feat: Docker images, compose stacks, nginx config, Gitea CI

- site image: multi-stage node build -> unprivileged nginx (non-root, read-only) - nginx: CSP + security headers, immutable asset caching, revalidated HTML, canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404 - externalise theme-init so CSP uses script-src 'self' (no inline hash) - prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user) - Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main - verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-04 06:21:35 +02:00
parent 033c9ec315
commit 9088dcffb9
11 changed files with 322 additions and 20 deletions
@@ -0,0 +1,85 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  ASTRO_TELEMETRY_DISABLED: '1'
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with: { version: 9 }
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm, cache-dependency-path: site/pnpm-lock.yaml }
+      - run: pnpm -C site install --frozen-lockfile
+      - run: pnpm -C site lint
+      - run: pnpm -C site check
+      - run: pnpm -C site test
+      - run: pnpm -C site build
+
+  e2e:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with: { version: 9 }
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm }
+      - run: pnpm -C site install --frozen-lockfile
+      - run: pnpm -C tests install --frozen-lockfile
+      - run: pnpm -C tests exec playwright install --with-deps chromium
+      - run: pnpm -C tests test:e2e
+
+  lighthouse:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with: { version: 9 }
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm }
+      - run: pnpm -C site install --frozen-lockfile
+      - run: pnpm -C site build
+      - run: pnpm dlx @lhci/cli@0.14.x autorun --config=site/lighthouserc.json
+
+  relay:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with: { dotnet-version: '9.0.x' }
+      - run: dotnet build relay/ContactRelay.csproj -c Release
+
+  images:
+    needs: [quality, e2e, relay]
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: git.cesnimda.uk
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Build & push site image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./site
+          push: true
+          tags: |
+            git.cesnimda.uk/cesnimda/resumesite-site:latest
+            git.cesnimda.uk/cesnimda/resumesite-site:${{ github.sha }}
+      - name: Build & push relay image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./relay
+          push: true
+          tags: |
+            git.cesnimda.uk/cesnimda/resumesite-relay:latest
+            git.cesnimda.uk/cesnimda/resumesite-relay:${{ github.sha }}