Modernize BookIT UI, runtime, and deployment

.dockerignore

@@ -0,0 +1,17 @@
+.git
+**/node_modules
+**/.env
+**/.env.*
+!**/.env.example
+**/build
+**/dist
+bookit/public
+**/.vite
+**/.cache
+**/coverage
+playwright-report
+test-results
+e2e
+.codex
+.agents
+*.log

.github/workflows/ci.yml

@@ -0,0 +1,191 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_call:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  CI: true
+
+jobs:
+  quality:
+    name: Checks
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: voidzero-dev/setup-vp@49c3e4e92c52e7f8392712a9267bbe71c5ab30e5 # v1.19.0
+        with:
+          node-version: "24.19.0"
+          version: "0.3.0"
+          run-install: false
+          cache: true
+      - name: Install the packageManager-pinned pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          run_install: false
+      - name: Install approved dependencies from the lockfile
+        run: vp install --frozen-lockfile
+      - name: Generate GraphQL contracts and check they are committed
+        shell: bash
+        run: |
+          pnpm codegen
+          if [[ -n "$(git status --porcelain --untracked-files=all)" ]]; then
+            echo "::error::pnpm codegen left repository changes. Regenerate and commit all generated output."
+            git status --short --untracked-files=all
+            git diff --no-ext-diff
+            git diff --cached --no-ext-diff
+            while IFS= read -r -d '' file; do
+              git diff --no-ext-diff --no-index -- /dev/null "$file" || true
+            done < <(git ls-files --others --exclude-standard -z)
+            exit 1
+          fi
+      - name: Generate Prisma client
+        run: pnpm --dir bookit exec prisma generate
+      - name: Check strict TypeScript contracts
+        run: pnpm typecheck
+      - name: Check formatting and type-aware lint
+        run: vp check
+      - name: Run unit tests
+        run: pnpm test
+      - name: Build BookIT
+        run: pnpm build
+      - name: Audit production and development dependencies
+        run: pnpm audit --audit-level low
+
+  publish:
+    name: Publish
+    needs: quality
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+    env:
+      BOOKIT_IMAGE: ghcr.io/cthit/bookit:${{ github.sha }}
+      CAN_PUBLISH: >-
+        ${{ github.actor != 'dependabot[bot]' &&
+            (github.event_name != 'pull_request' ||
+             (github.event.pull_request.head.repo.full_name == github.repository &&
+              github.event.pull_request.user.login != 'dependabot[bot]')) }}
+    outputs:
+      image: ${{ steps.image.outputs.image }}
+      published: ${{ steps.image.outputs.published }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - name: Log in to GHCR
+        if: env.CAN_PUBLISH == 'true'
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build the BookIT image
+        id: build
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64
+          push: ${{ env.CAN_PUBLISH == 'true' }}
+          load: ${{ env.CAN_PUBLISH != 'true' }}
+          tags: ${{ env.BOOKIT_IMAGE }}
+          cache-from: type=gha,scope=bookit
+          cache-to: type=gha,mode=max,scope=bookit
+      - name: Pass the built image to E2E
+        id: image
+        shell: bash
+        env:
+          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          echo "published=$CAN_PUBLISH" >> "$GITHUB_OUTPUT"
+          if [[ "$CAN_PUBLISH" == true ]]; then
+            test -n "$IMAGE_DIGEST"
+            echo "image=ghcr.io/cthit/bookit@$IMAGE_DIGEST" >> "$GITHUB_OUTPUT"
+          else
+            echo "image=$BOOKIT_IMAGE" >> "$GITHUB_OUTPUT"
+            docker save --output "$RUNNER_TEMP/bookit.tar" "$BOOKIT_IMAGE"
+          fi
+      - name: Share the image for fork and Dependabot PRs
+        if: env.CAN_PUBLISH != 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bookit-image
+          path: ${{ runner.temp }}/bookit.tar
+          compression-level: 0
+          retention-days: 1
+          if-no-files-found: error
+
+  e2e:
+    name: E2E
+    needs: publish
+    permissions:
+      contents: read
+      packages: read
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      BOOKIT_IMAGE: ${{ needs.publish.outputs.image }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: voidzero-dev/setup-vp@49c3e4e92c52e7f8392712a9267bbe71c5ab30e5 # v1.19.0
+        with:
+          node-version: "24.19.0"
+          version: "0.3.0"
+          run-install: false
+          cache: true
+      - name: Install the packageManager-pinned pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          run_install: false
+      - run: vp install --frozen-lockfile
+      - name: Install Chromium and its system dependencies
+        run: pnpm exec playwright install --with-deps chromium
+      - name: Log in to GHCR
+        if: needs.publish.outputs.published == 'true'
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Pull the published image by digest
+        if: needs.publish.outputs.published == 'true'
+        run: docker pull --platform linux/amd64 "$BOOKIT_IMAGE"
+      - name: Download the image for fork and Dependabot PRs
+        if: needs.publish.outputs.published != 'true'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: bookit-image
+          path: ${{ runner.temp }}
+      - name: Load the shared image
+        if: needs.publish.outputs.published != 'true'
+        run: docker load --input "$RUNNER_TEMP/bookit.tar"
+      - name: Run authenticated browser flows
+        shell: bash
+        run: pnpm test:e2e 2>&1 | tee e2e-run.log
+      - name: Preserve failing browser traces, screenshots, videos, and logs
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: playwright-failure-artifacts
+          path: |
+            playwright-report/
+            test-results/
+            e2e-run.log
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/main.yml

@@ -0,0 +1,23 @@
+name: Main
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Serialize publication and release tagging for the same commit.
+concurrency:
+  group: images-${{ github.sha }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate
+    if: github.ref == 'refs/heads/main'
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
+      packages: write

.github/workflows/release.yml

@@ -0,0 +1,55 @@
+name: Release BookIT
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  actions: read
+  packages: write
+
+concurrency:
+  group: images-${{ github.sha }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Tag tested BookIT image
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      RELEASE_TAG: ${{ github.event.release.tag_name }}
+    steps:
+      - name: Require successful main validation and publication
+        shell: bash
+        run: |
+          if [[ ! "$RELEASE_TAG" =~ ^[a-zA-Z0-9_][a-zA-Z0-9_.-]{0,127}$ ||
+                "$RELEASE_TAG" == latest || "$RELEASE_TAG" =~ ^[a-f0-9]{40}$ ]]; then
+            echo "Release tags must be valid Docker tags, not latest or a commit SHA." >&2
+            exit 1
+          fi
+          conclusion="$(gh api --method GET "repos/$GITHUB_REPOSITORY/actions/workflows/main.yml/runs" \
+            -f head_sha="$GITHUB_SHA" -f branch=main -f per_page=100 \
+            --jq '[.workflow_runs[] | select(.event == "push" or .event == "workflow_dispatch")][0].conclusion')"
+          if [[ "$conclusion" != success ]]; then
+            echo "The latest main validation and publication for $GITHUB_SHA must pass before releasing." >&2
+            exit 1
+          fi
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - name: Log in to GHCR
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Apply the release tag without rebuilding
+        shell: bash
+        run: |
+          repository="ghcr.io/cthit/bookit"
+          digest="$(docker buildx imagetools inspect "$repository:$GITHUB_SHA" --format '{{.Manifest.Digest}}')"
+          target="$repository:$RELEASE_TAG"
+          docker buildx imagetools create --prefer-index=false --tag "$target" "$repository@$digest"
+          actual="$(docker buildx imagetools inspect "$target" --format '{{.Manifest.Digest}}')"
+          test "$actual" = "$digest"