Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
147 commits
Select commit Hold shift + click to select a range
b43c227
chore: remove unused files and stale docs
GraysonCAdams Feb 28, 2026
bdc9cfb
docs: add DISCLAIMER.md and NOTICE for third-party attributions
GraysonCAdams Feb 28, 2026
fee8fa1
docs: add legal disclaimer, self-hosting responsibilities, and yt-dlp…
GraysonCAdams Feb 28, 2026
7bfea6c
feat: bundle legal pages in static directory for self-hosted instances
GraysonCAdams Feb 28, 2026
418a57e
refactor: use app-relative URLs for legal pages, fix pre-existing lin…
GraysonCAdams Feb 28, 2026
b580c78
chore: add license field, non-root Docker user, and .env.example secu…
GraysonCAdams Feb 28, 2026
e6de2f0
feat: add semgrep static analysis to security workflow
GraysonCAdams Feb 28, 2026
d6f53eb
feat: add eslint-plugin-security for node.js security linting
GraysonCAdams Feb 28, 2026
b4d19af
fix: stop masking unhandled security header findings in ZAP rules
GraysonCAdams Feb 28, 2026
335dae9
feat: add security response headers (CSP, X-Frame-Options, etc.)
GraysonCAdams Feb 28, 2026
78b4a7b
feat: thread avatarPath through clips API and add avatar to reel overlay
GraysonCAdams Feb 28, 2026
29ae4e1
feat: add circular icon backgrounds to action sidebar and avatar to o…
GraysonCAdams Feb 28, 2026
2368c1d
docs: update design guidelines with new overlay and sidebar patterns
GraysonCAdams Feb 28, 2026
d1db1e7
feat: auto-merge dependabot patch and minor updates after CI passes
GraysonCAdams Feb 28, 2026
c9959c7
refactor: extract shared clip types to src/lib/types.ts
GraysonCAdams Feb 28, 2026
0ad938d
refactor: split feed page into smaller modules
GraysonCAdams Feb 28, 2026
c12e021
refactor: streamline CLAUDE.md with @imports and lean structure
GraysonCAdams Feb 28, 2026
265abfe
feat: add .claude/rules/ for path-specific Claude instructions
GraysonCAdams Feb 28, 2026
c0c5a5c
feat: add permissions and schema to .claude/settings.json
GraysonCAdams Feb 28, 2026
a7c936c
feat: add .claudeignore to reduce token consumption
GraysonCAdams Feb 28, 2026
d7809ac
feat: add project-level /commit command with expanded rules
GraysonCAdams Feb 28, 2026
ae69275
refactor: extract ReelItem interactions, playback, and indicators
GraysonCAdams Feb 28, 2026
0ce2dd1
docs: update all documentation to reflect current codebase
GraysonCAdams Feb 28, 2026
b08b372
refactor: extract UploadStatus from AddVideoModal
GraysonCAdams Feb 28, 2026
d21f328
refactor: split ClipsManager into smaller modules
GraysonCAdams Feb 28, 2026
d0a1afe
chore: remove terms of service and privacy policy pages
GraysonCAdams Feb 28, 2026
adb9f46
chore: remove legal page links from SMS consent text
GraysonCAdams Feb 28, 2026
3a15837
refactor: extract settings API, notifications, and accent picker from…
GraysonCAdams Feb 28, 2026
d5c9d69
refactor: extract CommentsSheet logic and input component
GraysonCAdams Feb 28, 2026
11c908d
chore: enforce max-lines as error and tighten CI budget
GraysonCAdams Feb 28, 2026
75d8e82
chore: migrate repo ownership from GraysonCAdams to 312-dev org
GraysonCAdams Feb 28, 2026
9b8322f
chore: remove personal name from CODEOWNERS and API docs
GraysonCAdams Feb 28, 2026
0c77ead
chore: add configurable legal page URLs for self-hosted operators
GraysonCAdams Feb 28, 2026
6dd70b2
feat: conditionally show legal links in SMS consent based on operator…
GraysonCAdams Feb 28, 2026
810d47f
feat: add vitest test infrastructure and initial test suite
GraysonCAdams Feb 28, 2026
a5a120b
chore: add Claude security rules and type-check reminder
GraysonCAdams Feb 28, 2026
48d5f22
feat: add VitePress docs site with GitHub Pages deployment
GraysonCAdams Feb 28, 2026
bb897ac
chore: update eslint config for test rules and vitepress ignore
GraysonCAdams Feb 28, 2026
1718799
fix: exclude test files from svelte-check and fix service worker type…
GraysonCAdams Feb 28, 2026
772bf42
refactor: consolidate platform definitions with expanded platform sup…
GraysonCAdams Feb 28, 2026
5cee99b
feat: add max duration setting for groups
GraysonCAdams Feb 28, 2026
dc09e32
feat: enforce max duration limit during video download
GraysonCAdams Feb 28, 2026
6d46d4f
fix: improve accessibility across reel components
GraysonCAdams Feb 28, 2026
43279d5
fix: use browser check in stores and skip SW listener in dev
GraysonCAdams Feb 28, 2026
8964d6b
refactor: switch platform icons to simple-icons library
GraysonCAdams Feb 28, 2026
019ba41
feat: extend URL tracking parameter stripping
GraysonCAdams Feb 28, 2026
c73c8e8
test: update tests for expanded platform support
GraysonCAdams Feb 28, 2026
ab6d914
feat: enforce max duration limit during music and video downloads
GraysonCAdams Feb 28, 2026
af65d96
feat: add max duration picker to group settings
GraysonCAdams Feb 28, 2026
a3a3a66
refactor: extract clip feed helpers and update platform labels
GraysonCAdams Feb 28, 2026
d144f09
chore: update Claude settings with enabled plugins
GraysonCAdams Feb 28, 2026
9874231
feat: add Phase 1 animations — reduced motion guard, badge pops, hear…
GraysonCAdams Feb 28, 2026
88374bb
style: add micro-interaction animations
GraysonCAdams Feb 28, 2026
84c11d3
feat: add Phase 2+3 animations — sliding indicators, crossfades, stag…
GraysonCAdams Feb 28, 2026
4d67d2e
refactor: add download provider types, registry, and schema column
GraysonCAdams Feb 28, 2026
f05c001
feat: add binary management utilities for download providers
GraysonCAdams Feb 28, 2026
166b31b
feat: implement YtDlpProvider class and registry resolution
GraysonCAdams Feb 28, 2026
11fa141
refactor: wire download orchestrators to use provider interface
GraysonCAdams Feb 28, 2026
afd792a
feat: add provider management API and guard clip submission
GraysonCAdams Feb 28, 2026
b8ddbd8
feat: add download provider manager to settings UI
GraysonCAdams Feb 28, 2026
11304b7
feat: add no-provider empty state and remove yt-dlp from Docker image
GraysonCAdams Feb 28, 2026
258da00
test: add provider registry mock and no-provider test case
GraysonCAdams Feb 28, 2026
28ee164
docs: abstract download services from project documentation
GraysonCAdams Feb 28, 2026
c97bcbc
docs: strengthen consent and responsibility language for download pro…
GraysonCAdams Feb 28, 2026
5ec78c8
feat: add platform filter schema and shared validation
GraysonCAdams Feb 28, 2026
b383225
feat: add platform filter API endpoint and server-side enforcement
GraysonCAdams Feb 28, 2026
136cb46
feat: add platform filter settings UI
GraysonCAdams Feb 28, 2026
4ef89f8
feat: add client-side platform filter feedback
GraysonCAdams Feb 28, 2026
35feb9d
feat: add gif_url column to comments schema
GraysonCAdams Feb 28, 2026
b3f9663
feat: add GIF support to comments API
GraysonCAdams Feb 28, 2026
b7da00b
feat: add GIF picker UI to comments
GraysonCAdams Feb 28, 2026
45d1209
test: add GIF comment tests
GraysonCAdams Feb 28, 2026
2553498
feat: add max_file_size_mb column to groups schema
GraysonCAdams Feb 28, 2026
750d3d4
refactor: switch download options from duration to file size limit
GraysonCAdams Feb 28, 2026
6b0b738
refactor: enforce file size limit instead of duration in downloads
GraysonCAdams Feb 28, 2026
9b018d5
feat: add max file size API endpoint
GraysonCAdams Feb 28, 2026
522df1b
feat: add MaxFileSizePicker slider component
GraysonCAdams Feb 28, 2026
13004a8
feat: replace duration picker with file size slider in settings
GraysonCAdams Feb 28, 2026
c5179d8
chore: remove old MaxDurationPicker component
GraysonCAdams Feb 28, 2026
7eaf062
feat: add structured logging with pino
GraysonCAdams Feb 28, 2026
583fa12
refactor: replace console calls with structured logger
GraysonCAdams Feb 28, 2026
5e36c98
feat: add rate limiting and request logging
GraysonCAdams Feb 28, 2026
c96dd4b
feat: add automated SQLite backup strategy
GraysonCAdams Feb 28, 2026
f18e593
feat: add Caddy reverse proxy with auto-HTTPS
GraysonCAdams Feb 28, 2026
b5c0a29
docs: add code of conduct and update issue template labels
GraysonCAdams Feb 28, 2026
6201c85
refactor: add auth wrappers, query helpers, and notification utility …
GraysonCAdams Mar 1, 2026
b8f85ad
refactor: migrate all API routes to withAuth/withClipAuth/withHost wr…
GraysonCAdams Mar 1, 2026
ff46e2d
style: replace hardcoded overlay colors with CSS custom properties
GraysonCAdams Mar 1, 2026
6f13d89
fix: improve dialog accessibility and PWA install error handling
GraysonCAdams Mar 1, 2026
1dd3eaf
chore: add error pages, download provider docs, and app config updates
GraysonCAdams Mar 1, 2026
97d97ff
feat: add shortcut token fields and remove max duration from schema
GraysonCAdams Mar 1, 2026
4a57f32
feat: add server utilities for constants, download helpers, and phone…
GraysonCAdams Mar 1, 2026
cca04c0
fix: improve API safety with stream cancellation, transaction wrappin…
GraysonCAdams Mar 1, 2026
b630f74
feat: replace activity page with bottom sheet overlay
GraysonCAdams Mar 1, 2026
77f7f0b
feat: add horizontal swipe filtering, UI auto-hide, and feed improvem…
GraysonCAdams Mar 1, 2026
d6b21dc
refactor: improve reel components with unified playback, save button,…
GraysonCAdams Mar 1, 2026
5255a09
refactor: improve comments sheet, reaction picker, and viewer interac…
GraysonCAdams Mar 1, 2026
7476362
refactor: update settings page and components with improved UX
GraysonCAdams Mar 1, 2026
7dcff3e
feat: add share shortcut setup wizard and manager component
GraysonCAdams Mar 1, 2026
e12f244
style: replace hardcoded colors and border-radius with CSS custom pro…
GraysonCAdams Mar 1, 2026
6737437
refactor: improve progress bar with thumb indicator, auto-hide, and r…
GraysonCAdams Mar 1, 2026
37d3e76
refactor: simplify add video flow with streamlined modal
GraysonCAdams Mar 1, 2026
d496b8f
refactor: improve filter bar with swipe gesture support
GraysonCAdams Mar 1, 2026
45cf641
feat: add avatar crop modal for profile picture uploads
GraysonCAdams Mar 1, 2026
8ecf94a
fix: resolve type error in activity sheet navigation links
GraysonCAdams Mar 1, 2026
0601ed3
refactor: extract ReelOverlayActions from ReelOverlay
GraysonCAdams Mar 1, 2026
cdaaf5b
refactor: extract MusicDisc and SpeedPill from ReelItem
GraysonCAdams Mar 1, 2026
8d2070e
refactor: extract SetupStepCard and SetupDoneState from share setup page
GraysonCAdams Mar 1, 2026
fccbc88
fix: resolve lint issues in CommentsSheet and avatar endpoint
GraysonCAdams Mar 1, 2026
f8b20ee
fix: use eslint-disable-next-line for non-literal fs filename
GraysonCAdams Mar 1, 2026
88fa5ec
fix: skip husky during production npm ci in Docker build
GraysonCAdams Mar 1, 2026
af0f121
fix: replace paid gitleaks-action with open-source CLI
GraysonCAdams Mar 1, 2026
cd262d8
fix: use HUSKY=0 in Docker build and pin Trivy action version
GraysonCAdams Mar 1, 2026
6019782
fix: delete prepare script before production install in Docker
GraysonCAdams Mar 1, 2026
c8bec19
fix: replace broken trivy-action with direct CLI install
GraysonCAdams Mar 1, 2026
9bcf06c
fix: install Trivy via apt repo instead of GitHub API
GraysonCAdams Mar 1, 2026
be121e4
chore: upgrade from Node.js 20 to Node.js 24 LTS
GraysonCAdams Mar 1, 2026
d6f0a2c
chore: upgrade dependencies and align docs workflow to Node 24
GraysonCAdams Mar 1, 2026
fa93b8b
refactor: fix 14 infrastructure and pipeline anti-patterns
GraysonCAdams Mar 1, 2026
bdbce6f
fix: add Node engine constraint, .nvmrc, and Caddy security headers
GraysonCAdams Mar 1, 2026
5082fbc
chore: add commitlint with conventional commit enforcement
GraysonCAdams Mar 1, 2026
caaad57
ci: add release-please for automated versioning and changelog
GraysonCAdams Mar 1, 2026
909b6f5
ci: chain docker publish from release-please releases
GraysonCAdams Mar 1, 2026
31b8ae6
chore: add github release note categories
GraysonCAdams Mar 1, 2026
0e16602
fix: back up database before running migrations
GraysonCAdams Mar 1, 2026
84c53d4
docs: add upgrade and rollback procedures for docker
GraysonCAdams Mar 1, 2026
65f2721
feat: add iOS Safari install banner with persistent dismissal
GraysonCAdams Mar 1, 2026
e527a42
docs: add mermaid diagrams to public docs
GraysonCAdams Mar 1, 2026
1f6b4e3
docs: update internal docs with API additions and Node 24 references
GraysonCAdams Mar 1, 2026
5dc8f30
feat: add phosphor-svelte and create shared reaction icons mapping
GraysonCAdams Mar 1, 2026
313e884
refactor: replace inline SVGs with phosphor-svelte icons (phase 2)
GraysonCAdams Mar 1, 2026
f554a88
refactor: replace inline SVGs with phosphor icons in error/status pag…
GraysonCAdams Mar 1, 2026
a61edf6
refactor: replace inline SVGs with phosphor icons in core interaction…
GraysonCAdams Mar 1, 2026
e90317e
refactor: replace inline SVGs with phosphor icons in action sidebar a…
GraysonCAdams Mar 1, 2026
6351788
refactor: replace inline SVGs with phosphor icons in layout navigatio…
GraysonCAdams Mar 1, 2026
a1d1f41
refactor: replace inline SVGs with phosphor icons in feed page (phase 7)
GraysonCAdams Mar 1, 2026
3aead9d
refactor: replace remaining inline SVGs and add Streamable verificati…
GraysonCAdams Mar 1, 2026
3348d22
fix: add fetch-depth for commitlint in CI
GraysonCAdams Mar 1, 2026
39ecc4d
fix: resolve husky not found in Docker production build
GraysonCAdams Mar 1, 2026
0f7b537
fix: replace gitleaks-action with open-source CLI
GraysonCAdams Mar 1, 2026
08c4567
feat: auto-create group on first run and assign first user as host
GraysonCAdams Mar 1, 2026
9f8ded7
style: remove extra padding from first/last setting rows
GraysonCAdams Mar 1, 2026
e592371
fix: correct broken icon path and update README
GraysonCAdams Mar 1, 2026
adc44e3
chore(deps): upgrade drizzle-orm 0.45 and drizzle-kit 0.31
GraysonCAdams Mar 1, 2026
d062129
docs: update Node.js version references to 24+
GraysonCAdams Mar 1, 2026
b9b66ab
docs: update README features list to match current state
GraysonCAdams Mar 1, 2026
f7a3e37
fix: ignore upstream npm CVEs in container scan
GraysonCAdams Mar 1, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .claude/commands/commit.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
Break up our uncommitted changes into smaller, descriptive commits, addressing any pre-commit hook issues as you go.

Rules:
- Each commit should be one logical change (one feature, one fix, one refactor)
- Use conventional commit prefixes: feat:, fix:, refactor:, chore:, docs:, style:
- Imperative mood, lowercase, no period
- Never bundle unrelated changes
- If pre-commit hooks fail, fix the issue and create a NEW commit (don't amend)
16 changes: 16 additions & 0 deletions .claude/rules/api.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
---
paths:
- "src/routes/api/**/*.ts"
---

# API Route Rules

- All API routes are `+server.ts` files returning JSON
- Authenticated endpoints validate session cookie — return 401 if missing/invalid
- Use Drizzle ORM for all queries — never raw SQL strings
- IDs are UUIDs (text type), timestamps are Unix epoch integers
- Follow existing patterns in the codebase for error responses
- SMS inbound endpoint (`/api/sms/inbound`) must validate Twilio request signatures
- Video serving endpoints must support Range headers (206 Partial Content)
- Reference: docs/api.md for full endpoint documentation
- Reference: docs/data-model.md for schema and relationships
14 changes: 14 additions & 0 deletions .claude/rules/security.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
paths:
- "src/routes/api/**/*.ts"
- "src/lib/server/**/*.ts"
---

# Security Rules

- Never hardcode secrets, API keys, or tokens — always use environment variables
- Validate and sanitize all user input at API boundaries
- Use parameterized queries only (Drizzle handles this — never bypass with raw SQL)
- Error responses must not leak stack traces, file paths, or internal state
- Twilio webhook endpoints must validate request signatures
- Auth cookies: httpOnly, secure, sameSite=strict
14 changes: 14 additions & 0 deletions .claude/rules/server.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
paths:
- "src/lib/server/**/*.ts"
---

# Server Module Rules

- Server-only code lives in `src/lib/server/` — SvelteKit enforces this boundary
- Database access: use Drizzle ORM schema from `src/lib/server/db/schema.ts`
- Video downloads: pluggable provider system via `src/lib/server/providers/` + orchestration in `src/lib/server/video/`
- SMS: Twilio SDK wrapper in `src/lib/server/sms/`
- Push: web-push with VAPID keys via `src/lib/server/push.ts`
- Auth: session management via signed httpOnly cookies
- Never expose server modules to client code
19 changes: 19 additions & 0 deletions .claude/rules/styling.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
---
paths:
- "src/**/*.svelte"
- "src/**/*.css"
---

# Styling Rules

- Use CSS custom properties for ALL colors — `var(--bg-primary)`, `var(--text-secondary)`, etc.
- NEVER hardcode color values like `#000`, `#fff`, `rgb()`, `rgba()` in component styles
- Exception: `rgba(0,0,0,X)` / `rgba(255,255,255,X)` for overlays on video content only
- Theme switches via `[data-theme]` attribute — styles must work in both light and dark mode
- Mobile-first: base styles target `375px`, use `min-width` media queries to scale up
- Max content width: `520px` centered
- Touch targets: minimum `44px` x `44px`
- Use `100dvh` not `100vh` for viewport height
- Use spacing tokens: `--space-xs` through `--space-3xl`
- Use radius tokens: `--radius-sm` through `--radius-full`
- Full design system reference: docs/design-guidelines.md
16 changes: 16 additions & 0 deletions .claude/rules/svelte.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
---
paths:
- "src/**/*.svelte"
---

# Svelte Component Rules

- Use Svelte 5 runes exclusively: `$state`, `$props`, `$effect`, `$derived`, `$bindable`
- NEVER use legacy patterns: `let` for reactive vars, `export let` for props, `$:` reactive blocks, `$$props`, `$$restProps`
- Use `{#snippet}` blocks instead of `<slot>` for component composition
- Component props: `let { prop1, prop2 } = $props()`
- State: `let count = $state(0)` — not `let count = 0`
- Derived values: `let doubled = $derived(count * 2)` — not `$: doubled = count * 2`
- Event handlers: use `onclick={handler}` — not `on:click={handler}`
- Scoped `<style>` block in every component — never import external CSS
- All colors via CSS custom properties (`var(--token)`) — never hardcode hex
16 changes: 16 additions & 0 deletions .claude/rules/testing.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
---
paths:
- "src/**/*.test.ts"
- "src/**/*.spec.ts"
---

# Testing Rules

- Test framework: Vitest
- Run tests: `npm run test`
- Run with coverage: `npm run test:coverage`
- Watch mode: `npm run test:watch`
- Place test files alongside source files (co-located)
- Use descriptive test names that explain the expected behavior
- Prefer running single test files (`npx vitest run path/to/file.test.ts`) over the full suite
- When fixing a bug, write a failing test first, then fix
40 changes: 40 additions & 0 deletions .claude/settings.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,46 @@
{
"$schema": "https://json.schemastore.org/claude-code-settings.json",
"attribution": {
"commit": "",
"pr": ""
},
"permissions": {
"allow": [
"Bash(npm run dev)",
"Bash(npm run build)",
"Bash(npm run test *)",
"Bash(npm run test)",
"Bash(npm run check *)",
"Bash(npm run check)",
"Bash(npm run lint *)",
"Bash(npm run lint)",
"Bash(npm run format *)",
"Bash(npm run format)",
"Bash(npx drizzle-kit *)",
"Bash(npx svelte-kit sync)",
"Bash(git status *)",
"Bash(git log *)",
"Bash(git diff *)",
"Bash(git add *)",
"Bash(git commit *)",
"Bash(git branch *)",
"Bash(git checkout *)",
"Bash(git switch *)",
"Bash(git stash *)",
"Bash(git show *)"
],
"deny": [
"Read(.env)",
"Edit(.env)",
"Read(.env.local)",
"Edit(.env.local)",
"Read(.env.production)",
"Edit(.env.production)",
"Read(data/**)"
]
},
"enabledPlugins": {
"typescript-lsp@claude-plugins-official": true,
"svelte-skills@svelte-skills-kit": true
}
}
43 changes: 43 additions & 0 deletions .claudeignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
# Dependencies
node_modules/

# Build output
.output/
/.svelte-kit/
/build/
/dist/

# Runtime data (DB + videos)
/data/

# Secrets
.env
.env.*
!.env.example
!.env.test
*.pem
*.key

# Lock files (large, low signal)
package-lock.json

# Coverage & debug
/coverage/
/.codeql-db/

# OS files
.DS_Store
Thumbs.db

# Logs
*.log

# Editor
.idea/
.vscode/

# Git internals
.git/

# Inspiration images (large binaries)
docs/inspo/
37 changes: 31 additions & 6 deletions .env.example
Original file line number Diff line number Diff line change
@@ -1,7 +1,13 @@
# Session signing secret (generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))")
# ============================================================================
# SECURITY: Keep this file private. Never commit a filled-out .env to git.
# ============================================================================

# Session signing secret — REQUIRED, must be unique per instance
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SESSION_SECRET=

# Twilio
# Twilio — credentials for SMS verification and inbound clip sharing
# Keep these secret. Rotate if compromised.
TWILIO_ACCOUNT_SID=
TWILIO_AUTH_TOKEN=
TWILIO_VERIFY_SERVICE_SID=
Expand All @@ -13,7 +19,8 @@ VERIFY_CHANNELS=sms
# Set to "true" to bypass Twilio and auto-approve any verification code (dev/testing only)
SMS_DEV_MODE=false

# Web Push VAPID keys (generate with: npx web-push generate-vapid-keys)
# Web Push VAPID keys — generate a unique pair per instance
# Generate with: npx web-push generate-vapid-keys
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
VAPID_SUBJECT=mailto:you@example.com
Expand All @@ -22,6 +29,24 @@ VAPID_SUBJECT=mailto:you@example.com
# Must match the public URL users access (e.g. https://scrolly.example.com)
PUBLIC_APP_URL=http://localhost:3000

# iOS Shortcut (optional — iCloud link to a pre-built Shortcut for share sheet integration)
# Create the shortcut manually, share via iCloud, and paste the link here
SHORTCUT_ICLOUD_URL=
# Data directory (optional — defaults to ./data)
# DATA_DIR=./data

# Giphy API key (optional — enables GIF search in comments)
# Get one at https://developers.giphy.com/
GIPHY_API_KEY=

# Legal pages (optional — shown in SMS consent text on join/onboard screens)
# Self-hosted operators should provide their own Terms and Privacy Policy URLs
# Required by Twilio/CTIA for SMS verification compliance
PUBLIC_TERMS_URL=
PUBLIC_PRIVACY_URL=

# Logging (optional — trace, debug, info, warn, error, fatal. Default: info)
# LOG_LEVEL=info

# Database backups (optional — number of daily backups to keep. Default: 7)
# BACKUP_RETENTION_COUNT=7

# Domain for Caddy HTTPS (used with docker-compose.caddy.yml)
# DOMAIN=scrolly.example.com
14 changes: 7 additions & 7 deletions .github/CODEOWNERS
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# Default owner for everything
* @GraysonCAdams
* @312-dev

# Security-sensitive files
/.github/workflows/ @GraysonCAdams
/.github/codeql/ @GraysonCAdams
/src/lib/server/auth/ @GraysonCAdams
/src/lib/server/db/ @GraysonCAdams
/Dockerfile @GraysonCAdams
/SECURITY.md @GraysonCAdams
/.github/workflows/ @312-dev
/.github/codeql/ @312-dev
/src/lib/server/auth/ @312-dev
/src/lib/server/db/ @312-dev
/Dockerfile @312-dev
/SECURITY.md @312-dev
2 changes: 1 addition & 1 deletion .github/ISSUE_TEMPLATE/bug_report.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
name: Bug Report
about: Report a bug to help us improve
title: '[BUG] '
labels: bug
labels: 'type: bug', 'needs triage'
---

## Describe the Bug
Expand Down
2 changes: 1 addition & 1 deletion .github/ISSUE_TEMPLATE/config.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
blank_issues_enabled: true
contact_links:
- name: Security Vulnerability
url: https://github.com/graysoncadams/scrolly/security/advisories/new
url: https://github.com/312-dev/scrolly/security/advisories/new
about: Report a security vulnerability privately
2 changes: 1 addition & 1 deletion .github/ISSUE_TEMPLATE/feature_request.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
name: Feature Request
about: Suggest a new feature or improvement
title: '[FEATURE] '
labels: enhancement
labels: 'type: feature', 'needs triage'
---

## Problem Statement
Expand Down
14 changes: 14 additions & 0 deletions .github/release.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
changelog:
categories:
- title: "Features"
labels: ["enhancement", "feature"]
- title: "Bug Fixes"
labels: ["bug", "fix"]
- title: "Dependencies"
labels: ["dependencies"]
- title: "Documentation"
labels: ["documentation"]
- title: "Other Changes"
labels: ["*"]
exclude:
labels: ["skip-changelog"]
22 changes: 15 additions & 7 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -1,11 +1,17 @@
# NOTE: Branch protection should require the "ci" job to pass before merge.
# Configure in GitHub: Settings > Branches > Branch protection rules > main
# - Require status checks: ci
# - Require branches to be up to date before merging

name: CI

on:
push:
branches: [main]
paths-ignore: ['docs/**', '*.md']
pull_request:
branches: [main]
paths-ignore: ['*.md']
paths-ignore: ['docs/**', '*.md']
workflow_dispatch:

concurrency:
Expand All @@ -22,16 +28,22 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: npm

- name: Install dependencies
run: npm ci

- name: Validate commit messages
if: github.event_name == 'pull_request'
run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

- name: Lint (ratcheted)
run: npm run lint:ci

Expand All @@ -41,12 +53,8 @@ jobs:
- name: Type check
run: npm run type-check

- name: Unit tests
run: npm run test

- name: Coverage report
- name: Tests with coverage
run: npm run test:coverage
continue-on-error: true

- name: Upload coverage
if: always()
Expand Down
28 changes: 28 additions & 0 deletions .github/workflows/dependabot-auto-merge.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
name: Dependabot Auto-Merge

on:
pull_request:
paths:
- 'package*.json'

permissions:
contents: write
pull-requests: write

jobs:
auto-merge:
runs-on: ubuntu-latest
if: github.actor == 'dependabot[bot]'
steps:
- name: Fetch Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@v2
with:
github-token: ${{ secrets.GITHUB_TOKEN }}

- name: Auto-merge patch and minor updates
if: steps.metadata.outputs.update-type != 'version-update:semver-major'
run: gh pr merge --auto --squash "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Loading
Loading