Prepare OpenGeoMetadata API community transfer

.github/workflows/ci.yml

@@ -0,0 +1,165 @@
+name: Backend Test Suite
+
+on:
+  push:
+    branches: [develop]
+  pull_request:
+    branches: [develop]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: backend-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  backend:
+    name: Run full backend test suite
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    services:
+      paradedb:
+        image: paradedb/paradedb:0.18.11
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: opengeometadata_api
+        ports:
+          - 2345:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d opengeometadata_api"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+      elasticsearch:
+        image: docker.elastic.co/elasticsearch/elasticsearch:9.0.0
+        env:
+          discovery.type: single-node
+          xpack.security.enabled: "false"
+          ES_JAVA_OPTS: -Xms1g -Xmx1g
+        ports:
+          - 9200:9200
+        options: >-
+          --ulimit nofile=65536:65536
+          --health-cmd "curl -fsS http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=60s || exit 1"
+          --health-interval 10s
+          --health-timeout 10s
+          --health-retries 18
+      redis:
+        image: redis:7.4.6-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping | grep PONG"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 12
+
+    env:
+      APP_ENV: test
+      POSTGRES_PASSWORD: postgres
+      DB_PASSWORD: postgres
+      DB_USER: postgres
+      DB_HOST: localhost
+      DB_PORT: "2345"
+      TEST_DB_NAME: opengeometadata_api_test
+      DATABASE_URL: postgresql+asyncpg://postgres:postgres@localhost:2345/opengeometadata_api_test
+      APPLICATION_URL: http://localhost:8000
+      ELASTICSEARCH_URL: http://localhost:9200
+      ELASTICSEARCH_INDEX: opengeometadata_api_test
+      REDIS_HOST: localhost
+      REDIS_PORT: "6379"
+      REDIS_DB: "1"
+      ENDPOINT_CACHE: "false"
+      TURNSTILE_ENABLED: "false"
+      DISABLE_API_USAGE_LOG: "true"
+      DISABLE_RATE_LIMIT_FOR_TESTS: "true"
+      WALLCLOCK_TIMEOUT_SECONDS: "900"
+      TIMEOUT_GRACE_SECONDS: "30"
+
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            gcc \
+            g++ \
+            python3-dev \
+            libjpeg-dev \
+            zlib1g-dev \
+            libpng-dev \
+            libcairo2-dev \
+            pkg-config \
+            gdal-bin \
+            libgdal-dev \
+            curl \
+            ca-certificates
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: |
+            backend/pyproject.toml
+            backend/uv.lock
+
+      - name: Install backend dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e "backend[dev]"
+
+      - name: Prepare backend test database
+        working-directory: backend
+        run: |
+          python - <<'PY'
+          import os
+
+          import psycopg2
+          from psycopg2 import sql
+          from psycopg2.extensions import ISOLATION_LEVEL_AUTOCOMMIT
+
+          db_name = os.environ["TEST_DB_NAME"]
+          conn = psycopg2.connect(
+              dbname="postgres",
+              user=os.environ["DB_USER"],
+              password=os.environ["DB_PASSWORD"],
+              host=os.environ["DB_HOST"],
+              port=os.environ["DB_PORT"],
+          )
+          conn.set_isolation_level(ISOLATION_LEVEL_AUTOCOMMIT)
+          try:
+              with conn.cursor() as cur:
+                  cur.execute("SELECT 1 FROM pg_database WHERE datname = %s", (db_name,))
+                  if cur.fetchone() is None:
+                      cur.execute(
+                          sql.SQL("CREATE DATABASE {}").format(sql.Identifier(db_name))
+                      )
+          finally:
+              conn.close()
+          PY
+
+      - name: Run backend tests with coverage
+        working-directory: backend
+        run: |
+          python scripts/run_with_timeout.py \
+            python -X faulthandler -m pytest \
+            -n 2 \
+            -m "not network" \
+            --cov=app \
+            --cov-report=term-missing \
+            --cov-report=xml \
+            --cov-fail-under=50
+
+      - name: Upload backend coverage
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: backend-coverage
+          path: backend/coverage.xml
+          if-no-files-found: ignore

.github/workflows/ogm-nightly-sync.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Start SSH agent
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
         with:
           ssh-private-key: ${{ secrets.OGM_KAMAL_SSH_PRIVATE_KEY }}
 

.github/workflows/ruff.yml

@@ -2,28 +2,30 @@ name: Ruff
 
 on:
   push:
-    branches: [ develop ]
+    branches: [develop]
   pull_request:
-    branches: [ develop ]
+    branches: [develop]
+
+permissions:
+  contents: read
 
 jobs:
   lint:
     name: Run Ruff
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.11'
           cache: 'pip'
-          
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install ruff
-
-      - name: Run Ruff formatter
-        run: |
-          make format
+          pip install ruff==0.11.6
+
+      - name: Check formatting and lint
+        run: make lint-check

.github/workflows/transfer-readiness.yml

@@ -0,0 +1,19 @@
+name: Transfer Readiness
+
+on:
+  push:
+    branches: [develop]
+  pull_request:
+    branches: [develop]
+
+permissions:
+  contents: read
+
+jobs:
+  invariants:
+    name: Check repository and deployment invariants
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Verify transfer preparation
+        run: ./scripts/verify_transfer_readiness.sh

.gitignore

@@ -135,6 +135,9 @@ venv.bak/
 # Kamal
 .kamal/
 
+# Generated visual assets are runtime cache data, never repository source.
+backend/static/maps/
+
 # Spyder project settings
 .spyderproject
 .spyproject

Makefile

@@ -1,4 +1,4 @@
-.PHONY: lint format lint-check test test-fast test-no-coverage migrate reindex gazetteers ogm-nightly cache-prime cache-prime-background kamal-registry-login
+.PHONY: lint format lint-check test test-fast test-no-coverage migrate reindex gazetteers ogm-nightly cache-prime cache-prime-background kamal-registry-login transfer-readiness transfer-readiness-full
 
 BACKEND_DIR = backend
 
@@ -48,3 +48,9 @@ cache-prime-background:
 
 kamal-registry-login:
 	./scripts/kamal_registry_login.sh
+
+transfer-readiness:
+	./scripts/verify_transfer_readiness.sh
+
+transfer-readiness-full:
+	./scripts/verify_transfer_readiness.sh --full-history