Cut release: Research Workspace, MCP Unified, Docker Compose, and CI refactors

.dockerignore

@@ -14,6 +14,20 @@
 .claude/
 .codex/
 
+# Local env/secrets (never bake setup credentials into images)
+.env
+.env.*
+!.env.example
+.ENV
+.ENV.*
+!.ENV.example
+tldw_Server_API/Config_Files/.env
+tldw_Server_API/Config_Files/.env.*
+!tldw_Server_API/Config_Files/.env.example
+tldw_Server_API/Config_Files/.ENV
+tldw_Server_API/Config_Files/.ENV.*
+!tldw_Server_API/Config_Files/.ENV.example
+
 # Python/build outputs
 __pycache__/
 *.py[cod]

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+self-hosted-runner:
+  labels:
+    - macOS
+    - ARM64
+    - vz-linux

.github/workflows/actionlint.yml

@@ -3,11 +3,13 @@ name: Lint Workflows (actionlint)
 on:
   pull_request:
     paths:
+      - '.github/actionlint.yaml'
       - '.github/workflows/**'
       - '.github/actions/**'
   push:
     branches: [ main, master ]
     paths:
+      - '.github/actionlint.yaml'
       - '.github/workflows/**'
       - '.github/actions/**'
 
@@ -32,11 +34,12 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          ./actionlint -color \
+          ./actionlint -color -config-file .github/actionlint.yaml \
             .github/workflows/actionlint.yml \
             .github/workflows/codeql.yml \
             .github/workflows/container-build-check.yml \
             .github/workflows/frontend-ux-gates.yml \
             .github/workflows/publish-ghcr-main.yml \
             .github/workflows/publish-docker.yml \
-            .github/workflows/sbom.yml
+            .github/workflows/sbom.yml \
+            .github/workflows/vz-linux-host-gated.yml

.github/workflows/ci.yml

@@ -75,7 +75,6 @@ jobs:
     name: Lint & Type Check
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    continue-on-error: true
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
@@ -89,21 +88,25 @@ jobs:
             pyproject.toml
             uv.lock
 
-      - name: Install mypy
+      - name: Install tools
         run: |
           python -m pip install --upgrade pip
-          pip install mypy
+          pip install "mypy==1.20.1" "ruff==0.15.10"
 
-      - name: MyPy (non-blocking)
-        run: |
-          set +e
-          mypy tldw_Server_API/
-          set -e
+      - name: Ruff lint (non-blocking, baseline 1419 errors)
+        continue-on-error: true
+        run: ruff check tldw_Server_API/
+
+      - name: MyPy (non-blocking, baseline 10191 errors)
+        continue-on-error: true
+        run: mypy tldw_Server_API/
 
   frontend-lint:
     name: Frontend Lint (Next.js)
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    env:
+      SKIP_WXT_PREPARE: "1"
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
@@ -528,7 +531,7 @@ jobs:
         shell: bash
         run: |
           RESULTS_DIR="test-results-linux-${{ matrix.python }}"; MOD="Admin"; set +e
-          pytest -q --maxfail=1 --disable-warnings -p pytest_cov -p pytest_asyncio.plugin -m "not jobs and not e2e" \
+          PYTEST_ADDOPTS='' pytest -q --maxfail=1 --disable-warnings -p pytest_cov -p pytest_asyncio.plugin -m "not jobs and not e2e" \
             tldw_Server_API/tests/Admin \
             --cov=tldw_Server_API --cov-report=xml --cov-report=term-missing --cov-append \
             --junit-xml="$RESULTS_DIR/Admin.xml"; status=$?
@@ -1774,7 +1777,7 @@ jobs:
         shell: bash
         run: |
           RESULTS_DIR="test-results-${{ matrix.os }}-3.12"; MOD="Admin"; set +e
-          pytest -q --maxfail=1 --disable-warnings -p pytest_cov -p pytest_asyncio.plugin -m "not jobs and not e2e" \
+          PYTEST_ADDOPTS='' pytest -q --maxfail=1 --disable-warnings -p pytest_cov -p pytest_asyncio.plugin -m "not jobs and not e2e" \
             tldw_Server_API/tests/Admin \
             --cov=tldw_Server_API --cov-report=xml --cov-report=term-missing --cov-append \
             --junit-xml="$RESULTS_DIR/Admin.xml"; status=$?

.github/workflows/coverage-required.yml

@@ -75,4 +75,4 @@ jobs:
           pytest -q --maxfail=1 --disable-warnings -p pytest_cov -p pytest_asyncio.plugin \
             -m "not jobs and not e2e" \
             tldw_Server_API/tests/unit tldw_Server_API/tests/sanity_tests \
-            --cov=tldw_Server_API --cov-report=xml --cov-report=term-missing --cov-fail-under=4
+            --cov=tldw_Server_API --cov-report=xml --cov-report=term-missing --cov-fail-under=5

.github/workflows/frontend-e2e-tiers.yml

@@ -24,6 +24,9 @@ on:
 permissions:
   contents: read
 
+env:
+  SKIP_WXT_PREPARE: '1'
+
 concurrency:
   group: frontend-e2e-tiers-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/frontend-required.yml

@@ -49,6 +49,7 @@ jobs:
       MINIMAL_TEST_APP: '1'
       PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION: python
       PRIVILEGE_METADATA_VALIDATE_ON_STARTUP: '0'
+      SKIP_WXT_PREPARE: '1'
     steps:
       - name: No-op pass (frontend unchanged)
         if: needs.changes.outputs.frontend_changed != 'true'

.github/workflows/frontend-ux-gates.yml

@@ -38,6 +38,7 @@ jobs:
       NEXT_PUBLIC_API_URL: http://127.0.0.1:8000
       TLDW_WEB_CMD: 'env NEXT_DISABLE_MEM_OVERRIDE=1 NODE_OPTIONS=--max-old-space-size=5120 bun run dev -- --webpack -p 8080'
       TLDW_ONBOARDING_EVIDENCE_TAG: ci-${{ github.run_id }}-${{ github.run_attempt }}
+      SKIP_WXT_PREPARE: '1'
 
     steps:
       - name: Checkout
@@ -146,6 +147,7 @@ jobs:
       NEXT_PUBLIC_API_URL: http://127.0.0.1:8000
       TLDW_WEB_CMD: 'env NODE_OPTIONS=--max-old-space-size=4096 bun run start -- -p 8080'
       TLDW_SMOKE_HARD_GATE: '1'
+      SKIP_WXT_PREPARE: '1'
 
     steps:
       - name: Checkout

.github/workflows/publish-docker.yml

@@ -48,13 +48,13 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Log in to GHCR
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/publish-ghcr-main.yml

@@ -58,7 +58,7 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
 
       - name: Log in to GHCR
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/publish-pypi.yml

@@ -1,8 +1,6 @@
 name: Publish PyPI Package
 
 on:
-  release:
-    types: [published]
   workflow_dispatch:
     inputs:
       target:
@@ -71,7 +69,7 @@ jobs:
   publish-pypi:
     name: Publish to PyPI
     needs: build
-    if: ${{ github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.target == 'pypi') }}
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.target == 'pypi' }}
     runs-on: ubuntu-latest
     permissions:
       id-token: write

.github/workflows/sbom.yml

@@ -34,6 +34,7 @@ jobs:
       - name: Generate Python SBOM (CycloneDX)
         run: |
           set -euo pipefail
+          repo_root="${GITHUB_WORKSPACE:-$PWD}"
           # Install CycloneDX Python tooling. Newer releases expose the `cyclonedx-py` CLI,
           # older ones expose `cyclonedx-bom`. We support both.
           python -m pip install -q cyclonedx-bom
@@ -43,13 +44,17 @@ jobs:
             local req_dir req_file out_file
             req_dir="$(dirname "$req")"
             req_file="$(basename "$req")"
-            out_file="$PWD/sbom-python.cdx.json"
+            out_file="$repo_root/sbom-python.cdx.json"
             echo "Generating Python SBOM from ${req}"
 
-            # Try modern CLI first: cyclonedx-py requirements -i <file>
+            # Try modern CLI first: cyclonedx-py requirements <file>
             if command -v cyclonedx-py >/dev/null 2>&1; then
               echo "Using cyclonedx-py"
-              if (cd "$req_dir" && cyclonedx-py requirements -i "$req_file" -o "$out_file"); then
+              if (cd "$req_dir" && cyclonedx-py requirements "$req_file" -o "$out_file"); then
+                return 0
+              fi
+              echo "cyclonedx-py positional requirements failed; trying stdin form"
+              if (cd "$req_dir" && cyclonedx-py requirements - -o "$out_file" < "$req_file"); then
                 return 0
               fi
               echo "cyclonedx-py failed; will try fallbacks"
@@ -58,16 +63,20 @@ jobs:
             # Module invocation for modern CLI (avoid depending on CLI binary layout)
             if python -c "import importlib.util, sys; sys.exit(0 if importlib.util.find_spec('cyclonedx_py') else 1)" >/dev/null 2>&1; then
               echo "Using python -m cyclonedx_py"
-              if (cd "$req_dir" && python -m cyclonedx_py requirements -i "$req_file" -o "$out_file"); then
+              if (cd "$req_dir" && python -m cyclonedx_py requirements "$req_file" -o "$out_file"); then
+                return 0
+              fi
+              echo "python -m cyclonedx_py positional requirements failed; trying stdin form"
+              if (cd "$req_dir" && python -m cyclonedx_py requirements - -o "$out_file" < "$req_file"); then
                 return 0
               fi
               echo "python -m cyclonedx_py failed; trying legacy CLI"
             fi
 
-            # Legacy CLI: cyclonedx-bom -r <file>
+            # Legacy CLI: cyclonedx-bom -r -i <file>
             if command -v cyclonedx-bom >/dev/null 2>&1; then
               echo "Using cyclonedx-bom (legacy)"
-              if (cd "$req_dir" && cyclonedx-bom -r "$req_file" -o "$out_file"); then
+              if (cd "$req_dir" && cyclonedx-bom -r -i "$req_file" -o "$out_file"); then
                 return 0
               fi
               echo "cyclonedx-bom failed; trying legacy module"
@@ -76,7 +85,7 @@ jobs:
             # Legacy module invocation
             if python -c "import importlib.util, sys; sys.exit(0 if importlib.util.find_spec('cyclonedx_bom') else 1)" >/dev/null 2>&1; then
               echo "Using python -m cyclonedx_bom (legacy)"
-              if (cd "$req_dir" && python -m cyclonedx_bom -r "$req_file" -o "$out_file"); then
+              if (cd "$req_dir" && python -m cyclonedx_bom -r -i "$req_file" -o "$out_file"); then
                 return 0
               fi
             fi
@@ -85,12 +94,42 @@ jobs:
             return 1
           }
 
-          if [ -f tldw_Server_API/requirements.txt ]; then
-            gen_from_requirements tldw_Server_API/requirements.txt
-          elif [ -f requirements.txt ]; then
-            gen_from_requirements requirements.txt
+          gen_requirements_from_pyproject() {
+            local pyproject="$1"
+            local generated_req
+            generated_req="$(mktemp)"
+            python - "$pyproject" "$generated_req" <<'PY'
+          import sys
+          import tomllib
+          from pathlib import Path
+
+          pyproject = Path(sys.argv[1])
+          generated_req = Path(sys.argv[2])
+          data = tomllib.loads(pyproject.read_text(encoding="utf-8"))
+          dependencies = data.get("project", {}).get("dependencies") or []
+          dependencies = [str(dependency).strip() for dependency in dependencies if str(dependency).strip()]
+          if not dependencies:
+              raise SystemExit(f"No [project].dependencies entries found in {pyproject}")
+
+          generated_req.write_text("\n".join(dependencies) + "\n", encoding="utf-8")
+          print(f"Wrote {len(dependencies)} requirements from {pyproject} to {generated_req}")
+          PY
+            if gen_from_requirements "$generated_req"; then
+              rm -f "$generated_req"
+              return 0
+            fi
+            rm -f "$generated_req"
+            return 1
+          }
+
+          if [ -f "$repo_root/tldw_Server_API/requirements.txt" ]; then
+            gen_from_requirements "$repo_root/tldw_Server_API/requirements.txt"
+          elif [ -f "$repo_root/requirements.txt" ]; then
+            gen_from_requirements "$repo_root/requirements.txt"
+          elif [ -f "$repo_root/pyproject.toml" ]; then
+            gen_requirements_from_pyproject "$repo_root/pyproject.toml"
           else
-            echo "No requirements file found; cannot generate SBOM" >&2
+            echo "No Python dependency source found; cannot generate SBOM" >&2
             exit 1
           fi
 

.github/workflows/ui-playground-quality-gates.yml

@@ -40,6 +40,8 @@ jobs:
     name: Playground Device/A11y/Composer Gates
     runs-on: ubuntu-latest
     timeout-minutes: 35
+    env:
+      SKIP_WXT_PREPARE: "1"
     steps:
       - name: Checkout
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8