ci: docker images + release pipeline with dev/release tagging

[igun997]

Summary

CI that builds both binaries and publishes multi-arch container images, with :dev on master and semver tags on releases.

Tagging policy

Git event	Image tags
push/merge to master	dev, dev-<short-sha>
tag v0.0.1 (any 0.x.y)	0.0.1, 0.0, latest
tag v1.2.3	1.2.3, 1.2, 1, latest
pre-release v1.2.3-rc1	1.2.3-rc1 only

0.x gets no major-only tag — docker/metadata-action skips {{major}} for initial-development versions.

Images: ghcr.io/igun997/deploy-everything (server, entrypoint grpc-server, port 50051) and ghcr.io/igun997/deploy-everything-cli. Both distroless static, nonroot, linux/amd64 + linux/arm64, SBOM + provenance attestation. No secrets needed — built-in GITHUB_TOKEN.

Workflows

• .github/workflows/ci.yml (PRs): gofmt, go vet, build both binaries, go test, build both images without push, version smoke test
• .github/workflows/release.yml: verify → meta → images → binaries → release. Nothing publishes unless vet/build/test pass. Tag pushes also cross-compile linux/darwin (amd64+arm64) and windows/amd64 into tar.gz/zip + checksums.txt attached to a GitHub Release

Also included

• Dockerfile: one file, two final stages (server, cli), Go cross-compile from $BUILDPLATFORM so arm64 needs no QEMU emulation
• Makefile: build, build-cross, test, vet, fmt-check, docker, docker-cli, docker-buildx PUSH=1 — same ldflags as CI
• internal/version + version command on both binaries (Version/Commit/Date via -ldflags)
• Bug fix: .gitignore had a bare grpc-server pattern that matched the cmd/grpc-server/ directory, so the gRPC server entrypoint was never committed. Anchored the build-output patterns to repo root; cmd/grpc-server/main.go is now tracked. Without this, CI could not build the server.

Tested locally

• gofmt -l . clean, go vet ./... clean
• make build → both binaries, version prints injected metadata
• docker build both targets: server 20.9 MB, cli 8.74 MB; docker run --rm <img> version works
• docker buildx build --platform linux/amd64,linux/arm64 succeeds for the server target
• go test ./... with no .env present → integration tests skip, suite passes (matches CI environment)

Note: with a live .env locally, TestComposeFullStack fails on services.compose.updateSourceInline returning 400 ... "zodErrors":{"content":"Required"}. Pre-existing panel API mismatch, unrelated to this PR; it skips in CI.

Summary by CodeRabbit

• New Features

  • Added a gRPC server entry point with token authentication and service reflection.
  • Added a version command displaying version, commit, build date, and runtime details.
  • Added support for building server and CLI container images and cross-platform binaries.

• Release & Distribution

  • Added automated validation, multi-architecture container publishing, and release binary packaging.
  • Added container metadata, non-root runtime support, and documented usage instructions.

• Documentation

  • Expanded build, Docker, CI/CD, release, and versioning documentation.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c1d1fe5-a298-431e-8ccf-03ff1a0747d7

📥 Commits

Reviewing files that changed from the base of the PR and between 392f572 and 44a4374.

📒 Files selected for processing (10)

• .dockerignore
• .github/workflows/ci.yml
• .github/workflows/release.yml
• .gitignore
• Dockerfile
• Makefile
• README.md
• cmd/grpc-server/main.go
• cmd/version.go
• internal/version/version.go

---

📝 Walkthrough

Walkthrough

The change adds version metadata, a gRPC server executable, Makefile and Docker build targets, CI validation, multi-platform image publishing, release binary packaging, and related documentation.

Changes

Build and release pipeline

Layer / File(s)	Summary
Version metadata and executable entrypoints internal/version/version.go, cmd/version.go, cmd/grpc-server/main.go	Adds link-time build metadata, a Cobra version command, and a configured authenticated gRPC server entrypoint.
Local build and container targets Makefile, Dockerfile, .dockerignore, .gitignore	Adds host, cross-platform, and Docker build targets. The Dockerfile builds static server and CLI binaries and provides distroless runtime images.
Continuous integration validation .github/workflows/ci.yml	Adds formatting, vet, build, test, Docker build, and version smoke-test jobs for pull requests and manual runs.
Multi-platform release automation .github/workflows/release.yml	Adds metadata resolution, multi-architecture GHCR publishing, attested images, platform binary packages, checksums, and GitHub Releases.
Build and release documentation README.md	Documents version output, Makefile targets, Docker usage, CI/CD behavior, image tags, and release packaging.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant MetadataJob
  participant DockerBuild
  participant GHCR
  participant BinaryBuild
  participant ReleaseJob
  GitHubActions->>MetadataJob: resolve version, commit, and build date
  MetadataJob->>DockerBuild: provide build metadata
  DockerBuild->>GHCR: publish server and CLI images
  MetadataJob->>BinaryBuild: provide release metadata
  BinaryBuild-->>ReleaseJob: upload platform artifacts
  GHCR-->>ReleaseJob: provide published image details
  ReleaseJob->>ReleaseJob: generate checksums and release notes
  ReleaseJob-->>GitHubActions: publish GitHub Release

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/docker-images-release-pipeline

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}