ShipSecAI
diff --git a/‎.github/workflows/release.yml‎
Lines changed: 9 additions & 9 deletions b/‎.github/workflows/release.yml‎
Lines changed: 9 additions & 9 deletions
diff --git a/‎backend/.env.docker‎
Lines changed: 8 additions & 1 deletion b/‎backend/.env.docker‎
Lines changed: 8 additions & 1 deletion
diff --git a/‎backend/drizzle/0020_create-templates.sql‎
Lines changed: 59 additions & 0 deletions b/‎backend/drizzle/0020_create-templates.sql‎
Lines changed: 59 additions & 0 deletions
diff --git a/‎backend/package.json‎
Lines changed: 1 addition & 0 deletions b/‎backend/package.json‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎backend/src/app.module.ts‎
Lines changed: 2 additions & 0 deletions b/‎backend/src/app.module.ts‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎backend/src/config/env.schema.ts‎
Lines changed: 11 additions & 0 deletions b/‎backend/src/config/env.schema.ts‎
Lines changed: 11 additions & 0 deletions
diff --git a/‎backend/src/database/schema/index.ts‎
Lines changed: 1 addition & 0 deletions b/‎backend/src/database/schema/index.ts‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎backend/src/database/schema/templates.ts‎
Lines changed: 99 additions & 0 deletions b/‎backend/src/database/schema/templates.ts‎
Lines changed: 99 additions & 0 deletions
@@ -3,7 +3,7 @@ name: Release
 on:
   push:
     tags:
-      - 'v*.*.*'  # Triggers on tags like v1.0.0, v1.2.3, etc.
+      - 'v*.*.*' # Triggers on tags like v1.0.0, v1.2.3, etc.
   workflow_dispatch:
     inputs:
       version:
@@ -27,7 +27,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0  # Full history for changelog generation
+          fetch-depth: 0 # Full history for changelog generation
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -62,7 +62,7 @@ jobs:
           # Check if this is the latest tag (highest semver)
           CURRENT_TAG="${{ steps.version.outputs.version_clean }}"
           LATEST_TAG=$(git tag -l 'v*.*.*' | sort -V | tail -1 | sed 's/^v//')
-          
+
           if [ "$CURRENT_TAG" = "$LATEST_TAG" ]; then
             echo "is_latest=true" >> $GITHUB_OUTPUT
             echo "This is the latest release"
@@ -81,7 +81,7 @@ jobs:
           # Convert repository owner to lowercase for Docker registry compatibility
           IMAGE_PREFIX_LOWER=$(echo "${{ env.IMAGE_PREFIX }}" | tr '[:upper:]' '[:lower:]')
           VERSION_TAG="${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-backend:${{ steps.version.outputs.version_clean }}"
-          
+
           if [ "${{ steps.is_latest.outputs.is_latest }}" = "true" ]; then
             echo "backend_tags<<EOF" >> $GITHUB_OUTPUT
             echo "$VERSION_TAG" >> $GITHUB_OUTPUT
@@ -166,22 +166,22 @@ jobs:
         run: |
           VERSION="${{ steps.version.outputs.version }}"
           PREVIOUS_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
-          
+
           # Convert repository owner to lowercase for Docker registry compatibility
           IMAGE_PREFIX_LOWER=$(echo "${{ env.IMAGE_PREFIX }}" | tr '[:upper:]' '[:lower:]')
-          
+
           if [ -z "$PREVIOUS_TAG" ]; then
             echo "No previous tag found, generating full changelog"
             CHANGELOG=$(git log --pretty=format:"- %s (%h)" --no-merges)
           else
             echo "Generating changelog from $PREVIOUS_TAG to $VERSION"
             CHANGELOG=$(git log ${PREVIOUS_TAG}..HEAD --pretty=format:"- %s (%h)" --no-merges)
           fi
-          
+
           if [ -z "$CHANGELOG" ]; then
             CHANGELOG="No changes detected"
           fi
-          
+
           {
             echo "## Release $VERSION"
             echo ""
@@ -195,7 +195,7 @@ jobs:
             echo ""
             echo "$CHANGELOG"
           } > CHANGELOG.md
-          
+
           echo "changelog<<EOF" >> $GITHUB_OUTPUT
           cat CHANGELOG.md >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
 
@@ -29,4 +29,11 @@ LOKI_USERNAME=""
 LOKI_PASSWORD=""
 
 # Kafka / Redpanda configuration for node I/O, log, and event ingestion (Docker network)
-LOG_KAFKA_BROKERS="redpanda:9092"
+LOG_KAFKA_BROKERS="redpanda:9092"
+
+
+# GitHub template repository configuration
+GITHUB_TEMPLATE_REPO=shipsecai/workflow-templates
+GITHUB_TEMPLATE_BRANCH=main
+# Optional: GitHub personal access token for higher rate limits (60/hr → 5000/hr)
+GITHUB_TEMPLATE_TOKEN=
@@ -0,0 +1,59 @@
+-- Create templates table
+CREATE TABLE "templates" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"name" varchar(255) NOT NULL,
+	"description" text,
+	"category" varchar(100),
+	"tags" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"author" varchar(255),
+	"repository" varchar(255) NOT NULL,
+	"path" varchar(500) NOT NULL,
+	"branch" varchar(100) DEFAULT 'main' NOT NULL,
+	"version" varchar(50),
+	"commit_sha" varchar(100),
+	"manifest" jsonb NOT NULL,
+	"graph" jsonb,
+	"required_secrets" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"popularity" integer DEFAULT 0 NOT NULL,
+	"is_official" boolean DEFAULT false NOT NULL,
+	"is_verified" boolean DEFAULT false NOT NULL,
+	"is_active" boolean DEFAULT true NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+-- Create templates_submissions table
+CREATE TABLE "templates_submissions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"template_name" varchar(255) NOT NULL,
+	"description" text,
+	"category" varchar(100),
+	"repository" varchar(255) NOT NULL,
+	"branch" varchar(100),
+	"path" varchar(500) NOT NULL,
+	"commit_sha" varchar(100),
+	"pr_number" integer,
+	"pr_url" varchar(500),
+	"status" varchar(50) DEFAULT 'pending' NOT NULL,
+	"submitted_by" varchar(191) NOT NULL,
+	"organization_id" varchar(191),
+	"manifest" jsonb,
+	"graph" jsonb,
+	"feedback" text,
+	"reviewed_by" varchar(191),
+	"reviewed_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+-- Create indexes for templates
+CREATE INDEX "templates_repository_path_idx" ON "templates" ("repository", "path");
+CREATE INDEX "templates_category_idx" ON "templates" ("category");
+CREATE INDEX "templates_is_active_idx" ON "templates" ("is_active");
+CREATE INDEX "templates_popularity_idx" ON "templates" ("popularity" DESC);
+--> statement-breakpoint
+-- Create indexes for templates_submissions
+CREATE INDEX "templates_submissions_pr_number_idx" ON "templates_submissions" ("pr_number");
+CREATE INDEX "templates_submissions_submitted_by_idx" ON "templates_submissions" ("submitted_by");
+CREATE INDEX "templates_submissions_status_idx" ON "templates_submissions" ("status");
+CREATE INDEX "templates_submissions_organization_id_idx" ON "templates_submissions" ("organization_id");
@@ -45,6 +45,7 @@
     "bcryptjs": "^3.0.3",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.3",
+    "cookie-parser": "^1.4.7",
     "date-fns": "^4.1.0",
     "dotenv": "^17.2.3",
     "drizzle-orm": "^0.44.7",
 
@@ -34,6 +34,7 @@ import { WebhooksModule } from './webhooks/webhooks.module';
 import { HumanInputsModule } from './human-inputs/human-inputs.module';
 import { McpServersModule } from './mcp-servers/mcp-servers.module';
 import { McpGroupsModule } from './mcp-groups/mcp-groups.module';
+import { TemplatesModule } from './templates/templates.module';
 
 const coreModules = [
   AgentsModule,
@@ -53,6 +54,7 @@ const coreModules = [
   McpGroupsModule,
   McpModule,
   StudioMcpModule,
+  TemplatesModule,
   AuditModule,
 ];
 
 
@@ -75,6 +75,17 @@ export const backendEnvSchema = z
     PLATFORM_SERVICE_TOKEN: z.string().optional().default(''),
     PLATFORM_API_TIMEOUT_MS: z.string().optional().default(''),
 
+    // --- GitHub Template Library ---
+    GITHUB_TEMPLATE_REPO: z
+      .string()
+      .optional()
+      .default('shipsecai/workflow-templates')
+      .refine((v) => v.includes('/'), {
+        message: 'GITHUB_TEMPLATE_REPO must be in owner/repo format',
+      }),
+    GITHUB_TEMPLATE_BRANCH: z.string().optional().default('main'),
+    GITHUB_TEMPLATE_TOKEN: z.string().optional(),
+
     // --- Temporal ---
     TEMPORAL_BOOTSTRAP_DEMO: stringToBoolean(false),
   })
 
@@ -21,3 +21,4 @@ export * from './mcp-servers';
 
 export * from './node-io';
 export * from './organization-settings';
+export * from './templates';
@@ -0,0 +1,99 @@
+import {
+  pgTable,
+  uuid,
+  varchar,
+  text,
+  timestamp,
+  jsonb,
+  boolean,
+  integer,
+} from 'drizzle-orm/pg-core';
+import { z } from 'zod';
+
+/**
+ * Templates table - stores workflow template metadata
+ * Templates are synced from GitHub repository
+ */
+export const templatesTable = pgTable('templates', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  name: varchar('name', { length: 255 }).notNull(),
+  description: text('description'),
+  category: varchar('category', { length: 100 }),
+  tags: jsonb('tags').$type<string[]>().default([]),
+  author: varchar('author', { length: 255 }),
+  // GitHub repository info
+  repository: varchar('repository', { length: 255 }).notNull(), // e.g., "org/templates"
+  path: varchar('path', { length: 500 }).notNull(), // Path to template in repo
+  branch: varchar('branch', { length: 100 }).default('main'),
+  version: varchar('version', { length: 50 }), // Optional version tag
+  commitSha: varchar('commit_sha', { length: 100 }),
+  // Template content
+  manifest: jsonb('manifest').$type<TemplateManifest>().notNull(),
+  graph: jsonb('graph').$type<Record<string, unknown>>(), // Sanitized workflow graph
+  requiredSecrets: jsonb('required_secrets').$type<RequiredSecret[]>().default([]),
+  // Stats and flags
+  popularity: integer('popularity').notNull().default(0),
+  isOfficial: boolean('is_official').notNull().default(false),
+  isVerified: boolean('is_verified').notNull().default(false),
+  isActive: boolean('is_active').notNull().default(true),
+  // Timestamps
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+});
+
+/**
+ * Template submissions table - tracks PR-based template submissions
+ */
+export const templatesSubmissionsTable = pgTable('templates_submissions', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  templateName: varchar('template_name', { length: 255 }).notNull(),
+  description: text('description'),
+  category: varchar('category', { length: 100 }),
+  repository: varchar('repository', { length: 255 }).notNull(),
+  branch: varchar('branch', { length: 100 }),
+  path: varchar('path', { length: 500 }).notNull(),
+  commitSha: varchar('commit_sha', { length: 100 }),
+  pullRequestNumber: integer('pr_number'),
+  pullRequestUrl: varchar('pr_url', { length: 500 }),
+  status: varchar('status', { length: 50 }).notNull().default('pending'), // pending, approved, rejected, merged
+  submittedBy: varchar('submitted_by', { length: 191 }).notNull(),
+  organizationId: varchar('organization_id', { length: 191 }),
+  manifest: jsonb('manifest').$type<TemplateManifest>(),
+  graph: jsonb('graph').$type<Record<string, unknown>>(),
+  feedback: text('feedback'),
+  reviewedBy: varchar('reviewed_by', { length: 191 }),
+  reviewedAt: timestamp('reviewed_at', { withTimezone: true }),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+});
+
+// Zod schemas for validation
+export const RequiredSecretSchema = z.object({
+  name: z.string(),
+  type: z.string(),
+  description: z.string().optional(),
+  placeholder: z.string().optional(),
+});
+
+export const TemplateManifestSchema = z.object({
+  name: z.string(),
+  description: z.string().optional(),
+  version: z.string().optional(),
+  author: z.string().optional(),
+  category: z.string().optional(),
+  tags: z.array(z.string()).optional(),
+  requiredSecrets: z.array(RequiredSecretSchema).optional(),
+  entryPoint: z.string().optional(),
+  screenshots: z.array(z.string()).optional(),
+  documentation: z.string().optional(),
+});
+
+// Type exports
+export type TemplateManifest = z.infer<typeof TemplateManifestSchema>;
+export type RequiredSecret = z.infer<typeof RequiredSecretSchema>;
+
+export type Template = typeof templatesTable.$inferSelect;
+export type NewTemplate = typeof templatesTable.$inferInsert;
+
+export type TemplateSubmission = typeof templatesSubmissionsTable.$inferSelect;
+export type NewTemplateSubmission = typeof templatesSubmissionsTable.$inferInsert;
Original file line number	Diff line number	Diff line change
`@@ -21,3 +21,4 @@ export * from './mcp-servers';`
`21`	`21`
`22`	`22`	`export * from './node-io';`
`23`	`23`	`export * from './organization-settings';`
	`24`	`+export * from './templates';`