Update All The Things

.github/actionlint.yaml

@@ -0,0 +1,6 @@
+paths:
+  .github/workflows/**/*.{yml,yaml}:
+    ignore:
+      - '"inputs" section is alias node but mapping node is expected'
+      - '"paths" section must be sequence node but got alias node with "" tag'
+      - '"paths-ignore" section must be sequence node but got alias node with "" tag'

.github/workflows/ci.yaml

@@ -0,0 +1,110 @@
+name: "CI"
+
+on:
+  workflow_dispatch:
+    inputs:
+      build:
+        description: "Run Build"
+        type: boolean
+        default: true
+      deploy:
+        description: "Run Deploy"
+        type: boolean
+        default: true
+      cleanup:
+        description: "Run Cleanup"
+        type: boolean
+        default: true
+      env:
+        description: "Environment to Deploy"
+        required: true
+        default: "dev"
+        type: choice
+        options:
+          - dev
+          - prod
+
+  push:
+    branches-ignore:
+      - master
+    paths:
+      - ".github/workflows/ci.yaml"
+      - "app/**"
+      - "nginx/**"
+      - "docker-compose-swarm.yaml"
+      - "pyproject.toml"
+      - "uv.lock"
+
+env:
+  config-path: shane-red-api
+  stack-name: ${{ inputs.env || 'dev' }}_${{ github.repository_owner }}-${{ github.event.repository.name }}
+  env-name: ${{ inputs.env || 'dev' }}
+  build: ${{ github.event_name == 'push' && true || inputs.build }}
+  deploy: ${{ github.event_name == 'push' && true || inputs.deploy }}
+  cleanup: ${{ github.event_name == 'push' && true || inputs.cleanup }}
+
+concurrency:
+  group: ${{ inputs.env || 'dev' }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    name: "CI"
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: ${{ !contains(github.event.head_commit.message, '#noci') }}
+    concurrency:
+      group: ci
+      cancel-in-progress: true
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v6
+
+      - name: "Debug event.json"
+        continue-on-error: true
+        run: cat "${GITHUB_EVENT_PATH}"
+      - name: "Debug CTX github"
+        continue-on-error: true
+        env:
+          GITHUB_CTX: ${{ toJSON(github) }}
+        run: echo "$GITHUB_CTX"
+
+      - name: "Debug"
+        continue-on-error: true
+        run: |
+          echo group: ${{ inputs.env || 'dev' }}
+          echo github.event_name: ${{ github.event_name }}
+
+          echo inputs.build: ${{ inputs.build }}
+          echo inputs.deploy: ${{ inputs.deploy }}
+          echo inputs.cleanup: ${{ inputs.cleanup }}
+
+          echo env.build: ${{ env.build }}
+          echo env.deploy: ${{ env.deploy }}
+          echo env.cleanup: ${{ env.cleanup }}
+
+          echo env.stack-name: ${{ env.stack-name }}
+          echo env.env-name: ${{ env.env-name }}
+
+      - name: "Swarm Build Action"
+        if: ${{ env.build == 'true' }}
+        uses: hosted-domains/swarm-build-action@master
+        with:
+          version: ${{ env.env-name }}
+          username: ${{ vars.GHCR_USER }}
+          password: ${{ secrets.GHCR_PASS }}
+
+      - name: "Portainer Deploy Action"
+        if: ${{ env.deploy == 'true' }}
+        uses: hosted-domains/portainer-deploy-action@master
+        with:
+          version: ${{ env.env-name }}
+          stack-name: ${{ env.stack-name }}
+          config-file: services/${{ env.config-path }}/${{ env.env-name }}.env
+          config-ssh-key: ${{ secrets.SERVICE_CONFIGS_KEY }}
+          portainer-url: ${{ secrets.PORTAINER_URL }}
+          portainer-token: ${{ secrets.PORTAINER_TOKEN }}

.github/workflows/lint.yaml

@@ -0,0 +1,131 @@
+name: "Lint"
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths-ignore:
+      - "app/static/**"
+      - "*.env*"
+      - "nginx/nginx.conf"
+      - ".dockerignore"
+      - ".gitattributes"
+      - ".gitignore"
+      - ".prettierignore"
+      - "uv.lock"
+  pull_request:
+    branches: [master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: "Lint"
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    if: ${{ !contains(github.event.head_commit.message, '#nolint') }}
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v6
+
+      - name: "Debug event.json"
+        continue-on-error: true
+        run: cat "${GITHUB_EVENT_PATH}"
+      - name: "Debug CTX github"
+        continue-on-error: true
+        env:
+          GITHUB_CTX: ${{ toJSON(github) }}
+        run: echo "$GITHUB_CTX"
+
+      - name: "Install UV"
+        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
+
+      - name: "Install Python"
+        run: |
+          uv python install
+
+      - name: "Install Project"
+        run: |
+          uv sync --locked --all-extras --dev
+
+      - name: "Debug UV"
+        continue-on-error: true
+        run: |
+          uv python dir
+          uv python find
+          uv run python -V
+          echo "::group::uv tree"
+          uv tree
+          echo "::endgroup::"
+          echo "::group::uv pip list"
+          uv pip list
+          echo "::endgroup::"
+
+      - name: "astral-sh/ruff"
+        if: ${{ !cancelled() }}
+        uses: astral-sh/ruff-action@57714a7c8a2e59f32539362ba31877a1957dded1 # v3.5.1
+        with:
+          version: latest
+
+      - name: "astral-sh/ty"
+        continue-on-error: true
+        if: ${{ !cancelled() }}
+        run: |
+          uv run ty check -v
+
+      - name: "psf/black"
+        if: ${{ !cancelled() }}
+        uses: psf/black@stable
+
+      - name: "isort"
+        if: ${{ !cancelled() }}
+        uses: isort/isort-action@24d8a7a51d33ca7f36c3f23598dafa33f7071326 # v1.1.1
+
+      - name: "mypy"
+        continue-on-error: true
+        if: ${{ !cancelled() }}
+        run: |
+          uvx toml-run mypy
+
+      - name: "bandit"
+        if: ${{ !cancelled() }}
+        run: |
+          uvx toml-run bandit
+
+      - name: "tombi"
+        if: ${{ !cancelled() }}
+        run: |
+          uv run tombi lint
+
+      - name: "yamllint"
+        if: ${{ !cancelled() }}
+        run: |
+          uvx toml-run yamllint
+
+      - name: "prettier"
+        if: ${{ !cancelled() }}
+        run: |
+          echo "::group::Install"
+          npm install prettier
+          echo "::endgroup::"
+          npx prettier --check .
+
+      - name: "actionlint"
+        if: ${{ !cancelled() }}
+        uses: cssnr/actionlint-action@v1
+        with:
+          shellcheck_opts: -e SC2012
+
+      - name: "Hadolint"
+        if: ${{ !cancelled() }}
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: Dockerfile
+          recursive: true
+          ignore: DL3013,DL3018

.github/yamllint.yaml

@@ -0,0 +1,9 @@
+extends: relaxed
+
+ignore:
+  - "node_modules/"
+  - "**/templates/"
+
+rules:
+  line-length:
+    max: 119

.gitignore

@@ -1,9 +1,22 @@
+# Generic
 .idea/
 *.iml
-**/__pycache__/
-**/venv/
+.vscode/
+.venv/
+venv/
+__pycache__/
+*.egg-info/
+node_modules/
+build/
+dist/
+.*cache
+*.log
 *.pyc
 .coverage
-*.log
-*.sqlite3
+coverage.xml
+# App
+.env
+.secrets
+.vars
 settings.env
+*.sqlite3

.prettierignore

@@ -0,0 +1,4 @@
+package-lock.json
+**/templates
+**/*.html
+app/static

.prettierrc.json

@@ -0,0 +1,19 @@
+{
+  "trailingComma": "es5",
+  "semi": false,
+  "singleQuote": true,
+  "overrides": [
+    {
+      "files": ["**/*.html", "**/*.yaml", "**/*.yml"],
+      "options": {
+        "singleQuote": false
+      }
+    },
+    {
+      "files": ["**/*.js", "**/*.css", "**/*.scss"],
+      "options": {
+        "tabWidth": 4
+      }
+    }
+  ]
+}

.python-version

@@ -0,0 +1 @@
+3.13