Unify crud grammar

.github/dependabot.yml

@@ -1,30 +1,56 @@
 version: 2
 updates:
-- package-ecosystem: docker
-  directory: "/mpcontribs-kernel-gateway"
-  schedule:
-    interval: weekly
-    time: '08:00'
-    timezone: US/Pacific
-  open-pull-requests-limit: 10
-- package-ecosystem: npm
-  directory: "/mpcontribs-portal"
-  schedule:
-    interval: weekly
-    time: '08:00'
-    timezone: US/Pacific
-  open-pull-requests-limit: 10
-- package-ecosystem: docker
-  directory: "/mpcontribs-portal"
-  schedule:
-    interval: weekly
-    time: '08:00'
-    timezone: US/Pacific
-  open-pull-requests-limit: 10
-- package-ecosystem: docker
-  directory: "/mpcontribs-api"
-  schedule:
-    interval: weekly
-    time: '08:00'
-    timezone: US/Pacific
-  open-pull-requests-limit: 10
+  # --- GitHub Actions: keep workflow action versions current ---
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      time: "08:00"
+      timezone: US/Pacific
+    groups:
+      actions:
+        patterns: ["*"]
+    open-pull-requests-limit: 10
+
+  # --- Python via uv: monitors pyproject.toml + uv.lock --------
+  - package-ecosystem: uv
+    directory: "/mpcontribs-api"
+    schedule:
+      interval: weekly
+      time: "08:00"
+      timezone: US/Pacific
+    groups:
+      python-minor-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    open-pull-requests-limit: 10
+
+  # --- Existing entries ----------------------------------------
+  - package-ecosystem: docker
+    directory: "/mpcontribs-kernel-gateway"
+    schedule:
+      interval: weekly
+      time: "08:00"
+      timezone: US/Pacific
+    open-pull-requests-limit: 10
+  - package-ecosystem: npm
+    directory: "/mpcontribs-portal"
+    schedule:
+      interval: weekly
+      time: "08:00"
+      timezone: US/Pacific
+    open-pull-requests-limit: 10
+  - package-ecosystem: docker
+    directory: "/mpcontribs-portal"
+    schedule:
+      interval: weekly
+      time: "08:00"
+      timezone: US/Pacific
+    open-pull-requests-limit: 10
+  - package-ecosystem: docker
+    directory: "/mpcontribs-api"
+    schedule:
+      interval: weekly
+      time: "08:00"
+      timezone: US/Pacific
+    open-pull-requests-limit: 10

.github/rulesets/dev.json

@@ -0,0 +1,48 @@
+{
+  "name": "Protect dev",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/dev"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": ["squash", "merge", "rebase"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          { "context": "ci-success" }
+        ]
+      }
+    },
+    {
+      "type": "merge_queue",
+      "parameters": {
+        "check_response_timeout_minutes": 60,
+        "grouping_strategy": "ALLGREEN",
+        "max_entries_to_build": 5,
+        "max_entries_to_merge": 5,
+        "merge_method": "SQUASH",
+        "min_entries_to_merge": 1,
+        "min_entries_to_merge_wait_minutes": 5
+      }
+    }
+  ]
+}

.github/rulesets/master.json

@@ -0,0 +1,48 @@
+{
+  "name": "Protect master",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/master"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": ["squash", "merge", "rebase"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          { "context": "ci-success" }
+        ]
+      }
+    },
+    {
+      "type": "merge_queue",
+      "parameters": {
+        "check_response_timeout_minutes": 60,
+        "grouping_strategy": "ALLGREEN",
+        "max_entries_to_build": 5,
+        "max_entries_to_merge": 5,
+        "merge_method": "SQUASH",
+        "min_entries_to_merge": 1,
+        "min_entries_to_merge_wait_minutes": 5
+      }
+    }
+  ]
+}

.github/workflows/_python_ci.yml

@@ -0,0 +1,86 @@
+# Reusable CI runner.
+#
+# The `test` job always runs the suite named by `test-suite`
+# The `lint` and `typecheck` jobs only run when `run-quality` is true — the caller
+# sets that for pushes/PRs to dev or master, and leaves it false for feature-branch
+# pushes (which only get the fast unit suite).
+name: _python-ci
+
+on:
+  workflow_call:
+    inputs:
+      package:
+        description: "Package directory, e.g. mpcontribs-api"
+        required: true
+        type: string
+      python-version:
+        description: "Override Python version; empty = use the package's .python-version pin"
+        required: false
+        type: string
+        default: ""
+      test-suite:
+        description: "Suite passed to `just test <suite>` (e.g. u = unit, all = everything)"
+        required: false
+        type: string
+        default: "u"
+      run-quality:
+        description: "Run the lint/format/lock and typecheck gates (dev/master only)"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    if: ${{ inputs.run-quality }}
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ${{ inputs.package }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+          cache-dependency-glob: "${{ inputs.package }}/uv.lock"
+      - uses: extractions/setup-just@v4
+      - run: uv python install ${{ inputs.python-version }}
+      - run: just install
+      - run: just lint
+      - run: just format-check
+      - run: just lock-check
+
+  typecheck:
+    if: ${{ inputs.run-quality }}
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ${{ inputs.package }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+          cache-dependency-glob: "${{ inputs.package }}/uv.lock"
+      - uses: extractions/setup-just@v4
+      - run: uv python install ${{ inputs.python-version }}
+      - run: just install
+      - run: just typecheck
+
+  test:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ${{ inputs.package }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+          cache-dependency-glob: "${{ inputs.package }}/uv.lock"
+      - uses: extractions/setup-just@v4
+      - run: uv python install ${{ inputs.python-version }}
+      - run: just install
+      - run: just test ${{ inputs.test-suite }}

.github/workflows/ci.yml

@@ -0,0 +1,112 @@
+# Adding a package: once it has a uv-based justfile contract (install/lint/
+# format-check/typecheck/lock-check/test), add it to BOTH the paths-filter
+# `filters` below AND the `config` map in the discover step. Until a package is
+# migrated, leave it out - it stays covered by the legacy testing.yml instead.
+#
+# Gate levels (see the `full` flag in discover):
+#   - pull_request into dev/master   -> unit only (`just test u`), on every push
+#   - merge_group (PR entered the     -> full gate: lint + format + typecheck +
+#     merge queue via "merge when         `just test`. This is the real pre-merge
+#     ready")                             gate and runs once, at merge time.
+#   - push to dev/master (post-merge) -> full gate (safety net).
+
+name: ci
+
+on:
+  pull_request:
+    branches: [dev, master]
+  merge_group:
+  push:
+    branches: [dev, master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  discover:
+    runs-on: ubuntu-latest
+    outputs:
+      packages: ${{ steps.build.outputs.packages }}
+      full: ${{ steps.level.outputs.full }}
+    steps:
+      - name: Determine gate level
+        id: level
+        # "full" = the lint/format/typecheck + whole-suite gate. It runs for
+        # merge_group (a PR entering the merge queue) and for direct pushes to
+        # dev/master. A plain pull_request stays unit-only so open-PR pushes are
+        # cheap; the full suite only fires when the PR is queued to merge.
+        run: |
+          if [ "${{ github.event_name }}" = "merge_group" ] \
+             || [ "${{ github.ref }}" = "refs/heads/dev" ] \
+             || [ "${{ github.ref }}" = "refs/heads/master" ]; then
+            echo "full=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "full=false" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            mpcontribs-api:
+              - 'mpcontribs-api/**'
+              - '.github/workflows/ci.yml'
+              - '.github/workflows/_python_ci.yml'
+      - name: Build matrix of changed (migrated) packages
+        id: build
+        env:
+          CHANGES: ${{ toJSON(steps.filter.outputs) }}
+        run: |
+          # Map of migrated package -> optional python-version override
+          # ("" = use the package's .python-version pin). Only packages whose
+          # filter reported a change are emitted into the matrix.
+          python3 - "$CHANGES" <<'PY' >> "$GITHUB_OUTPUT"
+          import json, sys
+          changes = json.loads(sys.argv[1])
+          config = {
+              "mpcontribs-api": {"python-version": ""},
+              # "mpcontribs-client": {"python-version": ""},  # add when migrated
+          }
+          include = [
+              {"package": pkg, **cfg}
+              for pkg, cfg in config.items()
+              if changes.get(pkg) == "true"
+          ]
+          print("packages=" + json.dumps(include))
+          PY
+
+  ci:
+    needs: discover
+    if: ${{ needs.discover.outputs.packages != '[]' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.discover.outputs.packages) }}
+    uses: ./.github/workflows/_python_ci.yml
+    with:
+      package: ${{ matrix.package }}
+      python-version: ${{ matrix.python-version }}
+      test-suite: ${{ needs.discover.outputs.full == 'true' && 'all' || 'u' }}
+      run-quality: ${{ needs.discover.outputs.full == 'true' }}
+
+  # Always-reporting aggregate gate. Make ONLY this a required status check
+  gate:
+    name: ci-success
+    if: always()
+    needs: [discover, ci]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify CI result
+        run: |
+          result="${{ needs.ci.result }}"
+          # 'skipped' is success here: it means no migrated package needed checking.
+          if [ "$result" = "success" ] || [ "$result" = "skipped" ]; then
+            echo "CI gate passed (ci job: $result)"
+            exit 0
+          fi
+          echo "CI gate failed (ci job: $result)"
+          exit 1