Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 61 additions & 0 deletions .dockerignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
# Git
.git
.gitignore

# Python
__pycache__
*.py[cod]
*$py.class
*.so
.Python
.venv
venv/
ENV/
env/
.eggs
*.egg-info/
.mypy_cache/
.pytest_cache/
.ruff_cache/
htmlcov/
.coverage
coverage.xml

# IDE
.idea/
.vscode/
*.swp
*.swo

# Build artifacts
build/
dist/
*.egg

# Documentation
docs/
*.md
!README.md

# Tests (not needed in production image)
tests/
pytest.ini

# Development files
.pre-commit-config.yaml
Makefile
docker-compose*.yml

# Templates (not needed in production)
templates/

# Tools (not needed in production)
tools/

# Node modules (if any)
node_modules/

# Misc
.DS_Store
*.log
*.tmp
75 changes: 75 additions & 0 deletions docker/Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
# CodeFlow Engine Docker Image
# Multi-stage build for optimized production image

# Stage 1: Build stage
FROM python:3.12-slim as builder

WORKDIR /app

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential \
curl \
git \
libpq-dev \
&& rm -rf /var/lib/apt/lists/*

# Install poetry
RUN pip install --no-cache-dir poetry==1.8.3

# Copy dependency files
COPY pyproject.toml poetry.lock ./

# Configure poetry to not create virtual environment (we're in a container)
RUN poetry config virtualenvs.create false
Comment on lines +17 to +24
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Poetry package manager latest stable version 2025 Poetry 1.8.3 known issues

💡 Result:

Short answer

  • Latest stable Poetry (as of Dec 24, 2025): Poetry 2.2.1 (released Sep 21, 2025). [1][2]

Known issues with Poetry 1.8.3

  • Fails to handle wheel packages using metadata format 2.4 (locking/install errors); reported and tracked on GitHub. [3]
  • Version-solving/constraint resolution bugs (incorrect Python-range/solver errors) reported for 1.8.3. [4]
  • Multiple disclosed vulnerabilities affect older 1.x releases (security advisories list versions <1.8.4 as impacted). Upgrading to a 2.x release is recommended. [5][6]

If you want, I can link specific issue threads or show the exact error texts and suggested workarounds.

Sources

  1. Poetry releases (GitHub) — release 2.2.1. [1] (github.com)
  2. Poetry blog — 2.x release announcements. [2] (python-poetry.org)
  3. Issue: wheel metadata 2.4 causing install/lock failures (Poetry 1.8.3). [3] (github.com)
  4. Issue: version solving failures reported on 1.8.3. [4] (github.com)
  5. Vulnerability listings / advisories mentioning affected 1.8.x versions. [5] (data.safetycli.com)

Citations:


Upgrade Poetry to version 2.2.1 or latest 2.x release.

Poetry 1.8.3 is outdated and has known issues: it fails to handle wheel packages using metadata format 2.4, has version-solving/constraint resolution bugs, and is affected by disclosed vulnerabilities. The latest stable version is 2.2.1 (released September 2025). Upgrade the Dockerfile to use Poetry 2.2.1 or a newer 2.x release.

🤖 Prompt for AI Agents
In docker/Dockerfile around lines 17 to 24, the Dockerfile pins Poetry to the
old 1.8.3 release; update the installation to Poetry 2.x (preferably pin to
2.2.1 or a recent 2.x patch) by changing the pip install invocation to install
poetry==2.2.1 (or poetry>=2.2.1,<3.0) and then rebuild the image; after
updating, validate pyproject.lock compatibility by running poetry lock or a
dry-run install locally and adjust any CI/build steps if they rely on Poetry v1
behavior.


# Install dependencies (without dev dependencies by default)
ARG RUN_TESTS=false
RUN if [ "$RUN_TESTS" = "true" ]; then \
poetry install --no-interaction --no-ansi; \
else \
poetry install --no-interaction --no-ansi --only main,server,database,resilience; \
fi
Comment on lines +26 to +32
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify Poetry dependency groups in pyproject.toml

if [ -f "pyproject.toml" ]; then
    echo "=== Checking for Poetry dependency groups ==="
    
    # Look for all [tool.poetry.group.*] sections
    echo "Group sections found:"
    rg -n '^\[tool\.poetry\.group\.' pyproject.toml
    
    # Also check for dependencies section
    echo -e "\n[tool.poetry] dependencies section:"
    rg -n '^\[tool\.poetry\.dependencies\]' pyproject.toml
    
    # Extract the actual group names defined
    echo -e "\n=== Extracting defined group names ==="
    rg '^\[tool\.poetry\.group\.(\w+)' -o -r '$1' pyproject.toml | sort -u
else
    echo "ERROR: pyproject.toml not found in repository"
fi

Repository: JustAGhosT/codeflow-engine

Length of output: 660


Fix undefined Poetry group "main" in dependency installation.

The --only main,server,database,resilience flag on line 31 references a group called "main" that doesn't exist in pyproject.toml. The defined groups are: ai, database, dev, memory, monitoring, resilience, server, sidecar. The group main is not a valid Poetry group name; remove it from the --only list or replace it with a valid group that exists in your pyproject.toml.

🤖 Prompt for AI Agents
In docker/Dockerfile around lines 26 to 32, the Poetry install uses `--only
main,server,database,resilience` but "main" is not a defined group in
pyproject.toml; update the RUN command to remove "main" or replace it with one
or more valid groups (for example ai,memory,monitoring,sidecar as needed) so the
`--only` list contains only existing group names, then rebuild to verify Poetry
no longer errors on unknown groups.


# Stage 2: Production stage
FROM python:3.12-slim as production

WORKDIR /app

# Install runtime dependencies only
RUN apt-get update && apt-get install -y --no-install-recommends \
libpq5 \
curl \
&& rm -rf /var/lib/apt/lists/* \
&& useradd --create-home --shell /bin/bash codeflow

# Copy installed packages from builder
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin

# Copy application code
COPY codeflow_engine/ ./codeflow_engine/
COPY pyproject.toml ./
COPY alembic/ ./alembic/

# Set ownership to non-root user
RUN chown -R codeflow:codeflow /app

# Switch to non-root user
USER codeflow

# Environment variables
ENV PYTHONUNBUFFERED=1 \
PYTHONDONTWRITEBYTECODE=1 \
HOST=0.0.0.0 \
PORT=8080

# Expose the application port
EXPOSE 8080

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
CMD curl -f http://localhost:8080/health || exit 1

# Default command: run the server
CMD ["python", "-m", "codeflow_engine.server"]
34 changes: 17 additions & 17 deletions docs/development/CODE_QUALITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -56,53 +56,53 @@ Pre-commit hooks are automatically installed and will run on every commit. The h

### Using the Python Script

The `scripts/code_quality.py` script provides convenient commands:
The `tools/scripts/code_quality.py` script provides convenient commands:

```bash
# Format code
python scripts/code_quality.py format
python tools/scripts/code_quality.py format

# Run linting tools
python scripts/code_quality.py lint
python tools/scripts/code_quality.py lint

# Run tests
python scripts/code_quality.py test
python tools/scripts/code_quality.py test

# Check dependencies for vulnerabilities
python scripts/code_quality.py security
python tools/scripts/code_quality.py security

# Install pre-commit hooks
python scripts/code_quality.py pre-commit install
python tools/scripts/code_quality.py pre-commit install

# Run pre-commit hooks manually
python scripts/code_quality.py pre-commit run
python tools/scripts/code_quality.py pre-commit run

# Run all quality checks
python scripts/code_quality.py check
python tools/scripts/code_quality.py check
```

### Using the Windows Batch Script

For Windows users, `scripts/code_quality.bat` provides the same functionality:
For Windows users, `tools/scripts/code_quality.bat` provides the same functionality:

```cmd
# Format code
scripts\code_quality.bat format
tools\scripts\code_quality.bat format

# Run linting tools
scripts\code_quality.bat lint
tools\scripts\code_quality.bat lint

# Run tests
scripts\code_quality.bat test
tools\scripts\code_quality.bat test

# Check dependencies for vulnerabilities
scripts\code_quality.bat security
tools\scripts\code_quality.bat security

# Install pre-commit hooks
scripts\code_quality.bat install
tools\scripts\code_quality.bat install

# Run all quality checks
scripts\code_quality.bat check
tools\scripts\code_quality.bat check
```

### Direct Tool Usage
Expand Down Expand Up @@ -181,13 +181,13 @@ python -m pre_commit install
python -m pre_commit run --all-files

# Or use the comprehensive check
python scripts/code_quality.py check
python tools/scripts/code_quality.py check
```

## Development Workflow

1. **Before committing**: Pre-commit hooks run automatically
2. **Manual checks**: Use `scripts/code_quality.py check` for comprehensive validation
2. **Manual checks**: Use `tools/scripts/code_quality.py check` for comprehensive validation
3. **Fix issues**: Address any linting or formatting issues
4. **Commit**: Use conventional commit messages (enforced by commitizen)

Expand Down
36 changes: 18 additions & 18 deletions docs/development/MIGRATION_GUIDE.md
Original file line number Diff line number Diff line change
Expand Up @@ -162,7 +162,7 @@ New validation scripts have been created to maintain repository health:
### 1. Import Validation

```bash
python scripts/validate_imports.py
python tools/scripts/validate_imports.py
```

- Scans all Python files for broken imports
Expand All @@ -172,7 +172,7 @@ python scripts/validate_imports.py
### 2. Link Validation

```bash
python scripts/validate_links.py
python tools/scripts/validate_links.py
```

- Validates all Markdown links in documentation
Expand All @@ -182,7 +182,7 @@ python scripts/validate_links.py
### 3. Configuration Validation

```bash
python scripts/validate_configs.py
python tools/scripts/validate_configs.py
```

- Validates all configuration files (YAML, JSON, INI)
Expand All @@ -192,7 +192,7 @@ python scripts/validate_configs.py
### 4. Template Validation

```bash
python scripts/validate_templates.py
python tools/scripts/validate_templates.py
```

- Validates all template files
Expand All @@ -202,7 +202,7 @@ python scripts/validate_templates.py
### 5. Build System Validation

```bash
python scripts/validate_build_system.py
python tools/scripts/validate_build_system.py
```

- Validates pyproject.toml configuration
Expand Down Expand Up @@ -268,11 +268,11 @@ The pre-commit configuration has been updated to include:

```bash
# Run all validation scripts
python scripts/validate_imports.py
python scripts/validate_links.py
python scripts/validate_configs.py
python scripts/validate_templates.py
python scripts/validate_build_system.py
python tools/scripts/validate_imports.py
python tools/scripts/validate_links.py
python tools/scripts/validate_configs.py
python tools/scripts/validate_templates.py
python tools/scripts/validate_build_system.py
```

### Expected Results
Expand All @@ -288,7 +288,7 @@ python scripts/validate_build_system.py
1. **Import Errors After Reorganization:**

```bash
python scripts/validate_imports.py
python tools/scripts/validate_imports.py
```

- Check the generated report for specific import issues
Expand All @@ -297,7 +297,7 @@ python scripts/validate_build_system.py
2. **Broken Documentation Links:**

```bash
python scripts/validate_links.py
python tools/scripts/validate_links.py
```

- Review the link validation report
Expand All @@ -306,7 +306,7 @@ python scripts/validate_build_system.py
3. **Configuration Issues:**

```bash
python scripts/validate_configs.py
python tools/scripts/validate_configs.py
```

- Check for configuration validation errors
Expand All @@ -329,9 +329,9 @@ Run validation scripts regularly to maintain repository health:

```bash
# Weekly validation
python scripts/validate_imports.py
python scripts/validate_links.py
python scripts/validate_configs.py
python tools/scripts/validate_imports.py
python tools/scripts/validate_links.py
python tools/scripts/validate_configs.py
```

### Adding New Files
Expand All @@ -341,14 +341,14 @@ When adding new files, ensure they follow the established organization:
- **Documentation**: Place in appropriate `docs/` subdirectory
- **Templates**: Use existing template categories or create new ones
- **Configuration**: Add to `configs/` with proper validation
- **Scripts**: Add to `scripts/` with validation capabilities
- **Scripts**: Add to `tools/scripts/` with validation capabilities

### Updating Dependencies

When updating dependencies:

1. Update `pyproject.toml` only
2. Run `python scripts/validate_build_system.py`
2. Run `python tools/scripts/validate_build_system.py`
3. Test installation with new dependencies

## Conclusion
Expand Down
16 changes: 8 additions & 8 deletions docs/development/WINDOWS_DEVELOPMENT.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,12 @@ Instead of relying on pre-commit hooks, use our provided scripts for code qualit

```cmd
# Run all code quality checks before committing
scripts\code_quality.bat check
python -m codeflow_engine.actions.quality_engine --mode comprehensive

# Or run individual tools
scripts\code_quality.bat format
scripts\code_quality.bat lint
scripts\code_quality.bat test
# Or run with different modes
python -m codeflow_engine.actions.quality_engine --mode fast
python -m codeflow_engine.actions.quality_engine --mode smart
python -m codeflow_engine.actions.quality_engine --mode ai_enhanced
```

#### Option 2: Install Standard Python 3.13.5 (Highly Recommended)
Expand All @@ -55,7 +55,7 @@ If you want to keep Windows Store Python, you can create manual git hooks:
```bash
#!/bin/sh
echo "Running code quality checks..."
python scripts/code_quality.py check
python -m codeflow_engine.actions.quality_engine --mode fast
if [ $? -ne 0 ]; then
echo "Code quality checks failed. Please fix issues before committing."
exit 1
Expand All @@ -79,8 +79,8 @@ python -m isort . --profile black
python -m flake8 . --max-line-length 100
python -m mypy . --config-file pyproject.toml

# Or use our convenience script
scripts\code_quality.bat check
# Or use our convenience module
python -m codeflow_engine.actions.quality_engine --mode comprehensive
```

### Commit Message Format
Expand Down
4 changes: 2 additions & 2 deletions docs/testing/COVERAGE_GUIDE.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,13 +57,13 @@ open htmlcov/index.html

**Bash:**
```bash
./scripts/check-coverage.sh [threshold]
./tools/coverage/check-coverage.sh [threshold]
# Default threshold: 70%
```

**PowerShell:**
```powershell
.\scripts\check-coverage.ps1 -CoverageThreshold 70
.\tools\coverage\check-coverage.ps1 -CoverageThreshold 70
```

### Coverage by Module
Expand Down
Loading
Loading