Fix CI workflow syntax and restore green build

.dockerignore

@@ -0,0 +1,70 @@
+# Version control
+.git
+.gitignore
+
+# Python bytecode
+__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+*.so
+
+# Build artefacts
+*.egg-info/
+*.egg
+dist/
+build/
+wheels/
+sdist/
+
+# Virtual environments
+.venv/
+venv/
+env/
+ENV/
+
+# Test infrastructure (not needed in the image)
+tests/
+.pytest_cache/
+.coverage
+.tox/
+nosetests.xml
+
+# Type-checking caches
+.mypy_cache/
+.ruff_cache/
+
+# IDE / editor artefacts
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# Secrets (never bake into the image)
+.env
+.env.local
+*.pem
+*.key
+
+# CI/CD configuration
+.github/
+.travis.yml
+
+# Legacy packaging that is not needed for Docker builds
+hacklog.spec
+scripts/
+
+# Documentation and data samples (reduce image context size)
+doc/
+data/
+
+# Database files
+*.db
+*.sqlite
+*.sqlite3
+hacklog/hacklog.db
+
+# Miscellaneous
+*.log
+*.pid
+CHANGES

.env.example

@@ -0,0 +1,42 @@
+# Hacklog environment configuration
+# Copy to .env and fill in required secrets before starting the application.
+
+# --- Required SMTP secrets ---
+HACKLOG_SMTP_USER=<your-smtp-username>
+HACKLOG_SMTP_PASSWORD=<your-smtp-password>
+HACKLOG_SMTP_SENDER=<your-smtp-sender@example.com>
+HACKLOG_SMTP_HOST=smtp.gmail.com
+HACKLOG_SMTP_PORT=587
+HACKLOG_ALERT_RECIPIENT=<your-alert-recipient@example.com>
+# HACKLOG_ALLOWED_CIDRS=10.0.0.0/8,192.168.0.0/16
+
+# --- Optional metrics overrides ---
+# HACKLOG_METRICS_ENABLED=false
+# HACKLOG_METRICS_PORT=9090
+
+# --- Optional syslog listener overrides ---
+# HACKLOG_SYSLOG_BIND_ADDRESS=127.0.0.1
+# HACKLOG_SYSLOG_PORT=10514
+# HACKLOG_SYSLOG_MAX_MESSAGE_SIZE=8192
+# HACKLOG_SYSLOG_RATE_LIMIT_PER_SOURCE=100
+
+# --- Optional database overrides ---
+# HACKLOG_DATABASE_DB_URL=sqlite:///hacklog.db
+# HACKLOG_DATABASE_POOL_SIZE=5
+
+# --- Optional security overrides ---
+# HACKLOG_SECURITY_ALLOWED_SOURCE_CIDRS=10.0.0.0/8,192.168.0.0/16
+
+# --- Optional scoring overrides (defaults match legacy algorithm.py constants) ---
+# HACKLOG_SCORING_HOURS_WEIGHT=10
+# HACKLOG_SCORING_DAYS_WEIGHT=10
+# HACKLOG_SCORING_SERVER_WEIGHT=15
+# HACKLOG_SCORING_SUCCESS_WEIGHT=35
+# HACKLOG_SCORING_VPN_WEIGHT=0
+# HACKLOG_SCORING_INTERNAL_WEIGHT=10
+# HACKLOG_SCORING_EXTERNAL_WEIGHT=15
+# HACKLOG_SCORING_IP_WEIGHT=15
+# HACKLOG_SCORING_CRITICAL_THRESHOLD=50
+# HACKLOG_SCORING_SCARY_THRESHOLD=30
+# HACKLOG_SCORING_SCARE_COUNT_LIMIT=2
+# HACKLOG_SCORING_SCARE_DATE_EXPIRE_DAYS=1

.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master, release-next]
+  pull_request:
+    branches: [main, master, release-next]
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install dependencies
+        run: "pip install --only-binary=:all: -r requirements-ci.txt"
+
+      - name: Ruff
+        run: ruff check hacklog/ tests/
+
+      - name: Black
+        run: black --check hacklog/ tests/
+
+      - name: isort
+        run: isort --check hacklog/ tests/
+
+      - name: Mypy (typed modules)
+        run: >-
+          mypy hacklog/validators.py hacklog/security.py hacklog/metrics.py
+          --disallow-untyped-defs --ignore-missing-imports --follow-imports=skip
+          --disable-error-code=no-redef --disable-error-code=no-any-return
+
+      - name: Bandit
+        run: bandit -ll -ii -r hacklog/
+
+      - name: Pytest
+        env:
+          PYTHONPATH: ${{ github.workspace }}:${{ github.workspace }}/hacklog
+        run: pytest tests/ --cov=hacklog --cov-report=xml

.gitignore

@@ -35,3 +35,15 @@ nosetests.xml
 .mr.developer.cfg
 .project
 .pydevproject
+.forge-commit-ready
+.forge/project-id
+.forge/hook-version
+.cursor/hooks.json
+.cursor/hooks/
+.cursor/rules/forge-workflow.mdc
+.claude/
+CLAUDE.md
+
+# Local dev server artifacts
+.hacklog-dev.pid
+var/log/