Harden CI and switch release builds to tagged immutable images

.forgejo/workflows/ci.yml

@@ -6,66 +6,62 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   backend:
-    name: Backend (Python)
+    name: Backend
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v4
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+      - uses: actions/setup-go@v5
         with:
-          python-version: "3.12"
-
-      - name: Install dependencies
-        working-directory: backend
-        run: |
-          pip install -e ".[dev]"
-
-      - name: Lint (ruff)
-        working-directory: backend
-        run: ruff check .
-
-      - name: Type check (mypy)
-        working-directory: backend
-        run: mypy app/
-
-      - name: Test (pytest)
-        working-directory: backend
-        run: pytest --tb=short -q
-        env:
-          PAPERJET_DATABASE_PATH: ./test.sqlite
-          PAPERJET_PDF_STORAGE_PATH: ./test_pdfs
-          PAPERJET_THUMBNAILS_PATH: ./test_thumbs
+          go-version: "1.26.x"
+          cache: true
+      - name: Formatting
+        run: test -z "$(gofmt -l cmd internal)"
+      - name: Vet
+        run: go vet ./cmd/... ./internal/...
+      - name: Unit and architecture tests
+        run: go test -race ./cmd/... ./internal/...
 
   frontend:
-    name: Frontend (TypeScript)
+    name: Frontend
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v4
-
-      - name: Set up Node.js 22
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
       - name: Install dependencies
-        working-directory: frontend
-        run: npm ci
+        run: npm --prefix web ci
+      - name: Lint, typecheck, and test
+        run: npm --prefix web run check
+      - name: Production build
+        run: npm --prefix web run build
 
-      - name: Lint (eslint)
-        working-directory: frontend
-        run: npm run lint
+  contracts:
+    name: Contracts and repository policy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate OpenAPI
+        uses: docker://redocly/cli:1.34.5
+        with:
+          args: lint api/openapi.yaml
+      - name: Reject committed secrets and local data
+        run: |
+          test ! -e .env
+          test ! -d .data
 
-      - name: Type check (tsc)
-        working-directory: frontend
-        run: npx tsc -b
-
-      - name: Test (vitest)
-        working-directory: frontend
-        run: npx vitest run
+  container:
+    name: Container
+    runs-on: ubuntu-latest
+    needs: [backend, frontend, contracts]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build application image
+        run: docker build --build-arg VERSION=${{ github.sha }} -t drive-v2:${{ github.sha }} .