Restrict dev secret permissions and state exact Node.js ranges in README

The quick start now sets the dev data directory to 700 and the secret key file to 600, so other local users cannot read the key. The prerequisites state the exact supported Node.js ranges from the lockfile's jsdom engine (^22.22.2 || ^24.15.0 || >=26.0.0) instead of "22.22.2 or newer". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fix architecture and README accuracy findings from review
2026-10-03 00:24:07 -04:00 · 2026-10-03 00:20:30 -04:00 · 2026-10-03 00:16:58 -04:00 · 2026-10-03 00:15:12 -04:00
1 changed files with 37 additions and 9 deletions
@@ -1,11 +1,6 @@
 # Runs on every push and pull request (no branch filter) so feature branches,
 # their pull requests, and dev/main are all checked. Runs directly on the
 # self-hosted act_runner; no container: key.
-#
-# The Makefile is the single build definition: CI runs `make test` and
-# `make build` so it fails whenever either target would, and the binary
-# carries the Makefile's -trimpath and version-stamped -ldflags (the
-# `make build` log shows the -X main.version=... value).
 name: CI

 on: [push, pull_request]
@@ -21,12 +16,45 @@ jobs:
          go-version-file: go.mod
          cache: false

+      - name: gofmt
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "gofmt needed:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: go vet
+        run: go vet ./...
+
+      - name: go test
+        run: go test -race ./...
+
      - uses: actions/setup-node@v4
        with:
          node-version: "22"

-      - name: make test
-        run: make test
+      - name: npm ci
+        working-directory: web
+        run: npm ci

-      - name: make build
-        run: make build
+      - name: npm run typecheck
+        working-directory: web
+        run: npm run typecheck
+
+      - name: npm test
+        working-directory: web
+        run: npm test
+
+      - name: npm run build
+        working-directory: web
+        run: npm run build
+
+      # Embed the real PWA, as `make embed` does, then build the static binary.
+      - name: go build (embedded PWA)
+        run: |
+          rm -rf internal/frontend/dist
+          mkdir -p internal/frontend/dist
+          cp -R web/dist/. internal/frontend/dist/
+          CGO_ENABLED=0 go build -o bin/mealquest ./cmd/server
Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	60f977d50c	Restrict dev secret permissions and state exact Node.js ranges in README CI / ci (push) Successful in 23s Details CI / ci (pull_request) Successful in 24s Details Independent review Approved — 0 high findings (#7) Details The quick start now sets the dev data directory to 700 and the secret key file to 600, so other local users cannot read the key. The prerequisites state the exact supported Node.js ranges from the lockfile's jsdom engine (^22.22.2 \|\| ^24.15.0 \|\| >=26.0.0) instead of "22.22.2 or newer". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 00:24:07 -04:00
dev_agentandClaude Opus 5.5	bed51ed2bd	Fix architecture and README accuracy findings from review CI / ci (push) Successful in 23s Details CI / ci (pull_request) Successful in 23s Details Independent review Not signed off — 0 high, 1 medium, 1 low (#7) Details - Topology: show the port mapping host 8090 -> container 8080, and note that searxng is internal to the compose network with no published port. - Backend: logging is log/slog JSON. - Scheduler: only the household-configurable times live in household_settings; week_rollover and the ai_runs purge are fixed. - README: state the Node.js floor required by the committed lockfile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 00:20:30 -04:00
dev_agentandClaude Opus 5.5	37f6200250	Correct architecture doc to match the CTXD architecture section CI / ci (pull_request) Successful in 24s Details CI / ci (push) Successful in 23s Details Independent review Not signed off — 0 high, 3 medium, 2 low (#7) Details Replace the data model table with the CTXD tables and columns (recipes are fetched recipe pages; dinners hold the meal record and lifecycle), fix the dinner lifecycle (Pass leads to archived; tried can return to quest_log), add the session cookie attributes and expiry, require the session cookie and CSRF header on /api/v1, make the ai_runs purge daily, use the handoff routes plus the CTXD settings routes, and remove details not supported by CTXD, the requirements or the UI handoff. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 00:16:58 -04:00
dev_agentandClaude Opus 5.5	998898c549	Add AGENTS.md, CLAUDE.md, README and architecture docs AGENTS.md is the authoritative agent guide: house rules, approved dependencies, quality floor, repository layout, branch and merge conventions, where context and work tracking live, GLOSSARY vocabulary and the rule never to use tea. CLAUDE.md imports it. README gives the purpose and a make dev quick start. docs/ARCHITECTURE.md mirrors the CTXD CONTEXT.MD architecture section. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 00:15:12 -04:00