Merge branch 'dev' into ci/41-gitea-actions

Reviewed-on: #43

.env.example

@@ -5,6 +5,7 @@
 TELEGRAM_BOT_TOKEN=            # (secret) токен от @BotFather
 ADMIN_IDS=                     # Telegram ID первых администраторов через запятую
 LOG_LEVEL=INFO
+TELEGRAM_PROXY_URL=            # (secret) http://user:pass@host:port или socks5://… — на RF-сервере Telegram недоступен напрямую
 
 # --- База данных ---
 POSTGRES_PASSWORD=tgit         # (secret на сервере) пароль Postgres в Compose

.gitea/workflows/ci.yml

@@ -0,0 +1,72 @@
+name: CI
+
+# Гейт качества на каждый PR и push в dev/main — как в Vobot (.gitea/workflows/backend.yml).
+# CD (.gitea/workflows/deploy.yml) тесты не гоняет: они прошли здесь, на PR.
+on:
+  push:
+    branches: [dev, main]
+  pull_request:
+    branches: [dev, main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-and-test:
+    # Имя джоба — контекст статуса в PR; если включать branch protection, требовать именно его.
+    name: ruff · mypy · pytest
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: tgit_test
+          POSTGRES_USER: tgit
+          POSTGRES_PASSWORD: tgit
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+        # без маппинга портов: act_runner запускает job в контейнере, сервис доступен по имени `postgres`
+        # (опыт Vobot: маппинг 5432 на хост конфликтует с postgres самого Gitea)
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        # pip, а не astral-sh/setup-uv: на self-hosted Gitea экшен ходит в GitHub API и падает (опыт Vobot)
+        run: pip install uv
+
+      - name: Install deps
+        run: uv sync --frozen
+
+      - name: Ruff
+        run: |
+          uv run ruff check .
+          uv run ruff format --check .
+
+      - name: Mypy
+        run: uv run mypy
+
+      - name: Migrations on PostgreSQL — up, down, up
+        # pytest гоняет схему на SQLite; здесь — настоящий Postgres: JSONB, BIGINT, CHECK, откат
+        env:
+          DATABASE_URL: postgresql+asyncpg://tgit:tgit@postgres:5432/tgit_test
+        run: |
+          uv run alembic upgrade head
+          uv run alembic downgrade base
+          uv run alembic upgrade head
+
+      - name: Pytest (+ порог покрытия из pyproject)
+        run: |
+          git config --global user.name ci
+          git config --global user.email ci@ci
+          uv run pytest -q --cov --cov-report=term

.gitea/workflows/deploy.yml

@@ -0,0 +1,45 @@
+name: CD
+
+# Как в Vobot: тесты здесь не гоняем — они прошли в CI на PR.
+# dev → /srv/tgit/dev, main → /srv/tgit/prod на хосте Vobot (infra/deploy/deploy.sh).
+# Окружение без /srv/tgit/<env>/.env на сервере пропускается (prod — когда будет свой токен бота).
+on:
+  push:
+    branches: [dev, main]
+  workflow_dispatch: {}
+
+# Деплои одной ветки — строго по очереди, без отмены.
+concurrency:
+  group: cd-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: deploy → ${{ github.ref_name == 'main' && 'prod' || 'dev' }}
+    runs-on: ubuntu-latest
+    env:
+      DEPLOY_ENV: ${{ github.ref_name == 'main' && 'prod' || 'dev' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # Серия мержей подряд: устаревший прогон сам сворачивается, задеплоит актуальный (опыт Vobot)
+      - id: guard
+        name: "Актуален ли ещё этот пуш?"
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then echo "go=true" >> "$GITHUB_OUTPUT"; exit 0; fi
+          REMOTE_SHA=$(git ls-remote origin "refs/heads/${{ github.ref_name }}" | cut -f1)
+          if [ "$REMOTE_SHA" = "${{ github.sha }}" ]; then echo "go=true" >> "$GITHUB_OUTPUT"
+          else echo "⏭ ${{ github.sha }} уже не HEAD ${{ github.ref_name }} — пропускаю"; echo "go=false" >> "$GITHUB_OUTPUT"; fi
+
+      - name: Deploy
+        if: steps.guard.outputs.go == 'true'
+        env:
+          # Через env:, а не инлайном в run: — многострочный ключ иначе может попасть в лог (опыт Vobot)
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+        run: |
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          export DEPLOY_SSH_OPTS="-F /dev/null -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=20"
+          infra/deploy/deploy.sh "$DEPLOY_ENV" HEAD

.gitignore

@@ -24,5 +24,6 @@ build/
 .claude/worktrees/
 .DS_Store
 
-# local SQLite DB (bot without Docker)
+# local run without Docker: SQLite DB, uploads clone, demo repo
 *.db
+data/

CLAUDE.md

@@ -49,6 +49,7 @@ Telegram-бот «git в телеграме» для команды (учебн
 | [`docs/dev/ISSUE_TEMPLATE.md`](docs/dev/ISSUE_TEMPLATE.md) | Шаблон тела issue |
 | [`docs/dev/GITEA_API.md`](docs/dev/GITEA_API.md) | Gitea API: issue, PR, зависимости, зеркало |
 | [`docs/dev/SOURCECRAFT_API.md`](docs/dev/SOURCECRAFT_API.md) | SourceCraft API: CI-прогоны, логи, секреты |
+| [`docs/dev/DEPLOY.md`](docs/dev/DEPLOY.md) | **Деплой:** сервер, окружения dev/prod, руками, откат |
 
 ---
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: install lint fmt typecheck test cov up down logs ps
+.PHONY: install lint fmt typecheck test cov up down logs ps run demo-repo
 
 install:
 	uv sync
@@ -30,3 +30,18 @@ logs:
 
 ps:
 	docker compose ps
+
+# Run the bot on this machine without Docker: SQLite (./tgit.db) and the settings from .env
+run:
+	uv run python -m app
+
+# A local uploads repo seeded from the template — try the bot without SourceCraft:
+#   make demo-repo  →  put the printed GIT_UPLOADS_URL into .env  →  make run
+DEMO_REPO := $(CURDIR)/data/demo-uploads.git
+demo-repo:
+	@test ! -e $(DEMO_REPO) || { echo "$(DEMO_REPO) already exists"; exit 1; }
+	@rm -rf data/demo-seed && mkdir -p data && cp -r infra/uploads-template data/demo-seed
+	@cd data/demo-seed && git init -q -b main && git add -A \
+		&& git -c user.name=tgit-bot -c user.email=tgit-bot@users.noreply.tgit commit -qm "init: uploads template"
+	@git clone -q --bare data/demo-seed $(DEMO_REPO) && rm -rf data/demo-seed
+	@echo "GIT_UPLOADS_URL=$(DEMO_REPO)"

app/bot/routers/commit.py

@@ -20,10 +20,12 @@ from app.bot.menu import Nav, NavAction
 from app.db.models import ChangeOp, User
 from app.repo.drafts import DraftFull, DraftService, DraftView
 from app.repo.git import Entry, GitError, UploadsRepo
+from app.repo.publisher import Publisher, PushResult, PushStatus
 from app.repo.validate import (
     MAX_FILE_BYTES,
     ValidationError,
     check_content,
+    check_message,
     check_name,
     diff_stat,
     is_protected,
@@ -53,6 +55,11 @@ class Act(StrEnum):
     UNSTAGE = "x"
     FORCE = "y"
     FIX = "z"
+    MESSAGE = "m"
+    PUSH = "ps"
+    PUSH_GO = "pg"
+    PUSH_FORCE = "pf"
+    COMMIT = "cm"
 
 
 class CommitCb(CallbackData, prefix="c"):
@@ -66,6 +73,7 @@ class Flow(StatesGroup):
     dir_name = State()
     content = State()
     syntax = State()
+    message = State()
 
 
 class Mark(StrEnum):
@@ -172,8 +180,10 @@ def render_dir(
     kb.button(text=t.new_dir, callback_data=CommitCb(a=Act.NEW_DIR))
     sizes.append(2)
     if draft_count:
+        # the main action once something is staged — right in the folder, not two screens deep
+        kb.button(text=t.commit_button.format(count=draft_count), callback_data=CommitCb(a=Act.COMMIT))
         kb.button(text=t.draft_button.format(count=draft_count), callback_data=CommitCb(a=Act.DRAFT))
-        sizes.append(1)
+        sizes += [1, 1]
     if path:
         kb.button(text=t.up, callback_data=CommitCb(a=Act.UP))
         sizes.append(1)
@@ -201,7 +211,9 @@ def to_dir_keyboard(texts: Texts) -> InlineKeyboardMarkup:
     return kb.as_markup()
 
 
-def build_router(texts: Texts, repo: UploadsRepo, drafts: DraftService) -> Router:
+def build_router(
+    texts: Texts, repo: UploadsRepo, drafts: DraftService, publisher: Publisher, commit_url_template: str = ""
+) -> Router:
     router = Router(name="commit")
     t = texts.commit
 
@@ -236,15 +248,67 @@ def build_router(texts: Texts, repo: UploadsRepo, drafts: DraftService) -> Route
             ops = {ChangeOp.ADD: t.op_add, ChangeOp.MODIFY: t.op_modify, ChangeOp.DELETE: t.op_delete}
             lines = [t.draft_title.format(count=len(changes)), ""]
             lines += [f"{ops[c.op]}  /{c.path}" for c in changes]
+            message = draft.message if draft else None
+            lines += ["", t.message_current.format(message=message) if message else t.message_missing]
             text = "\n".join(lines)
             for i, c in enumerate(changes):
                 kb.button(
                     text=t.unstage.format(name=c.path.rsplit("/", 1)[-1]), callback_data=CommitCb(a=Act.UNSTAGE, i=i)
                 )
+        if changes:
+            kb.button(text=t.message_button, callback_data=CommitCb(a=Act.MESSAGE))
+            if draft and draft.message:
+                kb.button(text=t.push_button, callback_data=CommitCb(a=Act.PUSH))
         kb.button(text=t.to_dir, callback_data=CommitCb(a=Act.TO_DIR))
         kb.adjust(1)
         return text, kb.as_markup()
 
+    def confirm_screen(draft: DraftView) -> tuple[str, InlineKeyboardMarkup]:
+        builder = InlineKeyboardBuilder()
+        builder.button(text=t.push_go, callback_data=CommitCb(a=Act.PUSH_GO))
+        builder.button(text=t.edit_message, callback_data=CommitCb(a=Act.MESSAGE))
+        builder.button(text=texts.menu.back, callback_data=CommitCb(a=Act.TO_DIR))
+        builder.adjust(1)
+        return t.push_confirm.format(summary=summary(draft), message=draft.message), builder.as_markup()
+
+    def summary(draft: DraftView) -> str:
+        ops = {ChangeOp.ADD: t.op_add, ChangeOp.MODIFY: t.op_modify, ChangeOp.DELETE: t.op_delete}
+        return "\n".join(f"{ops[c.op]}  /{c.path}" for c in draft.changes)
+
+    async def do_push(msg: Message, state: FSMContext, member: User, *, overwrite: bool) -> None:
+        draft = await drafts.get(member.tg_id)
+        if draft is None or not draft.changes or not draft.message:
+            text, kb = await draft_screen(state, member.tg_id)
+            await msg.edit_text(text, reply_markup=kb)
+            return
+        await msg.edit_text(t.pushing)
+        result: PushResult = await publisher.push(member, draft, draft.message, overwrite=overwrite)
+        match result.status:
+            case PushStatus.OK:
+                assert result.sha is not None
+                first_line = draft.message.splitlines()[0]
+                lines = [t.pushed.format(sha=result.sha[:7], message=first_line)]
+                if commit_url_template:
+                    lines.append(commit_url_template.format(sha=result.sha))
+                lines.append(t.ci_pending)
+                await msg.edit_text("\n".join(lines))
+                await publisher.record(member, result, draft.message, draft, msg.chat.id, msg.message_id)
+                await drafts.clear(member.tg_id)
+                await state.update_data(commit_virtual=[])
+            case PushStatus.CONFLICT:
+                builder = InlineKeyboardBuilder()
+                builder.button(text=t.overwrite, callback_data=CommitCb(a=Act.PUSH_FORCE))
+                builder.button(text=texts.menu.cancel, callback_data=CommitCb(a=Act.DRAFT))
+                paths = "\n".join(f"/{p}" for p in result.conflicts)
+                await msg.edit_text(t.conflict.format(paths=paths), reply_markup=builder.as_markup())
+            case PushStatus.EMPTY:
+                await drafts.clear(member.tg_id)
+                await msg.edit_text(t.push_empty)
+            case PushStatus.LIMIT:
+                await msg.edit_text(t.push_limit, reply_markup=to_dir_keyboard(texts))
+            case PushStatus.FAILED:
+                await msg.edit_text(t.push_failed, reply_markup=to_dir_keyboard(texts))
+
     async def file_card(user_id: int, path: str, size: int, mark: Mark) -> str:
         card = t.file_card.format(path=path, size=human_size(size))
         if mark is Mark.NEW:
@@ -411,6 +475,34 @@ def build_router(texts: Texts, repo: UploadsRepo, drafts: DraftService) -> Route
                         base64.b64decode(pending),
                     )
                     return
+                case Act.MESSAGE:
+                    await state.set_state(Flow.message)
+                    await state.update_data(commit_then_push=False)
+                    await msg.edit_text(t.ask_message, reply_markup=to_dir_keyboard(texts))
+                case Act.PUSH:
+                    draft = await drafts.get(uid)
+                    if draft is None or not draft.changes or not draft.message:
+                        await query.answer()
+                        return
+                    confirm, markup = confirm_screen(draft)
+                    await msg.edit_text(confirm, reply_markup=markup)
+                case Act.COMMIT:
+                    draft = await drafts.get(uid)
+                    if draft is None or not draft.changes:
+                        await query.answer()
+                        return
+                    if draft.message:
+                        confirm, markup = confirm_screen(draft)
+                        await msg.edit_text(confirm, reply_markup=markup)
+                    else:
+                        # ask for the message, then go straight to the push confirmation
+                        await state.set_state(Flow.message)
+                        await state.update_data(commit_then_push=True)
+                        await msg.edit_text(t.ask_message, reply_markup=to_dir_keyboard(texts))
+                case Act.PUSH_GO | Act.PUSH_FORCE:
+                    await query.answer()
+                    await do_push(msg, state, member, overwrite=callback_data.a is Act.PUSH_FORCE)
+                    return
                 case Act.FIX:
                     await state.set_state(Flow.content)
                     await state.update_data(commit_pending=None)
@@ -470,6 +562,23 @@ def build_router(texts: Texts, repo: UploadsRepo, drafts: DraftService) -> Route
         text, kb = await dir_screen(state, member.tg_id, path, 0)
         await message.answer(text, reply_markup=kb)
 
+    @router.message(Flow.message, F.text)
+    async def got_message(message: Message, state: FSMContext, member: User) -> None:
+        try:
+            text = check_message(message.text or "")
+        except ValidationError:
+            await message.answer(t.bad_message)
+            return
+        await drafts.set_message(member.tg_id, text)
+        await state.set_state(None)
+        draft = await drafts.get(member.tg_id)
+        if (await state.get_data()).get("commit_then_push") and draft is not None and draft.changes:
+            await state.update_data(commit_then_push=False)
+            screen, kb = confirm_screen(draft)
+        else:
+            screen, kb = await draft_screen(state, member.tg_id)
+        await message.answer(screen, reply_markup=kb)
+
     @router.message(Flow.content, F.text | F.document)
     async def got_content(message: Message, state: FSMContext, member: User, bot: Bot) -> None:
         data = await state.get_data()

app/config.py

@@ -13,6 +13,8 @@ class TelegramSettings(BaseSettings):
     model_config = SettingsConfigDict(**_ENV, env_prefix="TELEGRAM_")
 
     bot_token: SecretStr
+    # http://user:pass@host:port or socks5://… — the RF server has no route to api.telegram.org (same as meditron)
+    proxy_url: SecretStr | None = None
 
 
 class AccessSettings(BaseSettings):
@@ -74,6 +76,8 @@ class GitSettings(BaseSettings):
     # container user (uid 10001 vs the owner's 0600). Written to a private temp file at startup.
     ssh_key_b64: SecretStr | None = None
     branch: str = "main"
+    # Web link to a commit in the uploads repo, e.g. https://sourcecraft.dev/{repo}/commit/{sha}; empty — no link
+    commit_url_template: str = ""
     clone_dir: Path = Path("data/uploads")
     # Browsing re-fetches at most this often; a push always fetches first (#9)
     fetch_interval: float = Field(default=10.0, ge=0)

app/main.py

@@ -5,6 +5,7 @@ import contextlib
 import logging
 
 from aiogram import Bot, Dispatcher
+from aiogram.client.session.aiohttp import AiohttpSession
 
 from app import __version__
 from app.access.service import AccessService
@@ -19,19 +20,24 @@ from app.health import heartbeat
 from app.logs_setup import setup_logging
 from app.repo.drafts import DraftService
 from app.repo.git import UploadsRepo
+from app.repo.publisher import Publisher
 from app.texts import Texts, load_texts
 
 log = logging.getLogger("tgit")
 
 
-def build_dispatcher(texts: Texts, sessions: SessionMaker, access: AccessService, repo: UploadsRepo) -> Dispatcher:
+def build_dispatcher(
+    texts: Texts, sessions: SessionMaker, access: AccessService, repo: UploadsRepo, commit_url_template: str = ""
+) -> Dispatcher:
     dp = Dispatcher(storage=make_storage(sessions))
     gate = AccessMiddleware(access, texts)
     # Outer middleware: runs before filters, so nothing — not even a stale button — reaches a handler unchecked.
     dp.message.outer_middleware(gate)
     dp.callback_query.outer_middleware(gate)
     dp.include_router(members.build_router(texts, access))
-    dp.include_router(commit.build_router(texts, repo, DraftService(sessions)))
+    dp.include_router(
+        commit.build_router(texts, repo, DraftService(sessions), Publisher(repo, sessions), commit_url_template)
+    )
     dp.include_router(common.build_router(texts, access))
     return dp
 
@@ -43,14 +49,21 @@ async def run(settings: Settings) -> None:
     sessions = make_sessionmaker(engine)
     access = AccessService(sessions, settings.access)
     await access.bootstrap_admins()
-    dp = build_dispatcher(texts, sessions, access, UploadsRepo(settings.git))
+    dp = build_dispatcher(texts, sessions, access, UploadsRepo(settings.git), settings.git.commit_url_template)
     rt = settings.runtime
     background = [
         asyncio.create_task(heartbeat(rt.heartbeat_file, rt.heartbeat_interval)),
         asyncio.create_task(cleanup_loop(sessions)),
     ]
-    bot = Bot(settings.telegram.bot_token.get_secret_value())
+    proxy = settings.telegram.proxy_url
-    log.info("tgit %s starting, %d bootstrap admin(s)", __version__, len(settings.access.admin_ids))
+    session = AiohttpSession(proxy=proxy.get_secret_value()) if proxy else None
+    bot = Bot(settings.telegram.bot_token.get_secret_value(), session=session)
+    log.info(
+        "tgit %s starting, %d bootstrap admin(s), telegram %s",
+        __version__,
+        len(settings.access.admin_ids),
+        "via proxy" if proxy else "direct",
+    )
     try:
         await dp.start_polling(bot, handle_signals=True)
     finally:

app/repo/git.py

@@ -47,11 +47,16 @@ class CommitInfo:
 class UploadsRepo:
     def __init__(self, settings: GitSettings) -> None:
         self._s = settings
-        self._dir = settings.clone_dir
+        # absolute: git clone runs from the parent dir, a relative path would land one level deeper
+        self._dir = settings.clone_dir.resolve()
         self._lock = asyncio.Lock()
         self._fetched_at: float | None = None
         self._key_path = self._materialize_key()
 
+    @property
+    def branch(self) -> str:
+        return self._s.branch
+
     @property
     def ref(self) -> str:
         return f"origin/{self._s.branch}"

app/repo/publisher.py

@@ -0,0 +1,171 @@
+"""Turns a member's draft into one commit on the uploads repo's main branch (SPEC C-20…C-25, ARCHITECTURE §2.3).
+
+Pushes are serialized with a lock: two members pushing at once never fight over the shared working tree.
+"""
+
+import asyncio
+import logging
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta
+from enum import StrEnum
+from pathlib import Path
+
+from sqlalchemy import func, select
+
+from app.db.models import ChangeOp, Push, User, utcnow
+from app.db.session import SessionMaker
+from app.repo.drafts import DraftView
+from app.repo.git import GitError, UploadsRepo
+
+log = logging.getLogger(__name__)
+
+BOT_NAME = "tgit-bot"
+BOT_EMAIL = "tgit-bot@users.noreply.tgit"
+PUSHES_PER_HOUR = 20
+PUSH_ATTEMPTS = 3
+
+
+class PushStatus(StrEnum):
+    OK = "ok"
+    CONFLICT = "conflict"  # someone changed the same files in main since the draft began
+    EMPTY = "empty"  # the draft matches main already
+    LIMIT = "limit"
+    FAILED = "failed"
+
+
+@dataclass(frozen=True)
+class PushResult:
+    status: PushStatus
+    sha: str | None = None
+    conflicts: list[str] = field(default_factory=list)
+
+
+class Publisher:
+    def __init__(
+        self,
+        repo: UploadsRepo,
+        sessions: SessionMaker,
+        clock: Callable[[], datetime] = utcnow,
+        before_push: Callable[[], Awaitable[None]] | None = None,  # test hook: simulate a concurrent push
+    ) -> None:
+        self._repo = repo
+        self._sessions = sessions
+        self._clock = clock
+        self._before_push = before_push
+        self._lock = asyncio.Lock()
+
+    async def push(self, member: User, draft: DraftView, message: str, *, overwrite: bool = False) -> PushResult:
+        if await self._pushes_last_hour(member.tg_id) >= PUSHES_PER_HOUR:
+            return PushResult(PushStatus.LIMIT)
+        async with self._lock:
+            try:
+                return await self._push(member, draft, message, overwrite)
+            except GitError:
+                log.exception("push failed")
+                await self._reset()
+                return PushResult(PushStatus.FAILED)
+
+    async def record(
+        self, member: User, result: PushResult, message: str, draft: DraftView, chat_id: int, message_id: int
+    ) -> None:
+        assert result.sha is not None
+        async with self._sessions.begin() as s:
+            s.add(
+                Push(
+                    user_id=member.tg_id,
+                    sha=result.sha,
+                    message=message,
+                    paths=[c.path for c in draft.changes],
+                    chat_id=chat_id,
+                    message_id=message_id,
+                    created_at=self._clock(),
+                )
+            )
+
+    async def _push(self, member: User, draft: DraftView, message: str, overwrite: bool) -> PushResult:
+        repo = self._repo
+        await repo.refresh(force=True)
+        if not overwrite:
+            conflicts = await self._conflicts(draft)
+            if conflicts:
+                return PushResult(PushStatus.CONFLICT, conflicts=conflicts)
+
+        await self._reset()
+        self._apply(draft)
+        await repo.git("add", "-A")
+        try:
+            await repo.git("diff", "--cached", "--quiet")
+            return PushResult(PushStatus.EMPTY)  # exit 0: nothing staged
+        except GitError:
+            pass  # exit 1: there are changes
+
+        handle = f"@{member.username}" if member.username else member.full_name
+        full_message = f"{message.strip()}\n\nTelegram-User: {handle} ({member.tg_id})"
+        await repo.git(
+            "-c", f"user.name={BOT_NAME}", "-c", f"user.email={BOT_EMAIL}", "commit", "-q", "-m", full_message
+        )
+
+        branch = repo.branch
+        for attempt in range(1, PUSH_ATTEMPTS + 1):
+            if self._before_push is not None:
+                await self._before_push()
+            try:
+                await repo.git("push", "-q", "origin", f"HEAD:{branch}")
+                break
+            except GitError:
+                if attempt == PUSH_ATTEMPTS:
+                    raise
+                log.info("push rejected, rebasing (attempt %d)", attempt)
+                await repo.git("fetch", "-q", "origin")
+                try:
+                    await repo.git(
+                        "-c", f"user.name={BOT_NAME}", "-c", f"user.email={BOT_EMAIL}", "rebase", "-q", repo.ref
+                    )
+                except GitError:
+                    await repo.git("rebase", "--abort")
+                    return PushResult(PushStatus.CONFLICT, conflicts=await self._conflicts(draft))
+        sha = (await repo.git("rev-parse", "HEAD")).decode().strip()
+        return PushResult(PushStatus.OK, sha=sha)
+
+    async def _conflicts(self, draft: DraftView) -> list[str]:
+        try:
+            out = await self._repo.git("diff", "--name-only", draft.base_sha, self._repo.ref)
+        except GitError:
+            return [c.path for c in draft.changes]  # base unknown (e.g. history rewritten): be safe
+        changed = set(out.decode().splitlines())
+        return [c.path for c in draft.changes if c.path in changed]
+
+    async def _reset(self) -> None:
+        repo = self._repo
+        await repo.git("checkout", "-q", "-B", repo.branch, repo.ref)
+        await repo.git("reset", "-q", "--hard", repo.ref)
+        await repo.git("clean", "-q", "-fdx")
+
+    def _apply(self, draft: DraftView) -> None:
+        root = self._repo.path.resolve()
+        for change in draft.changes:
+            target = (root / change.path).resolve()
+            if root not in target.parents:  # validated earlier; this is the last line of defence
+                raise GitError(f"path escapes the repo: {change.path}")
+            if change.op is ChangeOp.DELETE:
+                target.unlink(missing_ok=True)
+                _prune_empty_dirs(target.parent, root)
+            else:
+                target.parent.mkdir(parents=True, exist_ok=True)
+                target.write_bytes(change.content or b"")
+
+    async def _pushes_last_hour(self, user_id: int) -> int:
+        async with self._sessions() as s:
+            count = await s.scalar(
+                select(func.count())
+                .select_from(Push)
+                .where(Push.user_id == user_id, Push.created_at > self._clock() - timedelta(hours=1))
+            )
+            return count or 0
+
+
+def _prune_empty_dirs(directory: Path, root: Path) -> None:
+    while directory != root and directory.is_dir() and not any(directory.iterdir()):
+        directory.rmdir()
+        directory = directory.parent

app/repo/validate.py

@@ -74,3 +74,10 @@ def diff_stat(old: str, new: str) -> tuple[int, int]:
         elif line.startswith("- "):
             removed += 1
     return added, removed
+
+
+def check_message(message: str) -> str:
+    message = message.strip()
+    if not 1 <= len(message) <= 200 or len(message.splitlines()[0]) > 72:
+        raise ValidationError("message")
+    return message

app/texts.py

@@ -104,6 +104,24 @@ class CommitTexts(_Strict):
     op_add: str
     op_modify: str
     op_delete: str
+    message_button: str
+    message_current: str
+    message_missing: str
+    ask_message: str
+    bad_message: str
+    push_button: str
+    commit_button: str
+    edit_message: str
+    push_confirm: str
+    push_go: str
+    pushing: str
+    pushed: str
+    ci_pending: str
+    conflict: str
+    overwrite: str
+    push_empty: str
+    push_limit: str
+    push_failed: str
 
 
 class Texts(_Strict):

config/texts.yaml

@@ -107,3 +107,30 @@ commit:
   op_add: "A"
   op_modify: "M"
   op_delete: "D"
+  message_button: "💬 Сообщение коммита"
+  message_current: "💬 {message}"
+  message_missing: "💬 Сообщение коммита не задано."
+  ask_message: "Сообщение коммита: до 200 символов, первая строка — до 72."
+  bad_message: "Сообщение: 1–200 символов, первая строка — до 72. Пришлите другое."
+  push_button: "🚀 Push"
+  commit_button: "🚀 Закоммитить · {count}"
+  edit_message: "✏️ Изменить сообщение"
+  push_confirm: |-
+    Запушить в main?
+
+    {summary}
+
+    💬 {message}
+  push_go: "✅ Запушить"
+  pushing: "⏳ Пушу…"
+  pushed: "✅ Запушено: {sha} — {message}"
+  ci_pending: "⏳ CI…"
+  conflict: |-
+    ⚠️ Пока вы готовили черновик, в main изменились те же файлы:
+    {paths}
+
+    Перезаписать их вашей версией?
+  overwrite: "Перезаписать"
+  push_empty: "В main уже всё так же — коммитить нечего. Черновик очищен."
+  push_limit: "Лимит — 20 пушей в час. Попробуйте позже."
+  push_failed: "Не удалось запушить: репозиторий недоступен. Черновик сохранён — попробуйте позже."

docker-compose.yml

@@ -12,7 +12,7 @@ services:
       postgres:
         condition: service_healthy
     restart: unless-stopped
-    mem_limit: 256m
+    mem_limit: 384m  # ~190 MB idle; git clone/push and aiogram spikes need headroom
     labels:
       tgit.managed: "true"
     logging:

docs/DECISIONS.md

@@ -129,3 +129,11 @@
 **Решение:** первый куб задачи `check` в `tgit-uploads` — `meta`: `echo "TGIT_COMMIT_SHA=$SOURCECRAFT_COMMIT_SHA"`. Бот читает его лог (`SourceCraftClient.run_commit_sha`) и сопоставляет прогон с пушем.
 **Альтернативы:** запускать CI из бота вручную (`POST /cicd/runs` с `head.commit`) — номер прогона известен сразу, но push-триггер пришлось бы убрать, и ручные пуши в репозиторий остались бы без CI; сопоставление по времени — ломается при параллельных пушах.
 **Последствия:** +1 короткий куб на прогон; куб `meta` нельзя удалять или переименовывать (он в `.sourcecraft/`, который бот защищает от правок); прогоны старше этого решения sha не имеют.
+
+## ADR-015: CI/CD бота — на Gitea Actions (как в Vobot)
+**Дата:** 2026-10-16 · **Статус:** принято (меняет ADR-010 в части CI/CD бота)
+
+**Контекст:** SourceCraft отложен: ключ бота там не принимается, триггеры зависят от основной ветки, раннеры с очередью до минут. Гейт и деплой нужны сейчас.
+**Решение:** CI (`.gitea/workflows/ci.yml`: ruff, mypy, миграции на Postgres, pytest) и CD (`.gitea/workflows/deploy.yml` → `infra/deploy/deploy.sh`) — на Gitea Actions, как у Vobot и meditron, на общих раннерах Gitea. Деплой — на хост Vobot, `dev`/`prod` по веткам, через пользователя `tgit-deploy`. Репозиторий загрузок на сервере — временно `HSE/tgit-uploads` в Gitea.
+**Альтернативы:** ждать SourceCraft — блокирует проверку и демо.
+**Последствия:** `.sourcecraft/ci.yaml` бота остаётся для будущего возврата; при возврате к SourceCraft меняются `GIT_UPLOADS_URL` и ключ, код не трогаем. На RF-сервере Telegram — только через прокси (`TELEGRAM_PROXY_URL`).

docs/dev/DEPLOY.md

@@ -0,0 +1,45 @@
+# Деплой бота
+
+CD — `.gitea/workflows/deploy.yml` (Gitea Actions, ADR-015): push в `dev` → окружение **dev**, push в `main` → **prod**.
+Под капотом — `infra/deploy/deploy.sh`, тот же скрипт работает руками и для любого Docker-хоста.
+
+## Сервер (хост Vobot, 72.56.247.166)
+
+| Что | Где |
+|---|---|
+| Пользователь | `tgit-deploy` (группа `docker`), ключ CI в `~/.ssh/authorized_keys` |
+| Окружение | `/srv/tgit/<env>/` — `.env` (только здесь, 600), `app/` (текущий релиз), `app.old/` (предыдущий), `REVISION` |
+| Контейнеры | Compose-проект `tgit-<env>`: `tgit-<env>-bot-1`, `tgit-<env>-postgres-1`; volumes `pgdata`, `uploads` |
+| Telegram | с сервера напрямую недоступен → `TELEGRAM_PROXY_URL` (тот же прокси, что у meditron) |
+| Репозиторий загрузок | временно `ssh://git@gitea.24studbank.ru:2222/HSE/tgit-uploads.git`, deploy key бота с записью |
+
+Секреты репозитория в Gitea (Settings → Actions → Secrets): `DEPLOY_SSH_KEY` (приватный ключ `tgit-cd@gitea`), `DEPLOY_HOST` (`tgit-deploy@72.56.247.166`).
+
+## Руками
+
+```bash
+DEPLOY_SSH_OPTS="-F /dev/null -i ~/.ssh/tgit_ci_deploy -o IdentitiesOnly=yes" infra/deploy/deploy.sh dev HEAD
+```
+
+Другой сервер: `DEPLOY_HOST=user@host`, на нём — Docker, пользователь в группе `docker`, `/srv/tgit/<env>/.env`.
+
+## Проверить
+
+```bash
+ssh tgit-deploy@72.56.247.166 'cat /srv/tgit/dev/REVISION; docker ps --filter name=tgit-dev; docker logs --tail 20 tgit-dev-bot-1'
+```
+
+## Откат
+
+Ошибка health при деплое печатает команду; руками:
+
+```bash
+ssh tgit-deploy@72.56.247.166
+cd /srv/tgit/dev && rm -rf app && mv app.old app && cd app && docker compose -p tgit-dev up -d --build
+```
+
+## Завести prod
+
+Нужен **отдельный токен бота** (один токен — один процесс polling): создать бота у @BotFather →
+`/srv/tgit/prod/.env` по образцу dev (`TELEGRAM_BOT_TOKEN`, `ADMIN_IDS`, `POSTGRES_PASSWORD`, `GIT_UPLOADS_URL`,
+`GIT_SSH_KEY_B64`, `TELEGRAM_PROXY_URL`, `LLM_PROVIDER`). Пока файла нет, деплой `main` пропускается.

infra/deploy/deploy.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Deploy a git ref of the bot to a server. Used by hand and by CD (.gitea/workflows/deploy.yml).
+#   infra/deploy/deploy.sh <dev|prod> [git-ref]      default ref: HEAD
+# Env: DEPLOY_HOST  (default tgit-deploy@72.56.247.166 — the vobot host; any Docker host works)
+#      DEPLOY_SSH_OPTS (extra ssh/scp options, e.g. -i key)
+# Server layout: /srv/tgit/<env>/{.env, app/, app.old/, REVISION}; secrets live only in /srv/tgit/<env>/.env.
+# The host drops some ssh connections — every remote step is retried, and each one is safe to repeat.
+set -euo pipefail
+ENV=${1:?usage: deploy.sh <dev|prod> [ref]}
+REF=${2:-HEAD}
+case "$ENV" in dev | prod) ;; *) echo "env must be dev or prod" >&2; exit 2 ;; esac
+HOST=${DEPLOY_HOST:-tgit-deploy@72.56.247.166}
+OPTS=${DEPLOY_SSH_OPTS:-}
+DIR=/srv/tgit/$ENV
+SHA=$(git rev-parse --short "$REF")
+TGZ=$(mktemp --suffix=.tgz)
+trap 'rm -f "$TGZ"' EXIT
+git archive --format=tar.gz -o "$TGZ" "$REF"
+
+retry() { local n=0; until "$@"; do n=$((n + 1)); [ $n -ge 5 ] && return 1; echo "retry $n: $1" >&2; sleep $((n * 5)); done; }
+
+# shellcheck disable=SC2086
+if ! retry ssh $OPTS "$HOST" "test -f $DIR/.env"; then
+  echo "::notice::$HOST:$DIR/.env not found — environment '$ENV' is not configured, skipping deploy"
+  exit 0
+fi
+
+echo "deploy $REF ($SHA) -> $HOST:$DIR"
+# shellcheck disable=SC2086
+retry scp -q $OPTS "$TGZ" "$HOST:$DIR/release-$SHA.tgz"
+# shellcheck disable=SC2086
+retry scp -q $OPTS infra/deploy/remote.sh "$HOST:$DIR/remote.sh"
+# shellcheck disable=SC2086
+retry ssh $OPTS "$HOST" "bash $DIR/remote.sh $ENV $SHA"

infra/deploy/remote.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Runs on the server: unpack release-<sha>.tgz, swap app/ atomically, compose up, wait for healthy.
+#   bash /srv/tgit/<env>/remote.sh <env> <sha>        (uploaded by deploy.sh; safe to re-run)
+set -euo pipefail
+ENV=$1
+SHA=$2
+DIR=/srv/tgit/$ENV
+PROJECT=tgit-$ENV
+cd "$DIR"
+
+if [ -f "release-$SHA.tgz" ]; then
+  rm -rf app.new && mkdir app.new && tar -xzf "release-$SHA.tgz" -C app.new && rm -f "release-$SHA.tgz"
+  cp .env app.new/.env
+  rm -rf app.old
+  [ -d app ] && mv app app.old
+  mv app.new app
+fi
+
+cd app
+docker compose -p "$PROJECT" up -d --build --remove-orphans </dev/null
+
+status=""
+for _ in $(seq 1 40); do
+  status=$(docker inspect -f '{{.State.Health.Status}}' "$PROJECT-bot-1" 2>/dev/null || true)
+  [ "$status" = healthy ] && break
+  sleep 3
+done
+if [ "$status" != healthy ]; then
+  echo "bot is '$status' after 2 min — last logs:" >&2
+  docker logs --tail 50 "$PROJECT-bot-1" >&2 || true
+  echo "rollback: cd $DIR && rm -rf app && mv app.old app && cd app && docker compose -p $PROJECT up -d --build" >&2
+  exit 1
+fi
+echo "$SHA" > ../REVISION
+docker image prune -f >/dev/null
+echo "bot healthy @ $SHA ($ENV)"

pyproject.toml

@@ -14,6 +14,7 @@ dependencies = [
     "pyyaml>=6.0",
     "regex>=2024.7",
     "segno>=1.6",
+    "aiohttp-socks>=0.9",
 ]
 
 [dependency-groups]
@@ -42,6 +43,8 @@ extend-exclude = [".claude", "docs"]
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "B", "UP", "SIM", "ASYNC", "RUF"]
+# Russian UI texts, commit messages and comments are normal here, not homoglyph attacks
+ignore = ["RUF001", "RUF002", "RUF003"]
 
 [tool.mypy]
 python_version = "3.12"

tests/bot/test_commit_push.py

@@ -0,0 +1,92 @@
+from pathlib import Path
+
+import pytest
+from aiogram.methods import EditMessageText, SendMessage
+from aiogram.types import InlineKeyboardMarkup
+
+from app.access.service import AccessService
+from app.bot.routers.commit import Act, CommitCb
+from app.db.session import SessionMaker
+from app.main import build_dispatcher
+from app.repo.git import UploadsRepo
+from app.texts import Texts
+from tests.conftest import ADMIN, git
+from tests.fakes import TgClient
+
+
+@pytest.fixture
+def tg(texts: Texts, sessions: SessionMaker, access: AccessService, repo: UploadsRepo) -> TgClient:
+    return TgClient(build_dispatcher(texts, sessions, access, repo, "https://example.test/commit/{sha}"))
+
+
+def cb(action: Act, i: int = 0) -> str:
+    return CommitCb(a=action, i=i).pack()
+
+
+def labels(markup: object) -> list[str]:
+    assert isinstance(markup, InlineKeyboardMarkup)
+    return [b.text for row in markup.inline_keyboard for b in row]
+
+
+async def test_message_then_push_lands_in_remote(tg: TgClient, texts: Texts, remote: Path, tmp_path: Path) -> None:
+    t = texts.commit
+    await tg.send(ADMIN, texts.menu.commit)
+    await tg.press(ADMIN, cb(Act.NEW_FILE))
+    await tg.send(ADMIN, "notes.txt")
+    await tg.send(ADMIN, "привет из телеграма")
+    await tg.press(ADMIN, cb(Act.DRAFT))
+    draft = tg.session.sent(EditMessageText)[-1]
+    assert t.message_missing in draft.text and t.push_button not in labels(draft.reply_markup)
+
+    await tg.press(ADMIN, cb(Act.MESSAGE))
+    await tg.send(ADMIN, "x" * 80)  # first line too long
+    assert tg.session.sent(SendMessage)[-1].text == t.bad_message
+    await tg.send(ADMIN, "docs: заметки")
+    with_message = tg.session.sent(SendMessage)[-1]
+    assert t.message_current.format(message="docs: заметки") in with_message.text
+    assert t.push_button in labels(with_message.reply_markup)
+
+    await tg.press(ADMIN, cb(Act.PUSH))
+    assert tg.session.sent(EditMessageText)[-1].text.startswith("Запушить в main?")
+    await tg.press(ADMIN, cb(Act.PUSH_GO))
+
+    pushing, done = tg.session.sent(EditMessageText)[-2:]
+    assert pushing.text == t.pushing
+    assert done.text.startswith("✅ Запушено: ") and "docs: заметки" in done.text
+    assert "https://example.test/commit/" in done.text and done.text.endswith(t.ci_pending)
+
+    clone = tmp_path / "verify"
+    git(tmp_path, "clone", "-q", str(remote), str(clone))
+    assert (clone / "notes.txt").read_text(encoding="utf-8") == "привет из телеграма"
+
+    # the draft is gone after a push
+    tg.session.requests.clear()
+    await tg.send(ADMIN, texts.menu.commit)
+    assert not any(label.startswith("🧾") for label in labels(tg.session.sent(SendMessage)[-1].reply_markup))
+
+
+async def test_commit_button_in_folder_asks_message_then_confirms(
+    tg: TgClient, texts: Texts, remote: Path, tmp_path: Path
+) -> None:
+    t = texts.commit
+    await tg.send(ADMIN, texts.menu.commit)
+    await tg.press(ADMIN, cb(Act.NEW_FILE))
+    await tg.send(ADMIN, "quick.txt")
+    await tg.send(ADMIN, "быстро")
+
+    folder = tg.session.sent(SendMessage)[-1]
+    assert t.commit_button.format(count=1) in labels(folder.reply_markup)
+
+    await tg.press(ADMIN, cb(Act.COMMIT))
+    assert tg.session.sent(EditMessageText)[-1].text == t.ask_message
+    await tg.send(ADMIN, "feat: быстрый коммит")
+
+    confirm = tg.session.sent(SendMessage)[-1]
+    assert confirm.text.startswith("Запушить в main?") and "feat: быстрый коммит" in confirm.text
+    assert labels(confirm.reply_markup) == [t.push_go, t.edit_message, texts.menu.back]
+
+    await tg.press(ADMIN, cb(Act.PUSH_GO))
+    assert tg.session.sent(EditMessageText)[-1].text.startswith("✅ Запушено: ")
+    clone = tmp_path / "verify2"
+    git(tmp_path, "clone", "-q", str(remote), str(clone))
+    assert (clone / "quick.txt").read_text(encoding="utf-8") == "быстро"

tests/repo/test_git.py

@@ -83,3 +83,14 @@ async def test_unreachable_remote(tmp_path: Path) -> None:
     broken = UploadsRepo(GitSettings(uploads_url=str(tmp_path / "missing.git"), clone_dir=tmp_path / "c3"))
     with pytest.raises(GitError, match="clone"):
         await broken.refresh()
+
+
+async def test_relative_clone_dir(remote: Path, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    from app.config import GitSettings
+
+    monkeypatch.chdir(tmp_path)
+    relative = UploadsRepo(GitSettings(uploads_url=str(remote), clone_dir=Path("data/uploads")))
+    await relative.refresh()
+
+    assert (tmp_path / "data" / "uploads" / ".git").is_dir()
+    assert "README.md" in [e.name for e in await relative.list_dir()]

tests/repo/test_publisher.py

@@ -0,0 +1,143 @@
+from datetime import timedelta
+from pathlib import Path
+
+import pytest
+from sqlalchemy import select
+
+from app.access.service import AccessService
+from app.db.models import ChangeOp, Push, User, utcnow
+from app.db.session import SessionMaker
+from app.repo.drafts import Change, DraftView
+from app.repo.git import UploadsRepo
+from app.repo.publisher import PUSHES_PER_HOUR, Publisher, PushStatus
+from tests.conftest import ADMIN, git
+
+
+@pytest.fixture
+async def member(access: AccessService) -> User:
+    user = await access.get_member(ADMIN)
+    assert user is not None
+    return user
+
+
+def remote_log(remote: Path, tmp_path: Path, name: str = "check") -> tuple[Path, str]:
+    clone = tmp_path / name
+    git(tmp_path, "clone", "-q", str(remote), str(clone))
+    return clone, git(clone, "log", "-1", "--format=%an <%ae>%n%B")
+
+
+def foreign_commit(remote: Path, tmp_path: Path, path: str, text: str, name: str) -> None:
+    other = tmp_path / name
+    git(tmp_path, "clone", "-q", str(remote), str(other))
+    target = other / path
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(text, encoding="utf-8")
+    git(other, "add", "-A")
+    git(other, "commit", "-q", "-m", f"foreign {path}")
+    git(other, "push", "-q", "origin", "main")
+
+
+async def draft_on(repo: UploadsRepo, *changes: Change) -> DraftView:
+    await repo.refresh(force=True)
+    return DraftView(base_sha=await repo.head(), message=None, changes=list(changes))
+
+
+async def test_push_applies_changes_with_trailer(
+    repo: UploadsRepo, sessions: SessionMaker, member: User, remote: Path, tmp_path: Path
+) -> None:
+    draft = await draft_on(
+        repo,
+        Change("services/hello/utils.py", ChangeOp.ADD, b"X = 1\n"),
+        Change("services/hello/main.py", ChangeOp.MODIFY, b"print('v2')\n"),
+        Change("docs/logo.bin", ChangeOp.DELETE, None),
+        Change("docs/мои заметки.md", ChangeOp.DELETE, None),
+    )
+    publisher = Publisher(repo, sessions)
+
+    result = await publisher.push(member, draft, "feat: v2\n\nподробности")
+
+    assert result.status is PushStatus.OK and result.sha is not None
+    clone, log = remote_log(remote, tmp_path)
+    assert log.startswith("tgit-bot <tgit-bot@users.noreply.tgit>\nfeat: v2\n\nподробности\n\nTelegram-User: ")
+    assert f"({ADMIN})" in log
+    assert (clone / "services/hello/utils.py").read_text() == "X = 1\n"
+    assert (clone / "services/hello/main.py").read_text() == "print('v2')\n"
+    assert not (clone / "docs").exists()  # both files gone → the folder is gone too
+    assert git(clone, "rev-parse", "HEAD").strip() == result.sha
+
+
+async def test_nothing_to_commit(repo: UploadsRepo, sessions: SessionMaker, member: User) -> None:
+    draft = await draft_on(repo, Change("README.md", ChangeOp.MODIFY, b"# uploads\n"))
+
+    assert (await Publisher(repo, sessions).push(member, draft, "noop")).status is PushStatus.EMPTY
+
+
+async def test_conflict_then_overwrite(
+    repo: UploadsRepo, sessions: SessionMaker, member: User, remote: Path, tmp_path: Path
+) -> None:
+    draft = await draft_on(repo, Change("README.md", ChangeOp.MODIFY, b"mine\n"))
+    foreign_commit(remote, tmp_path, "README.md", "theirs\n", "other")
+    publisher = Publisher(repo, sessions)
+
+    conflict = await publisher.push(member, draft, "edit readme")
+    assert conflict.status is PushStatus.CONFLICT and conflict.conflicts == ["README.md"]
+
+    forced = await publisher.push(member, draft, "edit readme", overwrite=True)
+    assert forced.status is PushStatus.OK
+    clone, _ = remote_log(remote, tmp_path)
+    assert (clone / "README.md").read_text() == "mine\n"
+
+
+async def test_unrelated_change_in_main_is_not_a_conflict(
+    repo: UploadsRepo, sessions: SessionMaker, member: User, remote: Path, tmp_path: Path
+) -> None:
+    draft = await draft_on(repo, Change("a.txt", ChangeOp.ADD, b"a"))
+    foreign_commit(remote, tmp_path, "b.txt", "b", "other")
+
+    assert (await Publisher(repo, sessions).push(member, draft, "add a")).status is PushStatus.OK
+    clone, _ = remote_log(remote, tmp_path)
+    assert (clone / "a.txt").exists() and (clone / "b.txt").exists()
+
+
+async def test_rejected_push_is_rebased(
+    repo: UploadsRepo, sessions: SessionMaker, member: User, remote: Path, tmp_path: Path
+) -> None:
+    raced = False
+
+    async def someone_pushes_first() -> None:
+        nonlocal raced
+        if not raced:
+            raced = True
+            foreign_commit(remote, tmp_path, "race.txt", "r", "racer")
+
+    draft = await draft_on(repo, Change("mine.txt", ChangeOp.ADD, b"m"))
+    result = await Publisher(repo, sessions, before_push=someone_pushes_first).push(member, draft, "add mine")
+
+    assert result.status is PushStatus.OK and raced
+    clone, log = remote_log(remote, tmp_path)
+    assert "add mine" in log and (clone / "race.txt").exists() and (clone / "mine.txt").exists()
+
+
+async def test_path_escape_is_refused(repo: UploadsRepo, sessions: SessionMaker, member: User, tmp_path: Path) -> None:
+    draft = await draft_on(repo, Change("../evil.txt", ChangeOp.ADD, b"x"))
+
+    assert (await Publisher(repo, sessions).push(member, draft, "evil")).status is PushStatus.FAILED
+    assert not (tmp_path / "evil.txt").exists()
+
+
+async def test_rate_limit_and_record(repo: UploadsRepo, sessions: SessionMaker, member: User) -> None:
+    publisher = Publisher(repo, sessions)
+    draft = await draft_on(repo, Change("x.txt", ChangeOp.ADD, b"x"))
+    result = await publisher.push(member, draft, "x")
+    await publisher.record(member, result, "x", draft, chat_id=ADMIN, message_id=77)
+
+    async with sessions() as s:
+        push = await s.scalar(select(Push))
+        assert push is not None and push.sha == result.sha and push.paths == ["x.txt"] and push.message_id == 77
+        for i in range(PUSHES_PER_HOUR):
+            s.add(
+                Push(user_id=ADMIN, sha=f"{i:040d}", message="m", chat_id=1, created_at=utcnow() - timedelta(minutes=1))
+            )
+        await s.commit()
+
+    assert (await publisher.push(member, draft, "y")).status is PushStatus.LIMIT

uv.lock

@@ -74,6 +74,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/68/30/173960c42b05a6c59f7558e4b12a4b0d9ba376cf6aa9bde7f9e08a30ca8d/aiohttp-3.14.5-py3-none-any.whl", hash = "sha256:efc21a454892828368b11c2c780de0ff8bc991f73f6b99c6b66e56205470929b", size = 279517, upload-time = "2026-10-11T01:05:08.523Z" },
 ]
 
+[[package]]
+name = "aiohttp-socks"
+version = "0.12.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "aiohttp" },
+    { name = "python-socks" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/18/1d/a306e0111222180e60f17131a3f5d9bc694dd999a8115959a7dd76c2238e/aiohttp_socks-0.12.0.tar.gz", hash = "sha256:3caf9f5a4164611122d412bc11b2f9114fd29c85e1ba27bb38060d3c236bdc8d", size = 12061, upload-time = "2026-08-12T04:43:15.791Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/86/64/ca6289632020523ea1841f01363f83ada10eeb0f21dd931fc1118dd85668/aiohttp_socks-0.12.0-py3-none-any.whl", hash = "sha256:ba6f95ec775c761d87f8578ab48f137d0457c676da104984202bf75e747d5ee6", size = 10693, upload-time = "2026-08-12T04:43:14.524Z" },
+]
+
 [[package]]
 name = "aiosignal"
 version = "1.4.0"
@@ -642,6 +655,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/60/d1/38f3a3405989a89ac18390803e70c6ad7c7760da4f9b83cbeca0c44a0c72/python_dotenv-1.2.4-py3-none-any.whl", hash = "sha256:42269a8a5b3fd54ffa6f3d84b18abed50064717576b4ecf03dc4a55d8aa04fdc", size = 23266, upload-time = "2026-10-01T05:36:08.633Z" },
 ]
 
+[[package]]
+name = "python-socks"
+version = "3.1.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/04/ad/484ffb79532517b11a90af38647c38652224650b31a7ae1cedd5a418d8ab/python_socks-3.1.1.tar.gz", hash = "sha256:8d3e817cdbe858dc0bb8c8fdc8e79b6ce37acce110d33374c6f57a675cc9029e", size = 232781, upload-time = "2026-09-08T13:03:31.058Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/3b/23/2c2cef1b4313c55d1713201acd4ee2043fb2cf22e546ca9d36bf4317faea/python_socks-3.1.1-py3-none-any.whl", hash = "sha256:327e0d6378702c73a7790bf732e9f01392f17b48c7348a50b5bd1f710c2df1be", size = 49566, upload-time = "2026-09-08T13:03:29.604Z" },
+]
+
 [[package]]
 name = "pyyaml"
 version = "6.0.3"
@@ -763,6 +785,7 @@ version = "0.1.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiogram" },
+    { name = "aiohttp-socks" },
     { name = "alembic" },
     { name = "asyncpg" },
     { name = "httpx" },
@@ -789,6 +812,7 @@ dev = [
 [package.metadata]
 requires-dist = [
     { name = "aiogram", specifier = ">=3.13" },
+    { name = "aiohttp-socks", specifier = ">=0.9" },
     { name = "alembic", specifier = ">=1.13" },
     { name = "asyncpg", specifier = ">=0.29" },
     { name = "httpx", specifier = ">=0.27" },