fix(cli,db): scaffold secrets, compose hardening, workspace add, UTCDateTime render (#440–#445)

[antosubash]

Fixes the six issues filed from scaffolding a real app with simple_module_cli 0.0.35.

Changes

• db: render_item emits sqlmodel UTCDateTime without importing sqlmodel — initial autogenerate on Postgres fails with NameError #440 — render_item and sqlmodel 0.0.48. UTCDateTime now renders as sa.DateTime(timezone=True), the same as the e5f2a8c1d7b3 timestamptz migration. Any other sqlmodel.* type adds import sqlmodel to the migration, so autogenerate no longer emits a file that fails with NameError.
• cli: smpy new writes generated secrets into the committed .env.example #441 — secrets stay out of .env.example. smpy new writes SM_SECRET_KEY and the users token secrets to .env, which is gitignored. If .env already exists, only keys it doesn't define yet are added. The committed .env.example keeps # KEY= placeholders. The template no longer ships SM_SECRET_KEY=change-me-in-production: when the key is unset, one is generated at first boot.
• cli: smpy add <local path> for a workspace member writes a path source that uv rejects #442 — smpy add for workspace members. smpy add detects that a module path is a member of the enclosing uv workspace. It checks members globs minus exclude. For a member it writes { workspace = true } and an unpinned dependency, matching the scaffold's sample module. A relative path that doesn't exist under --path falls back to the cwd, and the error message names both bases. Inside a workspace, create-module prints the exact smpy add command to run next.
• cli: scaffold hygiene — 'sm' CLI name in templates, uv.lock gitignored, kebab-case Postgres DB name #443 — scaffold hygiene.
  • Templates say smpy, not sm.
  • uv.lock is no longer gitignored, so applications commit their lockfile.
  • The Postgres database name is snake_case (demo_app).
• cli: docker-compose template publishes Postgres on 0.0.0.0:5432 with postgres/postgres while the app runs in production mode #444 — compose hardening.
  • The postgres password comes from POSTGRES_PASSWORD via ${POSTGRES_PASSWORD:?…}. smpy new generates it into .env, and the dev SM_DATABASE_URL in .env uses the same password, so docker compose up -d postgres keeps working as a local dev database.
  • Postgres and Redis publish on 127.0.0.1 only.
• cli: scaffold dev group resolves playwright 1.18.1 (2022), breaking pytest at plugin load #445 — playwright floor. playwright>=1.45 is added next to pytest-playwright in both scaffold dev groups.

Docs updated: the installation guide, the project-structure guide, the workspace README template and the CHANGELOG. The CHANGELOG entry tells apps that already committed a generated .env.example to rotate those secrets.

Verification

• make lint: green.
• make test-py: 3961 passed, 11 skipped, 1 xfailed.
• make migrations-roundtrip-pg on a disposable local DB: green. This repo already runs sqlmodel 0.0.48, and alembic check shows no type drift after the UTCDateTime change.
• Scaffolded smpy new demo-app --db postgres by hand:
  • docker compose config accepts the generated .env. With no env it fails with set POSTGRES_PASSWORD in .env.
  • uv lock resolves playwright 1.63.0, pyee 13.0.1 and pytest-playwright 0.10.0.
• On a scaffold with smpy create-module + smpy add ../modules/forest_plots --path host, uv lock succeeds.
• Not run: make test-js and e2e (no frontend changes); a full uv sync + boot of a scaffolded app.

Review follow-ups (/ship)

• Optimize pass, net −19 lines: shared env_values parser, _set_source helper, dead guard and unused return removed.
• Code review fixes:
  • A placeholder on the last line with no trailing newline is now filled.
  • .env is written with mode 0600.
  • An existing .env keeps its POSTGRES_PASSWORD and DB URL together; one is never replaced without the other.
  • make docker-up prints which secrets to set when it creates .env from the template.
  • The create-module hint wording is fixed.
• Second review pass: clean.
• Re-verified at 9962a3e5: make lint green; make test-py 3963 passed, 11 skipped, 1 xfailed; make test-js green.
• Pipeline report: https://claude.ai/artifact/2AShoztBZ67hLsNhpH8LBJ (private Claude Artifact; share it from claude.ai if reviewers need access)

Closes #440, closes #441, closes #442, closes #443, closes #444, closes #445

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-13T10:13:15.903085Z	a4f86ee	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	9962a3e
Status:	✅  Deploy successful!
Preview URL:	https://c3a5e8c0.simple-module-python.pages.dev
Branch Preview URL:	https://fix-issue-batch-440-445.simple-module-python.pages.dev

View logs