# GitHub Access Configuration (God-Mode Provisioned)

## ALWAYS APPLY
This rule is always active for any GitHub, git, or Docker operations.

## Authentication
- GitHub CLI (`gh`) is available inside the Docker dev container
- Token injected via `GH_TOKEN` environment variable in `.env`
- SSH key for git push/pull generated in container, registered with GitHub
- NEVER hardcode tokens in any file, comment, or command
- NEVER commit `.env` or `.credentials-manifest.md`

## GitHub Account
- Owner: LookNoHandsMom
- Repo: LookNoHandsMom/LLMHosts.com (private)
- Plan: GitHub Pro ($4/mo) — ACTIVE as of 2026-02-17
- Account Status: UNFLAGGED (rate limit = 5000, GraphQL enabled)
- Branch Protection: main-protection ruleset (PR required, CI checks, no force push)
- Projects V2: "LLMHosts.com Roadmap" board active
- Copilot: Needs Copilot Pro subscription ($10/mo) — NOT YET ACTIVE
- Dependabot: Configured for pip, npm, docker, github-actions
- CODEOWNERS: All paths owned by @LookNoHandsMom

## GitHub as Single Source of Truth
- ALL project tracking in GitHub Issues + Projects V2
- ALL CI/CD via GitHub Actions
- ALL code changes via PRs (enforced by branch protection)
- ALL dependency updates via Dependabot
- Backlog, sprint planning, roadmap views all in Projects V2

## Container Rule (Non-Negotiable)
- ALL git and gh commands run inside the Docker dev container OR directly on dev server
- `docker compose run --rm dev [command]` for one-off commands
- `docker compose run --rm dev bash` for interactive shell
- OR run directly on dev server where `gh` is authenticated

## Git Workflow
- Protocol: SSH for git operations (`git@github.com:LookNoHandsMom/...`)
- Branch strategy: trunk-based, short-lived feature branches
- Branch naming: `feature/<issue-number>-<short-desc>` or `fix/<issue-number>-<short-desc>`
- Commits: Conventional Commits format (`feat:`, `fix:`, `chore:`, `test:`, `docs:`)
- PRs: Always create via `gh pr create`, never push directly to main
- Main branch: protected (requires PR + CI pass)

## GitHub API
- Use `gh` CLI for all GitHub API operations (inherits GH_TOKEN)
- Use `gh api` for REST/GraphQL calls
- Use `GH_TOKEN=$GH_TOKEN_PROJECTS gh project ...` for project board operations
- CI/CD secrets: managed via `gh secret set`

## Key Commands
```bash
# Start dev container
docker compose run --rm dev bash

# Check GitHub auth status
docker compose run --rm dev gh auth status

# Create a branch and PR
docker compose run --rm dev bash -c "git checkout -b feature/123-my-feature && git push -u origin HEAD && gh pr create --fill"

# Run tests
docker compose run --rm dev pytest tests/

# Seed a GitHub issue
docker compose run --rm dev gh issue create --title "feat: ..." --body "..." --label "feature,P1-high,size/M"
```

## Files Owned by God-Mode (Do Not Modify Structure)
- `Dockerfile.dev` -- base dev container (add deps, don't restructure)
- `docker-compose.yml` -- dev service base (add services, don't change dev service auth)
- `.docker/entrypoint.sh` -- auto-auth script (don't remove auth logic)
- `.env.example` -- credential template (add new vars, don't remove existing)
- This file (`.cursor/rules/github-access.mdc`)
