feat: harden pipelines and repository lifecycle

- require Docker isolation for production pipeline commands
- add restricted CI networking and runtime health checks
- secure pipeline secrets, paths, artifacts, and cancellation
- add explicit per-repository Pages publishing controls
- preserve web, Pages, HTTP, and SSH access across repo renames
- fully clean repository data and unshared LFS objects on deletion
- restore queued runs and scope cancellation to individual runs
- fix pnpm 11.1.3 CI setup and documentation deep links
- add migrations, documentation, and regression coverage

Author: gabrielcsapo

.github/workflows/ci.yml

@@ -12,8 +12,6 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
-        with:
-          version: 10
 
       - uses: actions/setup-node@v4
         with:
@@ -40,6 +38,9 @@ jobs:
       - name: Build
         run: pnpm build
 
+      - name: Run pipeline unit tests
+        run: pnpm --filter @groffee/web test:unit
+
       - name: Start production server
         run: pnpm --filter @groffee/web start &
         env:

.github/workflows/docs.yml

@@ -24,8 +24,6 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
-        with:
-          version: 10
 
       - uses: actions/setup-node@v4
         with:

.groffee/pipelines.yml

@@ -18,7 +18,7 @@ pipelines:
         timeout: 120
         steps:
           - name: Install pnpm
-            run: corepack enable && corepack prepare pnpm@latest --activate
+            run: mkdir -p "$HOME/.local/bin" && corepack enable --install-directory "$HOME/.local/bin"
           - name: Install dependencies
             run: pnpm install --frozen-lockfile
           - name: Lint
@@ -30,7 +30,7 @@ pipelines:
         timeout: 180
         steps:
           - name: Install pnpm
-            run: corepack enable && corepack prepare pnpm@latest --activate
+            run: mkdir -p "$HOME/.local/bin" && corepack enable --install-directory "$HOME/.local/bin"
           - name: Install dependencies
             run: pnpm install --frozen-lockfile
           - name: Typecheck
@@ -43,7 +43,7 @@ pipelines:
         timeout: 300
         steps:
           - name: Install pnpm
-            run: corepack enable && corepack prepare pnpm@latest --activate
+            run: mkdir -p "$HOME/.local/bin" && corepack enable --install-directory "$HOME/.local/bin"
           - name: Install dependencies
             run: pnpm install --frozen-lockfile
           - name: Build
@@ -55,16 +55,24 @@ pipelines:
 
       test:
         name: E2E Tests
-        image: mcr.microsoft.com/playwright:v1.52.0-noble
+        image: mcr.microsoft.com/playwright:v1.60.0-noble
         needs: [build]
         timeout: 600
         steps:
           - name: Install pnpm
-            run: corepack enable && corepack prepare pnpm@latest --activate
+            run: mkdir -p "$HOME/.local/bin" && corepack enable --install-directory "$HOME/.local/bin"
           - name: Install dependencies
             run: pnpm install --frozen-lockfile
           - name: Build
             run: pnpm build
+          - name: Unit tests
+            run: pnpm --filter @groffee/web test:unit
+          - name: Seed test data
+            run: pnpm seed && pnpm make-admin alice
+          - name: Start production server
+            run: pnpm --filter @groffee/web start > /tmp/groffee.log 2>&1 &
+          - name: Wait for server
+            run: npx wait-on http://localhost:3000 --timeout 30000
           - name: Run E2E tests
             run: pnpm test
         artifacts:

Dockerfile

@@ -40,6 +40,7 @@ RUN pnpm install --frozen-lockfile
 
 COPY . .
 ENV EXTERNAL_URL=""
+ENV NODE_ENV="production"
 
 EXPOSE 3000
 EXPOSE 2223

README.md

@@ -28,7 +28,7 @@ application ships as one Node.js service plus an SSH listener.
 ## Requirements
 
 - Node.js 22+
-- pnpm 10+
+- pnpm 11.1.3 (declared by `packageManager` and activated through Corepack)
 - git
 - git-lfs
 
@@ -108,22 +108,26 @@ EXTERNAL_URL=https://groffee.example.com pnpm start
 
 ## Environment Variables
 
-| Variable       | Default                  | Description                                           |
-| -------------- | ------------------------ | ----------------------------------------------------- |
-| `PORT`         | `3000`                   | HTTP server port                                      |
-| `SSH_PORT`     | `2223`                   | SSH server port                                       |
-| `DATA_DIR`     | `./data`                 | Directory for database, repositories, and LFS objects |
-| `EXTERNAL_URL` | `http://localhost:$PORT` | Public-facing URL (required for Git LFS over SSH)     |
+See the [configuration guide](packages/docs/src/pages/configuration.mdx) for the complete environment reference, including Docker runner limits and Pages settings.
 
 ## Docker
 
 ```bash
 docker build -t groffee .
 docker run -p 3000:3000 -p 2223:2223 \
   -e EXTERNAL_URL=https://groffee.example.com \
-  -v groffee-data:/app/data groffee
+  -e NODE_ENV=production \
+  -e DOCKER_HOST_DATA_DIR=/var/lib/docker/volumes/groffee-data/_data \
+  -v groffee-data:/app/data \
+  -v /var/run/docker.sock:/var/run/docker.sock groffee
 ```
 
+Production CI requires a dedicated `groffee-ci` Docker network with restricted egress. See the configuration guide before enabling repository pipelines.
+
+Pages publishing is disabled per repository by default, including for public repositories. An
+owner must explicitly enable it in repository settings. Published Pages sites are public even when
+their source repository is private.
+
 ## Project Structure
 
 ```

e2e/repo/pages-settings.spec.ts

@@ -0,0 +1,23 @@
+import { expect, test } from "../fixtures";
+
+test.describe("repository Pages policy", () => {
+  test("requires explicit public publishing opt-in", async ({ page, snap }) => {
+    await page.goto("/alice/mega-app/settings");
+    const publishing = page.getByRole("checkbox", { name: "Publish pipeline deployments" });
+    await expect(publishing).toBeVisible();
+    await expect(publishing).not.toBeChecked();
+    await expect(
+      page.getByText("Pages sites are publicly reachable, even when this repository is private."),
+    ).toBeVisible();
+    await snap("settings-pages-opt-in");
+
+    await page.goto("/alice/mega-app/pages");
+    await expect(page.getByRole("heading", { name: "Pages publishing is disabled" })).toBeVisible();
+    await expect(
+      page.getByText(
+        "The repository owner must explicitly enable public Pages publishing in Settings.",
+      ),
+    ).toBeVisible();
+    await snap("pages-disabled");
+  });
+});

packages/db/migrations/0023_repository-pages-and-redirects.sql

@@ -0,0 +1,13 @@
+CREATE TABLE `repository_redirects` (
+	`id` text PRIMARY KEY NOT NULL,
+	`owner_id` text NOT NULL,
+	`old_name` text NOT NULL,
+	`repo_id` text NOT NULL,
+	`created_at` integer NOT NULL,
+	FOREIGN KEY (`owner_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`repo_id`) REFERENCES `repositories`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `repo_redirect_owner_name_idx` ON `repository_redirects` (`owner_id`,`old_name`);--> statement-breakpoint
+CREATE INDEX `repo_redirect_repo_idx` ON `repository_redirects` (`repo_id`);--> statement-breakpoint
+ALTER TABLE `repositories` ADD `pages_enabled` integer DEFAULT false NOT NULL;