Harden CI and switch release builds to tagged immutable images

Dockerfile

@@ -0,0 +1,49 @@
+# syntax=docker/dockerfile:1.7
+FROM golang:1.26-bookworm AS go-base
+WORKDIR /src
+
+FROM node:24-bookworm AS web-dependencies
+WORKDIR /src/web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+
+FROM web-dependencies AS web-build
+COPY web/ ./
+RUN npm run build
+
+FROM go-base AS backend-build
+ARG VERSION=dev
+COPY go.mod ./
+COPY cmd/ ./cmd/
+COPY internal/ ./internal/
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -o /out/drive ./cmd/drive
+
+FROM node:24-bookworm AS verify
+COPY --from=go-base /usr/local/go /usr/local/go
+ENV PATH="/usr/local/go/bin:${PATH}"
+WORKDIR /src
+COPY . .
+RUN npm --prefix web ci
+CMD ["sh", "scripts/verify.sh"]
+
+FROM debian:bookworm-slim AS runtime
+RUN apt-get update \
+    && apt-get install --no-install-recommends -y ca-certificates tini \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --gid 65532 drive \
+    && useradd --uid 65532 --gid drive --no-create-home --home-dir /nonexistent drive
+
+WORKDIR /app
+COPY --from=backend-build /out/drive /usr/local/bin/drive
+COPY --from=web-build /src/web/dist /app/web
+
+ENV DRIVE_HTTP_ADDRESS=:8080 \
+    DRIVE_WEB_ROOT=/app/web \
+    DRIVE_STORAGE_ROOT=/storage/.drive \
+    DRIVE_PREVIEW_CACHE_ROOT=/cache/previews
+
+USER 65532:65532
+EXPOSE 8080
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/drive"]
+CMD ["serve"]
+