Compare commits

..
Author SHA1 Message Date
dev_agentandClaude Opus 5.5 9b66ba0ff5 Fix review findings F1-F3 for Docker context, health check and version
Independent review Approved — 0 high findings (#5)
F1: exclude generated internal/frontend/dist from the Docker build context.
F2: derive the health check host from MEALQUEST_HTTP_ADDR, mapping wildcard
hosts and localhost to 127.0.0.1 and keeping IPv6 brackets.
F3: compute the -dirty suffix ignoring the generated embed output, so a
rebuild of a clean checkout is not stamped dirty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-02 23:02:31 -04:00
dev_agentandClaude Opus 5.5 2e5724d150 Fix review findings F1 and F2 for the Dockerfile and .dockerignore
Independent review Not signed off — 0 high, 2 medium, 1 low (#5)
F1: derive the HEALTHCHECK port from MEALQUEST_HTTP_ADDR so an overridden
listen port is still probed at /health.
F2: make key/certificate exclusions recursive (**/*.pem, **/*.key) and add
**/*.p12, **/*.pfx, **/*.jks, **/*.keystore so nested local secrets never
enter the build context.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-02 22:55:44 -04:00
dev_agentandClaude Opus 5.5 4dfc7baa2d Add Makefile dev/test/docker targets and multi-stage Dockerfile
Independent review Not signed off — 0 high, 2 medium (#5)
Makefile: dev runs the Go server (:8080) and Vite (:5173) together and
stops both on Ctrl-C; test runs the gofmt check, go vet, go test -race and
npm ci/typecheck/test; build stamps the version via -ldflags into a static
CGO_ENABLED=0 binary; docker builds the root Dockerfile. VERSION defaults
to git describe with a dev fallback.

Dockerfile: digest-pinned Node 22, Go 1.25 and Alpine 3.22 stages; the
runtime runs as uid 10001 with /data as a volume, EXPOSE 8080 and a
HEALTHCHECK on /health. .dockerignore keeps VCS, design, dependencies,
build output, databases and secrets out of the context.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-02 22:50:16 -04:00
-60
View File
@@ -1,60 +0,0 @@
# Runs on every push and pull request (no branch filter) so feature branches,
# their pull requests, and dev/main are all checked. Runs directly on the
# self-hosted act_runner; no container: key.
name: CI
on: [push, pull_request]
jobs:
ci:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
cache: false
- name: gofmt
run: |
unformatted="$(gofmt -l .)"
if [ -n "$unformatted" ]; then
echo "gofmt needed:"
echo "$unformatted"
exit 1
fi
- name: go vet
run: go vet ./...
- name: go test
run: go test -race ./...
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: npm ci
working-directory: web
run: npm ci
- name: npm run typecheck
working-directory: web
run: npm run typecheck
- name: npm test
working-directory: web
run: npm test
- name: npm run build
working-directory: web
run: npm run build
# Embed the real PWA, as `make embed` does, then build the static binary.
- name: go build (embedded PWA)
run: |
rm -rf internal/frontend/dist
mkdir -p internal/frontend/dist
cp -R web/dist/. internal/frontend/dist/
CGO_ENABLED=0 go build -o bin/mealquest ./cmd/server