Docker laravel

.github/workflows/ci.yml

@@ -0,0 +1,96 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  php:
+    name: PHP Tests & Lint
+    runs-on: ubuntu-latest
+
+    services:
+      mariadb:
+        image: mariadb:11
+        env:
+          MARIADB_ROOT_PASSWORD: root
+          MARIADB_DATABASE: skillr_test
+          MARIADB_USER: skillr
+          MARIADB_PASSWORD: secret
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="healthcheck.sh --connect --innodb_initialized"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.4'
+          extensions: pdo, pdo_mysql, mbstring, bcmath, gd, opcache
+          coverage: none
+
+      - name: Install Composer dependencies
+        run: composer install --no-interaction --prefer-dist
+
+      - name: Prepare environment
+        run: |
+          cp .env.example .env
+          sed -i 's/DB_HOST=mariadb/DB_HOST=127.0.0.1/' .env
+          php artisan key:generate
+
+      - name: Run migrations
+        run: php artisan migrate --seed --force
+        env:
+          DB_HOST: 127.0.0.1
+          DB_DATABASE: skillr_test
+          DB_USERNAME: skillr
+          DB_PASSWORD: secret
+
+      - name: Run tests
+        run: php artisan test
+        env:
+          DB_HOST: 127.0.0.1
+          DB_DATABASE: skillr_test
+          DB_USERNAME: skillr
+          DB_PASSWORD: secret
+
+      - name: Check code formatting
+        run: vendor/bin/pint --test
+
+  frontend:
+    name: Frontend Lint & Build
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: ui/package-lock.json
+
+      - name: Install dependencies
+        working-directory: ui
+        run: npm ci
+
+      - name: Type check
+        working-directory: ui
+        run: npx tsc --noEmit
+
+      - name: Lint
+        working-directory: ui
+        run: npm run lint
+
+      - name: Build
+        working-directory: ui
+        run: npm run build

.github/workflows/docs.yml

@@ -0,0 +1,60 @@
+name: Deploy Docs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build Documentation
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: docs/package-lock.json
+
+      - name: Install dependencies
+        working-directory: docs
+        run: npm ci
+
+      - name: Build VitePress site
+        working-directory: docs
+        run: npm run build
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs/.vitepress/dist
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

CODE_OF_CONDUCT.md

@@ -0,0 +1,9 @@
+# Code of Conduct
+
+This project follows the [Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+Please read the full text at the link above. By participating in this project, you agree to abide by its terms.
+
+## Enforcement
+
+Instances of unacceptable behavior may be reported to the project maintainers at **conduct@eooo.io**.

CONTRIBUTING.md

@@ -0,0 +1,111 @@
+# Contributing to Skillr
+
+Thank you for your interest in contributing. This guide covers setup, coding standards, and the PR process.
+
+## Development Setup
+
+### Prerequisites
+
+- PHP 8.4+
+- Composer
+- Node.js 20+ and npm
+- MariaDB 11+ (or Docker)
+
+### With Docker
+
+```bash
+git clone https://github.com/eooo-io/skillr.git
+cd skillr
+cp .env.example .env
+# Edit .env — set PROJECTS_HOST_PATH to your local dev directory
+
+make build
+make up
+make migrate
+
+# Start the React SPA (separate terminal)
+cd ui && npm install && npm run dev
+```
+
+### Without Docker
+
+```bash
+git clone https://github.com/eooo-io/skillr.git
+cd skillr
+composer install
+cp .env.example .env
+php artisan key:generate
+
+# Configure database credentials in .env (DB_HOST=127.0.0.1)
+php artisan migrate --seed
+
+cd ui && npm install && cd ..
+composer dev
+```
+
+### Access Points
+
+| Interface | URL |
+|---|---|
+| React SPA | http://localhost:5173 |
+| Filament Admin | http://localhost:8000/admin |
+| API | http://localhost:8000/api |
+
+Default login: `admin@admin.com` / `password`
+
+## Running Tests
+
+```bash
+# PHP tests (Pest)
+composer test
+# or with Docker:
+make test
+
+# TypeScript type checking
+cd ui && npx tsc --noEmit
+
+# Frontend linting
+cd ui && npm run lint
+```
+
+## Coding Standards
+
+### PHP
+
+- Follow [PSR-12](https://www.php-fig.org/psr/psr-12/) coding style
+- Format with Laravel Pint: `vendor/bin/pint`
+- Use [Pest PHP](https://pestphp.com/) for tests
+- Add authorization checks (`$this->authorize()`) to any new controller methods that access user resources
+- Use FormRequest classes for complex validation
+
+### TypeScript / React
+
+- Run ESLint before committing: `cd ui && npm run lint`
+- Use TypeScript strictly (no `any` types)
+- Follow existing component patterns in `ui/src/components/`
+- Use Zustand stores for shared state
+
+## Pull Request Process
+
+1. **Open an issue first** to discuss significant changes
+2. Fork the repo and create a feature branch: `git checkout -b feature/my-feature`
+3. Write tests for new functionality
+4. Ensure all tests pass: `composer test` and `cd ui && npx tsc --noEmit`
+5. Format code: `vendor/bin/pint`
+6. Push and open a PR against `main`
+
+### PR Guidelines
+
+- Keep PRs focused — one feature or fix per PR
+- Include a clear description of what changed and why
+- Reference related issues with `Closes #123`
+- Add tests for new API endpoints
+- Update CLAUDE.md if you add new routes, models, or services
+
+## Project Structure
+
+See [CLAUDE.md](CLAUDE.md) for full architecture documentation including:
+- Database schema
+- API endpoints
+- Service layer overview
+- Provider sync system

PLAN.md

@@ -128,6 +128,39 @@ The React SPA (`ui/`), `.skillr/` file format, and all provider sync output form
 
 ---
 
+## Desktop App Config Sync — [Milestone](https://github.com/eooo-io/skillr/milestone/7)
+
+**Goal:** Extend Skillr to sync MCP server definitions and app settings to desktop AI tools — making Skillr the single source of truth for both project-level provider configs AND user-level desktop app configurations.
+
+The fragmentation problem doesn't stop at IDE/CLI instruction files. Desktop apps like Claude Desktop, ChatGPT Desktop, Claude Code, Codex CLI, Cursor, and Windsurf each maintain their own config files for MCP server connections, model preferences, permissions, and approval modes. Skillr already stores MCP server definitions per project — this phase generates desktop app configs from the same source.
+
+### Feature 1: Desktop MCP Config Sync
+
+| # | Issue | Status |
+|---|---|---|
+| #49 | Define desktop app config schema and data model | |
+| #50 | Desktop MCP sync drivers — Claude Desktop, Claude Code, Cursor, Windsurf | |
+| #51 | Desktop MCP sync API endpoints and UI | |
+| #52 | Reverse-import MCP servers from desktop app configs | |
+
+### Feature 2: Desktop App Settings Sync
+
+| # | Issue | Status |
+|---|---|---|
+| #53 | Desktop app settings model — workspace profiles | |
+| #54 | Desktop settings sync drivers — Claude Code, Codex CLI, Cursor | |
+| #55 | Desktop config diff preview before sync | |
+| #56 | Tests for desktop config sync drivers | |
+
+### Implementation sequence
+
+```
+#49 (data model) → #50 (MCP drivers) + #52 (reverse-import) in parallel → #51 (API + UI)
+#53 (workspace profiles) → #54 (settings drivers) → #55 (diff preview) → #56 (tests throughout)
+```
+
+---
+
 ## Laravel Legacy (Phases 1-26) — COMPLETE
 
 The original Laravel implementation built the full Component Layer:

README.md

@@ -89,6 +89,8 @@ composer dev
 
 Default login: `admin@admin.com` / `password`
 
+> **Warning:** Change these credentials immediately in any non-local environment. The seeded admin account is for development only.
+
 ## Features
 
 ### Skill Management
@@ -176,13 +178,11 @@ cd ui && npx tsc --noEmit
 
 ## Contributing
 
-Contributions are welcome. Please open an issue first to discuss what you'd like to change.
+Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for setup instructions and guidelines.
+
+## Security
 
-1. Fork the repo
-2. Create your feature branch (`git checkout -b feature/my-feature`)
-3. Commit your changes
-4. Push to the branch (`git push origin feature/my-feature`)
-5. Open a Pull Request
+If you discover a security vulnerability, please see [SECURITY.md](SECURITY.md) for responsible disclosure instructions. **Do not open a public issue.**
 
 ## License
 

SECURITY.md

@@ -0,0 +1,29 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Skillr, please report it responsibly.
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Instead, email security concerns to: **security@eooo.io**
+
+Please include:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+## Response Timeline
+
+- **Acknowledgment:** Within 48 hours
+- **Assessment:** Within 7 days
+- **Fix:** Depends on severity, typically within 30 days
+
+## Scope
+
+This policy covers the Skillr application code in this repository. Third-party dependencies are managed via Composer and npm, and their vulnerabilities should be reported to respective maintainers.
+
+## Default Credentials
+
+The database seeder creates a default admin account (`admin@admin.com` / `password`) for development purposes only. **Change these credentials immediately** in any non-local deployment.