The container-mode runner has no Docker socket, so the gitleaks 'docker run'
step failed; download and run the binary instead. Scope npm audit to production
dependencies (--omit=dev) so dev-toolchain advisories don't block merges, and
match dotnet's own vulnerable-packages line to avoid severity-word false hits.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
security.yml: gitleaks secret scan + NuGet/npm vulnerability gate on PRs and
pushes to main/develop (detective backstop to the pre-commit hook).
deploy-staging.yml: on merge to develop, re-verify then rebuild the isolated
local staging stack (needs a self-hosted Windows runner).
deploy-prod.yml: tag-gated production promotion (the tag is the approval), ready
to activate once the Linux server + its runner exist.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
pre-commit runs fast checks (block committed .env/secrets, verify dotnet
format); pre-push mirrors CI (Release build + tests + frontend build) to catch
failures before they leave the machine. install-hooks.ps1 wires core.hooksPath
so the hooks are shared and reviewable rather than living in un-tracked
.git/hooks. Bypass with --no-verify; CI still enforces the gate server-side.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Layer a staging overlay (docker-compose.staging.yml) on the base compose file:
same Linux images and Production runtime as prod, differing only in the dev
banner, capped sync, shifted ports (18080/18081), and an isolated project
namespace so it never touches prod data. Wire -Staging into deploy/up.ps1 and
deploy/down.ps1, add .env.staging.example, and track that template in git.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add the canonical workflow reference (docs/WORKFLOW.md): branch model
(main/develop + feature/fix/hotfix), Conventional Commits, SemVer, tagging,
and the three-environment strategy (native dev, Docker staging, Linux prod).
Seed VERSION (0.1.0) as the single source of truth and a Keep-a-Changelog
CHANGELOG.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cesnimda