11 Commits

Include renames

Author	SHA1	Message	Date
Lucas RayanandClaude Sonnet 5.5	a6719c6018	ci: fix the release job being skipped, and take the notes from the changelog ... The job inherited the implicit success() and was skipped whenever the build job upstream was skipped (images reused). It now checks publish explicitly, like publish does. Notes come from the matching CHANGELOG section through scripts/release-notes.sh, not from the commit log of the whole history. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 12:27:08 -03:00
Lucas RayanandClaude Sonnet 5.5	a3e071bb03	ci: reuse published images when the image sources are unchanged ... Release hashes services/, migrations/ and config/; when images for that hash already exist it skips CI and the build and only applies the new tags. Tagging a release no longer recompiles the webmail. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 12:20:51 -03:00
Lucas RayanandClaude Sonnet 5.5	5bbbb85128	release: 1.0.0, a changelog, one .env.example and the docs to match ... - CHANGELOG.md and CHANGELOG.pt-BR.md, from the project history. - .env.example now serves development and production; scripts/init-env.sh (make env) creates .env with random secrets. .env.production.example is gone. - docs/RELEASING.md: the pipeline, how a version is cut and deployed, the runners. - DEPLOYMENT.md and both READMEs updated for Gitea and the new env flow. - Service versions set to 1.0.0. - CI: the proxy network step is idempotent and the stack is torn down always, since the runner's Docker daemon now outlives a job. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 11:36:22 -03:00
Lucas RayanandClaude Sonnet 5.5	1aac8be531	ci: create a Gitea release when a v* tag is pushed ... The Release workflow only ever published container images; there was no entry under Releases. The new job runs after every image is published and writes the image list and the commit log since the previous tag. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 11:22:08 -03:00
Lucas RayanandClaude Sonnet 5.5	5d4e7147ce	ci: cache what is rebuilt on every run ... npm and Go module caches, the embedded Postgres binaries, Trivy's database, and the daemon's own layer cache for image builds. The webmail Next build is no longer run a second time outside the Dockerfile. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 10:07:21 -03:00
Lucas RayanandClaude Sonnet 5.5	a28a9bc9d4	ci: run Go tests as a non-root user ... initdb, used by the embedded Postgres in the e2e suites, refuses to run as root. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 09:33:43 -03:00
Lucas RayanandClaude Sonnet 5.5	c30d618b3f	ci: copy files into containers instead of bind-mounting, patch two advisories ... The job workspace is a volume the DinD daemon cannot see, so migrations and the Trivy filesystem scan now docker cp their inputs. Trivy's image gate flagged next 15.5.27 (unauthenticated RCE in image optimisation, fixed in 15.5.28) and go-jose 4.1.4 (DoS, fixed in 4.1.6); both are patch bumps. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 09:22:42 -03:00
Lucas RayanandClaude Sonnet 5.5	33fa05b019	ci: run Trivy from its official image and drop the gha cache ... aquasecurity/trivy-action clones the Trivy repository from the workflow's own server, which on Gitea is not GitHub. The gha buildx cache has no Gitea counterpart. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 09:01:45 -03:00
Lucas RayanandClaude Sonnet 5.5	91c5df433e	ci: build linux/amd64 under QEMU on the arm64 runner ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 08:56:34 -03:00
Lucas RayanandClaude Sonnet 5.5	59363734ff	ci: publish images to the Gitea registry, use the gitea context ... Release now pushes to git.lucasrguerra.dev.br instead of ghcr.io, tags each architecture separately (no artifact upload, no gha cache) and joins them with imagetools. GITHUB_OUTPUT and GITHUB_STEP_SUMMARY stay: they are the runner's own interface and the GITEA_* equivalents are not set. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 08:48:44 -03:00
Lucas RayanandClaude Sonnet 5.5	9a722bc5ac	ci: publish images to the Gitea registry and move workflows to .gitea ... Release now pushes to git.lucasrguerra.dev.br instead of ghcr.io, tags each architecture separately (no artifact upload, no gha cache) and joins them with imagetools. Workflows live in .gitea/workflows and use the gitea context. GITHUB_OUTPUT and GITHUB_STEP_SUMMARY stay: they are the runner's own interface. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 08:48:14 -03:00