Feature/ci quality gates

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.github
+venv
+__pycache__
+.pytest_cache
+tests
+htmlcov
+.coverage
+.env
+docs
+*.pyc
+!tests/

.github/workflows/ci.yml

@@ -0,0 +1,79 @@
+name: TaskTracker CI
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+      - dev
+      - feature/**
+  pull_request:
+    branches:
+      - main
+      - develop
+      - dev
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: tasktracker
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U postgres"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
+
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/tasktracker
+      APP_PORT: 8000
+      LOG_LEVEL: INFO
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements.txt
+
+      - name: Run tests
+        run: python -m pytest -v
+
+      - name: Lint with Ruff
+        run: ruff check .
+
+      - name: Run tests with coverage gate
+        run: python -m pytest --cov=app --cov-report=term-missing --cov-fail-under=80
+
+
+  publish:
+    if: github.event_name == 'push' &&  (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
+    needs: test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ secrets.DOCKERHUB_USERNAME }}/tasktracker:latest

Dockerfile

@@ -0,0 +1,23 @@
+FROM python:3.12.10-slim-bookworm AS builder
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
+
+COPY app ./app
+
+FROM python:3.12.10-slim-bookworm
+
+RUN useradd -m app
+
+WORKDIR /app
+
+COPY --from=builder /install /usr/local
+COPY app ./app
+
+USER app
+
+EXPOSE 8000
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

Dockerfile.test

@@ -0,0 +1,15 @@
+FROM python:3.12.10-slim-bookworm
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app ./app
+COPY tests ./tests
+COPY pytest.ini* ./
+ENV DATABASE_URL=sqlite:///./test.db \
+    APP_PORT=8000 \
+    LOG_LEVEL=INFO
+
+RUN python -m pytest -v

Makefile

@@ -0,0 +1,20 @@
+.PHONY: run test coverage lint format install
+
+install:
+	pip install -r requirements.txt
+
+run:
+	uvicorn app.main:app --reload
+
+test:
+	pytest -v
+
+coverage:
+	pytest --cov=app --cov-report=term-missing
+
+lint:
+	flake8 app tests
+
+format:
+	black .
+	isort .

README.md

@@ -1,2 +1,63 @@
-# TaskTracker
-Production-ready TaskTracker backend built with FastAPI, PostgreSQL, Docker, Kubernetes, Terraform and CI/CD practices. Includes migrations, structured JSON logging, health checks, automated testing and GitHub workflow automation.
+# TaskTracker Backend
+
+TaskTracker is a production-ready backend API built with FastAPI for managing users and tasks, featuring automated testing, containerization, and CI/CD.
+
+---
+
+## Tech Stack
+
+* FastAPI
+* PostgreSQL
+* SQLAlchemy
+* Alembic
+* Pytest & pytest-cov
+* Docker & Docker Compose
+* GitHub Actions
+
+---
+
+## Features
+
+### Users
+
+* Create and retrieve users
+* Email uniqueness validation
+
+### Tasks
+
+* Create, retrieve, update, and delete tasks
+* Filter tasks by owner and status
+* Input and ownership validation
+
+### Health Endpoints
+
+* `/healthz`
+* `/readyz`
+
+---
+
+## DevOps Highlights
+
+* Multi-stage Docker image running as a non-root user
+* Docker Compose setup with PostgreSQL health checks
+* Automated testing and coverage reporting via GitHub Actions
+* Automatic Docker Hub image publishing after successful CI
+
+---
+
+## Project Structure
+
+```text
+app/
+├── api/
+├── core/
+├── db/
+├── middleware/
+├── models/
+├── schemas/
+└── services/
+
+tests/
+docs/
+.github/workflows/
+```

alembic.ini

@@ -0,0 +1,149 @@
+# A generic, single database configuration.
+
+[alembic]
+# path to migration scripts.
+# this is typically a path given in POSIX (e.g. forward slashes)
+# format, relative to the token %(here)s which refers to the location of this
+# ini file
+script_location = %(here)s/alembic
+
+# template used to generate migration file names; The default value is %%(rev)s_%%(slug)s
+# Uncomment the line below if you want the files to be prepended with date and time
+# see https://alembic.sqlalchemy.org/en/latest/tutorial.html#editing-the-ini-file
+# for all available tokens
+# file_template = %%(year)d_%%(month).2d_%%(day).2d_%%(hour).2d%%(minute).2d-%%(rev)s_%%(slug)s
+# Or organize into date-based subdirectories (requires recursive_version_locations = true)
+# file_template = %%(year)d/%%(month).2d/%%(day).2d_%%(hour).2d%%(minute).2d_%%(second).2d_%%(rev)s_%%(slug)s
+
+# sys.path path, will be prepended to sys.path if present.
+# defaults to the current working directory.  for multiple paths, the path separator
+# is defined by "path_separator" below.
+prepend_sys_path = .
+
+
+# timezone to use when rendering the date within the migration file
+# as well as the filename.
+# If specified, requires the tzdata library which can be installed by adding
+# `alembic[tz]` to the pip requirements.
+# string value is passed to ZoneInfo()
+# leave blank for localtime
+# timezone =
+
+# max length of characters to apply to the "slug" field
+# truncate_slug_length = 40
+
+# set to 'true' to run the environment during
+# the 'revision' command, regardless of autogenerate
+# revision_environment = false
+
+# set to 'true' to allow .pyc and .pyo files without
+# a source .py file to be detected as revisions in the
+# versions/ directory
+# sourceless = false
+
+# version location specification; This defaults
+# to <script_location>/versions.  When using multiple version
+# directories, initial revisions must be specified with --version-path.
+# The path separator used here should be the separator specified by "path_separator"
+# below.
+# version_locations = %(here)s/bar:%(here)s/bat:%(here)s/alembic/versions
+
+# path_separator; This indicates what character is used to split lists of file
+# paths, including version_locations and prepend_sys_path within configparser
+# files such as alembic.ini.
+# The default rendered in new alembic.ini files is "os", which uses os.pathsep
+# to provide os-dependent path splitting.
+#
+# Note that in order to support legacy alembic.ini files, this default does NOT
+# take place if path_separator is not present in alembic.ini.  If this
+# option is omitted entirely, fallback logic is as follows:
+#
+# 1. Parsing of the version_locations option falls back to using the legacy
+#    "version_path_separator" key, which if absent then falls back to the legacy
+#    behavior of splitting on spaces and/or commas.
+# 2. Parsing of the prepend_sys_path option falls back to the legacy
+#    behavior of splitting on spaces, commas, or colons.
+#
+# Valid values for path_separator are:
+#
+# path_separator = :
+# path_separator = ;
+# path_separator = space
+# path_separator = newline
+#
+# Use os.pathsep. Default configuration used for new projects.
+path_separator = os
+
+# set to 'true' to search source files recursively
+# in each "version_locations" directory
+# new in Alembic version 1.10
+# recursive_version_locations = false
+
+# the output encoding used when revision files
+# are written from script.py.mako
+# output_encoding = utf-8
+
+# database URL.  This is consumed by the user-maintained env.py script only.
+# other means of configuring database URLs may be customized within the env.py
+# file.
+sqlalchemy.url = driver://user:pass@localhost/dbname
+
+
+[post_write_hooks]
+# post_write_hooks defines scripts or Python functions that are run
+# on newly generated revision scripts.  See the documentation for further
+# detail and examples
+
+# format using "black" - use the console_scripts runner, against the "black" entrypoint
+# hooks = black
+# black.type = console_scripts
+# black.entrypoint = black
+# black.options = -l 79 REVISION_SCRIPT_FILENAME
+
+# lint with attempts to fix using "ruff" - use the module runner, against the "ruff" module
+# hooks = ruff
+# ruff.type = module
+# ruff.module = ruff
+# ruff.options = check --fix REVISION_SCRIPT_FILENAME
+
+# Alternatively, use the exec runner to execute a binary found on your PATH
+# hooks = ruff
+# ruff.type = exec
+# ruff.executable = ruff
+# ruff.options = check --fix REVISION_SCRIPT_FILENAME
+
+# Logging configuration.  This is also consumed by the user-maintained
+# env.py script only.
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARNING
+handlers = console
+qualname =
+
+[logger_sqlalchemy]
+level = WARNING
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S

alembic/README

@@ -0,0 +1 @@
+Generic single-database configuration.