Harden CI and switch release builds to tagged immutable images

internal/adapters/postgres/doc.go

@@ -0,0 +1,2 @@
+// Package postgres contains PostgreSQL repository implementations generated from sqlc queries.
+package postgres

internal/adapters/storage/doc.go

@@ -0,0 +1,2 @@
+// Package storage is the only package permitted to access managed storage paths.
+package storage

internal/adapters/webassets/handler.go

@@ -0,0 +1,32 @@
+// Package webassets serves the compiled frontend without giving transport code filesystem access.
+package webassets
+
+import (
+	"io/fs"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+func New(root string) http.Handler {
+	files := os.DirFS(root)
+	fileServer := http.FileServer(http.FS(files))
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requested := strings.TrimPrefix(filepath.Clean(r.URL.Path), string(filepath.Separator))
+		if requested == "." {
+			requested = "index.html"
+		}
+		if _, err := fs.Stat(files, requested); err == nil {
+			fileServer.ServeHTTP(w, r)
+			return
+		}
+		if _, err := fs.Stat(files, "index.html"); err == nil {
+			r.URL.Path = "/"
+			fileServer.ServeHTTP(w, r)
+			return
+		}
+		http.Error(w, "Drive web assets are not built", http.StatusServiceUnavailable)
+	})
+}