core-framework 4.0.0__tar.gz → 4.1.0__tar.gz

core_framework-4.1.0/.agents/skills/building-pydantic-ai-agents

@@ -0,0 +1 @@
+../../.venv/lib/python3.14/site-packages/pydantic_ai/.agents/skills/building-pydantic-ai-agents

core_framework-4.1.0/.cursor/skills/building-pydantic-ai-agents

@@ -0,0 +1 @@
+../../.agents/skills/building-pydantic-ai-agents

core_framework-4.1.0/.cursor/skills/code-review/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: code-review
+description: >-
+  Review code and report a single list of items to address. Use when the user
+  asks for a code review, audit of code/implementation, or review of code
+  changes — and when they ask to elaborate, expand, or explain those findings.
+  Do not use for design / system-design / product-design doc readiness reviews
+  (use design-review).
+---
+
+# Code Review
+
+Report **one list of items to address**. Check repo rules and originating docs internally. Do **not** split the report into Standards vs Spec (or any other axis). Do **not** tag findings by source.
+
+## What to check
+
+**Repo rules.** Does the diff follow this repo’s rules and accepted decisions?
+
+Layers, conventions, scoped `.cursor/rules`, **Residue**, parallel drift, third-copy, strong reads, test names, main-feature flowchart when this change adds or alters a design doc. Use [`docs/platform/glossary.md`](docs/platform/glossary.md) terms.
+
+Do **not** flag documented accepted trade-offs in **`docs/platform/architecture-decisions.md`** unless the implementation violates them. Do **not** flag two similar copies as needing extraction (wait for the third). Do **not** import a generic smell list that fights those rules.
+
+**Originating docs.** Does the diff match the design and flow docs?
+
+- Missing or partial relative to the spec
+- Behavior the spec did not ask for
+- Implemented but wrong relative to a spec line (quote that line)
+
+**Spec sources** (first that applies): docs the user named; design/flow docs the change clearly belongs to; matching `docs/design/*-design.md` / `docs/domains/**/*-design.md` plus the paired flow doc. If none exist, skip this check — do not mention that there is no spec.
+
+## Reachability and impact
+
+Before keeping a race, edge case, or error-path finding, state who can trigger it and what it harms. Severity follows both.
+
+- **Who triggers it:** a correct client, a buggy client, or a deliberate caller (attacker).
+- **What it harms:** data corruption or lost writes; another user's data or existence (trust boundary); availability beyond what ordinary requests already allow; or only the caller's own request failing.
+
+**Drop** a finding when the only trigger is the caller's own invalid or contradictory request and the only outcome is that request failing, even with the wrong status (e.g. a deadlock that needs an illegal request to collide with a legal one, where the illegal one was already going to fail). Mention it only if the user asks for edge cases.
+
+**Keep** deliberate-caller findings that cross a trust boundary (another user's rows, enumeration, auth bypass) or give an attacker more load or disruption than ordinary requests allow. Do not drop a finding just because a correct client would not hit it.
+
+## Output format (required)
+
+**Actionable findings only**, under `## Findings`:
+
+- Bugs, wrong behavior, improvements, optimizations, doc/code contradictions, parallel implementation drift (sibling flows that diverge without documented reason), **Residue** after an implementation or refactor, spec gaps / extras / mismatches.
+- One numbered list, prioritized by severity (see **Reachability and impact**). Each item: file context, what is wrong, who can trigger it, fix direction.
+- **Do not** praise, summarize strengths, pad with checklist pass narratives, or emit empty-axis sentences.
+- One-line scope is fine. If there is nothing to address, say so in one sentence — no `## Findings` heading.
+
+## Elaborating review points (required)
+
+When the user asks to elaborate, expand, explain, or go deeper on review findings (one point, several, or all):
+
+- **Always include concrete examples** for each point — never prose-only elaboration.
+- Prefer examples from the reviewed code: cite the relevant snippet, then show a corrected or alternative version when a fix is implied.
+- If the issue is behavioral (race, ordering, missing branch), give a short before/after scenario or input sequence that triggers it.
+- Keep the example tight (a few lines); do not re-dump the whole review.
+
+## Workflow
+
+1. Pin the diff (named files, or `git diff` against the branch base / range the user gave).
+1. Identify spec sources (see **Originating docs** above).
+1. Read **`docs/platform/layers-and-boundaries.md`**, **`conventions.md`**, **`architecture-decisions.md`**, and **`glossary.md`** for the reviewed scope.
+1. Apply **scoped rules** (`.cursor/rules/*.mdc`) matching files under review — especially **`error-boundary`**, **`domain-imports`**, **`api-layer`**, **`application-layer`**, **`strong-reads`**.
+1. Check for **Residue** from this implementation or refactor (section below). Flag it with delete-now direction unless a live consumer still needs the old path.
+1. Check rules and originating docs. If the diff is large, parallel exploration is fine; **merge into one severity-ordered list** before reporting. Do not paste unmerged sub-agent reports.
+1. Report findings only — no filler.
+1. On elaborate/expand follow-ups, re-read this skill and apply **Elaborating review points**.
+
+## Quick checks
+
+- Application services: no HTTP types, no domain exceptions, no Pydantic return types, one-line docstrings.
+- API: thin routers, validation in schemas, orchestration in application — **fastapi** skill (`.agents/skills/fastapi/`) + **`api-layer`** / **`api-validation`** / **`error-boundary`** rules.
+- Domain: imports only via **`__init__.py`** / **`dependencies`** from outer layers; no caller-context names (**`domain-caller-context`**).
+- Read-after-write refetches use **`*_strong`** where applicable.
+- **Python modernity (constitution):** prefer current 3.14 syntax in reviewed code — PEP 695 type params over module-level `TypeVar`/`ParamSpec`; no unnecessary `from __future__ import annotations`; builtins / `X | Y` over legacy `typing` aliases; `asyncio.TaskGroup` over `gather`.
+- **Wait for the third copy before you extract** (`docs/platform/conventions.md`): flag a new private helper with one or two call sites unless it is ~15+ lines / non-obvious branching, or a scoped rule requires sharing (`strong-reads`). Do **not** flag two similar inlined copies as needing extraction.
+- **Test name should tell me what broke:** flag tests whose names only name the unit under test or a generic outcome (`test_create_post`, `test_success`, `test_happy_path`). The pytest failure line must state the invariant (e.g. `test_public_feed_excludes_others_followers_only_post`).
+- **Main-feature design flowchart:** if this change introduces a new `*-design.md` (or changes that design’s control flow) and there is no mermaid **`flowchart`** of the main control flow, flag it. Do **not** flag older design docs that never had a chart.
+
+## Residue
+
+Leftover seams after the new path shipped. Flag them; they are not “later retirement” unless a live producer or in-flight consumer still needs the old path. On greenfield (no hosts, no traffic), treat as **safe to delete now**.
+
+Look for:
+
+- Dead registration — worker tasks, enums, schedules, or “keep registered for drain” docs with no remaining producer.
+- Compatibility branches the new producers never write (old payload versions, dual handlers, mirrors-only v1).
+- Incomplete moves — logic still in the old module, a shared helper unused while call sites inline the same shape, types left as `Any` after a typed model exists.
+- Docs / OpenAPI still describing the pre-change stored shape, cutover drain, or a history/status value that is never written.
+- Naming leftovers after a rename (old helper name used for a different role).
+
+## Parallel drift
+
+Flag sibling modules with the same job but different structure (async layout, cleanup order, error/idempotency contracts) when docs do not explain the difference. Do **not** flag differences called out as intentional in design/flow docs or in **`docs/reviews/slices.md`** B7 **Do not flag** (for example root vs reply create-idempotency replay placement in **`docs/design/create-idempotency-design.md`**).

core_framework-4.1.0/.github/workflows/_deploy.yml

@@ -0,0 +1,252 @@
+name: Reusable Deployment
+
+on:
+  workflow_call:
+    inputs:
+      env_name:
+        type: string
+        required: true
+      dockerhub_username:
+        type: string
+        required: true
+      worker_replicas:
+        type: number
+        required: false
+        default: 1
+    secrets:
+      SECRET_KEY:
+        required: true
+      WRITE_POSTGRES_PASSWORD:
+        required: true
+      READ_POSTGRES_PASSWORD:
+        required: false
+      EMAIL_API_KEY:
+        required: false
+      AGENT_OPENAI_API_KEY:
+        required: false
+      FIREBASE_CONFIG:
+        required: true
+      IMAGE_SERVER_SSH_PRIVATE_KEY:
+        required: true
+      IMAGE_SERVER_KNOWN_HOSTS:
+        required: true
+      DEPLOY_SERVER_SSH_KEY:
+        required: true
+      DOCKERHUB_TOKEN:
+        required: true
+
+permissions: {}
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.env_name }}
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Render config.toml from template
+        env:
+          ENVIRONMENT: ${{ inputs.env_name }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+          PUBLIC_ZONE: ${{ vars.PUBLIC_ZONE }}
+          MEDIA_HOST_DOMAIN: ${{ vars.MEDIA_HOST_DOMAIN }}
+          MEDIA_PUBLISH_PARENT: ${{ vars.MEDIA_PUBLISH_PARENT }}
+          WRITE_POSTGRES_HOST: ${{ vars.WRITE_POSTGRES_HOST || '127.0.0.1' }}
+          WRITE_POSTGRES_PORT: ${{ vars.WRITE_POSTGRES_PORT || '5432' }}
+          WRITE_POSTGRES_USER: ${{ vars.WRITE_POSTGRES_USER }}
+          WRITE_POSTGRES_PASSWORD: ${{ secrets.WRITE_POSTGRES_PASSWORD }}
+          WRITE_POSTGRES_DB: ${{ vars.WRITE_POSTGRES_DB || 'postgres' }}
+          READ_POSTGRES_HOST: ${{ vars.READ_POSTGRES_HOST }}
+          READ_POSTGRES_PORT: ${{ vars.READ_POSTGRES_PORT || vars.WRITE_POSTGRES_PORT || '5432' }}
+          READ_POSTGRES_USER: ${{ vars.READ_POSTGRES_USER }}
+          READ_POSTGRES_PASSWORD: ${{ secrets.READ_POSTGRES_PASSWORD }}
+          READ_POSTGRES_DB: ${{ vars.READ_POSTGRES_DB }}
+          REDIS_HOST: ${{ vars.REDIS_HOST || '127.0.0.1' }}
+          REDIS_PORT: ${{ vars.REDIS_PORT || '6379' }}
+          REDIS_CACHE_DB: ${{ vars.REDIS_CACHE_DB || '0' }}
+          REDIS_QUEUE_DB: ${{ vars.REDIS_QUEUE_DB || '1' }}
+          ALLOWED_HOSTS: ${{ vars.ALLOWED_HOSTS || '[]' }}
+          APP_TITLE: ${{ vars.APP_TITLE }}
+          APP_DEBUG: ${{ vars.APP_DEBUG || 'false' }}
+          OPENAPI_URL: ${{ vars.OPENAPI_URL }}
+          AVATAR_HOST_DOMAIN: ${{ vars.AVATAR_HOST_DOMAIN }}
+          AVATAR_DEFAULT_IMAGE: ${{ vars.AVATAR_DEFAULT_IMAGE || 'default.webp' }}
+          AVATAR_PUBLISH_ROOT: ${{ vars.AVATAR_PUBLISH_ROOT }}
+          BANNER_HOST_DOMAIN: ${{ vars.BANNER_HOST_DOMAIN }}
+          BANNER_DEFAULT_IMAGE: ${{ vars.BANNER_DEFAULT_IMAGE || 'default.webp' }}
+          BANNER_PUBLISH_ROOT: ${{ vars.BANNER_PUBLISH_ROOT }}
+          ATTACHMENT_HOST_DOMAIN: ${{ vars.ATTACHMENT_HOST_DOMAIN }}
+          ATTACHMENT_DEFAULT_IMAGE: ${{ vars.ATTACHMENT_DEFAULT_IMAGE || 'default.webp' }}
+          ATTACHMENT_PUBLISH_ROOT: ${{ vars.ATTACHMENT_PUBLISH_ROOT }}
+          IMAGE_SERVER_HOST: ${{ vars.IMAGE_SERVER_HOST }}
+          IMAGE_SERVER_PORT: ${{ vars.IMAGE_SERVER_PORT || '22' }}
+          IMAGE_SERVER_USER: ${{ vars.IMAGE_SERVER_USER || 'root' }}
+          OBSERVABILITY_ENABLED: ${{ vars.OBSERVABILITY_ENABLED || 'false' }}
+          OBSERVABILITY_OTLP_ENDPOINT: ${{ vars.OBSERVABILITY_OTLP_ENDPOINT }}
+          PROFILING_KEY: ${{ vars.PROFILING_KEY }}
+          PROFILING_ENABLED: ${{ vars.PROFILING_ENABLED || 'false' }}
+          LOG_LEVEL: ${{ vars.LOG_LEVEL || 'info' }}
+          CORS_ALLOWED_ORIGINS: ${{ vars.CORS_ALLOWED_ORIGINS || '[]' }}
+          RETENTION_POST_VIEWS_DAYS: ${{ vars.RETENTION_POST_VIEWS_DAYS || '90' }}
+          RETENTION_READ_NOTIFICATIONS_DAYS: ${{ vars.RETENTION_READ_NOTIFICATIONS_DAYS || '7' }}
+          ANALYTICS_REFRESH_INTERVAL_SECONDS: ${{ vars.ANALYTICS_REFRESH_INTERVAL_SECONDS || '300' }}
+          EMAIL_ENABLED: ${{ vars.EMAIL_ENABLED || 'false' }}
+          EMAIL_PROVIDER: ${{ vars.EMAIL_PROVIDER || 'resend' }}
+          EMAIL_API_KEY: ${{ secrets.EMAIL_API_KEY }}
+          EMAIL_FROM_ADDRESS: ${{ vars.EMAIL_FROM_ADDRESS }}
+          EMAIL_FROM_NAME: ${{ vars.EMAIL_FROM_NAME }}
+          AGENT_ENABLED: ${{ vars.AGENT_ENABLED || 'false' }}
+          AGENT_MODEL: ${{ vars.AGENT_MODEL }}
+          AGENT_OPENAI_API_KEY: ${{ secrets.AGENT_OPENAI_API_KEY }}
+          AGENT_OPENAI_BASE_URL: ${{ vars.AGENT_OPENAI_BASE_URL }}
+          AGENT_TIMEOUT_SECONDS: ${{ vars.AGENT_TIMEOUT_SECONDS || '120' }}
+        run: |
+          set -euo pipefail
+
+          echo "Rendering config..."
+          envsubst < config.toml.template > config.toml
+          test -s config.toml
+          python3 - <<'PY'
+          import sys
+          import tomllib
+
+          try:
+              with open("config.toml", "rb") as f:
+                  tomllib.load(f)
+          except Exception as e:
+              print("ERROR: config.toml is invalid TOML", file=sys.stderr)
+              print(e, file=sys.stderr)
+              sys.exit(1)
+          PY
+
+      - name: Generate firebase_config.json from secret
+        env:
+          FIREBASE_CONFIG: ${{ secrets.FIREBASE_CONFIG }}
+        run: |
+          set -euo pipefail
+
+          echo "Generating firebase_config.json..."
+          echo "$FIREBASE_CONFIG" > firebase_config.json
+          test -s firebase_config.json
+          python3 - <<'PY'
+          import sys
+          import json
+
+          try:
+              with open("firebase_config.json", "r") as f:
+                  json.load(f)
+          except Exception as e:
+              print("ERROR: firebase_config.json is invalid JSON", file=sys.stderr)
+              print(e, file=sys.stderr)
+              sys.exit(1)
+          PY
+
+      - name: Generate image_server_ssh_key from secret
+        env:
+          IMAGE_SERVER_SSH_PRIVATE_KEY: ${{ secrets.IMAGE_SERVER_SSH_PRIVATE_KEY }}
+        run: |
+          set -euo pipefail
+
+          echo "Generating image_server_ssh_key..."
+          printf '%s\n' "$IMAGE_SERVER_SSH_PRIVATE_KEY" > image_server_ssh_key
+          test -s image_server_ssh_key
+          chmod 600 image_server_ssh_key
+
+      - name: Generate image_server_known_hosts from secret
+        env:
+          IMAGE_SERVER_KNOWN_HOSTS: ${{ secrets.IMAGE_SERVER_KNOWN_HOSTS }}
+        run: |
+          set -euo pipefail
+
+          echo "Generating image_server_known_hosts..."
+          printf '%s\n' "$IMAGE_SERVER_KNOWN_HOSTS" > image_server_known_hosts
+          test -s image_server_known_hosts
+          chmod 644 image_server_known_hosts
+
+      - name: Stage docker-compose.yml for upload
+        run: cp deploy/app/docker-compose.yml ./docker-compose.yml
+
+      - name: Upload rendered config.toml, firebase_config.json and docker-compose.yml
+        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
+        with:
+          host: ${{ vars.DEPLOY_SERVER_HOST }}
+          username: ${{ vars.DEPLOY_SERVER_USER }}
+          key: ${{ secrets.DEPLOY_SERVER_SSH_KEY }}
+          port: ${{ vars.DEPLOY_SERVER_PORT || 22 }}
+          source: "config.toml,firebase_config.json,docker-compose.yml,image_server_ssh_key,image_server_known_hosts"
+          target: "/home/${{ vars.DEPLOY_SERVER_USER }}/app_configs/core-framework"
+
+      - name: Deploy to Server via SSH
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        env:
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+          DOCKERHUB_USERNAME: ${{ inputs.dockerhub_username }}
+          DEPLOY_SERVER_USER: ${{ vars.DEPLOY_SERVER_USER }}
+          WORKER_REPLICAS: ${{ inputs.worker_replicas }}
+        with:
+          host: ${{ vars.DEPLOY_SERVER_HOST }}
+          username: ${{ vars.DEPLOY_SERVER_USER }}
+          key: ${{ secrets.DEPLOY_SERVER_SSH_KEY }}
+          port: ${{ vars.DEPLOY_SERVER_PORT || 22 }}
+          envs: DOCKERHUB_TOKEN,DOCKERHUB_USERNAME,DEPLOY_SERVER_USER,WORKER_REPLICAS
+          script: |
+            set -euo pipefail
+
+            echo "Logging in to Docker Hub"
+            printf '%s' "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+
+            COMPOSE_FILE="/home/$DEPLOY_SERVER_USER/app_configs/core-framework/docker-compose.yml"
+            CONFIG_PATH="/home/$DEPLOY_SERVER_USER/app_configs/core-framework/config.toml"
+            FIREBASE_CONFIG_PATH="/home/$DEPLOY_SERVER_USER/app_configs/core-framework/firebase_config.json"
+            MEDIA_STAGING_PATH="/home/$DEPLOY_SERVER_USER/app_configs/core-framework/media-staging"
+            IMAGE_SERVER_SSH_KEY_PATH="/home/$DEPLOY_SERVER_USER/app_configs/core-framework/image_server_ssh_key"
+            IMAGE_SERVER_KNOWN_HOSTS_PATH="/home/$DEPLOY_SERVER_USER/app_configs/core-framework/image_server_known_hosts"
+
+            echo "Pulling latest image"
+            DOCKERHUB_USERNAME="$DOCKERHUB_USERNAME" \
+            CONFIG_PATH="$CONFIG_PATH" \
+            FIREBASE_CONFIG_PATH="$FIREBASE_CONFIG_PATH" \
+            MEDIA_STAGING_PATH="$MEDIA_STAGING_PATH" \
+            IMAGE_SERVER_SSH_KEY_PATH="$IMAGE_SERVER_SSH_KEY_PATH" \
+            IMAGE_SERVER_KNOWN_HOSTS_PATH="$IMAGE_SERVER_KNOWN_HOSTS_PATH" \
+            docker compose -f "$COMPOSE_FILE" pull
+
+            echo "Preparing media staging directory and image server SSH key permissions"
+            mkdir -p "$MEDIA_STAGING_PATH"
+            docker run --rm \
+              --user root \
+              -v "$MEDIA_STAGING_PATH:/app/media-staging" \
+              -v "$IMAGE_SERVER_SSH_KEY_PATH:/app/image-server-ssh-key" \
+              -v "$IMAGE_SERVER_KNOWN_HOSTS_PATH:/app/image-server-known-hosts" \
+              --entrypoint "" \
+              "$DOCKERHUB_USERNAME/core-framework:latest" \
+              sh -c 'mkdir -p /app/media-staging && chown -R appuser:appgroup /app/media-staging && chown appuser:appgroup /app/image-server-ssh-key && chmod 600 /app/image-server-ssh-key && chown appuser:appgroup /app/image-server-known-hosts && chmod 644 /app/image-server-known-hosts'
+
+            echo "Running database migrations (cf-alembic iterates core_framework.bundled_alembic.ALEMBIC_DOMAINS in order)"
+            docker run --rm \
+              --network host \
+              -v "$CONFIG_PATH:/app/config.toml:ro" \
+              "$DOCKERHUB_USERNAME/core-framework:latest" \
+              cf-alembic
+
+            echo "Starting services with Docker Compose"
+            DOCKERHUB_USERNAME="$DOCKERHUB_USERNAME" \
+            CONFIG_PATH="$CONFIG_PATH" \
+            FIREBASE_CONFIG_PATH="$FIREBASE_CONFIG_PATH" \
+            MEDIA_STAGING_PATH="$MEDIA_STAGING_PATH" \
+            IMAGE_SERVER_SSH_KEY_PATH="$IMAGE_SERVER_SSH_KEY_PATH" \
+            IMAGE_SERVER_KNOWN_HOSTS_PATH="$IMAGE_SERVER_KNOWN_HOSTS_PATH" \
+            docker compose -f "$COMPOSE_FILE" up -d \
+              --remove-orphans \
+              --force-recreate \
+              --scale worker="$WORKER_REPLICAS"
+
+            echo "Cleaning up dangling Docker images"
+            docker image prune -f
+
+            echo "Deployment complete"

core_framework-4.1.0/.github/workflows/dev-ci-cd.yaml

@@ -0,0 +1,179 @@
+name: Development CI/CD
+
+on:
+  push:
+    branches:
+      - master
+
+concurrency:
+  group: core-framework-development
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  package-smoke:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          version: "0.7.9"
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Build wheel and verify install
+        run: |
+          set -euo pipefail
+          rm -rf dist
+          uv build
+          python -m venv /tmp/wheel-smoke
+          /tmp/wheel-smoke/bin/pip install --upgrade pip
+          bash .github/ci/package-smoke.sh /tmp/wheel-smoke/bin/python "$(echo dist/*.whl)"
+
+  app-docker:
+    needs: [package-smoke]
+    runs-on: ubuntu-latest
+    environment: development
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Docker Meta
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ${{ vars.DOCKERHUB_USERNAME }}/core-framework
+          flavor: latest=true
+
+      - name: Login to DockerHub
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build and Push
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./deploy/app/dockerfile
+          target: api
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+
+  worker-docker:
+    needs: [package-smoke]
+    runs-on: ubuntu-latest
+    environment: development
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Docker Meta
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ${{ vars.DOCKERHUB_USERNAME }}/core-framework-worker
+          flavor: latest=true
+
+      - name: Login to DockerHub
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build and Push
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./deploy/app/dockerfile
+          target: worker
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+
+  deploy:
+    needs: [app-docker, worker-docker]
+    permissions:
+      contents: read
+    uses: $/.github/workflows/_deploy.yml
+    with:
+      env_name: development
+      dockerhub_username: ${{ vars.DOCKERHUB_USERNAME }}
+    secrets:
+      SECRET_KEY: ${{ secrets.SECRET_KEY }}
+      WRITE_POSTGRES_PASSWORD: ${{ secrets.WRITE_POSTGRES_PASSWORD }}
+      READ_POSTGRES_PASSWORD: ${{ secrets.READ_POSTGRES_PASSWORD }}
+      EMAIL_API_KEY: ${{ secrets.EMAIL_API_KEY }}
+      AGENT_OPENAI_API_KEY: ${{ secrets.AGENT_OPENAI_API_KEY }}
+      FIREBASE_CONFIG: ${{ secrets.FIREBASE_CONFIG }}
+      IMAGE_SERVER_SSH_PRIVATE_KEY: ${{ secrets.IMAGE_SERVER_SSH_PRIVATE_KEY }}
+      IMAGE_SERVER_KNOWN_HOSTS: ${{ secrets.IMAGE_SERVER_KNOWN_HOSTS }}
+      DEPLOY_SERVER_SSH_KEY: ${{ secrets.DEPLOY_SERVER_SSH_KEY }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+
+  post-deploy-e2e:
+    needs: [deploy]
+    runs-on: ubuntu-latest
+    environment: development
+    continue-on-error: true
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          version: "0.7.9"
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Install the project
+        run: uv sync --locked --all-extras --dev
+
+      - name: Post-deploy E2E
+        run: uv run pytest tests/e2e
+        env:
+          E2E_API_BASE_URL: ${{ vars.E2E_API_BASE_URL || (vars.PUBLIC_ZONE && format('https://api.{0}', vars.PUBLIC_ZONE) || '') }}
+          E2E_FIREBASE_API_KEY: ${{ secrets.E2E_FIREBASE_API_KEY }}
+          E2E_USER_EMAIL: ${{ vars.E2E_USER_EMAIL }}
+          E2E_USER_PASSWORD: ${{ secrets.E2E_USER_PASSWORD }}
+          E2E_ADMIN_EMAIL: ${{ vars.E2E_ADMIN_EMAIL }}
+          E2E_ADMIN_PASSWORD: ${{ secrets.E2E_ADMIN_PASSWORD }}
+          E2E_MEDIA_BASE_URL: ${{ vars.E2E_MEDIA_BASE_URL || (vars.PUBLIC_ZONE && format('https://media.{0}', vars.PUBLIC_ZONE) || '') }}
+          E2E_ALLOWED_ORIGIN: ${{ vars.E2E_ALLOWED_ORIGIN || (vars.PUBLIC_ZONE && format('https://{0}', vars.PUBLIC_ZONE) || '') }}
+          E2E_WORKER_POLL_TIMEOUT_SEC: ${{ vars.E2E_WORKER_POLL_TIMEOUT_SEC }}

core_framework-4.1.0/.github/workflows/manual-deployment.yaml

@@ -0,0 +1,54 @@
+name: Manual Deployment
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: "Target environment (development or production)"
+        required: true
+        type: choice
+        options:
+          - development
+          - production
+      confirm:
+        description: "Type the environment name to confirm (development or production)"
+        required: true
+
+permissions: {}
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Validate confirmation
+        env:
+          CONFIRM: ${{ inputs.confirm }}
+          ENVIRONMENT: ${{ inputs.environment }}
+        run: |
+          if [ "$CONFIRM" != "$ENVIRONMENT" ]; then
+            echo "Deployment cancelled: confirmation mismatch."
+            echo "Expected: '$ENVIRONMENT', got: '$CONFIRM'"
+            exit 1
+          fi
+
+  deploy:
+    needs: validate
+    permissions:
+      contents: read
+    uses: $/.github/workflows/_deploy.yml
+    with:
+      env_name: ${{ inputs.environment }}
+      dockerhub_username: ${{ vars.DOCKERHUB_USERNAME }}
+      worker_replicas: "${{ inputs.environment == 'production' && 2 || 1 }}"
+    secrets:
+      SECRET_KEY: ${{ secrets.SECRET_KEY }}
+      WRITE_POSTGRES_PASSWORD: ${{ secrets.WRITE_POSTGRES_PASSWORD }}
+      READ_POSTGRES_PASSWORD: ${{ secrets.READ_POSTGRES_PASSWORD }}
+      EMAIL_API_KEY: ${{ secrets.EMAIL_API_KEY }}
+      AGENT_OPENAI_API_KEY: ${{ secrets.AGENT_OPENAI_API_KEY }}
+      FIREBASE_CONFIG: ${{ secrets.FIREBASE_CONFIG }}
+      IMAGE_SERVER_SSH_PRIVATE_KEY: ${{ secrets.IMAGE_SERVER_SSH_PRIVATE_KEY }}
+      IMAGE_SERVER_KNOWN_HOSTS: ${{ secrets.IMAGE_SERVER_KNOWN_HOSTS }}
+      DEPLOY_SERVER_SSH_KEY: ${{ secrets.DEPLOY_SERVER_SSH_KEY }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}