feat: complete submission + admin review + OAuth + CI/CD

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false

.git-hooks/commit-msg.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+
+/**
+ * commit-msg hook: validates commit message against project convention.
+ *
+ * Format: `:<emoji>: <type>(<scope>): <subject>`
+ * Example: `:sparkles: feat(auth): add OAuth login support`
+ *
+ * Rules:
+ * - Must start with :<emoji-name>:
+ * - Must contain <type>(<scope>): <subject>
+ * - type must be one of the known types
+ * - subject must be lowercase, no period at end
+ * - First line max 72 characters
+ * - No Chinese characters in the first line
+ */
+
+import { readFileSync } from 'node:fs';
+
+const COMMIT_TYPES = [
+  'feat', 'fix', 'docs', 'style', 'refactor', 'perf',
+  'test', 'build', 'ci', 'chore', 'revert',
+  'security', 'a11y', 'i18n', 'release', 'hotfix',
+];
+
+const EMOJI_PATTERN = /^:[a-z0-9_+-]+:\s+/;
+const FORMAT_PATTERN = /^:[a-z0-9_+-]+:\s+([a-z]+)(\([a-z0-9_-]+\))?(!)?:\s+.+/;
+
+function validate(filePath) {
+  const content = readFileSync(filePath, 'utf-8');
+  const lines = content.split('\n').filter(Boolean);
+
+  if (lines.length === 0) {
+    error('提交信息不能为空');
+  }
+
+  const firstLine = lines[0];
+  const restLines = lines.slice(1);
+
+  // Check first line length
+  if (firstLine.length > 72) {
+    error(`提交信息第一行超过 72 个字符（当前 ${firstLine.length}）`);
+  }
+
+  // Check emoji prefix
+  if (!EMOJI_PATTERN.test(firstLine)) {
+    error(`提交信息必须以 :emoji: 开头，如 ':sparkles: feat(auth): xxx'`);
+  }
+
+  // Check format
+  const match = firstLine.match(FORMAT_PATTERN);
+  if (!match) {
+    error(
+      `提交信息格式错误。\n` +
+      `格式: :<emoji>: <type>(<scope>): <subject>\n` +
+      `示例: :sparkles: feat(auth): add OAuth login support`,
+    );
+  }
+
+  if (match) {
+    const type = match[1];
+    if (!COMMIT_TYPES.includes(type)) {
+      error(
+        `未知的 type "${type}"。\n` +
+        `允许的值: ${COMMIT_TYPES.join(', ')}`,
+      );
+    }
+  }
+
+  // Check no Chinese characters in first line
+  const chinesePattern = /[一-鿿㐀-䶿]/;
+  if (chinesePattern.test(firstLine)) {
+    error('提交信息第一行不能包含中文字符，请使用英文');
+  }
+
+  // Check no trailing period on first line
+  if (firstLine.endsWith('.')) {
+    error('提交信息第一行不能以句号结尾');
+  }
+
+  // body lines should be wrapped at 72 characters
+  for (let i = 0; i < restLines.length; i++) {
+    const line = restLines[i];
+    // Skip blank lines and comment lines
+    if (line === '' || line.startsWith('#')) continue;
+    if (line.length > 72) {
+      error(`第 ${i + 2} 行超过 72 个字符（当前 ${line.length}）`);
+    }
+  }
+
+  process.exit(0);
+}
+
+function error(msg) {
+  console.error(`\n❌ 提交信息格式检查未通过:\n   ${msg}\n`);
+  console.error(
+    '正确的格式: :<emoji>: <type>(<scope>): <subject>\n' +
+    '示例:\n' +
+    '  :sparkles: feat(auth): add OAuth login support\n' +
+    '  :bug: fix(navbar): resolve mobile overflow\n' +
+    '  :recycle: refactor(utils): extract date formatting\n',
+  );
+  process.exit(1);
+}
+
+validate(process.argv[2]);

.github/workflows/deploy.yml

@@ -0,0 +1,135 @@
+name: Deploy Frontend + Backend
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: deploy-${{ github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository_owner }}/transcircle-backend
+
+jobs:
+  frontend:
+    name: Build & Deploy Frontend
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      deployments: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11.4.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'pnpm'
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm run build
+
+      - name: Deploy to Cloudflare Pages
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy dist --project-name=transcircle-submit --branch=${{ github.ref_name }}
+
+  backend:
+    name: Build & Push Backend Docker Image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11.4.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Enable pnpm via corepack
+        run: |
+          corepack enable
+          corepack prepare pnpm@11.4.0 --activate
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install & build backend
+        working-directory: ./functions
+        run: |
+          pnpm install
+          pnpm run build
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix={{branch}}-
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./functions
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  db-migrate:
+    name: Database Migration
+    runs-on: ubuntu-latest
+    needs: [backend]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Enable pnpm via corepack
+        run: |
+          corepack enable
+          corepack prepare pnpm@11.4.0 --activate
+
+      - name: Run database setup
+        working-directory: ./functions
+        env:
+          DB_CONFIG__DB_HOSTNAME: ${{ secrets.DB_HOST }}
+          DB_CONFIG__DB_PORT: ${{ secrets.DB_PORT || '3306' }}
+          DB_CONFIG__DB_USERNAME: ${{ secrets.DB_USER }}
+          DB_CONFIG__DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          DB_CONFIG__DB_DATABASE: ${{ secrets.DB_NAME || 'transcircle' }}
+        run: |
+          pnpm install
+          pnpm run db:setup

.github/workflows/story-rebuild.yml

@@ -0,0 +1,44 @@
+name: Rebuild Story Site
+
+on:
+  repository_dispatch:
+    types: [story-rebuild]
+  # Allow manual trigger for testing
+  workflow_dispatch:
+    inputs:
+      api_base:
+        description: 'API base URL to fetch published stories'
+        required: true
+        default: 'https://api.transcircle.org'
+
+env:
+  # Default API base — overridden by dispatch payload or workflow_dispatch input
+  API_BASE: ${{ github.event.client_payload.api_base || github.event.inputs.api_base || 'https://api.transcircle.org' }}
+
+jobs:
+  build-and-deploy:
+    name: Build & Deploy Story Site
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      deployments: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # ── Fetch published submissions from the API ──
+      - name: Fetch published stories
+        run: |
+          mkdir -p story/data
+          # API returns { data: [...], requestId: "..." } — extract the array
+          RESPONSE=$(curl -sSf "${{ env.API_BASE }}/v1/stories/published" -H "Accept: application/json" 2>/dev/null || echo '{"data":[]}')
+          echo "$RESPONSE" | jq '.data // []' > story/data/submissions.json
+          echo "Story entries: $(jq 'length' story/data/submissions.json)"
+
+      # ── Deploy to Cloudflare Pages (separate project for story site) ──
+      - name: Deploy to Cloudflare Pages
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy story --project-name=transcircle-story --branch=${{ github.ref_name }}

.gitignore

@@ -0,0 +1,28 @@
+node_modules/
+dist/
+.wrangler/
+.dev.vars
+story/.wrangler/
+
+# build outputs
+*.tsbuildinfo
+functions/dist/
+
+# logs
+functions/logs/
+
+# local config
+functions/config.toml
+config.toml
+
+# local env
+.env
+.env.local
+
+# generated lockfile (functions is standalone, lockfile created by CI)
+functions/pnpm-lock.yaml
+
+# dev/plan documents
+docs/superpowers/
+*.toml
+.jwt-keys/

.npmrc

@@ -0,0 +1,2 @@
+prefer-offline=true
+registry=https://registry.npmmirror.com/

.prettierrc

@@ -0,0 +1,8 @@
+{
+  "semi": false,
+  "singleQuote": true,
+  "trailingComma": "all",
+  "printWidth": 120,
+  "tabWidth": 2,
+  "arrowParens": "always"
+}