Merge branch 'hotfix/1.41.1' into develop

Author: HarmlessHarm

.github/release.yml

@@ -3,6 +3,7 @@ changelog:
     - title: New Features 🚀
       labels:
         - "Feature"
+        - "feature"
     - title: Improvements 🦾
       labels:
         - "improvement"

.github/workflows/build_main.yml

@@ -1,11 +1,13 @@
-# This workflow will do a clean install of node dependencies, cache/restore them, build the source code and run tests across different versions of node
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
+# Build and push the production image only when a version tag is pushed on main.
+# Pushing to main itself no longer deploys — releases are gated on tagging.
+# Tag format matches the project convention (e.g. 2.39.2).
 
 name: Deploy Live
 
 on:
   push:
-    branches: [main]
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
   workflow_dispatch:
 
 jobs:
@@ -15,14 +17,22 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Verify package.json version matches tag
+        run: |
+          PKG=$(jq -r .version package.json)
+          TAG=${GITHUB_REF_NAME}
+          if [ "$PKG" != "$TAG" ]; then
+            echo "::error::package.json version ($PKG) does not match git tag ($TAG). Did you forget 'npm version'?"
+            exit 1
+          fi
+
       - name: Create env file
         run: |
           cat << EOF >> .env.production.local
           ${{ secrets.ENV_FILE }}
           EOF
 
-      - # Login against GitHub Container Registry
-        name: Log in to GitHub Container Registry
+      - name: Log in to GitHub Container Registry
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
@@ -32,12 +42,22 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
-      - # Build and push Docker image
-        name: Build and push
+      - name: Extract image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/harmlesskey/harmlesskey
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest
+
+      - name: Build and push
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: true
-          tags: ghcr.io/harmlesskey/harmlesskey
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha,scope=live
           cache-to: type=gha,scope=live,mode=max

.github/workflows/build_staging.yml

@@ -1,11 +1,8 @@
-# This workflow will do a clean install of node dependencies, cache/restore them, build the source code and run tests across different versions of node
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
-
 name: Deploy Staging
 
 on:
   push:
-    branches: [develop]
+    branches: [develop, 'release/**']
   pull_request:
     branches: [develop]
   workflow_dispatch:
@@ -23,8 +20,7 @@ jobs:
           ${{ secrets.STAGING_ENV_FILE }}
           EOF
 
-      - # Login against GitHub Container Registry
-        name: Log in to GitHub Container Registry
+      - name: Log in to GitHub Container Registry
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
@@ -34,12 +30,21 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
-      - # Build and push Docker image
-        name: Build and push
+      - name: Extract image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/harmlesskey/harmlesskey_staging
+          tags: |
+            type=sha,prefix=sha-,format=short
+            type=raw,value=latest
+
+      - name: Build and push
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: true
-          tags: ghcr.io/harmlesskey/harmlesskey_staging
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha,scope=staging
           cache-to: type=gha,scope=staging,mode=max

CLAUDE.md

@@ -0,0 +1,90 @@
+# Shieldmaiden
+
+D&D combat tracker web app built with Vue 2 + Quasar 1 + Firebase.
+
+## Tech Stack
+
+- **Framework**: Vue 2.7 + Quasar 1 (SSR mode)
+- **Build**: Webpack 4 via `@quasar/app ~2.4.3`
+- **Backend**: Firebase v8 (namespaced API — do NOT migrate to modular v10+ API)
+- **State**: Vuex with modules in `src/store/modules/`
+- **Node**: >= 24, npm >= 10.2.4
+
+## Dev Commands
+
+```bash
+npm run ssr       # Start dev server (SSR mode)
+npm run build     # quasar build -m ssr
+npm run lint      # ESLint
+```
+
+## File Editing Rules
+
+- **Always use the `Edit` or `Write` tools** to modify files — never use Bash, `sed`, `awk`, `python`, or `node` for file editing
+- If the `Edit` tool fails due to whitespace mismatches, investigate the exact characters with `cat -A` and adjust the match — do not fall back to shell scripts
+
+## Vue Component Rules
+
+- `computed`, `data`, `methods`, `watch`, `props` and all other component options can only appear **once** per Vue component — JavaScript silently discards the first when two keys share the same name. Always merge into a single block rather than adding a second one.
+
+## Key Constraints
+
+- **Firebase v8 namespaced API** is used across 63+ files — do not switch to modular API
+- Vue 2 / Quasar 1 ecosystem locks transitive deps (postcss 7, webpack 4, etc.)
+- Many audit vulnerabilities are unfixable without framework migration — do not attempt to fix them
+- `package.json` uses `overrides` to force-update transitive deps
+
+## Project Structure
+
+```
+src/
+  boot/           # Quasar boot files (plugins, firebase-auth, etc.)
+  components/     # Vue components
+  layouts/        # App layouts
+  views/          # Page-level views
+  store/          # Vuex store
+    modules/
+      userContent/  # User data (campaigns, encounters, players, etc.)
+      content/      # API content (spells, monsters, items, conditions)
+  services/       # Firebase service layer (one file per resource)
+  utils/
+    generalFunctions.js  # Shared utility functions
+    generalConstants.js  # Shared constants
+```
+
+## Patterns
+
+- Services in `src/services/` handle Firebase reads/writes
+- Vuex modules dispatch to services and cache results in state
+- Extension communication uses `window.postMessage` bridge (not `chrome.runtime` directly)
+- Utility functions go in `src/utils/generalFunctions.js`
+
+## Planning Artifacts
+Feature specs live in `.planning/`. 
+- Always check `.planning/` for an existing spec before investigating or implementing anything
+- When writing a spec, always write it to `.planning/<feature-name>.md`
+- Never begin implementation without a spec file present in `.planning/`
+
+
+## Git Workflow
+
+We use **Git Flow**. Follow these rules strictly:
+
+### Branch Structure
+- `main` — production releases only
+- `develop` — integration branch
+- `feature/*` — new features, branched from `develop`
+- `release/*` — release preparation, branched from `develop`
+- `hotfix/*` — urgent production fixes, branched from `main`
+
+### Merging Rules
+- **Features**: open a PR from `feature/*` → `develop`
+- **Releases**: merge `release/*` → `main` AND `develop` (no PR required)
+- **Hotfixes**: merge `hotfix/*` → `main` AND `develop` (no PR required)
+- Never merge features directly to `main`
+
+### Tags
+- Tag every merge to `main` with the version number (e.g. `2.39.2`)
+
+### Commits & PRs
+- Do NOT add Claude as a co-author in commits or PR descriptions