# Contributing

## Branching model

- `main` — production. Auto-deploys to **produksjon.norgesprofil.no**. Protected.
- `development` — integration / staging. Auto-deploys to **dev.produksjon.norgesprofil.no**. Protected.
- `feature/<short-name>` — new work, branched from `development`.
- `fix/<short-name>` — bugfixes, branched from `development`.
- `hotfix/<short-name>` — emergency fixes, branched from `main`. PR to `main`, then merge `main` back into `development`.

```
feature/* ─┐
           ├──► development ──► main ──► production
fix/*    ──┘                       ▲
                                   │
hotfix/* ─────────────────────────┘
```

## Day-to-day workflow

```bash
git checkout development
git pull
git checkout -b feature/time-entry-crud
# ... commit small, focused changes ...
git push -u origin feature/time-entry-crud
# Open a PR on GitHub targeting `development`
```

When the PR is approved and CI is green, **squash-merge** it into `development`. The PR title becomes the commit message — write it in [Conventional Commits](https://www.conventionalcommits.org/) style:

```
feat(time): add clock-in/out endpoint
fix(auth): handle expired session on /me
chore(deps): bump primevue to 4.3
refactor(api): split Files controller
docs: update deploy instructions
```

When `development` has features ready to ship to production, open a PR `development` → `main`, get one approval, squash-merge. Push to `main` triggers the production deploy automatically.

## Hotfixes

```bash
git checkout main
git pull
git checkout -b hotfix/fix-login-500
# ... fix ...
# PR to main, merge.
# Then:
git checkout development
git pull
git merge main
git push
```

## Rules of thumb

- Keep branches short-lived (< 1 week ideally).
- Rebase your feature branch on top of `development` before opening the PR (`git fetch && git rebase origin/development`).
- One PR = one logical change. If you find unrelated cleanup, open a separate PR.
- Never `git push --force` to `main` or `development`. Force-push is fine on your own feature branches; use `--force-with-lease` to be safe.
- Never commit `.env`, secrets, or anything from `node_modules/`, `vendor/`, `writable/`.

## Local setup

See [README.md](README.md). Short version:

```bash
composer install
cp .env.example .env   # then edit DB creds
php spark key:generate
php spark migrate
php spark db:seed UserSeeder

cd vue && npm install
```

Run dev servers in two terminals:

```bash
php spark serve --port 8080      # CI4 API
cd vue && npm run dev            # Vite, http://localhost:5173
```

## CI

Every PR runs `.github/workflows/ci.yml`:
- PHP: composer validate, install, lint
- Vue: npm ci, typecheck, build

CI must be green before merging. Branch protection enforces this.

## Deploys

`.github/workflows/deploy.yml` runs automatically on:
- push to `main` → production (`produksjon.norgesprofil.no`)
- push to `development` → dev (`dev.produksjon.norgesprofil.no`)

You can also trigger it manually from the **Actions** tab.