akira69
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 54 additions & 1 deletion b/‎.github/workflows/ci.yml‎
Lines changed: 54 additions & 1 deletion
diff --git a/‎.github/workflows/guard-translations.yml‎
Lines changed: 99 additions & 0 deletions b/‎.github/workflows/guard-translations.yml‎
Lines changed: 99 additions & 0 deletions
diff --git a/‎.github/workflows/weblate-automerge.yml‎
Lines changed: 85 additions & 0 deletions b/‎.github/workflows/weblate-automerge.yml‎
Lines changed: 85 additions & 0 deletions
diff --git a/‎.gitignore‎
Lines changed: 4 additions & 2 deletions b/‎.gitignore‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎Dockerfile‎
Lines changed: 7 additions & 7 deletions b/‎Dockerfile‎
Lines changed: 7 additions & 7 deletions
diff --git a/‎README.md‎
Lines changed: 1 addition & 0 deletions b/‎README.md‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎client/.gitignore‎
Lines changed: 2 additions & 0 deletions b/‎client/.gitignore‎
Lines changed: 2 additions & 0 deletions
@@ -249,6 +249,59 @@ jobs:
           up-flags: "--abort-on-container-exit"
           down-flags: "--volumes"
   #
+  # Perform frontend (browser) integration tests against the real image
+  #
+  test-frontend:
+    needs: [build-amd64]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Download built image
+        uses: actions/download-artifact@v4.1.7
+        with:
+          name: spoolman-image
+          path: /tmp/spoolman-image
+
+      - name: Load built image
+        run: docker load --input /tmp/spoolman-image/spoolman.tar
+
+      - name: Install node
+        uses: actions/setup-node@v4.0.3
+        with:
+          node-version: '20'
+
+      - name: Install Playwright
+        run: |
+          cd tests_frontend
+          npm ci
+          npx playwright install --with-deps chromium
+
+      - name: Start Spoolman
+        run: docker compose -f tests_frontend/docker-compose.yml up -d --wait
+
+      - name: Run frontend integration tests
+        run: |
+          cd tests_frontend
+          npx playwright test
+
+      - name: Dump Spoolman logs on failure
+        if: failure()
+        run: docker compose -f tests_frontend/docker-compose.yml logs spoolman
+
+      - name: Upload Playwright report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4.4.0
+        with:
+          name: playwright-report
+          path: tests_frontend/playwright-report
+          retention-days: 7
+
+      - name: Stop Spoolman
+        if: always()
+        run: docker compose -f tests_frontend/docker-compose.yml down -v
+  #
   # Build arm64 image
   # Don't run this for pull requests
   # Only push to buildcache and let release job push to registry
@@ -336,7 +389,7 @@ jobs:
   #
   publish-images:
     if: ${{ github.event_name != 'pull_request' }}
-    needs: [test, build-amd64, build-arm64, build-armv7, style, build-client]
+    needs: [test, test-frontend, build-amd64, build-arm64, build-armv7, style, build-client]
     runs-on: ubuntu-latest
     permissions:
       packages: write
 
@@ -0,0 +1,99 @@
+name: Guard Translations
+
+# Translations are managed exclusively through Weblate (https://hosted.weblate.org/projects/spoolman/).
+# Only the "en" source locale is edited by hand in this repo; every other language is written back
+# by the Weblate bot. This workflow fails any PR (except Weblate's own) that MODIFIES or DELETES an
+# existing non-English translation file, so manual edits don't get overwritten and lost on the next
+# Weblate sync.
+#
+# ADDING a brand-new language file is allowed: contributors bootstrapping a new language must add the
+# code entry in client/src/i18n.ts, and they may include the initial client/public/locales/<lang>/
+# file in the same PR. Only edits to files that ALREADY exist on the base branch are blocked.
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+
+# NOTE: no `paths:` filter on purpose. If this check is marked "Required" in branch
+# protection, a paths filter would leave PRs that don't touch locales stuck "pending"
+# forever (the check would never post a status). Instead we always run and pass fast
+# when nothing offending changed.
+
+permissions:
+  contents: read
+
+jobs:
+  guard-translations:
+    runs-on: ubuntu-latest
+    # Skip the guard for Weblate's own translation-sync PRs.
+    if: github.event.pull_request.user.login != 'weblate'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check for manual non-English translation changes
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+
+          # Files changed in this PR, keyed by change type. --no-renames turns any rename into a
+          # delete + add pair, so a "renamed" (i.e. rewritten) existing file still trips the delete
+          # rule below and can't be smuggled through as a fresh add.
+          #
+          # --diff-filter=MD keeps only Modified and Deleted paths: edits to files that ALREADY
+          # exist on the base branch. Added (A) files are intentionally excluded, so a contributor
+          # may add a brand-new client/public/locales/<lang>/ file for a new language.
+          offending="$(git diff --no-renames --diff-filter=MD --name-only "$BASE_SHA" "$HEAD_SHA" \
+            | grep -E '^client/public/locales/[^/]+/' \
+            | grep -vE '^client/public/locales/en/' \
+            || true)"
+
+          if [ -n "$offending" ]; then
+            echo "::error title=Manual translation edits are not allowed::This PR edits existing non-English translation files. See the job summary for details."
+
+            {
+              echo "## ❌ Manual translation edits detected"
+              echo ""
+              echo "This PR modifies or deletes one or more **existing non-English** translation files:"
+              echo ""
+              echo '```'
+              echo "$offending"
+              echo '```'
+              echo ""
+              echo "### Why this is blocked"
+              echo ""
+              echo "Every language except the English source (\`client/public/locales/en/\`) is managed"
+              echo "**exclusively through Weblate**. Any manual edit to an existing non-English file here"
+              echo "will be **silently overwritten and lost** the next time Weblate syncs — so we don't"
+              echo "accept them."
+              echo ""
+              echo "### What to do instead"
+              echo ""
+              echo "- **To fix or improve an existing translation:** contribute it through Weblate at"
+              echo "  <https://hosted.weblate.org/projects/spoolman/>. It's free, requires no coding,"
+              echo "  and your change flows back into the repo automatically."
+              echo "- **To add or change a user-facing string:** edit **only** the English source files under"
+              echo "  \`client/public/locales/en/\`. Weblate will pick up the new keys and expose them to"
+              echo "  translators. Revert your changes to every other language and push again."
+              echo "- **To add a brand-new language:** that IS allowed here. Add the language entry to"
+              echo "  \`client/src/i18n.ts\` and, if you like, an initial \`client/public/locales/<lang>/\`"
+              echo "  file — new files are fine, only edits to existing ones are blocked."
+              echo ""
+              echo "> If you believe an existing file genuinely needs a manual change (e.g. a structural"
+              echo "> fix), please explain it in a PR comment so a maintainer can review."
+            } >> "$GITHUB_STEP_SUMMARY"
+
+            echo ""
+            echo "Offending files:"
+            echo "$offending"
+            exit 1
+          fi
+
+          echo "No manual edits to existing non-English translation files detected. ✅"
@@ -0,0 +1,85 @@
+name: Auto-merge Weblate PRs
+
+# Translations are managed exclusively through Weblate (https://hosted.weblate.org/projects/spoolman/),
+# which opens a pull request for every sync back to this repo (see guard-translations.yml). Those PRs
+# are machine-generated, always scoped to client/public/locales/, and gated by the full CI suite just
+# like any other PR. Rather than hand-merging each one, this workflow turns on GitHub's native
+# auto-merge for Weblate-authored PRs so they merge themselves once all required status checks pass.
+#
+# Why auto-merge instead of giving Weblate direct push access to master:
+#   - Every sync still runs through style/tests/build before it can land — nothing merges unvalidated.
+#   - No actor gains unrestricted, un-CI'd direct write to master. A compromised Weblate token can only
+#     open a PR; auto-merge fires solely on green CI for Weblate-authored PRs.
+#   - GitHub write/bypass can't be scoped to locale files, so direct write would grant all-file access.
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+# contents+pull-requests write let the built-in GITHUB_TOKEN enable auto-merge and perform the squash
+# merge. The token is not a ruleset bypass actor and doesn't need to be: with 0 required approvals it
+# satisfies the branch requirements once the required checks go green, exactly like a manual merge.
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    # Only ever act on Weblate's own translation-sync PRs. Human PRs are never touched.
+    # pull_request_target runs in the base-repo context (so GITHUB_TOKEN has write access even for
+    # branch PRs), and this job is safe under it because it never checks out or executes PR code —
+    # it only calls the GitHub API to enable auto-merge.
+    if: github.event.pull_request.user.login == 'weblate'
+    steps:
+      # Defence in depth: don't trust the author alone, trust the diff. Even a compromised Weblate
+      # token can only ever get auto-merged if the PR is confined to locale JSON files. Anything
+      # else (a code file, a workflow, a non-.json file, a file outside client/public/locales/)
+      # fails this step, auto-merge is never enabled, and the PR waits for a human. The file list is
+      # read from the API — this step never checks out or runs PR code, so pull_request_target is safe.
+      - name: Verify PR only changes locale JSON files
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+
+          files="$(gh api --paginate "repos/${REPO}/pulls/${PR_NUMBER}/files" --jq '.[].filename')"
+
+          if [ -z "$files" ]; then
+            echo "::error title=Empty diff::Weblate PR reports no changed files; refusing to auto-merge."
+            exit 1
+          fi
+
+          # Every changed path must be a .json file under client/public/locales/<lang>/.
+          offending="$(printf '%s\n' "$files" | grep -vE '^client/public/locales/[^/]+/.+\.json$' || true)"
+
+          if [ -n "$offending" ]; then
+            echo "::error title=Out-of-scope Weblate PR::PR touches files outside client/public/locales/**/*.json; not auto-merging."
+            {
+              echo "## ❌ Auto-merge blocked: out-of-scope changes"
+              echo ""
+              echo "This Weblate PR changes files that are **not** locale JSON under \`client/public/locales/\`:"
+              echo ""
+              echo '```'
+              echo "$offending"
+              echo '```'
+              echo ""
+              echo "Weblate sync PRs are only auto-merged when every changed file is a translation JSON"
+              echo "file. This PR isn't, so it has been left for a maintainer to review and merge by hand."
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+
+          echo "All $(printf '%s\n' "$files" | wc -l) changed file(s) are locale JSON. Safe to auto-merge."
+
+      - name: Enable auto-merge
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        # Squash is the only merge method the repo and the master ruleset allow.
+        run: gh pr merge --auto --squash "$PR_URL"
@@ -26,7 +26,8 @@ share/python-wheels/
 .installed.cfg
 *.egg
 MANIFEST
-requirements.txt
+# requirements.txt is committed (generated from uv on release) for bare-metal /
+# Moonraker update_manager consumers. See spoolman/bump.py.
 
 # PyInstaller
 #  Usually these files are written by a python script from a template
@@ -204,4 +205,5 @@ $RECYCLE.BIN/
 
 data/
 .pdm-python
-.history
+.history
+.claude
@@ -24,10 +24,12 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
     uv sync --locked --no-install-project
 
-# Copy and install app
-COPY --chown=app:app migrations /home/app/spoolman/migrations
-COPY --chown=app:app spoolman /home/app/spoolman/spoolman
-COPY --chown=app:app alembic.ini README.md uv.lock pyproject.toml /home/app/spoolman/
+# Copy and install app. No --chown here: the "app" user only exists in the
+# runner stage, and Podman (unlike Docker/BuildKit) refuses to resolve it. Final
+# ownership is set when these files are copied into the runner stage below.
+COPY migrations /home/app/spoolman/migrations
+COPY spoolman /home/app/spoolman/spoolman
+COPY alembic.ini README.md uv.lock pyproject.toml /home/app/spoolman/
 RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --locked
 
@@ -44,9 +46,7 @@ RUN apt-get update && apt-get install -y \
     && rm -rf /var/lib/apt/lists/*
 
 # Add local user so we don't run as root
-RUN groupmod -g 1000 users \
-    && useradd -u 1000 -U app \
-    && usermod -G users app \
+RUN useradd -u 1000 -U app \
     && mkdir -p /home/app/.local/share/spoolman \
     && chown -R app:app /home/app/.local/share/spoolman
 
 
@@ -32,6 +32,7 @@ Spoolman is a self-hosted web service designed to help you efficiently manage yo
   * [OctoPrint](https://github.com/mdziekon/octoprint-spoolman)
   * [OctoEverywhere](https://octoeverywhere.com/spoolman?source=github_spoolman)
   * [Home Assistant](https://github.com/Disane87/spoolman-homeassistant)
+  * [MCP Server](https://github.com/Disane87/spoolman-mcp) - Manage your filament inventory through AI assistants like Claude using the Model Context Protocol
 
 **Web client preview:**
 ![image](https://github.com/Donkie/Spoolman/assets/2332094/33928d5e-440f-4445-aca9-456c4370ad0d)
 
@@ -18,6 +18,8 @@
 .env.development.local
 .env.test.local
 .env.production.local
+# Generated at build time (CI and tests_frontend/run.py) — never committed
+.env.production
 
 npm-debug.log*
 yarn-debug.log*