Reqmango v0.1.0

Container images

docker pull ghcr.io/vinthuy/reqmango-backend:0.1.0
docker pull ghcr.io/vinthuy/reqmango-frontend:0.1.0

Or, from a checkout: REQMANGO_TAG=0.1.0 docker compose pull && REQMANGO_TAG=0.1.0 docker compose up -d

First tagged release. Reqmango is a self-hosted project manager whose intake
queue triages new requests before they reach the backlog, with AI assisting
triage, issue analysis, label suggestions and cycle summaries.

Added

• Work items — list and kanban views, state transitions, hierarchy up to six
  levels, assignees, labels, relations (blocks / relates / duplicates), comments
  and attachments.
• Intake — public intake forms and channels, a triage queue with
  accept/reject, and AI-suggested type, priority and duplicate candidates.
• Custom fields and templates — text, number, dropdown, boolean, date,
  member and URL fields; workspace type blueprints; project and issue templates.
• Workflows and automation — issue state machines with approvals and role
  gates; trigger → condition → action rules with a dry-run preview.
• Planning — cycles/sprints, modules, releases, pages with version history,
  and project metrics/dashboards.
• Search — RQL plus multi-field filters, saved views and search templates.
• AI layer — provider-agnostic (DeepSeek by default), optional; analyze,
  label suggestions, cycle summary, and a copilot that previews writes before
  applying them.
• Bulk import — CSV/JSON with pre-validation, preview (dry_run), explicit
  column mapping and per-row warnings.
• Platform — JWT auth, role-based access control, API tokens, notification
  centre with SSE, webhooks, audit-friendly tenancy scoping, MCP/CLI client in
  sdk/.
• Operations — single-command Docker Compose, GET /health, GET /readyz,
  GET /metrics (superuser), slow-request logging, graceful shutdown.
• Docs — English/Chinese README and contributing guide, architecture notes,
  API reference, and a production deployment checklist.

Security

• Demo and E2E seed data are now opt-in (SEED_DEMO, SEED_E2E, both
  off by default). Every release before this one seeded a superuser whose
  password was published in the repository, so a reachable instance could be
  taken over with a documented credential.
• Bootstrap admin — a fresh deployment with demo data off creates one
  superuser from ADMIN_EMAIL/ADMIN_PASSWORD, or prints a random password
  once. An existing account is never promoted automatically.
• Added SECURITY.md (private reporting, scope, response targets) and
  docs/deploy/production.md (secrets, network exposure, TLS/SSE, backups).
• CI scans the working tree with gitleaks and replays every API route as an
  outsider, a member and a cross-tenant caller (cmd/route_audit).

Fixed

• Workflow transitions are now scoped to their owning domain, so an agent
  workflow id can no longer address an issue state transition (BUG-58).
• The CI Docker job built from the repository root, where no Dockerfile exists;
  it now builds both component images and runs on every change instead of only
  on tags that never existed.

Upgrade notes

• SEED_DEMO defaults to false. docker compose up with .env.example
  keeps the demo experience; any existing deployment should set it explicitly
  and rotate or delete the old demo accounts — turning the flag off does not
  remove rows that were already seeded.
• SECRET_KEY must be set explicitly, or every restart invalidates all
  sessions.
• Images: ghcr.io/vinthuy/reqmango-backend and
  ghcr.io/vinthuy/reqmango-frontend, multi-arch (linux/amd64,
  linux/arm64).