[tilloh-bot]

Result

tilloh.dev is on tide 0.4.4 (tier 2, all texts English).

Building Blocks

• ✔ AGENTS.md — CLAUDE.md content moved over; longer parts in docs/development.md; CLAUDE.md removed
• ✔ .claude/settings.json — .claude submodule (unreachable repo) removed
• ✔ docs/: requirements/F-000-template.md, backlog.md, betrieb.md (tier 2 rules); docs/features/ untouched
• ✔ pnpm 12.9.0 workspace (frontend, backend, e2e), .node-version 22, minimumReleaseAge, allowBuilds
  • lockfile imported per package: resolved versions match main
  • declared imports npm only found via hoisting: backend express, @fastify/cors, mongodb, @types/express; frontend jsonc-eslint-parser
  • Backend.Dockerfile installs from package.json (no lockfile)
• ✔ CI: ci.yml (checks, audit, fs-scan, backend image-scan, changelog, gate) replaces pull_request_check.yml
  • deploy and restart jobs: environment: production, actions pinned by SHA, build with pnpm
  • develop workflows removed
  • release drafter: GITHUB_TOKEN instead of the deleted CI_TOKEN
• ✔ renovate.json
• ✔ vulnerable backend dependencies fixed (see Checks)
• ✘ docs/DESIGN.md — open, /tide:design as a separate run
• ✘ betrieb.md: MongoDB location, monitoring, backup — open, to be filled in by Tim
• ✘ E2E in CI — not set up (deliberate deviation)

Checks

Local, clean install: lint ✔ · check ✔ · test ✔ · build ✔ · audit --prod ✔
CI: checks ✔ · audit ✔ · fs-scan ✔ · image-scan ✔ · changelog ✔ · gate ✔

Fixed from the first image scan (16 HIGH in the backend runtime image, same packages the Uberspace host installs):

• fastify 5.11.3 → 5.12.5 (authentication bypass via malformed URLs), via override: @nestjs/platform-fastify 11 pins 5.11.3
• @fastify/static → ^10.1.2 (route guard bypass), as required by @nestjs/platform-fastify 11.2
• @fastify/busboy 1.x → 3.2.2 via override (DoS), used by fastify-multer; upload via @fastify/multipart + fastify-multer tested locally
• npm removed from the runtime image (pacote, sigstore, ip-address, picomatch, brace-expansion)
• overrides live in pnpm-workspace.yaml and in backend/package.json (for npm i on Uberspace)

Already broken before the bootstrap, not fixed:

• frontend tests: no test files, Vitest config not loadable → pnpm test runs backend tests only
• Frontend.Dockerfile copies the missing frontend/config-template.json → only the backend image is scanned
• 5 critical vulnerabilities in dev dependencies (vitest, ts-jest→handlebars, webpack-dev-server→shell-quote/websocket-driver, nx→form-data)

Deliberate Deviations

• Uberspace installs backend dependencies with npm i
• E2E tests run locally only
• changelog CI job: every PR updates CHANGELOG.md (Renovate PRs excepted)
• pnpm audit --prod in CI

Findings

• .env files: none committed (e2e/.env.test.example only)
• .claude submodule pointed to timlohse1104/claude-code-tools, not reachable for tilloh-bot → removed
• DOCKER_USERNAME / DOCKER_PASSWORD in production are no longer used by any workflow
• pnpm 12 writes pnpm-lock.yaml as multi-document YAML; nx 22 logs a parse warning during install; lint, test and build are unaffected
• git-hooks/pre-commit changes directory incorrectly: frontend tests never run, backend tests run twice

For Tim after the merge

• After the first deploy: try the OCR upload in Food Scan once (busboy 3 in fastify-multer)
• Run scripts/repo-setup.sh tilloh-dev/tilloh.dev again in the normal shell: the gate job only exists now, and the script makes it a required check. The run before the bootstrap is not enough.
• Enable the repo for Renovate on developer.mend.io
• Wait for the first "Dependency Dashboard" issue (D-028)
• Delete the develop branch
• Remove DOCKER_USERNAME / DOCKER_PASSWORD from production if Docker Hub pushes are not coming back
• Fill in the open rows in docs/betrieb.md

🤖 Generated with Claude Code