Rc/v4.23.1

.flake8

@@ -1,14 +1,8 @@
 [flake8]
 max-line-length = 120
-extend-ignore = E203, W503
-exclude = 
-    .git,
-    __pycache__,
-    venv,
-    .venv,
-    build,
-    dist,
-    htmlcov,
-    app/static/vendor
-
-
+max-complexity = 10
+# C901=complexity, E501=line length, F401=unused import, E402=import not at top,
+# F541=f-string no placeholder, E712=comparison to True/False, F841=unused variable, E741=ambiguous name,
+# F811=redefinition (e.g. import inside function), W293=blank line whitespace, E203=whitespace before ':'
+extend-ignore = C901, E501, F401, E402, F541, E712, F841, E741, F811, W293, E203
+exclude = .git,__pycache__,migrations,.venv,venv,build,dist

.github/workflows/cd-development.yml

@@ -157,6 +157,8 @@ jobs:
             type=raw,value=develop
             type=raw,value=dev-{{date 'YYYYMMDD-HHmmss'}}
             type=sha,prefix=dev-,format=short
+          labels: |
+            org.opencontainers.image.description=Self-hosted time tracking web application for projects, clients, and reports.
 
       - name: Determine version
         id: version

.github/workflows/cd-release.yml

@@ -365,6 +365,8 @@ jobs:
             type=semver,pattern={{major}},value=${{ needs.determine-version.outputs.version }}
             type=raw,value=latest,enable={{is_default_branch}}
             type=raw,value=stable,enable=${{ needs.determine-version.outputs.is_prerelease == 'false' }}
+          labels: |
+            org.opencontainers.image.description=Self-hosted time tracking web application for projects, clients, and reports.
 
       - name: Inject analytics configuration from GitHub Secrets
         env:
@@ -1017,16 +1019,16 @@ jobs:
         working-directory: mobile
         run: flutter pub get
 
+      - name: Generate iOS platform files
+        working-directory: mobile
+        run: flutter create --platforms=ios .
+
       - name: Generate launcher icons
         working-directory: mobile
         run: |
           dart run flutter_launcher_icons
           dart run flutter_launcher_icons -f flutter_launcher_icons_ios.yaml
 
-      - name: Generate iOS platform files
-        working-directory: mobile
-        run: flutter create --platforms=ios .
-
       - name: Configure iOS project for device build without code signing
         working-directory: mobile
         run: |

.github/workflows/migration-check.yml

@@ -135,21 +135,76 @@ jobs:
           FLASK_APP: app.py
           FLASK_ENV: testing
         run: |
+          set -e
           echo "🔄 Testing migration rollback safety..."
 
-          # Get current migration
-          CURRENT_MIGRATION=$(flask db current)
+          # Get current migration (trim whitespace and optional "(head)" suffix)
+          CURRENT_MIGRATION=$(flask db current | sed 's/ (head)$//' | tr -d '[:space:]')
           echo "Current migration: $CURRENT_MIGRATION"
 
-          if [ -n "$CURRENT_MIGRATION" ] && [ "$CURRENT_MIGRATION" != "None" ]; then
-            # Generic rollback test: downgrade one revision, then upgrade back to head
-            echo "Testing migration rollback (downgrade -1, upgrade head)..."
-            flask db downgrade -1
-            flask db upgrade head
-            echo "✅ Migration rollback test passed"
-          else
+          if [ -z "$CURRENT_MIGRATION" ] || [ "$CURRENT_MIGRATION" = "None" ]; then
             echo "ℹ️ No migrations to test rollback on"
+            exit 0
+          fi
+
+          # Resolve parent revision via Alembic (avoids ambiguous "downgrade -1" with merge revisions)
+          ROLLBACK_RESULT=$(python <<'PYEOF'
+          import os
+          import sys
+          from app import create_app, db
+          from alembic.config import Config
+          from alembic.script import ScriptDirectory
+
+          app = create_app()
+          with app.app_context():
+              r = db.session.execute(db.text("SELECT version_num FROM alembic_version"))
+              rows = r.fetchall()
+              if not rows:
+                  print("SKIP")
+                  sys.exit(0)
+              current_rev = rows[0][0]
+              config = Config(os.path.join(os.getcwd(), "migrations", "alembic.ini"))
+              script = ScriptDirectory.from_config(config)
+              rev = script.get_revision(current_rev)
+              if rev is None:
+                  print("SKIP")
+                  sys.exit(0)
+              down = rev.down_revision
+              if down is None:
+                  print("SKIP")
+              elif isinstance(down, tuple):
+                  print("SKIP")
+              else:
+                  print("PARENT:" + down)
+          PYEOF
+          )
+
+          if [ "$ROLLBACK_RESULT" = "SKIP" ]; then
+            echo "ℹ️ At base or merge revision — skipping downgrade, verifying upgrade head..."
+            if ! flask db upgrade head; then
+              echo "❌ Rollback test failed: upgrade head failed after skip"
+              exit 1
+            fi
+            echo "✅ Migration rollback test passed (downgrade skipped, upgrade head OK)"
+            exit 0
+          fi
+
+          PARENT_REV="${ROLLBACK_RESULT#PARENT:}"
+          if [ -z "$PARENT_REV" ]; then
+            echo "❌ Rollback test failed: could not resolve parent revision"
+            exit 1
+          fi
+
+          echo "Testing migration rollback (downgrade to $PARENT_REV, then upgrade head)..."
+          if ! flask db downgrade "$PARENT_REV"; then
+            echo "❌ Rollback test failed: downgrade to $PARENT_REV failed"
+            exit 1
+          fi
+          if ! flask db upgrade head; then
+            echo "❌ Rollback test failed: upgrade head failed after downgrade"
+            exit 1
           fi
+          echo "✅ Migration rollback test passed"
 
       - name: Test migration with sample data
         if: steps.migration_check.outputs.migration_changes == 'true'

.gitignore

@@ -143,6 +143,7 @@ backups/
 # IDE
 .vscode/
 .idea/
+.cursor/
 *.swp
 *.swo
 *~
@@ -167,16 +168,15 @@ bandit-report.json
 safety-report.json
 migration_report.md
 
-# Coverage reports
-.coverage.*
-coverage/
-htmlcov/
-.coverage
-coverage.xml
-
 # Test output
 .testmondata
 
+# Install / build logs
+install_log.txt
+
+# Benchmark output
+.benchmarks/
+
 # SSL Certificates (generated by mkcert)
 nginx/ssl/*.pem
 nginx/ssl/*.key
@@ -243,9 +243,6 @@ mobile/.flutter-plugins-dependencies.lock.lock.lock.lock.lock.lock.lock.lock
 mobile/.flutter-plugins-dependencies.lock.lock.lock.lock.lock.lock.lock.lock.lock
 mobile/.flutter-plugins-dependencies.lock.lock.lock.lock.lock.lock.lock.lock.lock.lock
 mobile/.flutter-plugins-dependencies.lock.lock.lock.lock.lock.lock.lock.lock.lock.lock.lock
-mobile/.android/
-
-
 
 
 ## License Files