v1.3.0 — Official Docs, Fig Best Practices, Hardened Auth

Version

v1.3.0

What's included

Minor release cut from main. Since v1.2.0 (a461cf3, 2026-09-12) — 94 commits,
of which 37 landed as merged PRs.

Added — deliverables

• PR #266 — deliverables/official-docs/: an official documentation registry.
  One JSON registry (src/official-docs.json) read from both sides of the stack
  (src/official_docs.py, src/official-docs.js, src/utils.ts), every link
  checked against the live URL by scripts/verify_links.py rather than assumed,
  and a React docs bar + image gallery (src/Company.jsx) rendered from the same
  registry so the UI cannot drift from the data.
• PR #265 — deliverables/fig-best-practices/: a quality gate for projects
  built on the Fig platform. BEST-PRACTICES.md is the policy, six agent briefs
  (developer / reviewer / security / designer / performance / deployment) state
  who enforces what, ci/quality-gate.yml is the Actions entry point, and two
  fixture projects — a known-bad and a known-good tree — exercise the gate.
  69 tests.
• PR #258 — deliverables/ci/: the full CI/CD pipeline (orchestrator plus
  reusable workflows).
• PR #238 — skills: pr-triage-automove, the automated form of
  organize-misplaced-files. A root file is moved only when it is not canonical,
  no tracked .py imports it (AST-parsed), and its name appears in no other
  tracked file. Wrapped in an import probe so a poisoned import cannot kill the
  run; dry-run by default, --apply required. 37 tests.
• PR #235 — deliverables/agent-core/: Dockerfile and Helm chart.
• PR #240 — skills: ci-workflow-authoring plus lint.py to check workflows
  before they run. 16 tests.
• PR #241 — Claude endpoint tests: mock responses, timeout, auth and error
  handling cases.

Changed

• PR #267 — hardened JWT secret validation and moved users onto a database.
  A signing key shorter than 32 characters, or one of a set of known placeholder
  values, is now rejected so a misconfigured deployment fails loudly instead of
  signing tokens with a guessable key. Added app/user_store.py, a
  SQLAlchemy-backed user table that imports legacy JSON users on first init and
  keeps the existing shape, so the API surface and per-user skill gating are
  unchanged. DATABASE_URL selects Postgres, otherwise SQLite. 43 tests.
• PR #252, PR #259, PR #248 — agent task skills and merge protection,
  cron automation, and the corresponding knowledge notes.
• PR #236 — rewrote README.md to describe the repository as it stands rather
  than as it was intended: the real entrypoints, which one app/Dockerfile and
  vercel.json serve, required vs optional configuration, the real test command,
  and a Known state section recording what is genuinely broken.
• PR #233 — activated the WhatsApp notification workflow, moved out of
  templates/ (which Actions does not read) into .github/workflows/.

Fixed

• PR #250 — SHA-pinned the workflow actions and repaired the broken workflow
  YAML.
• PR #249 — pointed knowledge/scripts/diff_policy.py at knowledge/ instead
  of the missing vault/.
• PR #243 — repaired auto-compress-manage.yml, which had failed at
  Set up job on all 781 runs: five action refs pointed at SHAs that do not exist
  upstream. Four skip conditions added alongside the fix.
• PR #234 — corrected YAML syntax and indentation in Auto-Index-Sync.yml.
• PR #262 — dropped the unused import sys from
  knowledge/scripts/diff_policy.py.
• PR #230 — ci.yml updated.

Direct to main — besides the PRs above, 57 commits landed straight on main:
new skill docs (SKILL.md files), knowledge notes, guideline documents, a
cron-automation/ directory, and several Add files via upload. These were not
reviewed through PRs and are listed here rather than itemised.

Dependencies

• PR #222 — requirements.txt updated.
• PR #223 — added a root requirements-dev.txt for test/lint tooling.
• PR #204 / #211 — npm dev-deps group bump; esbuild + vite bump in
  deliverables/product-crud/web.

Changelog

Full sections: CHANGELOG.md → [2026-09-14], [2026-09-13],
[2026-09-12]. Two merged PRs had no changelog record at the time of this
release — #265 and #266 — and are added in this release PR alongside the
notes.

Migration / breaking changes

None. No migration required. The JWT change (#267) is stricter than before by
design: a deployment signing tokens with a short or placeholder key will now fail
at startup instead of silently continuing. Set a key of at least 32 characters —
or unset it and let the local fallback generate one.

Verification

• CI green on main — see note below
• Tests pass — 69 (fig-best-practices), 43 (app/, clean venv),
  37 (pr-triage-automove), 16 (ci-workflow-authoring)
• Migration applied (if any) — N/A
• Tag + GitHub Release created from this section

CI note: every workflow on main still fails at Set up job, for the
pre-existing org policy reason — all actions must be pinned to a full-length
commit SHA. Repairs have been attempted repeatedly (#243, #250), and each
attempt was subsequently overwritten or left unreconciled, so the repo remains in
a state where the policy text (README.md, SECURITY.md) does not match the
workflows that are actually on main. This is tracked in PROBLEMS.md; it is
not introduced by this release and does not affect the artifacts above, which run
their own tests. It does mean no PR on this repository can show green checks.

v1.2.0

Version

v1.2.0

What's included

Minor release cut from main at 3bf46e4. Since v1.1.0 (d1ee77d, 2026-09-09) — 9 commits.

Added

• PR #212 — docs/MCP-Guide-Complete.md (MCP-DOC-2026-0912): Thai-language MCP troubleshooting & setup reference covering Google Cloud ADC, missing runtimes (Node.js / Dart / Go) and PATH, and third-party API keys. Plus scripts/check-mcp-environment.sh — automated checker with --gcp / --runtimes / --keys and a CI-suitable exit code that never prints secret values.
• PR #206 — fastapi-obsidian-backend connected to a live Obsidian vault via the Local REST API: app/obsidian/client.py + app/routers/obsidian.py. Writes require JWT and OBSIDIAN_ALLOW_WRITE=1; vault-relative paths only; payloads sanitized through the CWE-1321 bridge. 33 tests.

Fixed

• PR #214 — check_key() reported the length of the variable name (a constant 4) instead of the value.
• PR #216 — --help leaked source (sed -n '2,22p' ran past the comment header); two stale paths in the MCP guide corrected.

Dependencies

• 7daddda — bump the production-deps group with 3 updates.

Docs

• PR #213 / #215 / #217 — CHANGELOG entries for the above, per repo convention.

Changelog

Full section: CHANGELOG.md → [2026-09-12]. Also spans [2026-09-11] (Obsidian bridge, OnSpaceAI platform integration, roadmap).

Migration / breaking changes

None. No migration required.

Verification

• CI green on main — see note below
• Tests pass — scripts/test_mcp_checker.sh 17/17
• Migration applied (if any) — N/A

CI note: workflows on main currently fail at Set up job for two pre-existing reasons unrelated to this release — five workflow files are syntactically invalid, and all action refs must be pinned to full commit SHAs. The fix is prepared as a patch (ci_sha_pin_workflow_fix) but cannot be pushed: the GitHub App lacks the workflows permission. See P-001/P-003/P-009 in PROBLEMS.md.

v1.1.0 — Monorepo + AI + Security

v1.1.0 — Monorepo + AI + Security

Release covering the Sep 8–9 work: monorepo scaffold, AI & security skill suites, Azure CLI 2026 docs, and a cleaned-up changelog.

Highlights

• Monorepo scaffold (PR #155) — additive FastAPI/SQLModel async backend, React+Vite+TS frontend, Obsidian↔Algolia indexer, k8s manifests, typed PR templates.
• CWE-1321 Prototype Pollution Protection Suite (PR #148) — deliverables/cwe1321-protection-suite/ (JS + Python rules, runnable tests).
• Agent security suite (PRs #120, #122, #132, #134) — audit log, LangGraph recovery, MCP + RunPod clients, permission-aware ci_ops.
• NotebookLM skill suites (PRs #136, #140, #142) — link-share + access-artifact suites.
• Azure CLI 2026 docs (PRs #145–#147) — flashcards, cheat sheet, Bicep/IaC appendix, dev/prod .bicepparam.
• Docs & process (PRs #150, #156, #158, #160, #162) — Gemini CLI skills, SECURITY.md, RELEASE.md, README rewrite.
• Dependabot (PRs #124–#130) — docker/node/python/npm bumps.

What's inside (structure)

• deliverables/ — research skills, agent suites, knowledge references.
• skills/ — fetching, research, security skill definitions.
• graphql_api/, docs/, helm/ + k8s/, tests/.

Notes

• Docs/config-heavy release; no breaking deletions. Requires updating .env with new vars from .env.example.

v1.0.0 — AI‑Driven FastAPI DevOps Stack

📝 GitHub Release — Ready-to-Publish Template

Based on your repo state (main branch, AI-Driven DevOps Stack, first formal release), here’s the complete release content you can paste directly into the form:

---

Tag version

v1.0.0
(Target: main)

Release title

v1.0.0 — AI‑Driven FastAPI DevOps Stack

Release notes

# 🧠 FastAPI Python Boilerplate — v1.0.0

First official release of the **AI‑Driven DevOps Stack** — production‑ready FastAPI boilerplate with enterprise‑grade capabilities.

## ✨ Key Highlights

### 🧠 AI & Backend
- **LangGraph AI Agent** — Query PostgreSQL using natural language
- **FastAPI 0.100+** — High‑performance async web framework
- **PostgreSQL + SQLAlchemy 2.0 (Async)** + Alembic migrations
- **Supabase JWT Auth + Row‑Level Security (RLS)** enforced on all tables

### 💳 Services & Integrations
- **Stripe** — Full payment & subscription billing system
- **OpenAI / Local Model** — Switchable AI backend

### ☸️ DevOps & Deployment
- **Docker Compose** — Local dev environment up in one command
- **Kubernetes + Helm** — Production‑ready manifests & charts
- **Traefik Ingress** — Routing, load balancing, SSL termination
- **GitHub CI/CD** — Lint → test → coverage → scan → deploy

### 📡 Enterprise Alerting
- **Slack** — Real‑time notifications
- **Twilio (SMS/Voice)** — Supports Thai phone numbers
- **Jira Service Management** — Auto‑create support tickets
- **PagerDuty** — On‑call & incident escalation

## 🛠️ Tech Stack
- Python 3.11+ • FastAPI • PostgreSQL • SQLAlchemy 2.0 • Alembic
- Docker Compose • Kubernetes • Helm • Traefik
- Supabase Auth • Stripe • LangGraph • OpenAI

## ✅ CI Status
- ✅ Test & Coverage — 500+ runs, passing
- ⚠️ CI Pipeline — known issue, tracked separately; core tests passing
- ✅ CodeQL — Security scan
- ✅ Dependabot — Auto‑dependency updates

## 📄 License
**MIT License** © 2026 ZyntroAI

---

### 🚀 Getting Started
```bash
git clone https://github.com/ZyntroAI/fastapi-python-boilerplate.git
cd fastapi-python-boilerplate
cp .env.example .env
docker compose up --build

• API: http://localhost:8000
• Docs: http://localhost:8000/docs
• Health: http://localhost:8000/health

---

#### **Release label**
- ✅ **None** (Latest release)

---

### ✅ One-Click Checklist
1. **Tag version:** `v1.0.0`
2. **Target:** `main`
3. **Title & notes:** Paste block above
4. **Set as the latest release:** ✅ Checked (default)
5. **Publish release** → Done! 🎉

Would you like me to also generate a **pre-release version** (`v1.0.0-beta.1`) or **automate this via Release Drafter** so you don't need to fill it manually next time?

## What's Changed
* fix: repair config.py stub and tests/conftest.py import bug by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/106
* feat: integrate self-contained GraphQL API subproject (graphql_api/) by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/107
* Patch: Update configuration, workflows & documentation improvements by @zyntromedia in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/108
* feat(graphql): DB-backed resolvers + Alembic migrations by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/109
* feat(graphql): Redis pub/sub subscriptions + caching + standard errors by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/110
* docs: rewrite CHANGELOG to reflect actual merged work by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/111
* feat: add GitHub DevOps Toolkit + AI Agents Decision Pack deliverables by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/112
* docs: changelog — record deliverables PR #112 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/113
* feat: add fetching skill (SSRF-safe async HTTP fetch + retry + cache + provenance) by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/114
* docs: changelog — record fetching skill PR #114 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/115
* feat: extend fetching skill with GraphQL + WebSocket clients by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/116
* docs: changelog — record GraphQL + WebSocket extension PR #116 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/117
* feat: add research skill (multi-source synthesis + cross-validation + provenance graph) by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/118
* docs: changelog — record research skill PR #118 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/119
* feat: add agent-security-suite runnable core (audit log + JSON validation + Slack alert) by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/120
* docs: changelog — record agent-security-suite PR #120 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/121
* feat: extend agent-security-suite with LangGraph recovery + MCP client (lazy-import) by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/122
* docs: changelog — record agent-security-suite extension PR #122 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/123
* ci: reconfigure Dependabot for FastAPI stack by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/124
* chore(docker): bump python from 3.13-slim to 3.14-slim by @dependabot[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/127
* chore(docker): bump node from 22-alpine to 26-alpine by @dependabot[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/126
* chore(docker): bump alpine from 3.22 to 3.24 by @dependabot[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/125
* deps(npm)(deps): bump vercel from 33.7.1 to 59.11.7 in the production-deps group by @dependabot[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/128
* deps(pip)(deps): bump the production-deps group with 20 updates by @dependabot[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/129
* deps(npm)(deps-dev): bump the dev-deps group with 7 updates by @dependabot[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/130
* docs: changelog — record dependabot PRs #125-#130 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/131
* feat: add ci_ops module to agent-security-suite (permission-aware + SHA-pin + CI fingerprint) by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/132
* docs: changelog — record ci_ops module PR #132 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/133
* feat: add RunPod client to agent-security-suite (lazy import + schema validation + audit) by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/134
* docs: changelog — record RunPod client PR #134 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/135
* feat: add NotebookLM link-share skill (normalize + templates + validate) by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/136
* docs: changelog — record NotebookLM link-share PR #136 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/137
* feat: add agent-skill-template (progressive-disclosure loader + validator) by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/138
* docs: changelog — record agent-skill-template PR #138 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/139
* feat: add NotebookLM access-artifact suite core P0 (resolver + access + artifact) by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/140
* docs: changelog — record access-artifact suite PR #140 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/141
* feat: extend NotebookLM access-artifact suite to full sub-skill set by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/142
* docs: changelog — record access-artifact suite extension PR #142 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/143
* feat(skills): add changelog-auto-update skill by @zyntromedia in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/144
* docs(deliverables): Azure CLI 2026 — flashcards & cheat sheet by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/145
* docs(deliverables): update Azure CLI + Bicep + Workflow Examples by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/146
* docs(deliverables): add dev/prod .bicepparam examples by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/147
* feat(security): add CWE-1321 Prototype Pollution Protection Suite by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/148
* docs(changelog): record PRs #146, #147 by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/149
* docs(deliverables): add Gemini CLI docs & skills architecture by @fig-ai-agent[bot] in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/150
* Add files via upload by @zyntromedia in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/151
* Update README.md by @zyntromedia in https://github.com/ZyntroAI/fastapi-python-boilerplate/pull/152
* docs(changelog): record PR #150 by @fig-ai-agent[bot] in https://github.com/Z...