Merge pull request #64 from GeiserX/ai/project-health

feat: project health tooling, security hardening, and community files

Author: GeiserX

.cursor/rules/project.mdc

@@ -0,0 +1,30 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.py]
+indent_style = space
+indent_size = 4
+
+[*.{yml,yaml}]
+indent_style = space
+indent_size = 2
+
+[*.{json,toml}]
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Dockerfile*]
+indent_style = space
+indent_size = 4
+
+[*.sh]
+indent_style = space
+indent_size = 2

.editorconfig

@@ -0,0 +1,16 @@
+# Default owners for all files
+* @GeiserX
+
+# Core application
+/src/ @GeiserX
+/alembic/ @GeiserX
+
+# Infrastructure and CI
+/.github/ @GeiserX
+/Dockerfile @GeiserX
+/Dockerfile.viewer @GeiserX
+/docker-compose.yml @GeiserX
+
+# Documentation
+/docs/ @GeiserX
+/*.md @GeiserX

.github/CODEOWNERS

@@ -0,0 +1,70 @@
+version: 2
+
+updates:
+  # Python (pip) dependencies
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "deps"
+    labels:
+      - "dependencies"
+      - "automated"
+    groups:
+      minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    ignore:
+      # Ignore major version updates for stability
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "ci"
+    labels:
+      - "ci"
+      - "automated"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  # Docker base images
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "docker"
+    labels:
+      - "docker"
+      - "automated"
+
+  # Docker viewer image
+  - package-ecosystem: "docker"
+    directory: "/"
+    directories:
+      - "/Dockerfile.viewer"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "docker"
+    labels:
+      - "docker"
+      - "automated"

.github/dependabot.yml

@@ -0,0 +1,46 @@
+## Summary
+
+<!-- Describe the change in 1-2 bullets -->
+
+-
+
+## Type of Change
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that causes existing functionality to change)
+- [ ] Documentation update
+- [ ] Infrastructure/CI change
+
+## Database Changes
+
+- [ ] Schema changes (Alembic migration required)
+- [ ] Data migration script added in `scripts/`
+- [ ] No database changes
+
+## Data Consistency Checklist
+
+<!-- Required when modifying database code (see AGENTS.md) -->
+
+- [ ] All `chat_id` values use marked format (via `_get_marked_id()`)
+- [ ] All datetime values pass through `_strip_tz()` before DB operations
+- [ ] INSERT and UPDATE operations handle the same fields identically
+
+## Testing
+
+- [ ] Tests pass locally (`python -m pytest tests/ -v`)
+- [ ] Linting passes (`ruff check .`)
+- [ ] Formatting passes (`ruff format --check .`)
+- [ ] Manually tested in development environment
+
+## Security Checklist
+
+- [ ] No secrets or credentials committed
+- [ ] User input properly validated/sanitized
+- [ ] Authentication/authorization properly checked
+
+## Deployment Notes
+
+<!-- Any special considerations for deployment? Docker image rebuild needed? -->
+
+-

.github/pull_request_template.md

@@ -0,0 +1,32 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  schedule:
+    # Run weekly on Sundays at 04:00 UTC
+    - cron: "0 4 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: python
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:python"

.github/workflows/codeql.yml

@@ -53,7 +53,7 @@ jobs:
 
       # Build and push main backup image
       - name: Build and push backup image (dev)
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: Dockerfile
@@ -64,7 +64,7 @@ jobs:
 
       # Build and push viewer image
       - name: Build and push viewer image (dev)
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: Dockerfile.viewer