Feat/rework docker setup

.github/workflows/delete-merged-branch.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   delete-branch:
-    if: github.event.pull_request.merged == true && github.event.pull_request.head.ref != 'develop'
+    if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/format.yml

@@ -0,0 +1,53 @@
+name: Format
+
+on:
+  push:
+    branches:
+      - "feat/**"
+      - "fix/**"
+      - "chore/**"
+
+permissions:
+  contents: write
+
+jobs:
+  format:
+    name: Auto-format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config libssl-dev libpq-dev protobuf-compiler
+
+      - uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: cargo fmt
+        run: cargo fmt --all
+
+      - name: cargo clippy --fix
+        run: cargo clippy --fix --allow-dirty --allow-staged --workspace --all-targets
+
+      - name: Commit and push fixes
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          if ! git diff --quiet; then
+            git add -A
+            git commit -m "style: apply cargo fmt and clippy fixes"
+            git push origin HEAD:${{ github.ref_name }}
+          fi

.github/workflows/lint.yml

@@ -6,12 +6,42 @@ on:
   push:
     branches:
       - main
+  workflow_run:
+    workflows: ["Format"]
+    types: [completed]
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+  actions: read
+
 jobs:
-  clippy:
+  wait-for-format:
+    name: Wait for auto-format
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Poll for in-flight format run
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH="${{ github.event.pull_request.head.ref }}"
+          REPO="${{ github.repository }}"
+          for _ in $(seq 1 30); do
+            STATUS=$(gh run list --repo "$REPO" --workflow Format --branch "$BRANCH" \
+              --limit 1 --json status -q '.[0].status' 2>/dev/null || echo "")
+            if [ "$STATUS" != "in_progress" ] && [ "$STATUS" != "queued" ]; then
+              exit 0
+            fi
+            sleep 5
+          done
+
+  clippy-push:
     name: Clippy
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
     steps:
       - uses: actions/checkout@v6
 
@@ -34,11 +64,49 @@ jobs:
       - name: Clippy
         run: cargo clippy --workspace --all-targets -- -D warnings
 
+  clippy-pr:
+    name: Clippy
+    runs-on: ubuntu-latest
+    needs: wait-for-format
+    if: github.event_name == 'pull_request' && always() && (needs.wait-for-format.result == 'success' || needs.wait-for-format.result == 'skipped')
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config libssl-dev libpq-dev protobuf-compiler
+
+      - uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Clippy with PR annotations
+        uses: giraffate/clippy-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          reporter: github-pr-review
+          fail_on_error: true
+          clippy_flags: --workspace --all-targets -- -D warnings
+
   rustfmt:
     name: rustfmt
     runs-on: ubuntu-latest
+    needs: wait-for-format
+    if: always() && (needs.wait-for-format.result == 'success' || needs.wait-for-format.result == 'skipped')
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.ref || github.ref }}
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -59,4 +127,16 @@ jobs:
         run: cargo install cargo-audit --locked
 
       - name: Audit
-        run: cargo audit
+        id: audit
+        run: cargo audit --json > audit-report.json || echo "failed=true" >> "$GITHUB_OUTPUT"
+
+      - name: Post audit findings to PR
+        if: github.event_name == 'pull_request' && steps.audit.outputs.failed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          SUMMARY=$(jq -r '.vulnerabilities.list[] | "- **\(.advisory.id)** \(.package.name)@\(.package.version): \(.advisory.title)"' audit-report.json)
+          gh pr comment "${{ github.event.pull_request.number }}" \
+            --repo "${{ github.repository }}" \
+            --body "$(printf 'cargo audit found vulnerabilities:\n\n%s' "$SUMMARY")"
+          exit 1

.github/workflows/prerelease.yml

@@ -3,7 +3,7 @@ name: Pre-release Build
 on:
   push:
     branches:
-      - develop
+      - main
   workflow_dispatch:
     inputs:
       version:
@@ -38,7 +38,7 @@ jobs:
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT
           else
-            BASE=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
+            BASE=$(grep -m1 '^version' Cargo.toml | sed 's/[^"]*"\([^"]*\)".*/\1/')
             COUNT=$(git rev-list --count HEAD)
             echo "version=${BASE}-alpha.${COUNT}" >> $GITHUB_OUTPUT
           fi
@@ -262,7 +262,7 @@ jobs:
         with:
           repository: ${{ github.repository_owner }}/CSFX-Infra
           token: ${{ secrets.INFRA_REPO_TOKEN }}
-          ref: develop
+          ref: main
           path: infra
 
       - uses: actions/download-artifact@v8
@@ -419,6 +419,6 @@ jobs:
           git add versions.nix
           git diff --cached --quiet && echo "no changes" && exit 0
           git commit -m "chore: update versions.nix for v${VERSION}"
-          git push origin develop
+          git push origin main
           git tag "v${VERSION}"
           git push origin "v${VERSION}"

.github/workflows/docker-build.yml → .github/workflows/release-build.yml

@@ -1,9 +1,6 @@
 name: Release Build & Push
 
 on:
-  workflow_run:
-    workflows: ["Release Please"]
-    types: [completed]
   workflow_dispatch:
     inputs:
       version:
@@ -19,32 +16,13 @@ jobs:
   prepare:
     name: Prepare Build Context
     runs-on: ubuntu-latest
-    if: >
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
     outputs:
       version: ${{ steps.version.outputs.version }}
-      should_build: ${{ steps.version.outputs.should_build }}
+      should_build: "true"
     steps:
-      - uses: actions/checkout@v6
-
       - name: Resolve version
         id: version
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT
-            echo "should_build=true" >> $GITHUB_OUTPUT
-          else
-            TAG=$(gh release list --limit 1 --json tagName -q '.[0].tagName' 2>/dev/null || echo "")
-            if [ -z "$TAG" ]; then
-              echo "should_build=false" >> $GITHUB_OUTPUT
-            else
-              echo "version=${TAG#v}" >> $GITHUB_OUTPUT
-              echo "should_build=true" >> $GITHUB_OUTPUT
-            fi
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT
 
   build-binaries:
     name: Build ${{ matrix.binary }} (${{ matrix.arch }})

.github/workflows/release-please.yml

@@ -25,3 +25,12 @@ jobs:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
           token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - name: Trigger full release build
+        if: steps.release.outputs.release_created == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+        run: |
+          gh workflow run release-build.yml \
+            --repo "${{ github.repository }}" \
+            --field version="${{ steps.release.outputs.version }}"