Chore/maintenance

.docker/Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.7
 
 # Builder: hardened Alpine + dev toolchain
-FROM dhi.io/alpine-base:3.23-alpine3.23-dev AS builder
+FROM dhi.io/alpine-base:3.24-alpine3.24-dev AS builder
 
 USER root
 
@@ -24,7 +24,7 @@ RUN apk add --no-cache \
     pkgconf \
     ca-certificates
 
-ARG RUST_VERSION=1.90.0
+ARG RUST_VERSION=1.96.0
 ARG TARGETARCH
 ENV RUSTUP_HOME=/usr/local/rustup \
     CARGO_HOME=/usr/local/cargo \
@@ -99,7 +99,7 @@ EOF
 
 # Runtime: minimal hardened Alpine. Ships only busybox + musl + ca-certs.
 # DHI images run as the 'nonroot' user (uid/gid 65532) by default.
-FROM dhi.io/alpine-base:3.23
+FROM dhi.io/alpine-base:3.24
 
 # Lay down the binary and pre-create mount-point directories with the
 # correct ownership. Named volumes inherit this ownership on first use,

.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: ci
+
+on:
+   push:
+      branches:
+         - "**"
+
+jobs:
+   build:
+      name: build (${{ matrix.platform }})
+      runs-on: ${{ matrix.runner }}
+      permissions:
+         contents: read
+      strategy:
+         fail-fast: false
+         matrix:
+            include:
+               - platform: linux/amd64
+                 runner: ubuntu-latest
+               - platform: linux/arm64
+                 runner: ubuntu-24.04-arm
+
+      steps:
+         - name: Checkout
+           uses: actions/checkout@v7.0.1
+
+         - name: Set up Docker Buildx
+           uses: docker/setup-buildx-action@v4.2.0
+
+         # dhi.io is gated: the builder pulls dhi.io/alpine-base:*-dev and
+         # the runtime stage pulls dhi.io/alpine-base:3.23.
+         - name: Login to Docker Hub (for dhi.io)
+           uses: docker/login-action@v4.5.1
+           with:
+              registry: dhi.io
+              username: ${{ secrets.DOCKERHUB_USERNAME }}
+              password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+         - name: Build image (no push)
+           uses: docker/build-push-action@v7.3.0
+           with:
+              context: .
+              file: .docker/Dockerfile
+              platforms: ${{ matrix.platform }}
+              cache-from: type=gha,scope=${{ matrix.platform }}
+              cache-to: type=gha,scope=${{ matrix.platform }},mode=max
+              push: false

.github/workflows/release.yml

@@ -28,15 +28,15 @@ jobs:
 
       steps:
          - name: Checkout
-           uses: actions/checkout@v5
+           uses: actions/checkout@v7.0.1
 
          - name: Set up Docker Buildx
-           uses: docker/setup-buildx-action@v4
+           uses: docker/setup-buildx-action@v4.2.0
 
          # dhi.io is gated: the builder pulls dhi.io/alpine-base:*-dev and
          # the runtime stage pulls dhi.io/alpine-base:3.23.
          - name: Login to Docker Hub (for dhi.io)
-           uses: docker/login-action@v4
+           uses: docker/login-action@v4.5.1
            with:
               registry: dhi.io
               username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -45,21 +45,21 @@ jobs:
          # Push login to docker.io (default registry). Same creds as dhi.io,
          # but a separate registry endpoint so we can push the public image.
          - name: Login to Docker Hub (push)
-           uses: docker/login-action@v4
+           uses: docker/login-action@v4.5.1
            with:
               username: ${{ secrets.DOCKERHUB_USERNAME }}
               password: ${{ secrets.DOCKERHUB_TOKEN }}
 
          - name: Login to GHCR
-           uses: docker/login-action@v4
+           uses: docker/login-action@v4.5.1
            with:
               registry: ${{ env.REGISTRY }}
               username: ${{ github.actor }}
               password: ${{ secrets.GITHUB_TOKEN }}
 
          - name: Extract image metadata
            id: meta
-           uses: docker/metadata-action@v6
+           uses: docker/metadata-action@v6.2.0
            with:
               images: |
                  ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -69,7 +69,7 @@ jobs:
          # job below stitches the digests into one multi-arch manifest.
          - name: Build and push by digest
            id: build
-           uses: docker/build-push-action@v7
+           uses: docker/build-push-action@v7.3.0
            with:
               context: .
               file: .docker/Dockerfile
@@ -86,7 +86,7 @@ jobs:
               touch "/tmp/digests/${digest#sha256:}"
 
          - name: Upload digest
-           uses: actions/upload-artifact@v7
+           uses: actions/upload-artifact@v7.0.1
            with:
               name: digest-${{ strategy.job-index }}
               path: /tmp/digests/*
@@ -103,31 +103,31 @@ jobs:
 
       steps:
          - name: Download digests
-           uses: actions/download-artifact@v8
+           uses: actions/download-artifact@v8.0.1
            with:
               path: /tmp/digests
               pattern: digest-*
               merge-multiple: true
 
          - name: Set up Docker Buildx
-           uses: docker/setup-buildx-action@v4
+           uses: docker/setup-buildx-action@v4.2.0
 
          - name: Login to GHCR
-           uses: docker/login-action@v4
+           uses: docker/login-action@v4.5.1
            with:
               registry: ${{ env.REGISTRY }}
               username: ${{ github.actor }}
               password: ${{ secrets.GITHUB_TOKEN }}
 
          - name: Login to Docker Hub (push)
-           uses: docker/login-action@v4
+           uses: docker/login-action@v4.5.1
            with:
               username: ${{ secrets.DOCKERHUB_USERNAME }}
               password: ${{ secrets.DOCKERHUB_TOKEN }}
 
          - name: Extract image metadata
            id: meta
-           uses: docker/metadata-action@v6
+           uses: docker/metadata-action@v6.2.0
            with:
               images: |
                  ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

.gitignore

@@ -2,3 +2,6 @@ target/
 .env
 .DS_Store
 .certs/
+
+# used to locally test with real email (acme don't allow fake email)
+example/local.toml