Run without live credentials #
Use the existing repository and its pinned requirements. The runtime image uses Python3.13; the recorded JavaScript test runtime is Node24.21.0. Keep private environment files, databases, generated credentials and external dependency caches out of Git.
python -m venv .venv
# Activate the environment using your platform's normal command.
python -m pip install -r requirements-dev.txt
python -m uvicorn app.main:app --host 127.0.0.1 --port 8000 --no-access-logBlank credentials leave Twitch sign-in unavailable; health and public pages still run. Production-style viewer/auth tests use explicit synthetic fixtures in tests, never a public fake-login route.
Run the project checks #
python -m pytest
node --test tests/*.test.mjs
python scripts/package_extension.py
# Container test target:
docker build --target test -t community-raiders-test .
docker run --rm community-raiders-testOn shells that do not expand globs, pass the individual .test.mjs paths. Test authorization, community/account isolation, revisions, failed writes, back/reload and both website/native panel views. A packaged ZIP is not an installed Twitch Extension.
Edit these docs #
Public content lives in app/devdocs/content.json, rendered by the repository-native docs module and templates. Text is escaped; diagrams use native layout and source-backed flows. Search reads a public static content index without tracking or preference storage.
When changing an API, update the curated route policy and prose, then run the docs tests. Machine schemas are taken from actual registered request models, not guessed examples. Keep source anchors and the verified revision/date accurate.
Keep releases reviewable #
Work in an isolated branch/worktree and preserve other contributors' changes. Main publication can trigger automatic deployment; do not mix unfinished art, schema changes or experimental gameplay into a reviewed UI update. Never force-push over another contributor's work.
The runtime owns one persistent data volume and a nonroot application process. Schema/credential/security changes need explicit review. Keep existing data; do not reset it to make a test pass. Source access and deployment access are managed separately from these public docs.
Docs use the existing service at a separate configured hostname. A wildcard DNS record alone does not configure valid TLS or application routing. This hostname is not added to credentialed API CORS.