6 Commits

Include renames

Author	SHA1	Message	Date
ehoandClaude Opus 4.8	c404995980	ci: replace CodeQL with Semgrep (Gitea-compatible SAST) ... CodeQL is GitHub-only — its analyze step uploads SARIF to GitHub's code-scanning API and assumes a GitHub Security tab; this CI runs on Gitea only, so the job could never go green (it had been red since it was added). Replace it with Semgrep OSS, a plain CLI SAST with no account/platform API, which runs fine on Gitea. - Remove the codeql job (+ its security-events permission) and the schedule trigger (it existed only for codeql; semgrep runs on push + PR). - Add a semgrep job: setup-python + `pip install semgrep` + `semgrep scan --config p/default --config p/csharp --metrics=off`. pip-on-runner (not container:) mirrors the other jobs' model; anonymous registry, telemetry off. - Report-only for now (no --error → job stays green): a local dry-run found 27 findings, mostly CI/config policy (unpinned actions, .npmrc), not app-code vulns. WP-30 tracks triaging them + flipping to --error (a blocking gate). Verified locally: `semgrep scan` runs clean (exit 0 without --error, 306 rules / 450 files). CI behaviour confirmable only on the Gitea runner — watch the run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-22 09:34:13 +02:00
ehoandClaude Opus 4.8	7d3a63a7a5	docs(backlog): WP-30 — CI performance follow-ups ... Capture the deferred CI options from the speed pass (708d4c2) so they aren't lost: node_modules cache to skip npm ci, smaller CI runner image (act_runner label→image, needs admin; or repo-only container: for node-only jobs), path-filtered jobs, a fast split lint job, and an optional lean prod backend image. Notes the constraints (CI not observable from the agent env; compose images aren't used by CI). Added the README row. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-21 20:32:18 +02:00
ehoandClaude Opus 4.8	5761b13dd2	style: format the repo with prettier (green format:check) ... `npm run format:check` (a CI gate) had drifted red across 44 files — pre-existing files plus recently-added ones committed without formatting. Ran `prettier --write .`; no logic changes. Also regenerates documentation.json (compodoc reflects the reformatted component sources). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-21 17:20:42 +02:00
ehoandClaude Opus 4.8	5968ef9030	docs: ADR-0004 stamdata data-file + WP-29 stamdata beheer editor ... Amend ADR-0004 to record what shipped in 0e77faf: a table may live as typed C# or as a typed JSON data-file (the compile-time value check traded for editor ergonomics, caught by StamdataValidationTests instead); valid-time and the generic StamdataCatalog/StamdataTable model; the low-code PR-emitting editor is no longer "future". Add WP-29 backlog file (done) + README row. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-21 13:44:01 +02:00
ehoandClaude Opus 4.8	d4e5a76873	docs: reorganize into project/ + reference/, expand Storybook Foundations ... Move working docs (backlog, prd, roadmap) under docs/project/ and durable docs (architecture ADRs, guides, audits) under docs/reference/; add a docs/README.md index. Update every path reference in code comments, CLAUDE.md, READMEs, and the new-ssp skill. Expand the Storybook Foundations curriculum (Overview, BDD, i18n; rename Layers→Domain-Driven Design) and reorder the sidebar. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-20 20:33:32 +02:00
ehoandClaude Opus 4.8	55a0a2d166	test: split multi-assertion specs into single-behavior tests ... One behavior per test across FE machine/store specs and backend endpoint tests, so a failure names exactly what broke. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-20 20:33:25 +02:00