isolated
local staging stack (needs a self-hosted Windows runner).
deploy-prod.yml: tag-gated production promotion (the tag is the approval), ready
to activate once the Linux server + its runner exist.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cesnimda added 1 commit 2026-07-01 11:26:27 +02:00

ci(security): run gitleaks binary + audit prod deps only ... 98e94a8163

The container-mode runner has no Docker socket, so the gitleaks 'docker run'
step failed; download and run the binary instead. Scope npm audit to production
dependencies (--omit=dev) so dev-toolchain advisories don't block merges, and
match dotnet's own vulnerable-packages line to avoid severity-word false hits.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cesnimda added 1 commit 2026-07-01 11:38:10 +02:00

fix(security): patch vulnerable NuGet dependencies flagged by CI gate ... e981c63a4d

The new dependency scan correctly failed on real advisories. Bump MailKit
4.13.0->4.17.0 (clears MailKit+MimeKit moderates) and add transitive security
pins for the .NET 8.0.0 High-severity advisories: System.Text.Json 8.0.6,
Microsoft.Extensions.Caching.Memory 8.0.1 (with DependencyInjection.Abstractions
8.0.2), System.Security.Cryptography.Xml 8.0.3. Verified locally: clean vuln
scan, Release build OK, all 39 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cesnimda merged commit ae8e6b672e into develop 2026-07-01 11:44:35 +02:00

cesnimda referenced this pull request 2026-07-01 16:55:28 +02:00

Git workflow, environments & CI/CD pipeline (#1) #6

cesnimda referenced this pull request 2026-07-02 16:29:39 +02:00

feat!: migrate to .NET 10 LTS #28

cesnimda referenced this issue from a commit 2026-07-02 16:29:40 +02:00

feat!: migrate to .NET 10 LTS (RECOMMENDATIONS #1)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

cesnimda

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cesnimda/Inboxintel#1