Release Blockbusterr v2.0.0

.dockerignore

@@ -38,6 +38,15 @@ data/*.db
 # Documentation
 *.md
 LICENSE
+docs/
+
+# Local development and agent files
+.codex/
+.claude/
+plans/
+reference-docs/
+node_modules/
+*.log
 
 # Go test files
 *.test

.github/RELEASE_TEMPLATE.md

@@ -16,25 +16,26 @@
 - 
 
 ## Upgrading
-1. **Backup current config first!**
+1. **Stop Blockbusterr and back up its complete data directory.** The configuration and SQLite database must come from the same stopped snapshot.
 ```sh
-cp data/config.yaml data/config.yaml.backup
+docker stop blockbusterr
+cp -a data "data.backup-$(date +%Y%m%d-%H%M%S)"
 ```
 
-2. **Pull and restart**
+2. **Update `image:` in your Compose file to `ghcr.io/mahcks/blockbusterr:vX.Y.Z`, then pull and restart.**
 ```sh
-docker pull ghcr.io/mahcks/blockbusterr:vX.Y.Z
-docker-compose down && docker-compose up -d
+docker compose pull blockbusterr
+docker compose up -d blockbusterr
 ```
 
 *Or for docker run users*
 ```sh
 docker stop blockbusterr
 docker rm blockbusterr
-docker run -d \\
-  --name blockbusterr \\
-  -p 9090:9090 \\
-  -v $(pwd)/data:/app/data \\
+docker run -d \
+  --name blockbusterr \
+  -p 9090:9090 \
+  -v "$(pwd)/data:/app/data" \
   ghcr.io/mahcks/blockbusterr:vX.Y.Z
 ```
 

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/releases/v2.0.0.md

@@ -0,0 +1,48 @@
+# Blockbusterr v2.0.0
+
+Blockbusterr discovers movies and shows, evaluates them against your rules, and sends selected titles to Radarr, Sonarr, Jellyseerr, or Seerr. Version 2 adds more control over what reaches your library and clearer explanations of each decision.
+
+## What changed since v1
+
+- **Reusable Rules:** share movie/show policies across jobs, create job-specific copies, and manage universal title exceptions separately.
+- **Preview-first Jobs:** inspect candidates before delivery, start from disabled recipes, and choose discovery sources per job.
+- **Lists and watchlists:** use supported TMDB, Trakt, and MDBList sources. Direct public Letterboxd scraping remains experimental and opt-in.
+- **Delivery controls:** per-job and rolling global budgets, repeat handling, instance-wide dry-run, and ranked selection across participating jobs.
+- **Activity Entries and Job Runs:** inspect title decisions, scores, reasons, and delivery outcomes.
+- **Configuration portability:** export shareable automation separately from credentialed backups, and migrate supported v1 jobs and rules automatically.
+
+Blockbusterr remains MIT-licensed and runs in one container with SQLite. One configured discovery provider is enough; Trakt is optional. It works with your existing media stack and does not download or play media itself.
+
+## Install
+
+```bash
+docker run -d \
+  --name blockbusterr \
+  --restart unless-stopped \
+  -p 9090:9090 \
+  -v blockbusterr-data:/app/data \
+  ghcr.io/mahcks/blockbusterr:v2.0.0
+```
+
+Open `http://localhost:9090`, connect a discovery provider and delivery target, and preview your first job. Keep the service on a trusted network or behind an authenticated proxy/VPN. Optional owner authentication uses `BLOCKBUSTERR_AUTH_TOKEN` (at least 32 characters), with username `blockbusterr`.
+
+## Upgrade from v1
+
+**The stable `latest` image moves from v1 to v2 with this release.** Pin a version if you want to control when major upgrades happen.
+
+1. Stop Blockbusterr, record its current image, and back up the complete configuration/database mount together to a separate location.
+2. Update the image to `ghcr.io/mahcks/blockbusterr:v2.0.0`; keep the existing mounts and set `BLOCKBUSTERR_DRY_RUN=true` before the first start.
+3. Leave the container user unset so the entrypoint can repair v1 ownership, then run as UID/GID `10001:10001`.
+4. Review migrated Jobs, Rules, title exceptions, and integration settings. Preview enabled jobs before allowing delivery.
+5. Remove dry-run only when ready. Duration schedules can run at startup; cron schedules wait for their next occurrence.
+
+For rollback, stop v2 and restore the complete stopped v1 snapshot into an empty mount with the previous image. Do not reuse v2-written files with v1.
+
+## Reliability notes
+
+Release qualification covers configuration recovery, interrupted requests, concurrent budget reservations, provider failures, and preview/execution consistency. A delivery timeout can still mean the downstream service accepted the title: inspect that service before retrying. Uncertain requests retain their budget reservation to avoid spending the same slot twice; rolling reservations age out with the configured window. This is not an exactly-once delivery guarantee.
+
+- [Quick start](https://blockbusterr.dev/getting-started/quickstart/)
+- [Upgrade and rollback guide](https://blockbusterr.dev/getting-started/upgrading-to-v2/)
+- [Full changelog](https://github.com/Mahcks/blockbusterr/blob/v2.0.0/CHANGELOG.md)
+- [Report a bug](https://github.com/Mahcks/blockbusterr/issues)

.github/workflows/ci.yaml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, release/v2.0.0]
   pull_request:
-    branches: [main]
+    branches: [main, release/v2.0.0]
 
 jobs:
   lint:
@@ -16,7 +16,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.25.6"
+          go-version: "1.25.13"
 
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v9
@@ -37,14 +37,58 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.25.6"
+          go-version: "1.25.13"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24.12.0"
+          cache: npm
+
+      - name: Verify frontend assets
+        run: npm ci && npm run check:assets
 
       - name: Download dependencies
         run: go mod download
 
       - name: Build
         run: go build -v ./...
 
+      - name: Verify v1 container ownership upgrade
+        run: |
+          docker build --build-arg VERSION=v2.0.0-ci -t blockbusterr:ci .
+          legacy_data="$(mktemp -d)"
+          chmod 0775 "$legacy_data"
+          original_group="$(stat -c %g "$legacy_data")"
+          sudo touch "$legacy_data/config.yaml" "$legacy_data/blockbusterr.db" "$legacy_data/unrelated.txt"
+          sudo chmod 0644 "$legacy_data/config.yaml" "$legacy_data/blockbusterr.db" "$legacy_data/unrelated.txt"
+
+          docker run --rm \
+            -e DATA_DIR=/data \
+            -v "$legacy_data:/data" \
+            blockbusterr:ci \
+            sh -c 'test "$(id -u)" = 10001 && test "$(id -g)" = 10001 && touch /data/runtime-write-test'
+
+          test "$(stat -c %u "$legacy_data")" = 10001
+          test "$(stat -c %g "$legacy_data")" = "$original_group"
+          test "$(stat -c %u "$legacy_data/config.yaml")" = 10001
+          test "$(stat -c %u "$legacy_data/blockbusterr.db")" = 10001
+          test "$(stat -c %u "$legacy_data/unrelated.txt")" = 0
+          test "$(stat -c %u "$legacy_data/runtime-write-test")" = 10001
+          if docker run --rm -e DATA_DIR=/ blockbusterr:ci true; then
+            echo "entrypoint accepted unsafe DATA_DIR=/" >&2
+            exit 1
+          fi
+
+      - name: Verify unattended v1 to v2 upgrade
+        run: scripts/test-v1-upgrade.sh blockbusterr:ci
+
+      - name: Smoke runtime image
+        run: scripts/test-container-smoke.sh blockbusterr:ci
+
+      - name: Verify release metadata rules
+        run: scripts/test-release-metadata.sh
+
   test:
     name: Test
     runs-on: ubuntu-latest
@@ -54,7 +98,56 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.25.6"
+          go-version: "1.25.13"
 
       - name: Run tests
         run: go test -v -race ./...
+
+  security:
+    name: Dependency security
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25.13"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24.12.0"
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            docs/package-lock.json
+
+      - name: Scan reachable Go vulnerabilities
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+
+      - name: Audit application assets
+        run: npm ci && npm audit
+
+      - name: Audit and build documentation
+        working-directory: docs
+        run: npm ci && npm audit && npm run test:archive && npm run build
+
+  browser:
+    name: Browser smoke tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25.13"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24.12.0"
+          cache: npm
+
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium
+      - run: npm run test:browser

.github/workflows/deploy-docs.yml

@@ -2,7 +2,7 @@ name: Deploy Docs to GitHub Pages
 
 on:
   push:
-    branches: [main, release/v2.0.0]
+    branches: [main]
     paths:
       - 'docs/**'
       - '.github/workflows/deploy-docs.yml'
@@ -24,13 +24,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: main
+          ref: v1.5.2
           path: v1
 
       - name: Checkout v2
         uses: actions/checkout@v4
         with:
-          ref: release/v2.0.0
           path: v2
 
       - name: Setup Node
@@ -53,16 +52,22 @@ jobs:
 
       - name: Build v1 and v2 with Astro
         run: |
-          npm run build --prefix v1/docs
+          cp v2/docs/src/components/VersionedSiteTitle.astro v1/docs/src/components/VersionedSiteTitle.astro
+          npm run build --prefix v1/docs -- --base /v1/
+          node v2/docs/scripts/archive-v1.mjs v1/docs/dist
+          npm run build --prefix v2/docs
+          mkdir -p site/v1
+          cp -a v2/docs/dist/. site/
+          cp -a v1/docs/dist/. site/v1/
           DOCS_BASE=/v2/ npm run build --prefix v2/docs
           npm run check:v2-links --prefix v2/docs
-          mkdir -p v1/docs/dist/v2
-          cp -a v2/docs/dist/. v1/docs/dist/v2/
+          mkdir -p site/v2
+          cp -a v2/docs/dist/. site/v2/
 
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3
         with:
-          path: ./v1/docs/dist
+          path: ./site
 
   deploy:
     environment: