2 Commits

Include renames

Author	SHA1	Message	Date
steveandClaude Opus 4.8	c59688c2a3	Address Gadfly review findings on build-image CI ... Workflow: - Pass untrusted github.ref_name/repository/sha/token via env instead of inline ${{ }} in run: blocks, closing a branch-name shell-injection vector. - Check out the exact triggering commit (fetch by SHA, branch fallback) so the sha-<short> tag matches what was built. - Guard the tag scheme: a non-main branch named/sanitized to "latest" can't clobber :latest, and an empty sanitized name falls back to branch-<sha>. - Build --tag flags as a bash array (no word-splitting), drop the comma-string round-trip, and check-then-create the buildx builder so a real failure isn't swallowed. Dockerfile: - GOWORK=off in the build stage (matches the Makefile convention). - npm ci uses a BuildKit cache mount. - Drop the stale issue-number reference in a comment. .dockerignore: - Add .env/.env.*, go.work/go.work.sum, web/.vite; drop nonexistent .github. Graded all findings in the gadfly store. Deferred/keep-as-is: token-in-clone-URL (Gitea masks the secret in logs), sanitization collisions across branch names (the sha-<short> tag is the collision-proof identifier), and registry build cache (current builds are fast). False positives: alpine ships wget (busybox); docker login is its own step. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi	2026-07-18 15:53:10 -04:00
steveandClaude Opus 4.8	c9c404aa01	Add Gitea Action to build and push the image for Komodo deploys ... Multi-stage Dockerfile builds the web bundle, embeds it into the static Go binary (CGO_ENABLED=0), and ships it in a minimal alpine runtime: non-root user, ca-certificates + tzdata, SQLite on a /data volume, healthcheck on /api/v1/healthz, OCI provenance labels. build-image.yml pushes to the Gitea registry on every branch push: * main -> :latest * any other branch -> :<branch-name> (sanitized to valid tag chars) * every build -> :sha-<short> (immutable, for pinning) A push to a PR branch covers the PR, so there is no separate pull_request trigger. README documents the image, tags, and a docker run / Komodo compose snippet. Modeled on mort's CI. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi	2026-07-18 15:35:15 -04:00