The publish workflow only fired on push to main and on v* tags, which
meant the Dockerfile got no CI coverage at all until after it landed —
and the workflow could not be observed working before merging it.
PRs now run the same build with push disabled, amd64 only (the emulated
arm64 leg is the slow part and is not needed to prove the build works).
Login, SBOM, provenance and attestation are skipped when not publishing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The Docker setup built but never came up. Three separate blockers, each
found by running the full compose stack against a real Postgres:
- The runner stage hand-copied prisma/@prisma/dotenv, which misses the
CLI's transitive deps (valibot) and crash-looped the entrypoint. A
dedicated migrator stage now installs the CLI at the exact lockfile
version with its real dependency tree.
- Docker sets HOSTNAME to the container id and Next's standalone server
binds to it verbatim, so the app was unreachable on localhost inside
the container and the healthcheck could never pass. Pinned to 0.0.0.0.
- openssl was missing from the build stages but present at runtime, so
Prisma detected a different platform and tried to download a matching
query engine at boot, as an unprivileged user, into a root-owned
directory. Aligned openssl across every stage that touches Prisma.
Verified from a clean volume: migrations apply, both containers report
healthy, /api/health returns 200, and the app serves from the image.
Also:
- Publish multi-arch images to GHCR on push to main and on v* tags, with
an SBOM and a signed provenance attestation.
- Default compose to the published image; add a build override for
working on the app itself. Host port and image are configurable.
- Drop two unused dependencies: canvas (19MB of native node-canvas; the
pipeline uses @napi-rs/canvas) and multer (routes use formData()).
- Add a root .gitignore. There wasn't one, so a real .env was one
`git add .` away from being committed. Untrack .DS_Store.
- Rewrite the README around what the tool does and how to run it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
