Harden CI and switch release builds to tagged immutable images

compose.yaml

@@ -0,0 +1,61 @@
+name: drive-v2
+
+services:
+  postgres:
+    image: postgres:18.4-bookworm
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-drive}
+      POSTGRES_USER: ${POSTGRES_USER:-drive}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-drive-development-only}
+      POSTGRES_INITDB_ARGS: --data-checksums
+    volumes:
+      - ./.data/postgres:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    networks: [drive-internal]
+
+  drive:
+    build:
+      context: .
+      args:
+        VERSION: ${DRIVE_VERSION:-dev}
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      DRIVE_HTTP_ADDRESS: :8080
+      DRIVE_WEB_ROOT: /app/web
+      DRIVE_STORAGE_ROOT: /storage/.drive
+      DRIVE_PREVIEW_CACHE_ROOT: /cache/previews
+      DRIVE_DATABASE_URL: postgres://${POSTGRES_USER:-drive}:${POSTGRES_PASSWORD:-drive-development-only}@postgres:5432/${POSTGRES_DB:-drive}?sslmode=disable
+      DRIVE_LOG_LEVEL: ${DRIVE_LOG_LEVEL:-info}
+    ports:
+      - "${DRIVE_HTTP_PORT:-8080}:8080"
+    volumes:
+      - ./.data/storage:/storage
+      - ./.data/config:/config
+      - ./.data/previews:/cache/previews
+    read_only: true
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    cap_drop: [ALL]
+    networks: [drive-internal]
+
+  verify:
+    profiles: [tools]
+    build:
+      context: .
+      target: verify
+    command: ["sh", "scripts/verify.sh"]
+
+networks:
+  drive-internal:
+    internal: true
+