Feature/ai code reviewer

.astro/settings.json

@@ -1,5 +1,5 @@
 {
 	"_variables": {
-		"lastUpdateCheck": 1783539359887
+		"lastUpdateCheck": 1783961044818
 	}
 }

.env.example

@@ -76,6 +76,11 @@ SSH_PORT=2222
 STORAGE_TYPE=local
 STORAGE_PATH=./data/storage
 
+# NAS / dedicated-disk deployments (docker-compose.nas.yml):
+# Point every data directory at your NAS mount or dedicated disk.
+# OCH_DATA_DIR=/mnt/nas/opencodehub
+# STORAGE_PATH=./data/storage  # or /mnt/nas/opencodehub/storage with local driver
+
 # S3 Configuration (required when STORAGE_TYPE=s3)
 # Works with AWS S3, MinIO, Cloudflare R2, Garage, SeaweedFS,
 # Ceph RGW, Wasabi, Backblaze B2, etc.
@@ -159,6 +164,11 @@ BACKUP_DIR=./backups
 AIR_GAPPED_MODE=false
 
 # ── Observability (optional) ────────────────────────────────
+# Bearer token protecting GET /api/metrics (Prometheus). Set a value in
+# production; when empty, the endpoint is public and should be restricted
+# at the reverse proxy.
+METRICS_TOKEN=
+
 # Grafana Cloud OTLP
 GRAFANA_OTLP_ENDPOINT=
 GRAFANA_INSTANCE_ID=

.github/workflows/ai-review.yml

@@ -22,11 +22,14 @@ jobs:
         with:
           bun-version: latest
 
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
       - name: Run AI Review
         env:
           # Use user's PAT to count towards their GitHub contribution graph, fallback to standard bot token
           GITHUB_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
-          GEMINI_API_KEY: ${{ secrets.GEMINIKEY }}
+          AGENT_API_KEY: ${{ secrets.AGENT_API_KEY }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO: ${{ github.repository }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}

.github/workflows/ci.yml

@@ -255,8 +255,18 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Build Docker image
-        run: docker build -t opencodehub:ci -f Dockerfile .
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          load: true
+          tags: opencodehub:ci
+          file: Dockerfile
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@master
@@ -347,9 +357,11 @@ jobs:
           DATABASE_DRIVER: postgres
       - name: Start server and run perf check
         run: |
-          bun run dev &
+          HOST=127.0.0.1 PORT=4321 node ./dist/server/entry.mjs &
           SERVER_PID=$!
-          sleep 8
+          sleep 5
+          curl -s http://127.0.0.1:4321/api/health > /dev/null || true
+          curl -s http://127.0.0.1:4321/api/metrics > /dev/null || true
           bun run perf:baseline
           kill $SERVER_PID 2>/dev/null || true
         env:
@@ -360,6 +372,7 @@ jobs:
           INTERNAL_HOOK_SECRET: "ci-perf-hook"
           CSRF_SKIP_DEV: "true"
           RATE_LIMIT_SKIP_DEV: "true"
+          RATE_LIMIT_ENABLED: "false"
           SKIP_REDIS_CHECK: "1"
           PERF_BASE_URL: http://127.0.0.1:4321
           PERF_PATHS: /api/health,/api/metrics
@@ -460,6 +473,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build, e2e]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -482,7 +498,6 @@ jobs:
           done
           echo "::error::bun install failed after 3 attempts"
           exit 1
-        working-directory: cli
 
       - name: Build CLI
         run: bun run build
@@ -500,7 +515,7 @@ jobs:
   quality-gate:
     name: Quality Gate
     runs-on: ubuntu-latest
-    needs: [lint, docs-parity, security, test, e2e, container-scan, sast, perf, build]
+    needs: [lint, docs-parity, security, test, e2e, container-scan, sast, performance, build]
     if: always()
     steps:
       - name: Check all gates
@@ -515,13 +530,13 @@ jobs:
 
           echo "Docs Parity:      ${{ needs.docs-parity.result }}"
           echo "Security Gates:   ${{ needs.security.result }}"
-          echo "Perf Gate:        ${{ needs.perf.result }}"
+          echo "Perf Gate:        ${{ needs.performance.result }}"
 
           if [[ "${{ needs.lint.result }}" != "success" ]] || \
              [[ "${{ needs.docs-parity.result }}" != "success" ]] || \
              [[ "${{ needs.security.result }}" != "success" ]] || \
              [[ "${{ needs.test.result }}" != "success" ]] || \
-             [[ "${{ needs.perf.result }}" != "success" ]] || \
+             [[ "${{ needs.performance.result }}" != "success" ]] || \
              [[ "${{ needs.build.result }}" != "success" ]]; then
             echo "::error::Quality gate FAILED — required checks did not pass"
             exit 1

.github/workflows/docker-publish.yml

@@ -8,7 +8,8 @@ on:
 
 env:
   REGISTRY: docker.io
-  IMAGE_NAME: swadhinbiswas/opencodehub
+  IMAGE_NAME: opencodehub/opencodehub
+  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: "true"
 
 jobs:
   build-and-push:
@@ -21,6 +22,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -30,8 +34,8 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
 
-      - name: Extract metadata
-        id: meta
+      - name: Extract Metadata (App)
+        id: meta-app
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -42,47 +46,89 @@ jobs:
             type=sha,prefix=
             type=raw,value=latest,enable={{is_default_branch}}
           labels: |
-            org.opencontainers.image.title=OpenCodeHub
-            org.opencontainers.image.description=A modern, self-hosted Git platform for teams that want speed, control, and clean workflows.
+            org.opencontainers.image.title=OpenCodeHub Platform
+            org.opencontainers.image.description=A modern, self-hosted Git platform with stacked PRs, merge queue, CI/CD, and AI review.
+            org.opencontainers.image.url=https://github.com/swadhinbiswas/OpencodeHub
+            org.opencontainers.image.source=https://github.com/swadhinbiswas/OpencodeHub
+            org.opencontainers.image.licenses=MIT
+
+      - name: Extract Metadata (Worker)
+        id: meta-worker
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-worker
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix=
+            type=raw,value=latest,enable={{is_default_branch}}
+          labels: |
+            org.opencontainers.image.title=OpenCodeHub Worker
+            org.opencontainers.image.description=Background task worker for OpenCodeHub (queues, webhooks, notifications).
             org.opencontainers.image.url=https://github.com/swadhinbiswas/OpencodeHub
             org.opencontainers.image.source=https://github.com/swadhinbiswas/OpencodeHub
             org.opencontainers.image.licenses=MIT
 
-      - name: Build and push app image
+      - name: Extract Metadata (Runner)
+        id: meta-runner
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-runner
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix=
+            type=raw,value=latest,enable={{is_default_branch}}
+          labels: |
+            org.opencontainers.image.title=OpenCodeHub Runner
+            org.opencontainers.image.description=Docker-in-Docker CI/CD runner for OpenCodeHub pipelines.
+            org.opencontainers.image.url=https://github.com/swadhinbiswas/OpencodeHub
+            org.opencontainers.image.source=https://github.com/swadhinbiswas/OpencodeHub
+            org.opencontainers.image.licenses=MIT
+
+      - name: Build and Push App Image
         uses: docker/build-push-action@v5
         with:
           context: .
           file: ./Dockerfile
           push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.meta-app.outputs.tags }}
+          labels: ${{ steps.meta-app.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: linux/amd64,linux/arm64
 
-      - name: Build and push runner image
+      - name: Build and Push Worker Image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile.worker
+          push: true
+          tags: ${{ steps.meta-worker.outputs.tags }}
+          labels: ${{ steps.meta-worker.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64,linux/arm64
+
+      - name: Build and Push Runner Image
         uses: docker/build-push-action@v5
         with:
           context: .
           file: ./Dockerfile.runner
           push: true
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-runner:latest
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-runner:${{ github.sha }}
-          labels: |
-            org.opencontainers.image.title=OpenCodeHub Runner
-            org.opencontainers.image.description=CI/CD runner for OpenCodeHub
-            org.opencontainers.image.url=https://github.com/swadhinbiswas/OpencodeHub
-            org.opencontainers.image.source=https://github.com/swadhinbiswas/OpencodeHub
-            org.opencontainers.image.licenses=MIT
+          tags: ${{ steps.meta-runner.outputs.tags }}
+          labels: ${{ steps.meta-runner.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          platforms: linux/amd64,linux/arm64
 
       - name: Update Docker Hub Repository Description
         uses: peter-evans/dockerhub-description@v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
           repository: ${{ env.IMAGE_NAME }}
-          readme-filepath: ./README.md
-          short-description: "A modern, self-hosted Git platform with stacked PRs, merge queue, CI/CD, and AI review."
+          readme-filepath: ./DOCKERHUB.md
+          short-description: "Self-hosted Git platform with stacked PRs, merge queue, CI/CD, and AI code review"

.gitignore

@@ -61,8 +61,9 @@ pci/
 # Docker
 .docker/
 
-# Drizzle
-drizzle/meta/
+# Drizzle — migrations and the migration journal must be committed so that
+# runtime containers can apply schema deterministically (scripts/migrate.ts)
+# drizzle/
 
 # Monaco Editor cache
 .monaco/

.mimocode/.cron-lock

@@ -0,0 +1 @@
+{"pid":8618,"startedAt":1784441536749}

.mimocode/plans/1784309305424-sunny-pixel.md

@@ -0,0 +1,57 @@
+# GitHub-like Profile Portfolio Page
+
+## Current State
+The profile page at `src/pages/[owner]/index.astro` already has:
+- Avatar, display name, username, bio
+- Details (company, location, email, website, join date)
+- Followers/following
+- Contribution graph
+- Repository list
+- Activity feed
+
+## What Needs to Change
+
+On GitHub, when you visit `github.com/username`, you see:
+1. **Left sidebar**: Avatar (large), name, username, bio, details, followers/following, "Edit profile" button
+2. **Main content**: 
+   - "Read me" section rendered from `username/username` repository's README.md
+   - "Pinned" repositories section (6 repos max, customizable)
+   - Contribution graph
+   - Activity feed
+
+The current OpenCodeHub page has this mostly but the layout and "Read me" section from the special repo are missing.
+
+## Implementation Plan
+
+### 1. Auto-create profile repository on user registration
+- When a user registers, automatically create a `{username}/{username}` repository (like GitHub)
+- Seed it with a default README.md containing the user's name and bio
+- This repo should be private by default but its README is shown on the public profile
+
+### 2. Update profile page layout
+- Move to GitHub's 2-column layout: left sidebar (avatar + details) + main content
+- Left sidebar: Large avatar, name, username, bio, details, followers/following
+- Main content: Render README.md from profile repo, pinned repos, contribution graph, activity
+
+### 3. Add "Read me" section
+- Fetch `README.md` from `{username}/{username}` repository
+- Render it as markdown in the profile page (like GitHub does)
+- If no README exists, show the current default layout
+
+### 4. Add pinned repositories section
+- Allow users to pin up to 6 repositories to their profile
+- Store pinned repo IDs in user settings or a separate table
+- Show pinned repos in a grid below the README
+
+### Files to Modify
+- `src/pages/[owner]/index.astro` — Main profile page
+- `src/pages/api/repos/index.ts` — Auto-create profile repo on registration
+- `src/pages/register.astro` — Trigger profile repo creation
+- `src/components/repo/ProfileREADME.tsx` — New component to render profile README
+- `src/components/repo/PinnedRepos.tsx` — New component for pinned repos grid
+
+### Verification
+1. Register a new user → profile repo auto-created with README
+2. Visit `/{username}` → shows GitHub-like profile with README, pinned repos, contribution graph
+3. Edit profile repo README → profile page updates
+4. Pin/unpin repositories → grid updates

AGENTS.md

@@ -294,7 +294,7 @@ Configured via `STORAGE_TYPE` env var (`local` or `s3`).
 npm install -g opencodehub-cli
 
 # Auth
-och auth login --url http://localhost:3000
+och auth login --url http://localhost:4321
 
 # Stack workflow
 och stack create feature/part-1    # Create stacked branch
@@ -343,7 +343,7 @@ npm run db:push
 bun run scripts/seed-admin.ts   # Create admin user
 
 # Dev
-npm run dev                     # Start dev server (port 3000)
+npm run dev                     # Start dev server (port 4321)
 npm run git:start               # Start SSH git server (port 2222)
 npm run worker:start            # Start background worker
 npm run runner:start            # Start CI runner
@@ -392,7 +392,9 @@ docker-compose up -d            # Full stack with postgres + redis + runner
 4. Configure Redis for distributed locking
 5. Enable rate limiting (`RATE_LIMIT_ENABLED=true`)
 6. Set up email (SMTP) for notifications
-7. Configure storage backend (S3/GCS recommended for multi-node)
+7. Configure storage backend (`local` for single-host/NAS, S3-compatible for multi-node)
+8. Set `METRICS_TOKEN` to protect `GET /api/metrics`
+9. Apply committed migrations (`bun run migrate` — runs automatically in containers)
 
 ### Vercel/Edge
 - Turso (LibSQL) recommended for edge deployment