Merge insight-front repository into the insight monorepo

[mitasovr]

Goal

Merge the constructorfabric/insight-front repository into the constructorfabric/insight monorepo under src/frontend/, preserving git history.

Why it's cheap

The monorepo already treats the frontend as a component: src/frontend/helm/ is a first-class subchart of the umbrella chart (image ghcr.io/constructorfabric/insight-front), and build-images.yml already accepts a frontend_tag via cross-repo workflow_dispatch from insight-front's docker.yml. Only the sources and CI need to move. There are no path collisions (src/frontend/ contains only helm/; the front repo has no helm/ dir) and no JS tooling in the monorepo to conflict with. API coupling is relative /api/* paths only — no shared types or codegen.

Plan

Phase 0 — preparation (insight-front)

• Freeze: merge or close the open PRs (Data quality: API to write and read test findings #160, ID Res: First-necessity endpoints #162, Connector: MS Entra #163, ID Res: Super users #164).
• Long-lived branches must be merged before cutover or carried over via cherry-pick afterwards.

Phase 1 — import history into src/frontend/

git clone https://github.com/constructorfabric/insight-front.git /tmp/front-merge
cd /tmp/front-merge && git filter-repo --to-subdirectory-filter src/frontend

cd insight && git checkout -b merge/insight-front
git remote add front /tmp/front-merge && git fetch front
git merge --allow-unrelated-histories front/main

Cleanup commit in the same PR (history keeps everything, working tree gets trimmed):

• drop src/frontend/{cypilot,.agents,.codex,.windsurf,.claude,.github} (duplicates the monorepo's cf-studio tooling); replace the near-empty front AGENTS.md/CLAUDE.md with a short src/frontend/AGENTS.md;
• drop dead eslint-plugin-local/ (compiled dist/ only, referenced nowhere);
• drop front's LICENSE/NOTICE/SECURITY.md (monorepo has its own).

⚠️ The merge PR must land as a merge commit, not squash — squashing destroys the imported history. Needs a temporary branch-protection exception / admin merge.

Phase 2 — CI/CD

1. New frontend-ci.yml (port of front's ci.yml: test / lint / typecheck / diff-coverage ≥80%) with paths: [src/frontend/**] and working-directory: src/frontend; its scripts/ci/*.py move to src/frontend/scripts/ci/.
2. build-images.yml: add frontend to the dorny/paths-filter set + a build job (context src/frontend). Keep the image name ghcr.io/constructorfabric/insight-front so charts, values, and environments stay untouched.
3. Simplify the release: remove the frontend_tag dispatch input and insight-front's dispatch-umbrella job; publish-chart bumps src/frontend/helm/Chart.yaml appVersion directly when the frontend filter fires — same as api-gateway/analytics/identity. Side benefits: closes the documented manual-frontend-tag-pinning gap (deployment DESIGN.md) and fixes the amd64-only image (front's build matrix is amd64+arm64).
4. Note: e2e-bronze-to-api, functional-k3s, openapi-specs have no path filters, so frontend PRs will trigger heavy backend e2e. Either accept or add path filters in a separate PR (they are required checks — handle carefully).

Phase 3 — dev ergonomics

• docker-compose.yml: FRONTEND_MODE=built/dev builds from src/frontend instead of a sibling clone; remove the "git clone insight-front" branch from deploy/compose/insight-init.sh.
• Optional: JS hooks in .pre-commit-config.yaml, a src/frontend/ rule in CODEOWNERS.
• Keep front's README as src/frontend/README.md, fix links; add a frontend section to the root README.

Phase 4 — cutover

1. Land the merge PR; verify the first push to main builds the frontend image and publish-chart bumps the umbrella with the frontend appVersion.
2. Transfer open issues (works within the org), incl. Silver identity: validate on real data #156/YouTrack: validate bronze on real data #157 (BFF auth), dbt parse broken on main: duplicate model name "to_class_people" after MS Entra merge (#363) + CI gap #195 (KPI trend badge), [FE-08] Migrate API layer to Analytics API spec (per-metric queries, Connector Manager, Identity Service) #68 (nginx non-root).
3. Archive insight-front (do not delete — monorepo specs reference insight-front#66); point its README to the monorepo.
4. Add the frontend CI jobs to the required checks on main.

Risks

• Merge-commit vs branch protection — agree with admins up front.
• Verify the Playwright container and ubuntu-24.04-arm runners work in the monorepo's CI.
• Unmerged frontend branches after cutover can only be carried over via cherry-pick.

Estimate

Phases 1–3 are one careful PR plus ~a day of CI debugging; cutover is ~an hour of admin work.

[aleksdotbar]

Things to keep in mind

1. Trigger build-images.yml for frontend-only changes

   • Add src/frontend/** to the workflow-level push.paths and pull_request.paths.
   • Adding it only to dorny/paths-filter is not enough.

2. Handle required checks carefully

   • A workflow filtered to src/frontend/** should not be a globally required check.
   • Prefer an always-running frontend workflow with conditional jobs and one aggregate Frontend CI result.

3. Grant GHCR access before cutover

   • Add constructorfabric/insight to the existing insight-front package under Manage Actions access with Write permission.
   • Test with a temporary tag first.

4. Fix the architecture wording

   • The current frontend workflow already builds amd64 and arm64.
   • Replace “fixes the amd64-only image” with “preserves the existing amd64+arm64 build.”

5. Define the image jobs explicitly

   • build-frontend-amd64
   • build-frontend-arm64
   • merge-frontend-manifest
   • Add the merged job to publish-chart.needs.
   • Keep the image name explicitly set to ghcr.io/constructorfabric/insight-front.

6. Clarify branch migration

   • Direct cherry-picks from the old repo may place files at the monorepo root.
   • Either merge branches before freeze, rewrite them with filter-repo, or port commits manually.

7. Decide what to do with old tags

   • Keep them in the archived repo, prefix them, or import only main.

8. Do not blindly delete src/frontend/.github

   • Review CODEOWNERS, prompts, agent config, and other repo-specific files first.

9. Add a canary release

   • Test GHCR permissions, both architectures, and Helm packaging before the first production release.

10. Disable the old release workflow at cutover

    • Prevent late pushes to insight-front from publishing images or dispatching chart releases.