feat(rss): add rss and newsletter sources

.claude/commands/prepare-pr.md

@@ -0,0 +1,18 @@
+Prepare, commit, and open a pull request for the current branch. Do the following in order:
+
+1. Run `git status`, `git diff --cached`, `git log main..HEAD --oneline`, and `git diff main..HEAD` to understand what is staged and what the full branch diff looks like.
+
+2. Read `CHANGES.md` to understand the current upstream divergence state.
+
+3. Craft a conventional commit message for the staged changes:
+   - Format: `<type>(<scope>): <short description>` (under 72 chars)
+   - Types: feat, fix, chore, refactor, docs, style, test
+   - Focus on WHY and WHAT changed logically, not which files were touched
+
+4. Commit the staged changes with that message.
+
+5. Write the PR description — short, human-readable prose (2–4 sentences max). Explain what the change does and why, as if telling a teammate. No bullet lists of files. Capture intent and logic, not implementation details.
+
+6. Update `CHANGES.md` if any newly touched upstream files are not yet logged. Follow the existing table format.
+
+7. Push the branch and create the PR using `gh pr create` with the prose description.

.github/workflows/add-to-project.yml

@@ -1,11 +1,10 @@
 name: Add to Project
 
+# Disabled in this fork: targets the fastapi org project board and needs a
+# PROJECTS_TOKEN we don't have. Manual-only so it stays merge-clean with upstream.
+# Original triggers: pull_request_target; issues (opened, reopened).
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-  issues:
-    types:
-      - opened
-      - reopened
+  workflow_dispatch:
 
 permissions: {}
 

.github/workflows/deploy-production.yml

@@ -1,22 +1,68 @@
 name: Deploy to Production
 
 on:
-  release:
-    types:
-      - published
+  push:
+    branches:
+      - master
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push backend
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: .
+          file: backend/Dockerfile
+          push: true
+          tags: ${{ secrets.DOCKER_IMAGE_BACKEND }}:latest
+          cache-from: type=gha,scope=backend
+          cache-to: type=gha,mode=max,scope=backend
+
+      - name: Build and push frontend
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: .
+          file: frontend/Dockerfile
+          push: true
+          tags: ${{ secrets.DOCKER_IMAGE_FRONTEND }}:latest
+          build-args: |
+            VITE_API_URL=https://api.${{ secrets.DOMAIN_PRODUCTION }}
+            NODE_ENV=production
+          cache-from: type=gha,scope=frontend
+          cache-to: type=gha,mode=max,scope=frontend
+
   deploy:
-    environment: production
-    # Do not deploy in the main repository, only in user projects
-    if: github.repository_owner != 'fastapi'
+    needs: build
     runs-on:
       - self-hosted
       - production
+    environment: production
+    if: github.repository_owner != 'fastapi'
     env:
       ENVIRONMENT: production
+      PROJECT_NAME: Agentique
       DOMAIN: ${{ secrets.DOMAIN_PRODUCTION }}
       STACK_NAME: ${{ secrets.STACK_NAME_PRODUCTION }}
       SECRET_KEY: ${{ secrets.SECRET_KEY }}
@@ -26,12 +72,27 @@ jobs:
       SMTP_USER: ${{ secrets.SMTP_USER }}
       SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
       EMAILS_FROM_EMAIL: ${{ secrets.EMAILS_FROM_EMAIL }}
+      RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
+      RESEND_AUDIENCE_ID: ${{ secrets.RESEND_AUDIENCE_ID }}
       POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+      POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
+      POSTGRES_PORT: ${{ secrets.POSTGRES_PORT }}
+      POSTGRES_SERVER: ${{ secrets.POSTGRES_SERVER }}
+      DOCKER_IMAGE_BACKEND: ${{ secrets.DOCKER_IMAGE_BACKEND }}
+      DOCKER_IMAGE_FRONTEND: ${{ secrets.DOCKER_IMAGE_FRONTEND }}
+      FRONTEND_HOST: ${{ secrets.FRONTEND_HOST }}
+      BACKEND_CORS_ORIGINS: ${{ secrets.BACKEND_CORS_ORIGINS }}
       SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+      BAML_LOG: ${{ secrets.BAML_LOG }}
+      NVIDIA_NIM_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
+      RESIDENTIAL_PROXY_URL: ${{ secrets.RESIDENTIAL_PROXY_URL }}
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - run: docker compose -f compose.yml --project-name ${{ secrets.STACK_NAME_PRODUCTION }} build
+      - run: touch .env
+      - run: docker network create traefik-public 2>/dev/null || true
+      - run: docker compose -f compose.yml --project-name ${{ secrets.STACK_NAME_PRODUCTION }} pull
       - run: docker compose -f compose.yml --project-name ${{ secrets.STACK_NAME_PRODUCTION }} up -d

.github/workflows/deploy-staging.yml

@@ -33,5 +33,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
+      - run: touch .env
+      - run: docker network create traefik-public 2>/dev/null || true
       - run: docker compose -f compose.yml --project-name ${{ secrets.STACK_NAME_STAGING }} build
       - run: docker compose -f compose.yml --project-name ${{ secrets.STACK_NAME_STAGING }} up -d

.github/workflows/detect-conflicts.yml

@@ -1,8 +1,9 @@
 name: "Conflict detector"
+# Disabled in this fork: auto-labels conflicting PRs, only useful with many
+# concurrent contributors. Manual-only so it stays merge-clean with upstream.
+# Original triggers: push; pull_request_target (synchronize).
 on:
-  push:
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-    types: [synchronize]
+  workflow_dispatch:
 
 permissions: {}
 

.github/workflows/guard-dependencies.yml

@@ -1,11 +1,10 @@
 name: Guard Dependencies
 
+# Disabled in this fork: auto-closes dependency PRs from non-org members, only
+# relevant with external contributors. Manual-only so it stays merge-clean with upstream.
+# Original trigger: pull_request_target on master, paths pyproject.toml / uv.lock.
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] -- This workflow only reads context.payload metadata, never checks out PR code
-    branches: [master]
-    paths:
-      - pyproject.toml
-      - uv.lock
+  workflow_dispatch:
 
 permissions:
   contents: read

.github/workflows/issue-manager.yml

@@ -1,17 +1,11 @@
 name: Issue Manager
 
+# Disabled in this fork: the job is already gated to `repository_owner == 'fastapi'`
+# so it never runs here. Triggers neutered to manual-only to stop scheduled/event
+# runs spinning up. Stays merge-clean with upstream.
+# Original triggers: schedule (cron 21 17 * * *); issue_comment (created);
+# issues (labeled); pull_request_target (labeled); workflow_dispatch.
 on:
-  schedule:
-    - cron: "21 17 * * *"
-  issue_comment:
-    types:
-      - created
-  issues:
-    types:
-      - labeled
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-    types:
-      - labeled
   workflow_dispatch:
 
 permissions: {}

.github/workflows/labeler.yml

@@ -1,13 +1,10 @@
 name: Labels
+# Disabled in this fork: enforces upstream's label taxonomy and fails PRs lacking
+# one of its labels. Unneeded friction for a small fork.
+# Manual-only so it stays merge-clean with upstream.
+# Original trigger: pull_request_target (opened, synchronize, reopened, labeled, unlabeled).
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-    types:
-      - opened
-      - synchronize
-      - reopened
-      # For label-checker
-      - labeled
-      - unlabeled
+  workflow_dispatch:
 
 permissions: {}
 

.github/workflows/latest-changes.yml

@@ -1,11 +1,10 @@
 name: Latest Changes
 
+# Disabled in this fork: tiangolo's changelog bot (needs LATEST_CHANGES secret,
+# commits to release-notes.md we don't maintain). Manual-only so it stays
+# merge-clean with upstream.
+# Original trigger also included: pull_request_target on master (closed).
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-    branches:
-      - master
-    types:
-      - closed
   workflow_dispatch:
     inputs:
       number:

.github/workflows/playwright.yml

@@ -69,11 +69,30 @@ jobs:
         # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
         # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
         version: "0.11.18"
+    - name: Create .env for CI
+      run: |
+        cat > .env << 'EOF'
+        DOMAIN=localhost
+        STACK_NAME=agentique-ci
+        DOCKER_IMAGE_BACKEND=agentique-backend
+        DOCKER_IMAGE_FRONTEND=agentique-frontend
+        PROJECT_NAME=Agentique
+        ENVIRONMENT=development
+        FRONTEND_HOST=http://localhost:5173
+        SECRET_KEY=ci-test-secret-key-not-for-production
+        FIRST_SUPERUSER=admin@example.com
+        FIRST_SUPERUSER_PASSWORD=ci-test-password
+        POSTGRES_SERVER=localhost
+        POSTGRES_DB=app
+        POSTGRES_USER=postgres
+        POSTGRES_PASSWORD=ci-test-password
+        EOF
     - run: uv sync
       working-directory: backend
     - run: bun ci
       working-directory: frontend
     - run: bash scripts/generate-client.sh
+    - run: docker network create traefik-public 2>/dev/null || true
     - run: docker compose build
     - run: docker compose down -v --remove-orphans
     - name: Run Playwright tests

.github/workflows/pre-commit.yml

@@ -59,6 +59,24 @@ jobs:
         run: uv sync --all-packages
       - name: Install frontend dependencies
         run: bun ci
+      - name: Create .env for CI
+        run: |
+          cat > .env << 'EOF'
+          DOMAIN=localhost
+          STACK_NAME=agentique-ci
+          DOCKER_IMAGE_BACKEND=agentique-backend
+          DOCKER_IMAGE_FRONTEND=agentique-frontend
+          PROJECT_NAME=Agentique
+          ENVIRONMENT=development
+          FRONTEND_HOST=http://localhost:5173
+          SECRET_KEY=ci-test-secret-key-not-for-production
+          FIRST_SUPERUSER=admin@example.com
+          FIRST_SUPERUSER_PASSWORD=ci-test-password
+          POSTGRES_SERVER=localhost
+          POSTGRES_DB=app
+          POSTGRES_USER=postgres
+          POSTGRES_PASSWORD=ci-test-password
+          EOF
       - name: Run prek - pre-commit
         id: precommit
         run: uv run prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure

.github/workflows/smokeshow.yml

@@ -1,9 +1,11 @@
 name: Smokeshow
 
+# Disabled in this fork: uploads a coverage badge to smokeshow.com (needs
+# SMOKESHOW_AUTH_KEY). Coverage is already enforced in Test Backend (--fail-under=90).
+# Manual-only so it stays merge-clean with upstream.
+# Original trigger: workflow_run after [Test Backend] completed.
 on:
-  workflow_run: # zizmor: ignore[dangerous-triggers]
-    workflows: [Test Backend]
-    types: [completed]
+  workflow_dispatch:
 
 permissions: {}
 

.github/workflows/test-backend.yml

@@ -26,6 +26,24 @@ jobs:
           # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
           # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
           version: "0.11.18"
+      - name: Create .env for CI
+        run: |
+          cat > .env << 'EOF'
+          DOMAIN=localhost
+          STACK_NAME=agentique-ci
+          DOCKER_IMAGE_BACKEND=agentique-backend
+          DOCKER_IMAGE_FRONTEND=agentique-frontend
+          PROJECT_NAME=Agentique
+          ENVIRONMENT=development
+          FRONTEND_HOST=http://localhost:5173
+          SECRET_KEY=ci-test-secret-key-not-for-production
+          FIRST_SUPERUSER=admin@example.com
+          FIRST_SUPERUSER_PASSWORD=ci-test-password
+          POSTGRES_SERVER=localhost
+          POSTGRES_DB=app
+          POSTGRES_USER=postgres
+          POSTGRES_PASSWORD=ci-test-password
+          EOF
       - run: docker compose down -v --remove-orphans
       - run: docker compose up -d db mailcatcher
       - name: Migrate DB

.github/workflows/test-docker-compose.yml

@@ -1,10 +1,10 @@
 name: Test Docker Compose
 
+# Disabled in this fork: Playwright already builds and exercises the full stack,
+# so this smoke test is redundant. Manual-only so it stays merge-clean with upstream.
+# Original triggers: push on master; pull_request.
 on:
-  push:
-    branches:
-      - master
-  pull_request:
+  workflow_dispatch:
 permissions: {}
 
 jobs:

.gitignore

@@ -5,3 +5,6 @@ node_modules/
 /playwright-report/
 /blob-report/
 /playwright/.cache/
+.ignored/
+.DS_Store
+.env