bullet-train-co/bullet_train

This system is a multi-tenant SaaS application framework built on Rails 8.0, designed to provide a foundational structure for teams and user management. It features a comprehensive admin panel via Avo, a public-facing marketing interface, and a RESTful API v1 with OpenAPI documentation. The platform supports extensibility through a 'super scaffolding' system, integrates with Stripe for billing and Zapier for automation, and utilizes modern tooling including Webpacker, Stimulus, and Tailwind CSS.

25 changes.

The project upgraded to Rails 8.0 and 8.1, replacing the Sprockets asset pipeline with Propshaft and restructuring the repository for modern deployment workflows. Core authentication, authorization, and UI components were refactored to align with the Bullet Train framework, including the removal of custom Devise views and the adoption of modular concerns.

24 changes.

This period focused on establishing the core scaffolding system, introducing dedicated account and public controllers with super scaffolding support, and refactoring OAuth logic into shared integrations. Significant effort was also dedicated to building comprehensive test coverage, including factories, API validation, and system tests, while modernizing the JavaScript build pipeline with Webpacker and Stimulus.

23 changes.

This period focused on enhancing the platform's extensibility through super scaffolding support, dynamic view partials, and a new Zapier integration. It also modernized the development infrastructure by modularizing setup and configuration scripts, introducing Docker support, and establishing a comprehensive API v1 with OpenAPI documentation.

The shared account menu now renders a new 'Admin' link that directs users to the Avo admin panel. This link is visible only to users with the developer role, providing them with direct access to administrative tools from the main navigation.

app/views/account/shared/menu · high confidence

This change introduces the Avo admin panel by adding four new controller files (Invitations, Memberships, Teams, and Users) that inherit from Avo's base resource controller. These controllers enable standard Rails resource routing for the corresponding Avo resources, allowing administrators to manage these entities through the new Avo interface.

app/controllers/avo · high confidence

New shell scripts have been added to bin/docker and bin/docker-dev to manage the container lifecycle and initialization. The bin/docker-dev scripts (build, console, create, destroy, shell, start, stop) provide a workflow for building and interacting with a local development container, while the entrypoints in both directories configure jemalloc for performance and automatically run database migrations (db:prepare) when the Rails server or dev process starts.

bin/docker, bin/docker-dev · high confidence

A new shared views directory has been created at app/views/shared to hold reusable view components. This structural change allows for better organization of shared UI elements across the application.

app/views/shared · high confidence

This change introduces the foundational view templates for the API v1 endpoints, defining the JSON structure for Team, User, Membership, and Invitation resources via Jbuilder partials. It also adds the OpenAPI v3.1 specification file which documents these resources, including Bearer token authentication, pagination parameters, and automatic path generation for the listed models. Notably, the User serialization now includes team context (team\_id and team\_name) when the user acts as a platform agent, supporting OAuth2 clients like Zapier.

app/views/api · high confidence

The application now includes a basic Action Cable consumer configuration in \app/javascript/channels/consumer.js\, which initializes the WebSocket connection using \@rails/actioncable\. An \index.js\ file is also present to handle channel loading, though it currently contains a commented-out implementation due to compatibility issues with esbuild.

app/javascript/channels · high confidence

This change introduces a new Zapier integration that enables users to connect their teams and automate workflows involving Creative Concepts and Tangible Things. The integration provides OAuth2 authentication and exposes two triggers—'Creative Concept Created' and 'Tangible Thing Created'—which fire when new items are added via webhooks. It also includes two actions, 'Create Creative Concept' and 'Create Tangible Thing', allowing users to create these resources directly from Zaps. The entry includes the core Zapier app configuration, authentication logic, trigger and action definitions, and corresponding integration tests.

zapier · high confidence

This change adds the Avo resource definitions for Invitation, Membership, Team, and User, establishing the foundational structure for the new admin panel. These resources expose key fields such as email, name, roles, and time zones, and define the relationships between users, teams, and memberships, enabling administrators to view and manage these core entities through the Avo interface.

app/avo · high confidence

A new controller hierarchy for the public section of the application has been established. The \Public::ApplicationController\ sets the 'public' layout for all public pages, while the \Public::HomeController\ handles root navigation by redirecting to either a marketing site or the sign-in page, supports invitation-only sign-ups, and enables access to documentation at \/docs\.

app/controllers/public · high confidence

The account area now includes dedicated controllers for Dashboard, Invitations, Memberships, Teams, and Users, all inheriting from a new Application Controller. These controllers integrate with a 'super scaffolding' system, providing structured hooks (permitted\_fields, permitted\_arrays, process\_params) that allow developers to easily extend user, team, and membership attributes without modifying core logic. The Application Controller also introduces an onboarding enforcement mechanism to guide new users through setup steps.

app/controllers/account · high confidence

A new shared menu partial (\_menu.html.erb) has been introduced to structure the account sidebar navigation. This component renders distinct sections for Teams, Integrations (conditionally including Stripe), Developers (including Webhooks), and Team settings, while also supporting an expanded view for user account items. The menu respects configuration flags to hide team resource menus, disable the developer menu, or suppress scaffolding-related items, ensuring the navigation adapts to the current application state and permissions.

app/views/account/shared · high confidence

A new public home page view has been added at app/views/public/home/index.html.erb, replacing previous implementations. The page features a centered layout using Tailwind CSS classes (e.g., h-screen, flex, grid) and includes a background fade effect. It displays the Bullet Train logo and version number, a welcome message with a link to documentation, and a primary 'Sign In' button. The view also integrates a scroll-reveal animation controller for visual effects on the logo and content card.

app/views/public · high confidence

A new 'builds' directory has been created in the assets folder, populated with a .keep file to ensure the directory is tracked by version control. This change appears to be a structural adjustment to the asset pipeline organization, likely preparing for future build artifacts or configuration.

app/assets/builds · low confidence

The user account view now includes dedicated partials to support dynamic field rendering and OAuth provider integration. A new \\_fields.html.erb\ partial has been added to allow new user model fields to be inserted into the account interface, while \\_oauth.html.erb\ renders the Stripe accounts index for the current user when Stripe is enabled, providing a structured location for additional OAuth providers.

app/views/account/users · high confidence

The application session key has been renamed from '\_shinkansen-app\_session' to '\_untitled\_application\_session' to reflect the application's new name. The asset pipeline has been updated to use Propshaft, with specific exclusions added for Avo, Cloudinary, Doorkeeper, and Bullet Train theme assets to prevent unnecessary files from being published during precompilation. Additionally, the API version is now explicitly set to 'v1' via the new api initializer.

config/initializers · high confidence

The monolithic \bin/configure\ script has been refactored into a suite of smaller, independent Ruby scripts within the \bin/configure-scripts\ directory. This change allows individual setup steps—such as checking Ruby and Yarn versions, renaming Git remotes, setting up GitHub, updating application configuration, and adding deploy buttons for Heroku or Render—to be executed in isolation. Users benefit from a more transparent and flexible setup experience, where specific configuration tasks can be reviewed or re-run without re-executing the entire process.

bin/configure-scripts · high confidence

A new directory structure for font assets has been established at app/assets/fonts, populated by moving the placeholder .keep file from test/fixtures. This change organizes font resources separately from test fixtures, ensuring a clearer separation of concerns for application assets.

app/assets/fonts · low confidence

This change introduces several new Rake tasks in the \lib/tasks\ directory to customize development and deployment workflows. The \action\_text:install\ and \stimulus:manifest:update\ tasks are overridden to skip execution by default, preventing redundant configuration and protecting custom manifest files, with the ability to force execution via the \--clobber\ flag. A new \aws:set\_cors\ task allows users to configure CORS permissions on their S3 bucket, while \auto\_generate\_diagram.rake\ ensures the \rails-erd\ tool correctly loads all Active Record models. Additionally, \coverage\_report.rake\ provides CI-friendly tasks to collate and format test coverage data, including specific grouping for Bullet Train core gems.

lib/tasks · high confidence

This update applies a comprehensive series of database migrations that establish the foundational schema and progressively refactor it. Initial changes introduce core entities such as Users, Teams, Memberships, and API Keys, alongside features like two-factor authentication, webhooks, and role-based access control. Subsequent migrations refactor the data model by migrating from simple boolean flags to a granular Role system, consolidating OAuth integrations via Doorkeeper, and replacing legacy storage fields with Rails Active Storage and Action Text. The schema also expands to support team-level time zones, user locales, and collaborative editing on Creative Concepts, while removing deprecated tables and columns to clean up the database structure.

db/migrate · high confidence

The database schema has been regenerated for Rails 8.1.3, introducing support for new core features and integrations. Users will now have access to tables for address management, Stripe integration installations, and bulk onboarding invitation lists. The schema also includes standard Rails 8 components such as Action Mailbox, Action Text, and Active Storage, alongside updated OAuth tables for improved access token handling. Additionally, the database seeding process has been enhanced to automatically configure a platform application for Zapier if the Zapier app is detected in the environment.

db · high confidence

The ApplicationHelper now includes the Helpers::Base module and defines a current\_theme method that returns :light. This ensures that the application defaults to the light theme and provides access to shared helper functionality.

app/helpers · high confidence

The application now includes dedicated seed scripts for the development, production, and test environments. These scripts provide immediate console feedback upon execution and, in the test environment, include a specific stub to verify the \seeding?\ state of ActiveRecord models when triggered via the \seed\_stub\ environment variable.

db/seeds · high confidence

The OAuth callback handling for the account area has been refactored to extract core logic into the \bullet\_train-integrations\ package. The local controller now inherits from the shared base and delegates specific provider handling (such as Stripe Connect) to the centralized callback method, allowing external packages to register OAuth providers automatically.

app/controllers/account/oauth · high confidence

The mailer stylesheet pipeline now uses a dedicated PostCSS configuration file that dynamically loads Tailwind CSS settings via a Ruby script. This setup explicitly includes postcss-css-variables to support CSS variables in email clients, despite their limited support, and utilizes tailwindcss/nesting for nested CSS syntax.

_postcss\_mailer\config · high confidence

The JavaScript build system has been updated to use Webpacker, replacing the previous asset pipeline configuration. The application now imports core functionality via the \@bullet-train/bullet-train\ npm package, including specific modules for sorting (\@bullet-train/bullet-train-sortable\) and Trix editor integration. Default Rails components like Active Storage and Turbo are explicitly imported, and legacy global jQuery definitions have been removed in favor of modern module imports.

app/javascript · high confidence

This change introduces new API v1 controllers for Invitations, Memberships, Teams, and Users, each inheriting from a shared base and including specific controller modules to handle request parameters. The previous Api::V1::AuthenticatedController, which handled HTTP basic authentication via API keys, has been removed. Instead, the Api::V1::ApplicationController now includes Api::Controllers::Base, centralizing authentication and base behavior for the new controllers.

app/controllers/api · high confidence

The Membership view templates (\_attributes.html.erb and \_fields.html.erb) now include specific comment markers that allow the super scaffolding system to dynamically insert new fields. This change enables future updates to add new attributes to the Membership model without requiring manual edits to these view partials, as the scaffolding tool will automatically place new inputs above the designated insertion points.

app/views/account/memberships · high confidence

The application has been upgraded to Rails 8.0, updating configuration defaults and enabling bootsnap for faster boot times. The application module and database names have been changed from 'ShinkansenApp' to 'UntitledApplication', and the database adapter now supports concurrent test runs via git worktree suffixes. Additionally, the Puma server configuration has been updated to use a dynamic thread pool, preload apps, and support Solid Queue, while the CI configuration now includes an Importmap vulnerability audit step.

config · high confidence

The public error pages (400, 404, 406, 422, 500) have been completely redesigned with a modern, responsive layout that supports dark mode, replacing the previous static dialog style. A new 406 Unsupported Browser page has been added to handle browser compatibility issues. Additionally, the robots.txt file has been updated to point to the current official documentation URL.

public · high confidence

The ApplicationMailer class has been refactored to include the Mailers::Base module, replacing the previous default configuration for the 'from' address and mailer layout. This change centralizes common mailer behavior and configuration within the Base module, potentially affecting how default sender addresses and layouts are applied to outgoing emails.

app/mailers · medium confidence

The \AuthenticatedController\ class has been removed, consolidating authentication logic into the \Controllers::Base\ concern included in \ApplicationController\. Authorization is now handled via a \current\_ability\ method in the ActionCable channel, and WebSocket connections now explicitly identify and validate the \current\_user\ via Warden. Additionally, CSRF protection in the application controller is configured to run first using \prepend: true\.

app/controllers · high confidence

The application layout has been restructured to extract head content into a partial (\\_head.html.erb\), replacing the previous monolithic \application.html.erb\. This change updates the meta tags to include \turbo-cache-control\ for Turbo compatibility, adds \mobile-web-app-capable\ support for iOS, and conditionally loads the Cloudinary widget and intl-tel-input utilities. The legacy \mailer.html.erb\ and \mailer.text.erb\ layouts have been removed.

app/views/layouts · high confidence

The authentication UI has been restructured to support modular, composable components. A new shared partial \\_oauth.html.erb\ was added to render OAuth provider buttons (such as Stripe) within a grid layout, allowing for easy integration of additional providers via scaffolding. Concurrently, several legacy Devise view files (\passwords/edit.html.erb\, \passwords/new.html.erb\, and \shared/\_links.html.erb\) were removed, indicating a shift away from the default Devise view structure toward this new componentized approach.

app/views/devise/shared · high confidence

The application's core models (User, Team, Membership, Invitation) and the permission system (Ability) have been refactored to use Bullet Train's modular concern structure. User authentication now relies on included concerns rather than explicit Devise module declarations, and the Ability class now dynamically parses roles from config/roles.yml via a 'permit' method. Additionally, the base ApplicationRecord now includes Records::Base by default, and new models for Address handling and Current request context have been introduced.

app/models · high confidence

The monolithic \bin/setup\ script has been replaced by a suite of independent, executable scripts in \bin/setup-scripts/\ (e.g., \brew\_bundle.rb\, \check\_postgres.rb\, \yarn\_install.rb\). This modularization allows the setup process to check for and install specific dependencies—such as Homebrew packages, PostgreSQL, Redis, Node.js, Yarn, and image processing tools—separately. The new structure also introduces more granular control, allowing users to skip optional checks (like \icu4c\ if \bullet\_train-conversations\ is absent) and enabling non-breaking behavior when services like Redis or PostgreSQL are not immediately available.

bin/setup-scripts · high confidence

The Sprockets asset manifest file (manifest.js) has been deleted, indicating that the application is no longer using the Sprockets asset pipeline for managing JavaScript and CSS assets. This change aligns with the migration to Propshaft, which handles asset serving differently and does not require this explicit manifest configuration.

app/assets/config · high confidence

The application no longer uses custom HTML templates for Devise authentication emails. Specifically, the views for confirmation instructions, password change notifications, reset password instructions, and account unlock instructions have been deleted. Users will now receive the default Devise email formats for these actions instead of the previously customized versions.

app/views/devise/mailer · high confidence

The custom login page template for Devise sessions has been removed from the application. Users will now see the default Devise login interface instead of the previous custom form that included email, password, and remember-me fields.

app/views/devise/sessions · high confidence

The application has removed the legacy Sprockets JavaScript manifest (application.js) and the Action Cable client configuration (cable.js). This indicates a migration away from the traditional Rails asset pipeline and bundled WebSocket support, likely towards a modern JavaScript bundler or a different real-time communication strategy. Additionally, the ApplicationJob base class now includes commented-out examples for automatic retry on deadlocks and discarding on deserialization errors, serving as documentation for available job resilience patterns without enabling them by default.

app/assets/javascripts, app/jobs · high confidence

The application no longer uses custom views for the 'Resend confirmation instructions' and 'Resend unlock instructions' flows. The specific ERB templates for these Devise actions have been deleted, meaning users will now see the default Devise UI for these operations instead of the previously customized forms.

app/views/devise/confirmations, app/views/devise/unlocks · high confidence

The default ERB templates for the user sign-up and account-edit pages have been deleted from the application. This removes the built-in UI for registration and profile updates, indicating that these views are no longer served directly by this location and likely replaced by componentized or alternative implementations elsewhere in the codebase.

app/views/devise/registrations · high confidence

The repository has been restructured to support modern development and deployment workflows. This includes adding a production Dockerfile and a development-specific dev.Dockerfile, along with a .dockerignore file to optimize build contexts. Deployment configurations for Heroku (app.json) and Render (render.yaml) have been introduced to streamline one-click deployments. The project now specifies Ruby 4.0.3 and Node.js 24.15.0 via .ruby-version and .nvmrc files, and introduces a Brewfile for Homebrew dependency management. Additionally, new configuration files such as .standard.yml for code linting, .yarnrc.yml for Yarn settings, and .redocly.yaml for API documentation are included to standardize the development environment.

(repo-wide) · high confidence

The bin directory has been significantly restructured to improve modularity and developer experience. The monolithic \bin/setup\ and \bin/configure\ scripts have been split into smaller, independent sub-scripts (e.g., \bin/setup-scripts/\, \bin/configure-scripts/\) that handle specific tasks like dependency checks, database preparation, and GitHub integration. New automation tools have been added: \bin/bump-core\ for updating core gem and npm package versions (with GitHub Actions integration), \bin/secrets\ for generating environment-specific encrypted credentials, \bin/db\_schema\_check\ to prevent uncommitted schema changes, and \bin/set-ngrok-url\ to automatically update the base URL during local development. Additionally, \bin/dev\ now defaults to using \overmind\ if available, \bin/super-scaffold\ is deprecated in favor of the Rails generator, and legacy scripts like \bin/spring\, \bin/bundle\, and \bin/update\ have been removed to reduce overhead.

bin · high confidence

The JavaScript controllers entry point now initializes a Stimulus application that automatically loads local controllers while merging definitions from the @bullet-train/bullet-train, @bullet-train/fields, and @bullet-train/bullet-train-sortable packages. It registers global 'reveal' and 'scroll-reveal' controllers, initializes CableReady for real-time updates, and exposes the Stimulus application instance on the window object to enable browser console debugging of controller actions and lifecycle hooks.

app/javascript/controllers · high confidence

The application stylesheet now imports the theme's default styles via the $ThemeStylesheet postcss resolver instead of using the previous require\_tree directive. This change integrates the Bullet Train theme system, allowing users to customize styles by ejecting the theme's CSS locally or adding custom CSS in the designated section, which helps avoid merge conflicts during framework updates.

app/assets/stylesheets · high confidence

The team show page has been updated to display Creative Concepts associated with the team. This is achieved by rendering a new partial for Creative Concepts, which is conditionally included only if scaffolding features are not disabled. A placeholder comment has also been added to the team fields partial to support future field additions via the scaffolding system.

app/views/account/teams · high confidence

The development, production, and test environment configurations have been updated to reflect newer Rails conventions and Bullet Train-specific requirements. In development, code reloading is now controlled via \config.enable\_reloading\ instead of the deprecated \config.cache\_classes\, and new logging features like server timing, verbose query logs, and view annotation are enabled by default. Production settings now use \enable\_reloading = false\, serve static files conditionally based on the \RENDER\ environment variable, and support Postmark or Mailgun for email delivery. Test environment configurations now enable eager loading in CI, use \:rescuable\ exception handling, and integrate Capybara Lockstep middleware for improved system test stability. Additionally, webhook header namespaces and Active Storage service defaults (local, Amazon S3, or Cloudinary) are standardized across all environments.

config/environments · high confidence

A new file \lib/bullet\_train\_oauth\_scaffolder\_support.rb\ has been added to resolve a NameError that occurs when upgrading to Rails 7.2. Previously, requiring this file in \config/application.rb\ caused an uninitialized constant error because the file was empty or missing the module definition. The new file defines the \BulletTrainOauthScaffolderSupport\ module and includes utility methods like \any\_oauth\_enabled?\ to ensure smooth integration when generating OAuth providers via super scaffolding.

lib · high confidence

Added FactoryBot factory definitions for scaffolding test data; Added OpenAPI validation and API test base class; Added controller tests for the TangibleThings API resource; Added example factories for test data generation; Added integration tests for account controllers; Added mailer preview classes for Devise, User, and Webhook emails; Added model tests for user details, invitations, abilities, and Stripe webhooks; Added system test coverage for core application features; Added system test for device\_test migration script; Added system tests for super scaffolding scenarios; Added system tests for the Audit Logs gem; Added test coverage for API v1 Teams and Users controllers; Added test coverage for platform access tokens and application provisioning; Added test factories for outgoing webhook models; Added test factories for platform access tokens and applications; Added test factory for OAuth Stripe accounts; Added test factory for Scaffolding::AbsolutelyAbstract::CreativeConcept; Added test factory for StripeInstallation; Added test infrastructure scripts for Action Models and Audit Logs system tests; Added test support utilities and fixtures; Added tests for SuperSelectSupport concern; Added tests for application controller localization logic; Enhanced test infrastructure with coverage reporting and parallel execution support.

The project now includes a \package.json\ and \yarn.lock\ file, establishing the JavaScript dependency tree for the application. This setup pins core Bullet Train packages (\@bullet-train/bullet-train\, \@bullet-train/fields\, \@bullet-train/bullet-train-sortable\) to version 1.45.1, alongside essential frontend libraries such as Stimulus, Turbo, Tailwind CSS, and esbuild. It also configures Yarn 4.2.2 as the package manager and defines build scripts for asset compilation, ensuring the frontend tooling is ready for development and production builds.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• First survey — no prior run to compare against. CAI 51.

• Code Health 61
• Architecture 76
• Maturity 48
• Readiness 42
• Security 72
• Domain Modelling 100
• Accessibility 74

• 300 commits — 294 feature/other, 6 fixes

• (root) — 267 commits
• zapier/yarn.lock — 8 commits
• .github/workflows — 4 commits
• test/system — 4 commits
• app/views — 2 commits
• bin/dev — 2 commits
• db/migrate — 2 commits
• .circleci/checkout-and-link-core-repo — 1 commit
• app/assets — 1 commit
• app/models — 1 commit
• bin/configure-scripts — 1 commit
• bin/docker-dev — 1 commit
• bin/setup-scripts — 1 commit
• bin/theme — 1 commit
• config/application.rb — 1 commit
• config/environments — 1 commit
• config/initializers — 1 commit
• lib/tasks — 1 commit

• fix: Fix standardrb complaints (#2262)
• fix: Migration to fix mismatches between memberships.user_email and users.email (#2299)
• fix: Revert "Upgrade to Tailwind CSS v4. (#2362)" (#2377)
• fix: Temporary fix for the release process (#2197)
• fix: fix invitation test class names (#2165)
• fix: fix small SETUP_GITHUB issue (#2200)
• change: Add Brewfile and instructions for Homebrew (#2354)
• change: Add a Dockerfile and dev.Dockerfile that uses BT images (#2102)
• change: Add a system test for platform applications and the API. (#2337)
• change: Add aarch64-linux as a supported platform (#2129)
• change: Add graphviz for entity-relationship diagrams (#2386)
• change: Add webhook_secret column to webhooks_outgoing_endpoints table (#2088)
• change: Allow tests (and system tests) to run concurrently on different worktrees. (#2340)
• change: BT-Core version bump: - 1.25.0 (#2134)
• change: BT-Core version bump: - 1.25.1 (#2135)
• change: BT-Core version bump: - 1.26.0 (#2142)
• change: BT-Core version bump: - 1.26.1 (#2159)
• change: BT-Core version bump: - 1.27.0 (#2175)
• change: BT-Core version bump: - 1.28.0 (#2178)
• change: BT-Core version bump: - 1.29.0 (#2198)
• …and 280 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

bullet-train-co/bullet_train was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.