7fca7af9d4
ci: upload server and client coverage reports to codecov ( #183 )
...
* ci: upload server and client coverage reports to codecov
Generate client lcov output and publish per-package coverage from CI so Codecov checks and README coverage artifacts stay up to date.
* ci: configure codecov project status and pr comments
* ci: isolate codecov coverage status by flags
* ci: add patch coverage status, per-flag badges, and client coverage scope
- Add patch coverage status in codecov.yml (server and client flags) so
Codecov checks coverage on changed lines in PRs, not just overall trend
- Add include/exclude patterns to client vitest coverage config so test
files and entry points are excluded from coverage stats
- Add per-flag server/client coverage badges to the README coverage section
* docs: restructure coverage map in README
Move the coverage map down to the documentation and contributing section, giving it its own heading. Remove the redundant server and client badges from the top.
2026-05-31 21:41:42 -06:00
75ee8d495c
chore(deps): bump the github-actions group with 3 updates ( #138 )
...
Bumps the github-actions group with 3 updates: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ), [docker/login-action](https://github.com/docker/login-action ) and [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action ).
Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 )
Updates `docker/login-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee )
Updates `docker/setup-qemu-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases )
- [Commits](https://github.com/docker/setup-qemu-action/compare/ce360397dd3f832beb865e1373c09c0e9f86d70a...06116385d9baf250c9f4dcb4858b16962ea869c3 )
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 4.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: docker/login-action
dependency-version: 4.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: docker/setup-qemu-action
dependency-version: 4.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-28 21:24:40 -06:00
ca1f123785
chore(deps): bump the github-actions group with 2 updates ( #79 )
...
Bumps the github-actions group with 2 updates: [docker/build-push-action](https://github.com/docker/build-push-action ) and [actions/stale](https://github.com/actions/stale ).
Updates `docker/build-push-action` from 7.1.0 to 7.2.0
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/bcafcacb16a39f128d818304e6c9c0c18556b85f...f9f3042f7e2789586610d6e8b85c8f03e5195baf )
Updates `actions/stale` from 10.2.0 to 10.3.0
- [Release notes](https://github.com/actions/stale/releases )
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/stale/compare/b5d41d4e1d5dceea10e7104786b73624c18a190f...eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 )
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 7.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: actions/stale
dependency-version: 10.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-21 22:30:37 -06:00
8786a18f04
fix(scanner): clamp oversized MergerFS inodes before storage ( #30 )
...
* fix(scanner): clamp oversized MergerFS inodes before storage
MergerFS generates synthetic unsigned 64-bit inodes by hashing file paths.
Values above 2^63-1 overflow PostgreSQL's signed bigint column, crashing
the scanner with 'value out of range for type bigint'.
Switch all file stat() calls to stat(path, { bigint: true }) to read
inodes as precise BigInt values instead of lossy JS numbers. Introduce
clampIno(ino: bigint): number which returns 0 for any inode exceeding
PostgreSQL's bigint max - 0 is the existing sentinel meaning 'rename
detection disabled', so no other code needs to change.
The fix covers all four code paths that write ino to a FileStat:
statFilesIntoAcc and buildSingleBookCandidate in walk.ts, plus the two
targeted-scan paths in scanner.service.ts.
Fixes #19
* ci: add maintainer-gated PR GHCR image publish
---------
Signed-off-by: neon <18559658+neonsolstice@users.noreply.github.com >
2026-05-18 17:11:28 -06:00
ab2af020a4
chore: set open-pull-requests-limit = 1
2026-05-18 16:49:18 -06:00
1fc04f8af6
fix(books): downgrade archiver to v7 to restore zip export ( #41 )
...
archiver v8 switched to pure ESM with no default export and a
completely different API, breaking every zip export request with
TypeError: (0 , _archiver.default) is not a function. The NestJS
SWC build produces CJS output, which cannot import the new ESM-only
package at runtime.
Downgrade to ~7.0.1 (the last CJS release) and add a Dependabot
ignore rule for archiver major bumps so this cannot recur silently.
Fixes #31
2026-05-18 15:48:46 -06:00
df52eee23e
chore(deps): bump brace-expansion from 1.1.13 to 5.0.5 ( #38 )
...
* chore(deps): bump brace-expansion from 1.1.13 to 5.0.5
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion ) from 1.1.13 to 5.0.5.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases )
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.13...v5.0.5 )
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 5.0.5
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
* chore(deps): skip dependabot branch and issue checks
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: neon <18559658+neonsolstice@users.noreply.github.com >
2026-05-18 15:13:19 -06:00
54fa317441
chore: remove legacy markdown issue templates
...
Keep only YAML issue forms so GitHub does not show duplicate Bug and Feature entries.
2026-05-18 00:17:54 -06:00
e89f4ce0e4
ci: enforce PR issue references and branch conventions
...
Validate BO-<issue>-<slug> branch names and lint PR titles and commit headers in CI and release workflows.
Require GitHub closing-keyword issue references and verify referenced issues exist. Align contributing, release, commit, testing, and policy docs with the enforced behavior and tone.
2026-05-17 13:10:32 -06:00
f7fb010fe0
chore(deps): bump the github-actions group with 3 updates ( #12 )
...
Bumps the github-actions group with 3 updates: [actions/labeler](https://github.com/actions/labeler ), [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action ) and [actions/stale](https://github.com/actions/stale ).
Updates `actions/labeler` from 5.0.0 to 6.1.0
- [Release notes](https://github.com/actions/labeler/releases )
- [Commits](https://github.com/actions/labeler/compare/8558fd74291d67161a8a78ce36a881fa63b766a9...f27b608878404679385c85cfa523b85ccb86e213 )
Updates `docker/setup-qemu-action` from 3.6.0 to 4.0.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases )
- [Commits](https://github.com/docker/setup-qemu-action/compare/29109295f81e9208d7d86ff1c6c12d2833863392...ce360397dd3f832beb865e1373c09c0e9f86d70a )
Updates `actions/stale` from 9.1.0 to 10.2.0
- [Release notes](https://github.com/actions/stale/releases )
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/stale/compare/5bef64f19d7facfb25b37b414482c7164d639639...b5d41d4e1d5dceea10e7104786b73624c18a190f )
---
updated-dependencies:
- dependency-name: actions/labeler
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: docker/setup-qemu-action
dependency-version: 4.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/stale
dependency-version: 10.2.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-14 21:39:28 -06:00
040a43f341
chore(release): fix release changelog text formatting
2026-05-15 02:03:06 +00:00
3138cf3a4d
fix(security): complete sanitizeLogValue sweep, DOMParser stripHtml, least-privilege CI permissions, pin Dockerfile image
2026-05-15 00:15:23 +00:00
db2b3f9696
ci: run E2E only on nightly schedule, skip E2E on PR/push/manual CI, keep manual e2e workflow for on-demand runs, and align matrix/docs accordingly
2026-05-14 16:37:18 +00:00
102360116b
ci: pin stale action to valid v9 commit hash
...
Use the correct resolvable SHA for actions/stale v9 so the workflow can download the action successfully.
2026-05-14 08:17:34 -06:00
f9c1e29911
feat: implement version UI and short-sha CI versioning
2026-05-13 22:24:46 +00:00
266b57c38a
chore: reorganize docs, improve README, and add FOSS project hygiene
2026-05-13 15:05:04 +00:00
ff817e4c8a
Update issue templates
2026-05-12 01:15:26 -06:00
e1cdc16245
chore(deps): bump actions/dependency-review-action ( #3 )
...
Bumps the github-actions group with 1 update: [actions/dependency-review-action](https://github.com/actions/dependency-review-action ).
Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0
- [Release notes](https://github.com/actions/dependency-review-action/releases )
- [Commits](https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294 )
---
updated-dependencies:
- dependency-name: actions/dependency-review-action
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-12 00:46:52 -06:00
838033717c
fix(ci,books): resolve GHCR/CVE issues and clean pin/unpin fallbacks
...
- regenerate lockfile after package version alignment
- remove useless fallback spreads in pin and unpin column
- resolve GHCR push auth and fast-uri CVE
- patch fast-xml-builder CVE in image scan
2026-05-08 19:10:03 -06:00
de7a61888b
ci: consolidate release workflow and automate release notes
...
- Hardened multi-arch container release flow with build-once promotion and safer image gating.
- Reworked semantic-release execution, permissions, and action pinning for more reliable releases.
- Expanded release notes transformation with contributor and artifact metadata, plus cleaner formatting.
- Fixed edge cases in notes rendering by preserving commit metadata and guarding author formatting.
- Removed redundant release notes sections to keep generated output concise and consistent.
2026-04-27 08:21:15 -06:00
812efcd1be
ci: fix PR token permissions and gate dependency review
2026-04-26 19:15:56 -06:00
8ce315a7d0
ci: add semantic-release workflow and docs
2026-04-26 19:03:03 -06:00
739d311e9e
chore: sync dependency branch with main
2026-04-25 21:35:27 -06:00
cfc3672a6c
refactor: rename book-bucket to book-dock and lens to smart-scope
2026-04-20 22:57:27 -06:00
ef7f63cb1c
ci: allow dependency-review to fail without blocking CI
2026-04-14 04:38:10 -06:00
19f81faf4d
ci: reorganize project scripts and E2E workflows by type
2026-04-12 17:12:36 -06:00
b804abb043
chore: enhance ci pipeline
2026-04-10 11:06:25 -06:00
e6186c09df
test: add comprehensive unit tests and increase coverage thresholds
2026-04-10 09:26:37 -06:00
3c95efe25b
ci: add Trivy image scan gate before GHCR push
2026-04-07 05:51:02 -06:00
9fd4e162aa
feat(server): harden booklore migration with adapters and E2E tests
2026-04-05 16:01:04 -06:00
bab3813ff8
feat(metadata): add per-field locking to protect fields from overwrites
2026-04-03 21:31:02 -06:00
0a58a87239
refactor(scanner): rename staging module to book bucket
2026-04-03 20:50:11 -06:00
c3fd3f8f2e
ci: consolidate E2E into pipeline and gate image builds on test suite
2026-04-02 06:45:00 -06:00
6e999ccaa8
ci: standardize E2E naming across workflows and scripts
2026-04-02 05:25:00 -06:00
00ecdc34cd
test(users): add lifecycle E2E suite and harden admin contracts
2026-04-02 04:05:00 -06:00
6115656153
test(email): add email lifecycle E2E suite and harden send behavior
2026-04-02 02:45:00 -06:00
835bc91a09
test(reader): add state isolation E2E suite and fix isolation bugs
2026-04-02 01:25:00 -06:00
64abfa8c41
test(opds): add auth catalog end-to-end tests
2026-04-02 00:05:00 -06:00
157224be9f
test(metadata): expand end-to-end scenarios and assertions
2026-04-01 11:50:59 -06:00
a6d84ae20c
test(metadata): add initial E2E coverage for metadata write flow
2026-04-01 08:05:00 -06:00
0c195165e6
test(scanner): add staging ingest and finalize E2E test suite
2026-03-30 23:17:27 -06:00
4d58418b93
test(auth): add end-to-end coverage for authentication flows
2026-03-30 03:58:27 -06:00
b5cc1ef370
test(scanner): refactor E2E scaffolding and extract shared test harness
2026-03-30 02:11:51 -06:00
db30a45782
test(scanner): bootstrap scanner E2E test infrastructure
2026-03-30 01:18:32 -06:00
1418957b6f
chore: cleanup project structure and resolve client type errors
...
- resolve all 69 client type-checking errors for stricter TS compliance
- remove obsolete type-check baseline scripts and files
- overhaul project root with updated README.md and new DEVELOPMENT.md
- migrate to unified baseline migration strategy and cleanup docker configs
- remove redundant production and dev-specific shell scripts
2026-03-25 07:14:51 -06:00
9d61ded2ff
chore: add OSS readiness files and contributor docs
2026-03-20 00:34:07 -06:00
d65a4815bc
feat(stats): add advanced analytics charts and defaults
2026-03-19 08:11:17 -06:00
8abfb82214
chore: speed up Docker builds
...
- drop arm64/QEMU — build amd64 only
- add pnpm store cache mounts to client and server install steps
2026-03-11 14:07:42 -06:00
4c4a5cbf25
chore: migrate server tests from Jest to Vitest
2026-03-11 13:30:04 -06:00
a3579ac57f
ci: overhaul CI workflows for reliability and maintainability
...
- add CODEOWNERS assigning .github/ to @neonsolstice
- configure automated updates for npm, docker, and github-actions ecosystems
- replace custom change-detection bash script with dorny/paths-filter@v4
- consolidate lint, typecheck, and test into a single checks matrix job
- gate per-package change detection via has-changes step (matrix unavailable in job-level if)
- fix duplicate actions/setup-node call in setup-node-pnpm composite action
- scope pnpm store cache key by pnpm version to prevent stale cross-version cache hits
- pin all action references to commit SHAs
- fix container-image concurrency group to use commit SHA across all trigger types
- add timeout-minutes to all jobs
- document fail-fast: false rationale and checks: write trade-off
2026-03-07 18:14:36 -06:00
neon
dependabot[bot]