Harden CI and switch release builds to tagged immutable images

.forgejo/workflows/build.yml

@@ -1,25 +1,34 @@
-name: Automated Container Build
+name: Container release
 
 on:
   push:
-    branches:
-      - main
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
 
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-
-      - name: Log into Local Registry
+      - uses: actions/checkout@v4
+      - name: Log into local registry
+        run: echo "${{ secrets.FORGEJO_PAT }}" | docker login git.elijahkuntz.com -u "${{ github.actor }}" --password-stdin
+      - name: Build and publish immutable release
+        env:
+          REPOSITORY: ${{ github.repository }}
+          REVISION: ${{ github.sha }}
+          TAG: ${{ github.ref_name }}
         run: |
-          echo "${{ secrets.FORGEJO_PAT }}" | docker login git.elijahkuntz.com -u "${{ gitea.actor }}" --password-stdin
-
-      - name: Build and Push Image
-        run: |
-          # Force the entire image path string to lowercase dynamically
-          IMAGE_PATH=$(echo "git.elijahkuntz.com/${{ gitea.actor }}/${{ github.event.repository.name }}:latest" | tr '[:upper:]' '[:lower:]')
-          
-          docker build -t "$IMAGE_PATH" .
-          docker push "$IMAGE_PATH"
+          IMAGE_PATH="git.elijahkuntz.com/$(echo "$REPOSITORY" | tr '[:upper:]' '[:lower:]')"
+          docker build \
+            --build-arg VERSION="$TAG+$REVISION" \
+            --label org.opencontainers.image.revision="$REVISION" \
+            --label org.opencontainers.image.version="$TAG" \
+            -t "$IMAGE_PATH:$TAG" \
+            -t "$IMAGE_PATH:sha-$REVISION" \
+            -t "$IMAGE_PATH:latest" .
+          docker push "$IMAGE_PATH:$TAG"
+          docker push "$IMAGE_PATH:sha-$REVISION"
+          docker push "$IMAGE_PATH:latest"

.forgejo/workflows/ci.yml

@@ -6,66 +6,62 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   backend:
-    name: Backend (Python)
+    name: Backend
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v4
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+      - uses: actions/setup-go@v5
         with:
-          python-version: "3.12"
-
-      - name: Install dependencies
-        working-directory: backend
-        run: |
-          pip install -e ".[dev]"
-
-      - name: Lint (ruff)
-        working-directory: backend
-        run: ruff check .
-
-      - name: Type check (mypy)
-        working-directory: backend
-        run: mypy app/
-
-      - name: Test (pytest)
-        working-directory: backend
-        run: pytest --tb=short -q
-        env:
-          PAPERJET_DATABASE_PATH: ./test.sqlite
-          PAPERJET_PDF_STORAGE_PATH: ./test_pdfs
-          PAPERJET_THUMBNAILS_PATH: ./test_thumbs
+          go-version: "1.26.x"
+          cache: true
+      - name: Formatting
+        run: test -z "$(gofmt -l cmd internal)"
+      - name: Vet
+        run: go vet ./cmd/... ./internal/...
+      - name: Unit and architecture tests
+        run: go test -race ./cmd/... ./internal/...
 
   frontend:
-    name: Frontend (TypeScript)
+    name: Frontend
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v4
-
-      - name: Set up Node.js 22
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
       - name: Install dependencies
-        working-directory: frontend
-        run: npm ci
+        run: npm --prefix web ci
+      - name: Lint, typecheck, and test
+        run: npm --prefix web run check
+      - name: Production build
+        run: npm --prefix web run build
 
-      - name: Lint (eslint)
-        working-directory: frontend
-        run: npm run lint
+  contracts:
+    name: Contracts and repository policy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate OpenAPI
+        uses: docker://redocly/cli:1.34.5
+        with:
+          args: lint api/openapi.yaml
+      - name: Reject committed secrets and local data
+        run: |
+          test ! -e .env
+          test ! -d .data
 
-      - name: Type check (tsc)
-        working-directory: frontend
-        run: npx tsc -b
-
-      - name: Test (vitest)
-        working-directory: frontend
-        run: npx vitest run
+  container:
+    name: Container
+    runs-on: ubuntu-latest
+    needs: [backend, frontend, contracts]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build application image
+        run: docker build --build-arg VERSION=${{ github.sha }} -t drive-v2:${{ github.sha }} .