Improvements

.dockerignore

@@ -0,0 +1,11 @@
+.git
+.github
+.idea
+.env
+.venv
+__pycache__
+*.py[cod]
+data
+logs
+tests
+*.log

.env-example

@@ -6,8 +6,19 @@ BOT_TOKEN=
 # Optional settings:
 # LOGS_CHAT_ID=
 # MAX_FILESIZE=52428800
-# OUTPUT_FOLDER=/tmp/yt-dlp-telegram
-# COOKIES_FILE=
+# WORKERS=2
+# MAX_QUEUE=200
+# UPLOAD_WORKERS=2
+# JOB_TIMEOUT_SECONDS=900
+# DEFAULT_LANGUAGE=en
+# DELETE_ORIGINAL=true
+# MEDIA_CACHE_ENABLED=true
+# DISK_CACHE_MAX_FILES=5
+# DISK_CACHE_TTL_SECONDS=300
+# FILE_ID_CACHE_MAX_ITEMS=500
+# FILE_ID_CACHE_TTL_DAYS=30
+# COOKIES_FILE=/app/data/cookies.txt
+# LOG_LEVEL=INFO
 YTDLP_JS_RUNTIMES=node
 YTDLP_REMOTE_COMPONENTS=ejs:github
 YTDLP_INSTAGRAM_IMPERSONATE=chrome

.gitattributes

@@ -0,0 +1,6 @@
+* text=auto
+*.sh text eol=lf
+Dockerfile text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.py text eol=lf

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,21 @@
+name: Bug report
+description: Report a reproducible problem
+body:
+  - type: textarea
+    attributes:
+      label: Description
+      description: What happened and what did you expect?
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Reproduction
+      description: Provide safe steps without tokens, cookies, private URLs, or chat data.
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: Version
+  - type: textarea
+    attributes:
+      label: Relevant redacted logs

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/pull_request_template.md

@@ -0,0 +1,11 @@
+## Summary
+
+## User-visible behavior
+
+## Compatibility and configuration
+
+## Verification
+
+- [ ] Tests added or updated
+- [ ] `ruff check`, `ruff format --check`, and `pytest` pass
+- [ ] No secrets, cookies, media, logs, or private chat data are included

.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: python -m pip install -r requirements-dev.txt
+      - run: python -m ruff check .
+      - run: python -m ruff format --check .
+      - run: python -m pytest
+
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: linkdownloaderbotforgroups:test

.gitignore

@@ -9,3 +9,7 @@ venv/
 
 # Runtime / cache
 data/
+logs/
+.pytest_cache/
+.ruff_cache/
+.idea/

CODE_OF_CONDUCT.md

@@ -0,0 +1,5 @@
+# Code of Conduct
+
+Be respectful, constructive, and patient. Harassment, discrimination, personal attacks, and publication of another person's private information are not acceptable. Maintainers may edit or remove abusive contributions and restrict participation when necessary.
+
+Report conduct concerns privately to the repository owner. Reports will be reviewed fairly and confidentially where possible.

CONTRIBUTING.md

@@ -0,0 +1,24 @@
+# Contributing
+
+Thank you for helping improve Link Downloader Bot for Telegram Groups.
+
+## Development workflow
+
+1. Fork the repository and create a focused branch.
+2. Install `requirements-dev.txt` in Python 3.11 or newer.
+3. Preserve the quiet automatic-download behavior unless the change is explicitly discussed.
+4. Add or update tests for behavior changes.
+5. Run:
+
+```bash
+python -m ruff check .
+python -m ruff format --check .
+python -m pytest
+docker build -t linkdownloaderbotforgroups:test .
+```
+
+Do not include bot tokens, cookies, downloaded media, logs, or real private chat data in issues or commits.
+
+## Pull requests
+
+Explain the user-visible effect, compatibility impact, tests performed, and any configuration changes. Keep unrelated refactoring separate. Security reports must follow `SECURITY.md` rather than a public issue.

Dockerfile

@@ -1,18 +1,57 @@
-FROM python:3.11-slim
+FROM python:3.12-slim
+
+ARG NODE_VERSION=24.18.0
 
 ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
     PIP_DISABLE_PIP_VERSION_CHECK=1 \
-    PIP_NO_CACHE_DIR=1
+    PIP_NO_CACHE_DIR=1 \
+    DATA_DIR=/app/data \
+    LOGS_DIR=/app/logs \
+    OUTPUT_FOLDER=/app/data/cache
 
 WORKDIR /app
 
-RUN apt-get update -y && apt-get install -y --no-install-recommends \
-      ffmpeg ca-certificates nodejs \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update -y; \
+    apt-get install -y --no-install-recommends ffmpeg ca-certificates gosu curl xz-utils; \
+    case "$(dpkg --print-architecture)" in \
+      amd64) node_arch='x64' ;; \
+      arm64) node_arch='arm64' ;; \
+      *) echo 'Unsupported architecture' >&2; exit 1 ;; \
+    esac; \
+    node_archive="node-v${NODE_VERSION}-linux-${node_arch}.tar.xz"; \
+    curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/${node_archive}"; \
+    curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt"; \
+    grep " ${node_archive}$" SHASUMS256.txt | sha256sum -c -; \
+    tar -xJf "$node_archive" -C /usr/local/bin --strip-components=2 "node-v${NODE_VERSION}-linux-${node_arch}/bin/node"; \
+    node --version; \
+    rm -f "$node_archive" SHASUMS256.txt; \
+    apt-get purge -y --auto-remove curl xz-utils; \
+    rm -rf /var/lib/apt/lists/*
 
 COPY requirements.txt /app/requirements.txt
-RUN pip install --no-cache-dir -r /app/requirements.txt
+RUN sed '/^yt-dlp/d' /app/requirements.txt > /tmp/requirements-base.txt \
+    && pip install --no-cache-dir -r /tmp/requirements-base.txt
+
+# The updater changes this argument to refresh yt-dlp without invalidating the
+# slower OS and stable Python dependency layers.
+ARG YTDLP_CACHEBUST=initial
+RUN echo "$YTDLP_CACHEBUST" >/tmp/ytdlp-cachebust \
+    && pip install --no-cache-dir --upgrade 'yt-dlp[default,curl-cffi]'
+
+COPY app /app/app
+COPY main.py config.py /app/
+COPY scripts/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+
+RUN groupadd --gid 10001 bot \
+    && useradd --uid 10001 --gid bot --no-create-home --home-dir /app bot \
+    && mkdir -p /app/data/cache /app/logs \
+    && chown -R bot:bot /app/data /app/logs
+
+RUN chmod 0755 /usr/local/bin/docker-entrypoint.sh
+
+ENV XDG_CACHE_HOME=/tmp/.cache
 
-# main.py is mounted from host by docker-compose (for easy editing)
-# config.py is mounted from host by docker-compose
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["python", "-u", "/app/main.py"]