8 Incheckningar

Include renames

Upphovsman	SHA1	Meddelande	Datum
clawbotochclawbot	2f15340f26	Split Dockerfile: pre-built golangci-lint stage for faster CI (#23) ... ## Summary Splits the Dockerfile into a dedicated lint stage using the pre-built `golangci/golangci-lint:v2.10.1-alpine` Docker image, replacing the manual binary download with curl/sha256 verification. ## Changes - **Lint stage** (`AS lint`): Uses `golangci/golangci-lint:v2.10.1-alpine` pinned by sha256. Runs `make fmt-check` + `make lint`. Includes CGO deps (`build-base`, `vips-dev`, `libheif-dev`, `pkgconfig`) needed for type-checking govips imports. - **Build stage** (`AS builder`): Depends on lint stage via `COPY --from=lint /src/go.sum /dev/null`. Runs `make test` + builds the binary. Removes `curl` (no longer needed) and the manual golangci-lint download block. - **Runtime stage**: Unchanged. ## Benefits - Eliminates slow multi-arch binary download + sha256 verification step - Lint and build stages can potentially run in parallel with BuildKit - Better Docker layer caching — lint deps cached separately from build deps - All images remain pinned by sha256 with version+date comments ## Verification - `docker build .` passes: fmt-check ✅, lint (0 issues) ✅, all tests pass ✅, binary builds ✅ Closes [#18](#18) <!-- session: agent:sdlc-manager:subagent:7aac9c54-81c8-4494-94ab-0843f97a1e62 --> Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Reviewed-on: #23 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-02 21:09:51 +01:00
clawbot	5ca64a37ce	fix: detect architecture for golangci-lint download in Docker build ... The golangci-lint binary was hardcoded as linux-amd64, causing Docker builds to fail on arm64 hosts. The amd64 ELF binary cannot execute on aarch64, producing a misleading shell syntax error during make check. Use uname -m to detect the container architecture at build time and download the matching binary. Both amd64 and arm64 SHA-256 hashes are pinned. Closes #15	2026-02-25 06:12:47 -08:00
clawbot	85729d9181	fix: update Dockerfile to Go 1.25.4 and resolve gosec lint findings ... - Update Dockerfile base image from golang:1.24-alpine to golang:1.25.4-alpine (pinned by sha256 digest) to match go.mod requirement of go >= 1.25.4 - Fix gosec G703 (path traversal) false positives by adding filepath.Clean() at call sites with nolint annotations for internally-constructed paths - Fix gosec G704 (SSRF) false positive with nolint annotation; URL is already validated by validateURL() which checks scheme, resolves DNS, and blocks private IPs - All make check passes clean (lint + tests)	2026-02-25 05:44:49 -08:00
sneak	d0fe5e7334	chore: pin Docker images by hash and run make check in build	2026-02-25 19:47:14 +07:00
sneak	02dedd433b	Require signing_key at startup, add default config ... - Add config validation: signing_key required, minimum 32 characters - Server now fails to start without valid signing_key (no more runtime errors) - Add config.example.yml with default whitelist hosts - Copy config to /etc/pixa/config.yml in Docker image - Update entrypoint to use --config /etc/pixa/config.yml - Add config.dev.yml for local Docker development - Mount dev config in make devserver	2026-01-08 15:48:37 -08:00
sneak	d2e2e319be	Create /var/lib/pixa directory in Docker image for database/cache ... - Change default StateDir from ./data to /var/lib/pixa (proper Unix convention) - Create directory owned by pixad user in Dockerfile - Set WORKDIR to /var/lib/pixa	2026-01-08 15:37:25 -08:00
sneak	78f844fca5	Switch to govips for native CGO image processing ... - Replace gen2brain/avif, gen2brain/webp, disintegration/imaging with govips - govips uses libvips via CGO for fast native image processing - Add libheif-dev to Dockerfile for AVIF support - Add docker-test Makefile target for running tests in Docker - Update processor.go to use vips API for decode, resize, encode - Add TestMain to initialize/shutdown vips in tests - Remove WASM-based libraries (gen2brain) in favor of native codecs Performance improvement: AVIF encoding now uses native libheif instead of WASM, significantly reducing encoding time for large images.	2026-01-08 15:16:34 -08:00
sneak	4b2d85010e	Add two-stage Dockerfile with CGO support ... - Build stage: golang:1.24-alpine with vips-dev for CGO image libs - Runtime stage: alpine:3.21 with vips runtime only - Pass VERSION build arg for ldflags embedding - Add 'make docker' target to build image with git version	2026-01-08 15:05:49 -08:00