[codex] Publish CommandSphere and audit remediation

.dockerignore

@@ -0,0 +1,15 @@
+.git
+.github
+backend/vendor
+backend/storage/logs
+backend/storage/framework/cache
+backend/storage/framework/sessions
+backend/storage/framework/testing
+backend/storage/framework/views
+frontend/.angular
+frontend/coverage
+frontend/dist
+frontend/node_modules
+frontend/playwright-report
+frontend/test-results
+node_modules

.env.example

@@ -0,0 +1,21 @@
+MEILISEARCH_MASTER_KEY=local_meilisearch_master_key
+REVERB_APP_ID=commandsphere-local
+REVERB_APP_KEY=local-reverb-key
+REVERB_APP_SECRET=local-reverb-secret
+APP_KEY=
+APP_URL=http://localhost:8000
+COMMANDSPHERE_PUBLIC_ORIGIN=http://localhost:4200
+COMMANDSPHERE_API_PUBLIC_URL=http://localhost:8000/api/v1
+COMMANDSPHERE_ALLOWED_HOSTS=localhost,127.0.0.1
+COMMANDSPHERE_REVERB_PUBLIC_HOST=localhost
+COMMANDSPHERE_REVERB_PUBLIC_PORT=8080
+COMMANDSPHERE_REVERB_PUBLIC_SCHEME=http
+DB_DATABASE=commandsphere
+DB_USERNAME=commandsphere
+DB_PASSWORD=
+DB_ROOT_PASSWORD=
+GITHUB_TOKEN=
+GITHUB_WEBHOOK_SECRET=
+DISCORD_CLIENT_ID=
+DISCORD_CLIENT_SECRET=
+DISCORD_REDIRECT_URI=http://localhost:4200/auth/discord/callback

.github/workflows/ci.yml

@@ -0,0 +1,134 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - "feature/**"
+      - "fix/**"
+      - "refactor/**"
+      - "docs/**"
+
+jobs:
+  backend:
+    name: Backend
+    runs-on: ubuntu-latest
+    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: commandsphere_test
+        ports:
+          - "3306:3306"
+        options: >-
+          --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -proot"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+      redis:
+        image: redis:7-alpine
+        ports:
+          - "6379:6379"
+        options: >-
+          --health-cmd="redis-cli ping"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+      meilisearch:
+        image: getmeili/meilisearch:v1.12
+        env:
+          MEILI_ENV: development
+          MEILI_MASTER_KEY: commandsphere-test-master-key
+        ports:
+          - "7700:7700"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.3"
+          extensions: bcmath, mbstring, pdo_mysql, redis, pcntl, posix, zip
+          coverage: none
+
+      - name: Wait for Meilisearch
+        run: |
+          for attempt in {1..30}; do
+            if curl -fsS http://127.0.0.1:7700/health; then
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "Meilisearch did not become healthy in time."
+          exit 1
+
+      - name: Install dependencies
+        working-directory: backend
+        run: composer install --no-interaction --prefer-dist --no-progress
+
+      - name: Composer audit
+        working-directory: backend
+        run: composer audit
+
+      - name: Pint
+        working-directory: backend
+        run: ./vendor/bin/pint --test
+
+      - name: Pest
+        working-directory: backend
+        env:
+          APP_ENV: testing
+          APP_KEY: base64:Fx6s3fIDiYxFNwNf0U8et7uRNwXU0kZKNjJUJt4xbnQ=
+          BCRYPT_ROUNDS: 4
+          DB_CONNECTION: mysql
+          DB_HOST: 127.0.0.1
+          DB_PORT: 3306
+          DB_DATABASE: commandsphere_test
+          DB_USERNAME: root
+          DB_PASSWORD: root
+          CACHE_STORE: array
+          MAIL_MAILER: array
+          MEILISEARCH_HOST: http://127.0.0.1:7700
+          MEILISEARCH_KEY: commandsphere-test-master-key
+          QUEUE_CONNECTION: sync
+          SESSION_DRIVER: array
+        run: ./vendor/bin/pest
+
+  frontend:
+    name: Frontend
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Typecheck
+        working-directory: frontend
+        run: npm run lint
+
+      - name: Jest
+        working-directory: frontend
+        run: npm test -- --runInBand
+
+      - name: Dependency audit
+        working-directory: frontend
+        run: npm audit --audit-level=critical
+
+      - name: Build SSR
+        working-directory: frontend
+        run: npm run build

.gitignore

@@ -0,0 +1,4 @@
+.env
+frontend/playwright-report/
+frontend/test-results/
+frontend/coverage/