Initial push of Plunk Next

.github/pull_request_template.md

@@ -0,0 +1,45 @@
+## Description
+
+<!-- Describe your changes in detail -->
+
+## Type of Change
+
+<!-- Mark the appropriate option with an 'x' -->
+
+- [ ] `feat:` New feature (MINOR version bump)
+- [ ] `fix:` Bug fix (PATCH version bump)
+- [ ] `feat!:` Breaking change - new feature (MAJOR version bump)
+- [ ] `fix!:` Breaking change - bug fix (MAJOR version bump)
+- [ ] `docs:` Documentation update (no version bump)
+- [ ] `chore:` Maintenance/dependencies (no version bump)
+- [ ] `refactor:` Code refactoring (no version bump)
+- [ ] `test:` Adding tests (no version bump)
+- [ ] `perf:` Performance improvement (PATCH version bump)
+
+## PR Title Format
+
+<!--
+Your PR title should follow conventional commits format:
+✅ feat: add email template editor
+✅ fix: resolve memory leak in worker
+✅ feat!: redesign API authentication
+❌ Added new feature (missing type prefix)
+
+See VERSIONING.md for more details
+-->
+
+## Testing
+
+<!-- Describe how you tested your changes -->
+
+## Checklist
+
+- [ ] PR title follows conventional commits format
+- [ ] Code builds successfully
+- [ ] Tests pass locally
+- [ ] Documentation updated (if needed)
+
+## Related Issues
+
+<!-- Link any related issues here -->
+Closes #

.github/workflows/ci.yml

@@ -0,0 +1,197 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - next
+  pull_request:
+    branches:
+      - next
+
+jobs:
+  test:
+    name: Test Suite
+    runs-on: ubuntu-latest
+
+    # Service containers for database, Redis, and Minio
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: plunk_test
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
+      redis:
+        image: redis:7-alpine
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 6379:6379
+
+      minio:
+        image: minio/minio:edge-cicd
+        env:
+          MINIO_ROOT_USER: plunk
+          MINIO_ROOT_PASSWORD: plunkminiopass
+        ports:
+          - 9000:9000
+        options: >-
+          --health-cmd "curl -f http://localhost:9000/minio/health/live || exit 1"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'yarn'
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Setup environment variables
+        run: |
+          cat > .env << EOF
+          NODE_ENV=test
+
+          # Database
+          DATABASE_URL=postgresql://postgres:postgres@localhost:5432/plunk_test
+          DIRECT_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/plunk_test
+
+          # Redis
+          REDIS_URL=redis://localhost:6379
+
+          # Security
+          JWT_SECRET=test-jwt-secret-for-ci-only
+
+          # S3 (Minio)
+          S3_ENDPOINT=http://localhost:9000
+          S3_ACCESS_KEY_ID=plunk
+          S3_ACCESS_KEY_SECRET=plunkminiopass
+          S3_BUCKET=uploads
+          S3_PUBLIC_URL=http://localhost:9000/uploads
+          S3_FORCE_PATH_STYLE=true
+
+          # Application URLs (not needed for tests but required by schema)
+          API_URI=http://localhost:8080
+          DASHBOARD_URI=http://localhost:3000
+          LANDING_URI=http://localhost:4000
+          WIKI_URI=http://localhost:1000
+
+          # AWS SES (mock values for tests)
+          AWS_SES_REGION=us-east-1
+          AWS_SES_ACCESS_KEY_ID=mock
+          AWS_SES_SECRET_ACCESS_KEY=mock
+          SES_CONFIGURATION_SET=test
+          SES_CONFIGURATION_SET_NO_TRACKING=test-no-tracking
+          EOF
+
+      - name: Build shared packages
+        run: yarn build --filter="@plunk/shared" --filter="@plunk/db"
+
+      - name: Generate Prisma Client
+        run: yarn workspace @plunk/db db:generate
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/plunk_test
+          DIRECT_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/plunk_test
+
+      - name: Run database migrations
+        run: yarn workspace @plunk/db migrate:prod
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/plunk_test
+          DIRECT_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/plunk_test
+
+      - name: Create MinIO bucket
+        run: |
+          docker run --rm --network host \
+            --entrypoint /bin/sh minio/mc:latest \
+            -c "mc alias set local http://localhost:9000 plunk plunkminiopass && \
+                mc mb local/uploads --ignore-existing"
+
+      - name: Run tests
+        run: yarn test:run
+        env:
+          NODE_ENV: test
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results
+          path: |
+            coverage/
+            **/*.test.ts.log
+          retention-days: 7
+
+  lint:
+    name: Lint & Type Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'yarn'
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Setup minimal env (for build)
+        run: |
+          cat > .env << EOF
+          NODE_ENV=development
+          DATABASE_URL=postgresql://postgres:postgres@localhost:5432/plunk
+          DIRECT_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/plunk
+          REDIS_URL=redis://localhost:6379
+          JWT_SECRET=test
+
+          # S3 (minimal - not needed but schema may require)
+          S3_ENDPOINT=http://localhost:9000
+          S3_ACCESS_KEY_ID=mock
+          S3_ACCESS_KEY_SECRET=mock
+          S3_BUCKET=uploads
+          S3_PUBLIC_URL=http://localhost:9000/uploads
+          S3_FORCE_PATH_STYLE=true
+
+          # Application URLs
+          API_URI=http://localhost:8080
+          DASHBOARD_URI=http://localhost:3000
+          LANDING_URI=http://localhost:4000
+          WIKI_URI=http://localhost:1000
+
+          # AWS SES (mock)
+          AWS_SES_REGION=us-east-1
+          AWS_SES_ACCESS_KEY_ID=mock
+          AWS_SES_SECRET_ACCESS_KEY=mock
+          SES_CONFIGURATION_SET=test
+          SES_CONFIGURATION_SET_NO_TRACKING=test
+          EOF
+
+      - name: Build shared packages
+        run: yarn build --filter="@plunk/shared" --filter="@plunk/db"
+
+      - name: Run linter
+        run: yarn lint
+
+      - name: Type check
+        run: yarn build --filter="api" --filter="web" --filter="landing" --filter="wiki" || true

.github/workflows/docker-build-canary.yml

@@ -1,32 +0,0 @@
-name: Build and Push Docker image (Canary)
-
-on:
-  push:
-    branches:
-      - canary
-
-jobs:
-  docker:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@v2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v2
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: |
-            driaug/plunk:canary
-          platforms: linux/amd64,linux/arm64

.github/workflows/docker-build-prod.yml

@@ -1,37 +0,0 @@
-name: Build and Push Docker image (Production)
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  docker:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@v2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-
-      - name: Get version from package.json
-        id: get_version
-        run: echo "VERSION=$(jq -r .version package.json)" >> $GITHUB_ENV
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v2
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: |
-            driaug/plunk:${{ env.VERSION }}
-            driaug/plunk:latest
-          platforms: linux/amd64,linux/arm64

.github/workflows/docker-publish.yml

@@ -0,0 +1,134 @@
+name: Docker Build and Publish
+
+on:
+  push:
+    branches:
+      - next
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Turborepo cache
+        uses: actions/cache@v4
+        with:
+          path: .turbo
+          key: ${{ runner.os }}-turbo-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-turbo-
+
+      - name: Check if this commit is a release
+        id: check-release
+        run: |
+          git fetch --tags
+
+          # Check if this is a release-please commit
+          if git log -1 --pretty=%B | grep -q "release-please--branches--next"; then
+            echo "This is a release commit, waiting for tag..."
+            # Wait up to 60 seconds for release-please to create the tag
+            for i in {1..12}; do
+              sleep 5
+              git fetch --tags
+              TAG=$(git tag --points-at HEAD | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || echo "")
+              if [[ -n "$TAG" ]]; then
+                echo "is_release=true" >> $GITHUB_OUTPUT
+                echo "release_tag=$TAG" >> $GITHUB_OUTPUT
+                echo "Found release tag: $TAG"
+                exit 0
+              fi
+              echo "Waiting for tag... ($i/12)"
+            done
+            echo "ERROR: Release commit but no tag found after 60s"
+            exit 1
+          else
+            # Regular commit, check for tag immediately
+            TAG=$(git tag --points-at HEAD | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || echo "")
+            if [[ -n "$TAG" ]]; then
+              echo "is_release=true" >> $GITHUB_OUTPUT
+              echo "release_tag=$TAG" >> $GITHUB_OUTPUT
+              echo "This is a release: $TAG"
+            else
+              echo "is_release=false" >> $GITHUB_OUTPUT
+              echo "This is a regular commit"
+            fi
+          fi
+
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
+          docker system prune -af --volumes
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          buildkitd-flags: --debug
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute tags
+        id: tags
+        run: |
+          if [[ "${{ steps.check-release.outputs.is_release }}" == "true" ]]; then
+            # This is a release: use semver tags
+            TAG="${{ steps.check-release.outputs.release_tag }}"
+            VERSION="${TAG#v}"
+            MAJOR=$(echo "$VERSION" | cut -d. -f1)
+            MINOR=$(echo "$VERSION" | cut -d. -f2)
+            TAGS="${VERSION},${MAJOR}.${MINOR},${MAJOR},latest"
+            echo "Building RELEASE with tags: $TAGS"
+          else
+            # Regular commit: use SHA tags
+            SHORT_SHA="${GITHUB_SHA:0:7}"
+            TAGS="sha-${SHORT_SHA},latest"
+            echo "Building COMMIT with tags: $TAGS"
+          fi
+          echo "tags=$TAGS" >> $GITHUB_OUTPUT
+
+      - name: Build and push
+        run: |
+          IMAGE="ghcr.io/${{ github.repository }}"
+          TAGS="${{ steps.tags.outputs.tags }}"
+
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            $(echo "$TAGS" | tr ',' '\n' | sed "s|^|--tag ${IMAGE}:|") \
+            --cache-from type=gha \
+            --cache-to type=gha,mode=max \
+            --build-arg BUILDTIME="$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
+            --build-arg VERSION="${{ github.ref_name }}" \
+            --build-arg REVISION="${{ github.sha }}" \
+            .
+
+      - name: Summary
+        run: |
+          IMAGE="ghcr.io/${{ github.repository }}"
+          TAGS="${{ steps.tags.outputs.tags }}"
+          echo "## Docker Image Published 🚀" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if [[ "${{ steps.check-release.outputs.is_release }}" == "true" ]]; then
+            echo "**Type:** Release (${{ steps.check-release.outputs.release_tag }})" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "**Type:** Commit (sha-${GITHUB_SHA:0:7})" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Tags:**" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "$TAGS" | tr ',' '\n' | sed "s|^|${IMAGE}:|" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY

.github/workflows/release.yml

@@ -0,0 +1,24 @@
+name: Release Please
+
+on:
+  push:
+    branches:
+      - next
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Release Please
+        uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}