## Summary Implements issue #59 by enforcing a hard boundary between CI validation tooling and deployable runtime images. This PR: - Adds automated deployable-runtime boundary checks in CI. - Verifies deployable backend/frontend artifacts are free of CI/development tooling. - Documents runtime-vs-validation ownership and enforcement behavior. ## What Changed ### CI workflow enforcement - Updated `.gitea/workflows/docker-build-main.yaml` to: - Checkout additional verification inputs (`Dockerfile.backend`, `Dockerfile.frontend`, scripts, backend/frontend directories). - Run `scripts/check-dockerfile-boundaries.sh`. - Build deployable runtime images (`Dockerfile.backend`, `Dockerfile.frontend --target production`). - Run `scripts/verify-deployable-image-purity.sh` against both images before publishing CICD image. - Updated `.gitea/workflows/cicd-checks.yaml` to add: - `dockerfile-boundary-check` job. - Boundary validation execution inside the CICD validation image. ### New enforcement scripts - Added `scripts/check-dockerfile-boundaries.sh`: - Ensures deployable Dockerfiles do **not** reference CICD image paths (`cicd-base`, `CICD_BASE_IMAGE`, `Dockerfile.cicd*`, etc.). - Ensures deployable Dockerfiles do **not** include disallowed CI-only tooling tokens. - Enforces runtime base expectations: - Backend: `python:3.14-slim` - Frontend production target: `nginx:alpine` - Added `scripts/verify-deployable-image-purity.sh`: - Baseline binary checks for disallowed tooling. - Backend-specific deep checks: - Python module import probes for disallowed CI/dev modules. - `pip show` package metadata checks for disallowed CI/dev packages. - Frontend-specific deep checks: - OS package metadata checks (`apk`/`dpkg` when available) for disallowed runtime leaks. - Directory-based checks for development package trees (`node_modules`, `.venv`, `site-packages`, `dist-packages` in sensitive paths). ## Documentation updates - Updated `docs/DEVELOPMENT.md`: - Clarifies runtime-vs-validation enforcement and where checks run. - Notes purity checks include binaries and metadata artifacts. - Updated `docs/CICD_MULTI_STAGE_BUILD.md`: - Adds explicit “Runtime Boundary Enforcement” section. - Documents metadata-level purity probes. - Updated `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`: - Replaces future-only language with current enforcement hooks. - Documents binary + metadata-level purity enforcement. ## Acceptance Criteria Mapping 1. **Deployable backend/frontend image paths do not require CI-only tool installation** - Enforced by: - `scripts/check-dockerfile-boundaries.sh` - `scripts/verify-deployable-image-purity.sh` - `docker-build-main.yaml` pre-publish gates 2. **Checks and tests execute in dedicated validation environment(s)** - Reinforced by: - `cicd-checks.yaml` boundary-check job running in CICD validation image - Existing check/test workflow usage of CICD image 3. **Workflow docs identify runtime vs validation concerns** - Addressed via updates to: - `docs/DEVELOPMENT.md` - `docs/CICD_MULTI_STAGE_BUILD.md` - `docs/DEPLOYABLE_RUNTIME_CONTRACT.md` ## Scope / Non-Goals - Included: - Structural separation enforcement - Workflow-level guardrails - Documentation clarity and traceability - Not included: - Full staging deployment wiring - Security policy redesign ## Notes for Reviewers - Main enforcement path is in `docker-build-main.yaml` before CICD image publish. - New scripts are intentionally fail-fast and policy-oriented. - Existing deployable Dockerfiles currently satisfy the new gates. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #69
Plex Playlist Project
A full-stack application for managing Plex playlists with a FastAPI backend and Vue.js frontend.
Architecture
- Backend: Python 3.14 + FastAPI + uv + ruff
- Frontend: TypeScript + Vue.js + Vite
- Database: PostgreSQL 16
- Containerization: Docker + Docker Compose
Deployable Runtime Contract
Deployable image requirements are defined in:
These documents define backend/frontend runtime boundaries, startup and health behavior expectations, environment contracts, and disallowed non-runtime tooling classes in deployable artifacts.
Development Setup
Prerequisites
- Docker and Docker Compose
- Git
- pre-commit (for development)
Code Quality Tools
This project uses comprehensive linting and formatting:
Backend (Python):
ruff- Fast Python linter and formatterpyright- Type checkingpydoclint- Docstring linting (Google style)
Frontend (TypeScript/Vue):
eslint- Linting with Vue and TypeScript supportprettier- Code formattingvue-tsc- Vue TypeScript checkingeslint-plugin-tsdoc- TSDoc documentation linting
Task Runner:
poethepoet- Unified task runner for development workflows
General:
pre-commit- Git hooks for automated quality checks- TOML formatting and validation
Unified Development with Poe
This project uses Poe the Poet for streamlined development:
# Complete setup (installs deps, starts dev environment)
poe setup
# Code quality (format, lint, type-check all code)
poe ci-quick
# Run all tests
poe test-all
# See all available tasks
poe --help
Manual Setup (Alternative)
pip install pre-commit
pre-commit install
Quick Start
Clone the repository, then choose one of these startup paths.
Unified Development
# Complete setup and start development environment
poe setup
# Or manually:
cd backend
pip install -e .
poe dev-env-start
Traditional Setup
# Backend development
cd backend
pip install -e .
# Frontend development
cd frontend
npm install
npm run dev
Docker Development
# Using Poe (recommended)
poe docker-dev-up
# Or directly
docker compose -f compose.dev.yml up --build
Production Build
poe docker-prod-up
# Or: docker compose up --build
Running in Production Mode
docker compose up --build -d
This will start:
- PostgreSQL database on port 5432
- FastAPI backend on port 8000
- Vue.js frontend on port 80
Project Structure
plex-playlist/
├── backend/ # FastAPI backend
├── frontend/ # Vue.js frontend
│ └── nginx.conf # Nginx configuration
├── Dockerfile.backend # Backend Docker image
├── Dockerfile.frontend # Frontend Docker image
├── compose.yml # Production Docker Compose
├── compose.dev.yml # Development Docker Compose override
└── README.md
CI Operations
For Gitea Actions runner image mirror maintenance, use:
source scripts/gitea-actions/repair_runner_mirror.xshsource scripts/gitea-actions/check_runner_images.xshsource scripts/gitea-actions/collect_runner_diagnostics.xsh [since] [trace_id]
For full troubleshooting context, see docs/GITEA_ACTIONS_TROUBLESHOOTING.md.
Environment Variables
Backend
DATABASE_URL: PostgreSQL connection stringBACKEND_REQUIRED_PYTHON: Runtime policy baseline (3.14default)ENVIRONMENT:developmentorproductionRELOAD: Enable uvicorn auto-reload (development only)
Frontend
- No required runtime environment variables for production nginx serving
Database
The PostgreSQL database is configured with:
- Database:
plex_playlist - User:
plex_user - Password:
plex_password
Development Workflow
- Make changes to your code
- The development containers will automatically reload:
- Backend: uvicorn with
--reloadflag - Frontend: Vite dev server with hot module replacement
- Backend: uvicorn with
API Documentation
When running, the FastAPI automatic documentation is available at:
- Development: http://localhost:8001/docs
- Production: http://localhost:8000/docs
Manual Setup (if not using Docker)
Backend Setup (FastAPI, Python 3.14, uv, ruff, pyright)
1. Create and activate the uv virtual environment
cd backend
uv venv .venv
source .venv/bin/activate
2. Install dependencies
uv sync --all-groups
3. Install dev tools
uv run poe format
uv run poe lint
uv run poe test
4. Project structure
src/backend/- FastAPI application codetests/- Test suitepyrightconfig.json- Pyright type checking configpyproject.toml- Ruff, pytest, and task configuration
5. Run the development server
uv run uvicorn backend.main:app --reload --app-dir src
Frontend Setup (Vue 3, Vite, TypeScript)
1. Create the project
cd frontend
npm create vite@latest . -- --template vue-ts
npm install
2. Recommended: Enable strictest TypeScript settings
Edit tsconfig.json and set:
{
"compilerOptions": {
"strict": true,
"noImplicitAny": true,
"strictNullChecks": true,
"strictFunctionTypes": true,
"strictBindCallApply": true,
"noImplicitThis": true,
"alwaysStrict": true,
"noUnusedLocals": true,
"noUnusedParameters": true,
"noFallthroughCasesInSwitch": true
}
}
3. Run the frontend
npm run dev
Documentation
Development & Workflow
- Development Environment Setup
- Comprehensive guide for setting up your development environment, git workflow, pre-commit hooks, manual tool usage, and CI/CD pipeline understanding
- Poe Task Reference
- Complete guide to unified development tasks and workflows using Poe the Poet
- Deployable Runtime Contract
- Canonical backend/frontend deployable runtime image requirements and exclusions
- ADR003: Deployable Runtime Image Contract Boundaries
- Architectural decision that locks deployable image boundary policy
Architecture & CI/CD
- CI/CD Multi-stage Build
- Docker multi-stage build strategy, architecture decisions, and performance optimizations
- CI/CD Troubleshooting Guide
- Comprehensive troubleshooting, optimization decisions, and performance monitoring for Docker builds and E2E testing
- CI/CD Success Summary
- Complete validation results and performance metrics for the optimized pipeline
Dependency Management & Automation
- Renovate Bot Setup
- Automated dependency updates with Renovate for Python, Node.js, and Docker dependencies
Operations & Troubleshooting
- Gitea Actions Troubleshooting
- Solutions for CI/CD pipeline issues, including the critical "jobs waiting forever" problem
- Secure Docker CI/CD
- Security considerations and setup for Docker-based CI/CD pipelines
See the backend/ and frontend/ folders for more details.