Release 1.0.0

.github/dependabot.yml

@@ -1,6 +1,6 @@
 version: 2
 updates:
-  # Enable version updates for npm (works with pnpm too)
+  # "npm" also covers pnpm.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
@@ -12,38 +12,30 @@ updates:
     labels:
       - "dependencies"
       - "automated"
-    # Group updates to reduce PR noise
     groups:
-      # Group all Next.js related packages together
       nextjs:
         patterns:
           - "next"
           - "eslint-config-next"
-      # Group all Prisma packages together
       prisma:
         patterns:
           - "@prisma/*"
           - "prisma"
-      # Group all tRPC packages together
       trpc:
         patterns:
           - "@trpc/*"
-      # Group all React Query packages together
       react-query:
         patterns:
           - "@tanstack/react-query*"
-      # Group all TipTap editor packages together
       tiptap:
         patterns:
           - "@tiptap/*"
-      # Group React core packages
       react:
         patterns:
           - "react"
           - "react-dom"
           - "@types/react"
           - "@types/react-dom"
-      # Group TypeScript and ESLint tooling
       dev-tools:
         patterns:
           - "typescript"
@@ -52,24 +44,18 @@ updates:
           - "typescript-eslint"
           - "prettier"
           - "prettier-plugin-*"
-      # Group Tailwind packages
       tailwind:
         patterns:
           - "tailwindcss"
           - "@tailwindcss/*"
-    # Ignore specific updates if needed
     ignore:
       - dependency-name: "next"
         update-types: ["version-update:semver-major"]
-      # typescript-eslint hard-throws on any TS >= 7 (unconditional version guard,
-      # no flag or env var to opt out), so a TS 7 bump breaks `pnpm lint` entirely.
-      # Upstream is targeting TS >= 7.1 and skipping 7.0:
+      # typescript-eslint throws on TS >= 7 and breaks `pnpm lint`; drop once it supports TS 7.1:
       # https://github.com/typescript-eslint/typescript-eslint/issues/10940
-      # Drop this entry once typescript-eslint ships TS 7.1 support.
       - dependency-name: "typescript"
         update-types: ["version-update:semver-major"]
 
-  # Enable version updates for GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
@@ -83,7 +69,6 @@ updates:
       - "github-actions"
       - "automated"
 
-  # Enable version updates for Docker
   - package-ecosystem: "docker"
     directory: "/"
     schedule:

.github/workflows/build-verification.yml

@@ -85,9 +85,6 @@ jobs:
           SKIP_ENV_VALIDATION: 1
           NODE_ENV: production
           NEXT_TELEMETRY_DISABLED: 1
-          # Add other non-secret env vars needed for build
-          # BETTER_AUTH_SECRET: dummy-secret-for-build
-          # BETTER_AUTH_URL: http://localhost:3000
 
       - name: Check build output
         run: |

.github/workflows/database-validation.yml

@@ -28,8 +28,7 @@ jobs:
         with:
           node-version: "22"
 
-      # Ohne `version` liest die Action das `packageManager`-Feld aus
-      # package.json — dieselbe Quelle, die auch pnpm selbst verwendet.
+      # Ohne `version` liest die Action `packageManager` aus package.json.
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
 
@@ -61,11 +60,8 @@ jobs:
         env:
           DATABASE_URL: postgresql://dummy:dummy@localhost:5432/dummy
 
-  # `prisma validate` prüft nur, ob das Schema in sich stimmig ist. Es sagt
-  # nichts darüber, ob die Migrationen auf einer leeren Datenbank überhaupt
-  # durchlaufen — und genau das passiert beim Deploy auf mittwald. Schlägt es
-  # dort fehl, startet die App nicht (30 Versuche, dann Abbruch). Dieser Job
-  # zieht den Fehlschlag in die PR vor.
+  # `prisma validate` prüft nicht, ob die Migrationen auf leerer Datenbank laufen;
+  # scheitern sie beim Deploy auf mittwald, startet die App nicht.
   migrate-deploy:
     name: Migrations & Drift
     runs-on: ubuntu-latest
@@ -118,33 +114,27 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      # Der eigentliche Test: alle Migrationen auf einer jungfräulichen
-      # Datenbank, so wie beim ersten Start auf einem neuen Server.
+      # Alle Migrationen auf leerer Datenbank, wie beim ersten Start auf neuem Server.
       - name: Apply all migrations from scratch
         run: pnpm prisma migrate deploy
 
-      # Fängt den Fall ab, dass jemand schema.prisma ändert und die passende
-      # Migration vergisst: die Datenbank läuft dann auseinander mit dem
-      # Client, den `prisma generate` erzeugt. --exit-code liefert 2, wenn ein
-      # Unterschied bleibt.
+      # Fängt eine vergessene Migration zu einer schema.prisma-Änderung ab;
+      # --exit-code liefert 2 bei Unterschied.
       - name: Check for schema drift
         run: >-
           pnpm prisma migrate diff
           --from-config-datasource
           --to-schema prisma/schema.prisma
           --exit-code
 
-      # Beide Skripte laufen bei jedem Produktions-Deploy automatisch und sind
-      # dort bewusst "non-fatal" — ein Fehler würde also still durchgehen.
-      # Hier dürfen sie scheitern.
+      # Beim Deploy sind beide Skripte "non-fatal"; hier sollen Fehler auffallen.
       - name: Run post-migration setup
         run: pnpm tsx prisma/post-migration-setup.ts
 
       - name: Run slug backfill
         run: pnpm tsx prisma/backfill-slugs.ts
 
-      # Wiederholbarkeit ist die Eigenschaft, auf die sich die Deploy-Skripte
-      # verlassen: Sie laufen bei *jedem* Start, nicht nur beim ersten.
+      # Die Deploy-Skripte laufen bei *jedem* Start, müssen also wiederholbar sein.
       - name: Re-run setup and backfill (idempotency)
         run: |
           pnpm tsx prisma/post-migration-setup.ts

.github/workflows/release-deploy.yml

@@ -1,27 +1,12 @@
-# =============================================================================
-# Release & Deploy Workflow
-# =============================================================================
-# Triggers on every published release, INCLUDING pre-releases.
-#
-#   build-and-push:     builds Docker images and pushes them to GHCR with
-#                       semver tags; "latest" is only applied to full releases
-#   deploy-next:        old server (pwr.lehdev.de) via SSH — receives every
-#                       release AND every pre-release (bleeding edge)
-#   deploy-production:  mittwald container stack via deploy-container-action —
-#                       full releases only
-#
-# GitHub environments used: "next" (old server SSH secrets) and
-# "production" (mittwald API token, stack id, app secrets — see deploy/stack.yaml
-# for the full list of values the stack file expects).
-# =============================================================================
+# Runs on every release incl. pre-releases: the old server (env "next") gets all of them,
+# mittwald (env "production", values see deploy/stack.yaml) only full releases.
 
 name: Release & Deploy
 
 on:
   release:
     types: [published]
 
-# Prevent concurrent deployments
 concurrency:
   group: release-deploy
   cancel-in-progress: false
@@ -34,9 +19,6 @@ env:
   CRON_IMAGE_NAME: nichtlehdev/pwr-cron
 
 jobs:
-  # ===========================================================================
-  # Build and Push Docker Images (all releases, including pre-releases)
-  # ===========================================================================
   build-and-push:
     name: Build & Push Docker Image
     runs-on: ubuntu-latest
@@ -46,8 +28,7 @@ jobs:
       packages: write
 
     outputs:
-      # Clean semver version without leading "v" (e.g. 1.4.2 or 1.5.0-rc.1);
-      # used by the deploy jobs to pin the exact image tag.
+      # Semver without leading "v" (e.g. 1.5.0-rc.1); pins the image tag for the deploys.
       version: ${{ steps.meta.outputs.version }}
       image-tag: ${{ steps.meta.outputs.tags }}
       image-digest: ${{ steps.build.outputs.digest }}
@@ -136,9 +117,6 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  # ===========================================================================
-  # Deploy to Old Server (every release and pre-release)
-  # ===========================================================================
   deploy-next:
     name: Deploy to Old Server (next)
     runs-on: ubuntu-latest
@@ -173,34 +151,22 @@ jobs:
           port: ${{ secrets.SERVER_PORT }}
           envs: CR_PAT
           script: |
-            # Navigate to project directory
             cd ${{ secrets.SERVER_PROJECT_PATH }}
 
-            # Pin the exact release version for docker compose interpolation
-            # (pre-releases are never tagged "latest")
+            # Pre-releases are never tagged "latest", so pin the exact version.
             export APP_IMAGE_TAG=${{ needs.build-and-push.outputs.version }}
 
-            # Login to GitHub Container Registry
             echo "${{ secrets.CR_PAT }}" | docker login ghcr.io -u nichtlehdev --password-stdin
 
-            # Pull the release images
             docker pull ghcr.io/nichtlehdev/pwr-web:$APP_IMAGE_TAG
             docker pull ghcr.io/nichtlehdev/pwr-backup:$APP_IMAGE_TAG
             docker pull ghcr.io/nichtlehdev/pwr-cron:$APP_IMAGE_TAG
 
-            # Update the running containers
             docker compose -f docker-compose.prod.yml pull
             docker compose -f docker-compose.prod.yml up -d
 
-            # Cleanup old images.
-            #
-            # This server receives every pre-release, so each deploy leaves
-            # three more tagged images behind — that, not dangling layers, is
-            # what fills the disk. Only our own repositories are touched, and
-            # only tags other than the one just deployed (plus "latest", which
-            # a manual `docker compose up` without APP_IMAGE_TAG falls back
-            # to). Images belonging to anything else on this server are left
-            # alone, which `docker image prune -af` would not do.
+            # Every pre-release leaves three tagged images behind. Remove only our own old tags
+            # ("latest" stays as fallback without APP_IMAGE_TAG); `prune -af` would hit other images.
             echo "Disk before cleanup:"
             docker system df --format 'table {{.Type}}\t{{.Size}}\t{{.Reclaimable}}' || true
 
@@ -213,8 +179,6 @@ jobs:
                 | xargs -r docker rmi 2>/dev/null || true
             done
 
-            # Dangling layers left over from the above, plus stopped
-            # containers' writable layers.
             docker image prune -f
 
             echo "Disk after cleanup:"
@@ -233,7 +197,6 @@ jobs:
             # Wait for container to be healthy
             sleep 10
 
-            # Check if containers are running
             if docker ps | grep -q posaunenwerk-app; then
               echo "✅ App container is running"
             else
@@ -258,9 +221,6 @@ jobs:
               exit 1
             fi
 
-  # ===========================================================================
-  # Deploy to mittwald (full releases only)
-  # ===========================================================================
   deploy-production:
     name: Deploy to mittwald (production)
     runs-on: ubuntu-latest
@@ -279,8 +239,7 @@ jobs:
       - name: Deploy stack to mittwald
         uses: mittwald/deploy-container-action@v1
         env:
-          # Every {{ .Env.* }} placeholder in deploy/stack.yaml must be
-          # defined here (see the stack file header for the full list).
+          # Every {{ .Env.* }} placeholder in deploy/stack.yaml must be defined here.
           RELEASE_VERSION: ${{ needs.build-and-push.outputs.version }}
           POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
           APP_URL: ${{ vars.APP_URL }}