feat!: rewrite aurora on react router, drizzle and a cookie-free tracker

.commitlintrc.json

@@ -0,0 +1,6 @@
+{
+  "extends": ["@commitlint/config-conventional"],
+  "rules": {
+    "subject-case": [2, "always", "lower-case"]
+  }
+}

.dockerignore

@@ -0,0 +1,10 @@
+node_modules
+**/node_modules
+**/build
+**/.next
+**/.react-router
+**/app/generated
+.git
+.github
+*.md
+**/.env

.github/workflows/ci.yml

@@ -0,0 +1,235 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Narrow by default; the two jobs that need more declare it themselves.
+permissions:
+  contents: read
+
+# There is no commit to hook here, and the commitlint job below is the real
+# enforcement point anyway.
+env:
+  HUSKY: 0
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm lint
+      - run: pnpm format:check
+
+  # The commit-msg hook is one `--no-verify` away from being bypassed, and it
+  # never sees the message that actually lands: squash merges are enabled with
+  # `squash_merge_commit_title: COMMIT_OR_PR_TITLE`, so a multi-commit squash
+  # takes the *pull request title* as the subject on main. Both are checked.
+  commitlint:
+    name: Commitlint
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # commitlint walks the base..head range, which shallow clones lack.
+          fetch-depth: 0
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Commits
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: pnpm exec commitlint --verbose --from "$BASE_SHA" --to "$HEAD_SHA"
+
+      # Through the environment, never interpolated into the script: a pull
+      # request title is attacker-controlled text on a public repository.
+      - name: Pull request title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: echo "$PR_TITLE" | pnpm exec commitlint --verbose
+
+  web:
+    name: Web
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/web
+
+    env:
+      DATABASE_URL: postgres://root:password@localhost:5432/aurora
+      SESSION_SECRET: impossibletoguess
+
+    services:
+      postgres:
+        # Pinned to the patch for the reason docker-compose.yml gives at length:
+        # Postgres reads zones from its image's own OS tzdata package, so a
+        # floating `postgres:16` picks up whichever release the latest rebuild
+        # carried. It resolves to 16.14 / tzdata 2026b today, one release ahead
+        # of the 2026a the Dockerfile asserts against `process.versions.tz` and
+        # docker-compose's healthcheck refuses to start without. The
+        # timezone-sensitive suites are the ones that run here, so this was the
+        # one place the two zone databases were never checked against each
+        # other. Move this with the pin in docker-compose.yml.
+        image: postgres:16.13
+        env:
+          POSTGRES_DB: aurora
+          POSTGRES_USER: root
+          POSTGRES_PASSWORD: password
+        options: >-
+          --health-cmd pg_isready --health-interval 10s --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+        working-directory: .
+
+      - run: pnpm db:migrate
+      - run: pnpm typecheck
+      - run: pnpm test
+      - run: pnpm build
+
+  # The deployment path, which nothing else exercises. `pnpm build` covers the
+  # app's own compilation, but the Dockerfile carries logic that only ever runs
+  # here: the base stage's tzdata assertion, the `--filter web... --filter
+  # tracker...` scoped installs, the `--prod` install, and the runner stage's
+  # hand-assembled node_modules copy. A dependency that only resolved because a
+  # dev dependency hoisted it, or a file the runner stage forgets to copy, is
+  # invisible to every step above and surfaces at deploy time.
+  #
+  # Pull requests only: on main the publish job below builds the same image for
+  # real, so running this too would build it twice.
+  docker:
+    name: Docker
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+
+      # Build only — the image is never pushed from a pull request. This is a
+      # gate, not a release step. Its own cache scope, because it builds one
+      # architecture where publish builds two.
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          cache-from: type=gha,scope=gate
+          cache-to: type=gha,mode=max,scope=gate
+
+  # Opens (and maintains) a release pull request from the conventional commits
+  # on main; merging that pull request is what bumps the version, writes
+  # CHANGELOG.md, tags, and publishes the GitHub release. Gated on lint and web
+  # so a red main cannot produce a release.
+  release:
+    name: Release
+    if: github.event_name == 'push'
+    needs: [lint, web]
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+
+    outputs:
+      release_created: ${{ steps.release-please.outputs.release_created }}
+      tag_name: ${{ steps.release-please.outputs.tag_name }}
+
+    steps:
+      # No `release-type` input: omitting it is what makes the action read
+      # release-please-config.json and .release-please-manifest.json.
+      - uses: googleapis/release-please-action@v4
+        id: release-please
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  # Publishing lives here, keyed off the job above's output, rather than in a
+  # workflow triggered `on: release`. A release created with GITHUB_TOKEN does
+  # not fire `release`, `create`, or tag `push` events — GitHub suppresses them
+  # so workflows cannot trigger themselves — so the obvious wiring would simply
+  # never run. Reading `release_created` in the same workflow avoids needing a
+  # personal access token or a GitHub App just to break that loop.
+  publish:
+    name: Publish
+    if: github.event_name == 'push'
+    needs: [release]
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # linux/arm64 is emulated, so its install and build stages are slow on a
+      # cold cache. If that becomes the bottleneck, the repository is public and
+      # therefore has free ubuntu-24.04-arm runners: split into a per-platform
+      # matrix that builds by digest and merge with `buildx imagetools create`.
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # `edge` and `sha-` land on every push to main; the version tags only on
+      # the push that merged a release pull request. Every versioned entry is
+      # gated on `release_created` rather than on tag_name being empty, so no
+      # entry is ever handed a value to parse that isn't a tag: on an ordinary
+      # push a `type=semver` with no value falls back to github.ref, which is
+      # `refs/heads/main`.
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=edge
+            type=sha,prefix=sha-,format=short
+            type=semver,pattern={{version}},value=${{ needs.release.outputs.tag_name }},enable=${{ needs.release.outputs.release_created == 'true' }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ needs.release.outputs.tag_name }},enable=${{ needs.release.outputs.release_created == 'true' }}
+            type=semver,pattern={{major}},value=${{ needs.release.outputs.tag_name }},enable=${{ needs.release.outputs.release_created == 'true' }}
+            type=raw,value=latest,enable=${{ needs.release.outputs.release_created == 'true' }}
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          # Carries org.opencontainers.image.source, which is what links the
+          # package to this repository and inherits its visibility.
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=publish
+          cache-to: type=gha,mode=max,scope=publish

.gitignore

@@ -1,19 +1,18 @@
 # See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
 
 # dependencies
-/node_modules
-/.pnp
+node_modules/
+.pnp
 .pnp.js
 
 # testing
-/coverage
+coverage/
 
-# next.js
-/.next/
-/out/
-
-# production
-/build
+# builds
+build/
+dist/
+out/
+.react-router/
 
 # misc
 .DS_Store
@@ -23,13 +22,14 @@
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+pnpm-debug.log*
 
 # local env files
+.env
 .env.local
 .env.development.local
 .env.test.local
 .env.production.local
 
 # vercel
 .vercel
-.env

.husky/commit-msg

@@ -0,0 +1 @@
+pnpm exec commitlint --edit "$1"