14 Commits

Author	SHA1	Message	Date
lerko	87270490de	fix(docker): non-root user, supply chain attestations, build cleanup ... BREAKING: Container now runs as UID 1000 (uptop) instead of root. Existing volumes with root-owned files need migration: docker run --rm -v <volume>:/data alpine chown -R 1000:1000 /data - Add uptop user (UID/GID 1000) with entrypoint writability check - Enable SBOM and provenance attestations for Docker Scout compliance - Prune dangling images and build cache after release builds	2026-06-01 11:46:05 -04:00
lerko	9a4a53f487	ci: sync README to Docker Hub on release ... Use peter-evans/dockerhub-description to push README.md as the Docker Hub repository overview after each image build.	2026-05-29 20:51:40 -04:00
lerko	38c7739995	fix(ci): use docker-builder runner for Docker image builds	2026-05-29 18:01:07 -04:00
lerko	5679dffffa	fix(ci): use internal Gitea URL for GoReleaser API calls	2026-05-29 17:26:57 -04:00
lerko	65406ce69c	fix(ci): install git and gcc for GoReleaser in release pipeline	2026-05-29 16:02:28 -04:00
lerko	2cd3dcddb4	chore: bump Go 1.24.4 → 1.26.3, Alpine 3.21 → 3.23 ... Go 1.24 EOL since Feb 2026. Fixes 33 stdlib vulns found by govulncheck (database/sql, os/exec, net/http). Gets Green Tea GC.	2026-05-26 20:12:43 -04:00
lerko	7d4ef1f594	fix(ci): remove explicit container, use sh shell ... Act runner is Alpine-based — container: directive breaks node-based actions (checkout, setup-go). Runner already has apk natively. Added shell: sh to all jobs since runner lacks bash.	2026-05-26 18:44:08 -04:00
lerko	f0ff87c0d0	fix(ci): rename GITEA_TOKEN to RELEASE_TOKEN ... Gitea reserves the GITEA_ prefix for repo action secrets.	2026-05-26 18:36:11 -04:00
lerko	5aab391b74	ci: overhaul pipeline — caching, GoReleaser, govulncheck ... - Add module + build cache to CI (was only caching go-build, not go/pkg/mod) - Declare explicit Alpine container instead of relying on runner image - Drop redundant go vet (already in golangci-lint) - Add govulncheck job for dependency CVE scanning - Add GoReleaser config for Gitea-native binary releases + checksums - Replace .github/workflows/docker.yml with .gitea/workflows/release.yml - Docker multiarch (amd64+arm64) via buildx in release workflow - Dockerfile: add --mount=type=cache for mod/build, add -trimpath	2026-05-26 18:24:19 -04:00
lerko	d038361320	ci: cache Go build artifacts between runs	2026-05-24 15:52:21 -04:00
lerko	26268bb6ef	fix(ci): install gcc for race detector support	2026-05-24 12:49:21 -04:00
lerko	5915e0ebe3	fix(ci): enable CGO for race detector, use lint-action v7	2026-05-24 12:45:28 -04:00
lerko	6d7ecc46eb	fix(ci): use sh instead of bash for runner compatibility	2026-05-24 12:42:49 -04:00
lerko	fb3f96f608	ci: add Gitea Actions pipeline for test and lint ... Runs on push to main and on pull requests. Two parallel jobs: - test: go vet + go test -race - lint: golangci-lint via official action	2026-05-23 22:02:26 -04:00