ci: add caching, test reliability, per-app credentials, and BuildKit cache

- Add .dockerignore to reduce Docker build context
- Add pip caching and BuildKit cache mounts for faster builds
- Make tests non-optional (must pass if they exist)
- Add per-app credentials block to deploy.yml
- Add continue-on-error to validate.yml platform checkout

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: baijum

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.github
+.claude
+__pycache__
+*.pyc
+.pytest_cache
+.env
+.env.*
+docs/
+plans/
+*.md
+!requirements.txt

.github/workflows/deploy.yml

@@ -13,12 +13,17 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+          cache: 'pip'
 
       - name: Run tests
         run: |
           pip install -r requirements.txt
           pip install pytest
-          pytest --tb=short || echo "No tests found, skipping"
+          if python -m pytest --collect-only -q 2>/dev/null | grep -q "test"; then
+            pytest --tb=short
+          else
+            echo "No tests found, skipping"
+          fi
 
       - name: Deploy to server
         uses: appleboy/ssh-action@v1
@@ -44,6 +49,25 @@ jobs:
               || docker compose -f /opt/platform/docker-compose.yml exec -T postgres \
               psql -U postgres -c "CREATE DATABASE ${APP_DB}"
 
+            # Source per-app credentials and update deploy/.env if available
+            CREDENTIALS_FILE="/opt/platform/credentials/${APP_NAME}.env"
+            if [ -f "$CREDENTIALS_FILE" ]; then
+              echo "Using per-app credentials from $CREDENTIALS_FILE"
+              source "$CREDENTIALS_FILE"
+              # Update DATABASE_URL with per-app user credentials
+              sed -i "s|^DATABASE_URL=.*|DATABASE_URL=postgresql://${DB_USER}:${DB_PASSWORD}@postgres:5432/${APP_DB}|" deploy/.env
+              # Update S3 credentials with per-app MinIO user
+              sed -i "s|^S3_ACCESS_KEY=.*|S3_ACCESS_KEY=${S3_ACCESS_KEY}|" deploy/.env
+              sed -i "s|^S3_SECRET_KEY=.*|S3_SECRET_KEY=${S3_SECRET_KEY}|" deploy/.env
+              # Update S3 bucket name
+              sed -i "s|^S3_BUCKET=.*|S3_BUCKET=${APP_NAME}-uploads|" deploy/.env
+              echo "deploy/.env updated with per-app credentials"
+            else
+              echo "WARNING: Per-app credentials not found at $CREDENTIALS_FILE"
+              echo "Run create-app-credentials.sh ${APP_NAME} for isolated credentials."
+              echo "Falling back to existing deploy/.env credentials."
+            fi
+
             # Build and start app containers (project name = app name for predictable container names)
             docker compose -p ${APP_NAME} -f deploy/docker-compose.yml up -d --build
 

.github/workflows/validate.yml

@@ -18,6 +18,8 @@ jobs:
         with:
           repository: towlion/platform
           path: _platform
+        continue-on-error: true
 
       - name: Run spec validator
+        if: success()
         run: python _platform/validator/validate.py --tier 2 --dir .

app/Dockerfile

@@ -1,11 +1,13 @@
+# syntax=docker/dockerfile:1
 FROM python:3.11-slim AS base
 
 RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install -r requirements.txt
 
 COPY app/ ./app/