Feature/ai code reviewer

.astro/settings.json

@@ -1,5 +1,5 @@
 {
 	"_variables": {
-		"lastUpdateCheck": 1783961044818
+		"lastUpdateCheck": 1785773647919
 	}
 }

.github/rulesets/main-branch-ruleset.json

@@ -47,11 +47,7 @@
             "integration_id": 15368
           },
           {
-            "context": "Unit Tests (Lane: unit)",
-            "integration_id": 15368
-          },
-          {
-            "context": "Integration Tests (Lane: integration)",
+            "context": "Unit & Integration Tests",
             "integration_id": 15368
           },
           {

.github/workflows/ci.yml

@@ -65,6 +65,56 @@ jobs:
       - name: Check docs parity
         run: bun run docs:parity
 
+  wiring-audit:
+    name: Wiring Audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: |
+          for i in 1 2 3; do
+            bun install --frozen-lockfile && exit 0
+            echo "bun install attempt $i failed, retrying in 10s..."
+            sleep 10
+          done
+          echo "::error::bun install failed after 3 attempts"
+          exit 1
+
+      - name: Run wiring audit
+        run: bun run wiring:audit
+
+  openapi-coverage:
+    name: OpenAPI Coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: |
+          for i in 1 2 3; do
+            bun install --frozen-lockfile && exit 0
+            echo "bun install attempt $i failed, retrying in 10s..."
+            sleep 10
+          done
+          echo "::error::bun install failed after 3 attempts"
+          exit 1
+
+      - name: Check OpenAPI coverage
+        run: bun run openapi:coverage
+        env:
+          OPENAPI_COVERAGE_THRESHOLD: "60"
+
   # ──────────────────────────────────────────────────
   # Stage 2: Security Audit
   # ──────────────────────────────────────────────────
@@ -168,6 +218,62 @@ jobs:
           path: coverage/
           retention-days: 14
 
+  # ──────────────────────────────────────────────────
+  # Stage 3b: Contract Tests (Lane: contract)
+  # ──────────────────────────────────────────────────
+  contract:
+    name: Contract Tests (Lane: contract)
+    runs-on: ubuntu-latest
+    needs: lint
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: |
+          for i in 1 2 3; do
+            bun install --frozen-lockfile && exit 0
+            echo "bun install attempt $i failed, retrying in 10s..."
+            sleep 10
+          done
+          echo "::error::bun install failed after 3 attempts"
+          exit 1
+
+      - name: Run contract tests
+        run: bun run test:contract
+
+  # ──────────────────────────────────────────────────
+  # Stage 3c: Smoke Tests (Lane: smoke)
+  # ──────────────────────────────────────────────────
+  smoke:
+    name: Smoke Tests (Lane: smoke)
+    runs-on: ubuntu-latest
+    needs: lint
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: |
+          for i in 1 2 3; do
+            bun install --frozen-lockfile && exit 0
+            echo "bun install attempt $i failed, retrying in 10s..."
+            sleep 10
+          done
+          echo "::error::bun install failed after 3 attempts"
+          exit 1
+
+      - name: Run smoke tests
+        run: bun run test:smoke
+
   # ──────────────────────────────────────────────────
   # Stage 4: E2E Tests (Playwright)
   # ──────────────────────────────────────────────────
@@ -504,25 +610,46 @@ jobs:
         working-directory: cli
 
       - name: Publish to npm
-        run: npm publish --access public --provenance
         working-directory: cli
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          # Check if package version already exists on registry
+          PKG_NAME=$(node -p "require('./package.json').name")
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/${PKG_NAME}/${PKG_VERSION}")
+          if [ "$HTTP_CODE" = "200" ]; then
+            echo "::warning::Version ${PKG_VERSION} already exists on npm, skipping publish"
+            exit 0
+          fi
+          # First publish of a new package: --provenance requires the package to exist
+          # so we attempt with provenance first, fall back without it on 404
+          if npm publish --access public --provenance 2>&1 | tee /tmp/npm-publish.log; then
+            echo "Published with provenance"
+          elif grep -q "404" /tmp/npm-publish.log; then
+            echo "Package not yet on registry, publishing without provenance for initial seed..."
+            npm publish --access public
+          fi
 
   # ──────────────────────────────────────────────────
   # Quality Gate Summary
   # ──────────────────────────────────────────────────
   quality-gate:
     name: Quality Gate
     runs-on: ubuntu-latest
-    needs: [lint, docs-parity, security, test, e2e, container-scan, sast, performance, build]
+    needs: [lint, docs-parity, wiring-audit, openapi-coverage, security, test, contract, smoke, e2e, container-scan, sast, performance, build]
     if: always()
     steps:
       - name: Check all gates
         run: |
           echo "=== Quality Gate Summary ==="
           echo "Lint & Typecheck: ${{ needs.lint.result }}"
+          echo "Docs Parity:      ${{ needs.docs-parity.result }}"
+          echo "Wiring Audit:     ${{ needs.wiring-audit.result }}"
+          echo "OpenAPI Coverage: ${{ needs.openapi-coverage.result }}"
           echo "Unit Tests:       ${{ needs.test.result }}"
+          echo "Contract Tests:   ${{ needs.contract.result }}"
+          echo "Smoke Tests:      ${{ needs.smoke.result }}"
           echo "E2E Tests:        ${{ needs.e2e.result }}"
           echo "Container Scan:   ${{ needs.container-scan.result }}"
           echo "SAST:             ${{ needs.sast.result }}"

CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.0] - 2026-08-15
+
+### 🚀 Production Readiness Release
+- **Full-stack E2E proof** (`scripts/e2e-proof.sh`, 20 checks): real git push → workflow → CI success (Docker), PR + squash merge, OAuth provider flow, org invites + transfer, org-owned repo APIs — all green against Postgres + Redis.
+- **Git protocol fixes** (found by the proof): post-receive hooks now fire (stdin newline + capability stripping), receive-pack status on sideband band 1 with nested pkt-line framing + inner flush — real `git push` completes cleanly.
+- **CI engine**: parallel job waves with `needs` ordering, matrix expansion, cron scheduler, GITHUB_OUTPUT/GITHUB_ENV, repo secrets injection, Docker image auto-pull, speculative-build CI execution, docker actions (`uses: docker://`) on self-hosted runners, action resolver for composite actions + checkout.
+- **Configuration**: `.env` no longer shadows real environment variables; Redis uses static imports (distributed rate limiting + locks actually active).
+- **Collaboration**: issue assignees/milestones/custom-fields/workflow transitions wired, PR labels + assignees + requested-reviewers, draft PRs, merge-method selection, review-thread resolution, @mentions, issue templates, real contribution graph, watch/unwatch.
+- **Security**: OAuth provider mode (authorization-code + refresh-token grants, userinfo), fine-grained PAT scopes with implication, GitHub/Google login, org SAML config, org-aware permission resolution everywhere.
+- **Organizations**: CRUD + pages, member invites, teams, repo transfer (API + UI), org-owned repos work across all routes/pages.
+- **DX**: GraphQL expansion (issues/orgs/labels mutations), OpenAPI 100% coverage (275 routes) with an idempotent generator + CI gate, npm registry protocol completion (login/whoami/publish/metadata/tarballs).
+- **Observability**: per-request correlation IDs bound to every log line; OTLP transport for Grafana Cloud.
+- **Quality**: authz matrix suite (43 cases, scope-implication fix), multi-instance chaos suite, load baseline green (p95 ≤136ms at 20-concurrency), DR drills, wiring-audit gate, contract/smoke lanes.
+- **CLI**: `opencodehub-cli` 1.2.0.
+
+## [1.1.2] - 2026-08-10
+
+### 🛡️ Quality Gates (Phase 0 of production-parity plan)
+- **CI lanes**: Added real `Contract Tests (Lane: contract)` and `Smoke Tests (Lane: smoke)` jobs; branch ruleset now requires job names that exist.
+- **Contract suite**: New `tests/contract/` — pkt-line protocol, webhook HMAC (GitHub-vector pinned), workflow trigger semantics, OpenAPI shape (27 tests).
+- **Smoke suite**: New `tests/smoke/` — boot-critical module wiring (env validation, storage, db, auth, git) (6 tests).
+- **Coverage**: vitest now emits `coverage-summary.json` + `lcov.info`; the CI threshold check is no longer a silent no-op.
+- **Disaster-recovery drills**: Implemented `drill:backup-restore`, `drill:redis`, `drill:postgres` scripts that the weekly-drills workflow was already calling.
+- **Versioning**: Root package unified to 1.1.2 (was 1.0.0), matching the CLI.
+- **GitHub-Actions glob fix**: `**` in branch/path filters now spans directories correctly (previously collapsed to a single level); `on: workflow_dispatch` shorthand triggers now work; `!`-negation in `paths:` filters is honored.
+- **OpenAPI**: Documented previously-missing core paths (`/repos`, `/repos/{owner}/{repo}/issues`, `/issues/{number}`, `/branches`, `/labels`).
+
 ## [1.1.0] - 2026-01-22
 
 ### 📚 Documentation (Major Overhaul)

Dockerfile.worker

@@ -11,6 +11,11 @@ RUN for i in 1 2 3; do \
       (echo "bun install attempt $i failed, retrying in 10s..." && sleep 10); \
     done
 
+# Copy source into a staging layer so COPY --from has the files
+FROM base AS source
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
 # Production image
 FROM oven/bun:1 AS runner
 WORKDIR /app
@@ -23,15 +28,15 @@ RUN mkdir -p /data/repositories /data/storage /data/cache && \
     chown -R bun:bun /data
 
 # Copy node_modules and source
-COPY --from=deps --chown=bun:bun /app/node_modules ./node_modules
-COPY --from=deps --chown=bun:bun /app/package.json ./
-COPY --from=deps --chown=bun:bun /app/cli ./cli
-COPY --from=deps --chown=bun:bun /app/tsconfig.json ./
+COPY --from=source --chown=bun:bun /app/node_modules ./node_modules
+COPY --from=source --chown=bun:bun /app/package.json ./
+COPY --from=source --chown=bun:bun /app/cli ./cli
+COPY --from=source --chown=bun:bun /app/tsconfig.json ./
 
 # Copy source files needed for worker
-COPY --from=deps --chown=bun:bun /app/src/lib ./src/lib
-COPY --from=deps --chown=bun:bun /app/src/db ./src/db
-COPY --from=deps --chown=bun:bun /app/scripts/worker.ts ./scripts/worker.ts
+COPY --from=source --chown=bun:bun /app/src/lib ./src/lib
+COPY --from=source --chown=bun:bun /app/src/db ./src/db
+COPY --from=source --chown=bun:bun /app/scripts/worker.ts ./scripts/worker.ts
 
 # Set environment variables
 ENV NODE_ENV=production

astro.config.mjs

@@ -35,6 +35,7 @@ export default defineConfig({
     },
     ssr: {
       noExternal: ["@radix-ui/*"],
+      external: ["node:async_hooks"],
     },
   },
 });

cli/package.json

@@ -1,6 +1,6 @@
 {
     "name": "opencodehub-cli",
-    "version": "1.1.2",
+    "version": "1.2.0",
     "description": "Stack-first PR workflows from your terminal - CLI for OpenCodeHub",
     "author": "Swadhin Biswas <swadhinbiswas@duck.com>",
     "license": "MIT",