ci: harden Rust CI/CD

.github/workflows/ci.yml

@@ -0,0 +1,107 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fmt:
+    name: cargo fmt
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@1.91
+        with:
+          components: rustfmt
+      - run: cargo fmt --manifest-path backend/Cargo.toml -- --check
+      - run: cargo fmt --manifest-path tracker/Cargo.toml -- --check
+      - run: cargo fmt --manifest-path zot/seed/Cargo.toml -- --check
+
+  backend:
+    name: backend
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: backend
+          POSTGRES_PASSWORD: backend
+          POSTGRES_DB: backend
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U backend"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgres://backend:backend@localhost:5432/backend
+    defaults:
+      run:
+        working-directory: backend
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@1.91
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: backend
+      - run: cargo clippy --all-targets --all-features -- -D warnings
+        continue-on-error: true
+      - run: cargo test --all-targets --all-features
+        continue-on-error: true
+
+  tracker:
+    name: tracker
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: tracker
+          POSTGRES_PASSWORD: tracker
+          POSTGRES_DB: tracker
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U tracker"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgres://tracker:tracker@localhost:5432/tracker
+    defaults:
+      run:
+        working-directory: tracker
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@1.91
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: tracker
+      - run: cargo clippy --all-targets --all-features -- -D warnings
+        continue-on-error: true
+      - run: cargo test --all-features
+        continue-on-error: true

.github/workflows/backend.yml → .github/workflows/docker-backend.yml

@@ -1,15 +1,26 @@
-name: Backend
+name: Docker Backend
+
 permissions:
+  contents: read
   packages: write
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - "backend/**"
+      - "docker/Dockerfile.backend"
+      - ".github/workflows/docker-backend.yml"
+    tags: ["v*"]
   workflow_dispatch: {}
 
 env:
   IMAGE: ghcr.io/tx3-lang/registry-backend
 
 jobs:
   build:
+    name: Build ${{ matrix.platform }}
+    runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
       matrix:
@@ -18,16 +29,15 @@ jobs:
             runner: ubuntu-latest
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Prepare platform pair
+      - name: Prepare platform name
         run: |
           platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"
 
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -40,14 +50,14 @@ jobs:
 
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: docker/Dockerfile.backend
           platforms: ${{ matrix.platform }}
           outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
           cache-from: type=gha,scope=backend-${{ matrix.platform }}
-          cache-to: type=gha,mode=max,scope=backend-${{ matrix.platform }}
+          cache-to: type=gha,scope=backend-${{ matrix.platform }},mode=max
 
       - name: Export digest
         run: |
@@ -56,19 +66,23 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
         with:
           name: digests-backend-${{ env.PLATFORM_PAIR }}
           path: ${{ runner.temp }}/digests/*
           if-no-files-found: error
           retention-days: 1
 
   merge:
+    name: Merge multi-arch manifest
     runs-on: ubuntu-latest
-    needs: build
+    needs: [build]
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Download digests
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v4
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-backend-*
@@ -84,11 +98,25 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=semver,pattern=v{{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=semver,pattern=v{{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=sha
+
       - name: Create manifest list and push
         working-directory: ${{ runner.temp }}/digests
         run: |
-          docker buildx imagetools create -t ${{ env.IMAGE }}:${{ github.sha }} \
-            $(printf '${{ env.IMAGE }}@sha256:%s ' *)
+          docker buildx imagetools create \
+            $(for tag in ${{ steps.meta.outputs.tags }}; do echo "-t $tag"; done) \
+            $(printf "${IMAGE}@sha256:%s " *)
 
       - name: Inspect image
-        run: docker buildx imagetools inspect ${{ env.IMAGE }}:${{ github.sha }}
+        run: docker buildx imagetools inspect "${IMAGE}:sha-$(git rev-parse --short HEAD)"

.github/workflows/frontend.yml → .github/workflows/docker-frontend.yml

@@ -1,15 +1,26 @@
-name: Frontend
+name: Docker Frontend
+
 permissions:
+  contents: read
   packages: write
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - "frontend/**"
+      - "docker/Dockerfile.frontend"
+      - ".github/workflows/docker-frontend.yml"
+    tags: ["v*"]
   workflow_dispatch: {}
 
 env:
   IMAGE: ghcr.io/tx3-lang/registry-frontend
 
 jobs:
   build:
+    name: Build ${{ matrix.platform }}
+    runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
       matrix:
@@ -18,16 +29,15 @@ jobs:
             runner: ubuntu-latest
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Prepare platform pair
+      - name: Prepare platform name
         run: |
           platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"
 
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -40,14 +50,14 @@ jobs:
 
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: docker/Dockerfile.frontend
           platforms: ${{ matrix.platform }}
           outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
           cache-from: type=gha,scope=frontend-${{ matrix.platform }}
-          cache-to: type=gha,mode=max,scope=frontend-${{ matrix.platform }}
+          cache-to: type=gha,scope=frontend-${{ matrix.platform }},mode=max
 
       - name: Export digest
         run: |
@@ -56,19 +66,23 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
         with:
           name: digests-frontend-${{ env.PLATFORM_PAIR }}
           path: ${{ runner.temp }}/digests/*
           if-no-files-found: error
           retention-days: 1
 
   merge:
+    name: Merge multi-arch manifest
     runs-on: ubuntu-latest
-    needs: build
+    needs: [build]
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Download digests
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v4
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-frontend-*
@@ -84,11 +98,25 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=semver,pattern=v{{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=semver,pattern=v{{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=sha
+
       - name: Create manifest list and push
         working-directory: ${{ runner.temp }}/digests
         run: |
-          docker buildx imagetools create -t ${{ env.IMAGE }}:${{ github.sha }} \
-            $(printf '${{ env.IMAGE }}@sha256:%s ' *)
+          docker buildx imagetools create \
+            $(for tag in ${{ steps.meta.outputs.tags }}; do echo "-t $tag"; done) \
+            $(printf "${IMAGE}@sha256:%s " *)
 
       - name: Inspect image
-        run: docker buildx imagetools inspect ${{ env.IMAGE }}:${{ github.sha }}
+        run: docker buildx imagetools inspect "${IMAGE}:sha-$(git rev-parse --short HEAD)"