Merge branch 'main' into codex/add-lru_cache-for-get_settings-helper

Author: shayancoin

.github/workflows/assets.yml

@@ -0,0 +1,49 @@
+name: assets
+on:
+  pull_request: {}
+
+jobs:
+  validate-assets:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: paform/frontend/package-lock.json
+
+      - name: Install frontend deps
+        run: |
+          cd paform/frontend
+          npm ci
+
+      - name: Generate reference GLBs
+        run: |
+          cd paform
+          python3 scripts/generate_reference_glbs.py
+
+      - name: Pack GLBs (LOD0/LOD1) with KTX2
+        run: |
+          cd paform
+          bash scripts/pack_models.sh
+
+      - name: Validate GLBs (fail on warnings)
+        run: |
+          cd paform
+          python3 scripts/glb_validate.py frontend/public/models/*.glb --fail-on-warning
+
+      - name: Generate manifest.json
+        run: |
+          cd paform
+          python3 scripts/gen_glb_manifest.py > frontend/public/models/manifest.json
+
+      - name: Upload manifest
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: assets-artifacts
+          path: paform/frontend/public/models/manifest.json

.github/workflows/ci.yml

@@ -1,5 +1,14 @@
 name: CI
 
+permissions:
+  contents: read
+  actions: read
+  checks: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [ main ]
@@ -10,14 +19,14 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c
       with:
         python-version: '3.12'
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d
       with:
         version: "0.5.21"
         enable-cache: true
@@ -37,14 +46,14 @@ jobs:
         working-directory: ./backend
 
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c
       with:
         python-version: '3.12'
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d
       with:
         version: "0.5.21"
         enable-cache: true
@@ -57,7 +66,15 @@ jobs:
     - name: Test with pytest
       run: |
         source .venv/bin/activate
-        pytest
+        mkdir -p test-results/pytest
+        pytest -q -W error --maxfail=1 --durations=50 --junitxml=test-results/pytest/junit.xml
+
+    - name: Upload test results
+      if: always()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      with:
+        name: backend-test-results
+        path: backend/test-results
 
   frontend-tests:
     runs-on: ubuntu-latest
@@ -66,17 +83,20 @@ jobs:
         working-directory: ./frontend
 
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
     - name: Set up Node.js
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@0a44ba78451273a1ed8ac2fee4e347c72dfd377f
       with:
-        node-version: '18'
+        node-version: '20'
         cache: 'npm'
         cache-dependency-path: ./frontend/package-lock.json
 
     - name: Install dependencies
       run: npm ci
 
+    - name: Test
+      run: npm test
+
     - name: Lint
       run: npm run lint
 

.github/workflows/docs.yml

@@ -1,7 +1,11 @@
 name: docs
+
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 on:
   push:
@@ -44,21 +48,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d
         with:
           version: "0.5.21"
           enable-cache: true
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c
         with:
           python-version: "3.12"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@0a44ba78451273a1ed8ac2fee4e347c72dfd377f
         with:
           node-version: '20'
           cache: 'npm'
@@ -83,27 +87,29 @@ jobs:
           ./build-docs.sh
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: docs-site
           path: site/
           retention-days: 1
 
   deploy:
     needs: build
+    permissions:
+      contents: write
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
 
       - name: Download artifact
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
         with:
           name: docs-site
           path: site
@@ -112,7 +118,7 @@ jobs:
         run: touch site/.nojekyll
 
       - name: Deploy to Github pages
-        uses: JamesIves/github-pages-deploy-action@v4.7.3
+        uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8
         with:
           branch: gh-pages
           folder: site

.github/workflows/perf-light.yml

@@ -1,17 +1,21 @@
 name: perf-light
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request: {}
 
 jobs:
   k6:
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    concurrency:
-      group: perf-${{ github.ref }}
-      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Install k6
         run: |
@@ -20,12 +24,10 @@ jobs:
 
       - name: Start stack
         run: |
-          cd paform
           docker compose --env-file .env.development -f docker-compose.dev.yml up -d --build
 
       - name: Wait for API
         run: |
-          cd paform
           for i in {1..60}; do curl -sf http://localhost:8000/healthcheck && break || sleep 2; done
 
       - name: Wait for Frontend
@@ -36,7 +38,6 @@ jobs:
         env:
           BASE_URL: http://localhost:8000
         run: |
-          cd paform
           python - <<'PY'
 import json
 import os
@@ -84,18 +85,16 @@ PY
           BASE_URL: http://localhost:8000
           FRONTEND_BASE_URL: http://localhost:3000
         run: |
-          cd paform
           k6 run --summary-export k6-summary.json tests/perf/k6-quote-cnc.js
 
       - name: Upload k6 summary
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: k6-summary
-          path: paform/k6-summary.json
+          path: k6-summary.json
 
       - name: Shutdown stack
         if: always()
         run: |
-          cd paform
           docker compose --env-file .env.development -f docker-compose.dev.yml down

backend/alembic/versions/cfe1d8e4e001_add_sync_events.py

@@ -0,0 +1,31 @@
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision = "cfe1d8e4e001_add_sync_events"
+down_revision = "0001"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "sync_events",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("event_id", sa.String(length=255), nullable=True),
+        sa.Column("source", sa.String(length=100), nullable=False),
+        sa.Column("body_sha256", sa.String(length=64), nullable=False),
+        sa.Column(
+            "received_at",
+            sa.TIMESTAMP(timezone=True),
+            server_default=sa.text("CURRENT_TIMESTAMP"),
+            nullable=False,
+        ),
+        sa.UniqueConstraint("source", "event_id", name="uq_sync_events_src_event"),
+        sa.UniqueConstraint("source", "body_sha256", name="uq_sync_events_src_body"),
+        sa.UniqueConstraint("body_sha256", name="uq_sync_events_body"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("sync_events")

backend/api/db.py

@@ -1,5 +1,4 @@
 """Database configuration and session management using SQLAlchemy 2.x."""
-
 from __future__ import annotations
 
 import os
@@ -21,7 +20,6 @@ def _normalize_postgres_url(url: str) -> str:
     Accepts legacy prefixes and ensures the SQLAlchemy URL includes the
     ``+psycopg`` dialect when using PostgreSQL.
     """
-
     if url.startswith("postgres://"):
         return url.replace("postgres://", "postgresql+psycopg://", 1)
     if url.startswith("postgresql://") and "+psycopg" not in url:
@@ -31,17 +29,14 @@ def _normalize_postgres_url(url: str) -> str:
 
 def get_engine_url() -> str:
     """Resolve the database URL from env or settings with sane defaults."""
-
-    settings = get_settings()
+    settings = Settings()
     url = os.getenv("DATABASE_URL", settings.database_url)
     if url.startswith("sqlite"):
-        # SQLite works as-is
         return url
     return _normalize_postgres_url(url)
 
 
 ENGINE_URL = get_engine_url()
-
 engine = create_engine(ENGINE_URL, pool_pre_ping=True, future=True)
 
 SessionLocal = sessionmaker(
@@ -51,14 +46,14 @@ def get_engine_url() -> str:
     future=True,
 )
 
+# Ensure models are registered on Base.metadata for create_all/drop_all
+import api.models  # noqa: E402,F401
+
 
 def get_db() -> Generator:
     """FastAPI dependency to provide a session per request."""
-
     db = SessionLocal()
     try:
         yield db
     finally:
-        db.close()
-
-
+        db.close()