fix(deps): remove safety==2.3.5 to resolve packaging dependency conflict

Root cause: safety==2.3.5 pins packaging<22.0 while black==23.12.1 requires
packaging>=22.0. pip cannot satisfy both constraints simultaneously.
This caused ResolutionImpossible across ALL environments:
  - GitHub CI test job (pip install -r requirements.txt failed)
  - GitHub Docker build job (Dockerfile RUN pip install failed)
  - Docker Hub push job (image failed to build)

Fix: Removed safety from requirements.txt entirely. safety is a security
audit CLI tool — it belongs in a separate audit step, not in app deps.
To audit manually: pip install safety && safety check

fix(ci): rewrite docker-publish.yml to eliminate invalid tag format

Root cause: docker/metadata-action with type=sha,prefix={{branch}}-
generated tag credify:-<sha> (leading hyphen) on PR events where the
branch context is empty, causing: invalid tag: invalid reference format.

Fix: Replaced metadata-action with hardcoded clean tags for push events
and a separate build-only (push: false) step for PRs. PRs now validate
the image builds without attempting any registry operations.

Author: udaycodespace

.github/workflows/ci.yml

@@ -10,7 +10,6 @@ jobs:
   test:
     name: Run Tests
     runs-on: ubuntu-latest
-    continue-on-error: true   # Job-level: allows downstream jobs to run even if tests fail
 
     steps:
     - name: Checkout code
@@ -33,7 +32,6 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         pip install -r requirements.txt
-        pip install pytest pytest-cov
 
     - name: Run tests
       run: |
@@ -43,7 +41,7 @@ jobs:
     name: Build Docker Image
     needs: test
     runs-on: ubuntu-latest
-    if: always()   # Always run build even if tests had failures
+    if: always()
 
     steps:
     - name: Checkout code
@@ -56,7 +54,7 @@ jobs:
       run: |
         docker build -t credify:${{ github.sha }} .
 
-    - name: Test Docker image
+    - name: Test Docker image starts correctly
       run: |
         docker run -d -p 5000:5000 --name test-app \
           -e DATABASE_URL=sqlite:////tmp/credify.db \

.github/workflows/docker-publish.yml

@@ -19,40 +19,35 @@ jobs:
       uses: docker/setup-buildx-action@v3
 
     - name: Login to Docker Hub
-      # Only login and push when triggered by a push event (not pull_request).
-      # Secrets are not available to pull_request workflows from forks,
-      # and push-to-registry is unsafe from unreviewed PR branches.
+      # Secrets are NOT available on pull_request events — skip login on PRs
       if: github.event_name == 'push'
       uses: docker/login-action@v3
       with:
         username: ${{ secrets.DOCKER_USERNAME }}
         password: ${{ secrets.DOCKER_TOKEN }}
 
-    - name: Extract metadata
-      id: meta
-      uses: docker/metadata-action@v5
+    - name: Build and push Docker image (push event)
+      # On push: build + push to Docker Hub with clean, valid tags
+      if: github.event_name == 'push'
+      uses: docker/build-push-action@v5
       with:
-        images: ${{ secrets.DOCKER_USERNAME }}/credify
+        context: .
+        push: true
         tags: |
-          type=ref,event=branch
-          type=sha,prefix={{branch}}-
-          type=raw,value=latest,enable={{is_default_branch}}
-          type=semver,pattern={{version}}
-          type=semver,pattern={{major}}.{{minor}}
-          type=raw,value=v2.1.0,enable={{is_default_branch}}
-        flavor: |
-          latest=auto
-
-    - name: Build and push Docker image
+          ${{ secrets.DOCKER_USERNAME }}/credify:latest
+          ${{ secrets.DOCKER_USERNAME }}/credify:v2.1.0
+          ${{ secrets.DOCKER_USERNAME }}/credify:sha-${{ github.sha }}
+        cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/credify:buildcache
+        cache-to: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/credify:buildcache,mode=max
+
+    - name: Build only (pull_request validation — no push)
+      # On PR: just validate the image builds cleanly — no login, no push
+      if: github.event_name == 'pull_request'
       uses: docker/build-push-action@v5
       with:
         context: .
-        # Only push on actual push events — NOT on pull_request
-        push: ${{ github.event_name == 'push' }}
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
-        cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/credify:buildcache
-        cache-to: ${{ github.event_name == 'push' && format('type=registry,ref={0}/credify:buildcache,mode=max', secrets.DOCKER_USERNAME) || '' }}
+        push: false
+        tags: credify:pr-validate
 
     - name: Image digest
-      run: echo "✅ Docker build completed successfully!"
+      run: echo "✅ Docker build step completed."

requirements.txt

@@ -43,4 +43,5 @@ flake8==7.0.0
 isort==5.13.2
 mypy==1.8.0
 pre-commit==3.6.0
-safety==2.3.5
+# safety removed: safety==2.3.5 conflicts with black>=23 (packaging<22 vs packaging>=22)
+# Run safety audits separately: pip install safety && safety check