refactor(docker): multi-arch docker 🐳 build overhaul 🏗️

.dockerignore

@@ -1,4 +1,7 @@
 node_modules
+.git
+.github
+.vscode
 dist
 build
 .env

.env.example

@@ -1,12 +1,26 @@
-KENER_SECRET_KEY=please_change_me
-NODE_ENV=production
-PORT=3000
+TZ=Etc/UTC
+KENER_SECRET_KEY=please_change_me_to_something_secure
+
+# For SQLite database...
+DATABASE_URL=sqlite://./database/kener.sqlite.db
+
+# For PostgreSQL database...
+# DATABASE_URL=postgresql://db_user:db_password@localhost:5432/kener_db
+# POSTGRES_PASSWORD=some_super_random_secure_password
+
+# For MySQL database...
+# DATABASE_URL=mysql://db_user:[email protected]:3306/kener_db
+# MYSQL_PASSWORD=some_super_random_secure_password
+
 KENER_BASE_PATH=""
-RESEND_API_KEY=
 ORIGIN=http://localhost:3000
-DATABASE_URL=sqlite://./database/kener.sqlite.db
-TZ=UTC
+
+RESEND_API_KEY=""
 RESEND_SENDER_EMAIL=Accounts <[email protected]>
 
-# DATABASE_URL=postgresql://myuser:mypassword@localhost:5432/mydatabase
-# DATABASE_URL=mysql://root:[email protected]:3306/kener
+# Likely no need to change...
+# NODE_ENV=production   # already defined in container
+# PORT=3000   # default port Kener service is exposed upon
+
+# Add the below variable if you would like to ‘white-label’ the product (aka. remove some of the attributions scattered throughout the app)
+# WHITE_LABEL=true

.github/workflows/protect-readme.yml

@@ -0,0 +1,21 @@
+name: Prevent Direct README Changes
+
+on:
+  pull_request:
+    paths:
+      - "README.md"
+
+jobs:
+  check-readme:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/[email protected]
+
+      - name: Detect direct README changes
+        run: |
+          if git diff --name-only origin/main | grep -q "README.md"; then
+            echo "❌ Direct modifications to README.md are not allowed!"
+            echo "Please update README.md.template instead."
+            exit 1
+          fi

.github/workflows/publish-images.yml

@@ -0,0 +1,165 @@
+---
+name: Publish Docker image to Docker Hub and GitHub Container Registry
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "*.*.*"
+    paths-ignore:
+      - '**/*.md'
+      - 'docs/**'
+  workflow_dispatch:  # Allows manual execution
+
+env:
+  ALPINE_VERSION: "23-alpine"
+  DEBIAN_VERSION: "23-slim"
+  # Registry URLs
+  DOCKERHUB_REGISTRY: docker.io
+  GITHUB_REGISTRY: ghcr.io
+  # Docker Hub image name (using Docker Hub username)
+  DOCKERHUB_IMAGE_NAME: ${{ secrets.DOCKER_USERNAME }}/${{ github.event.repository.name }}
+  # GitHub image name (formatted as `account/repo`)
+  GITHUB_IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build_and_push_to_registries:
+    name: Push Docker images to Docker Hub and GitHub Container Registry
+    strategy:
+      matrix:
+        variant: [alpine, debian]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      # This is used to complete the identity challenge with sigstore/fulcio when running outside of PRs.
+      id-token: write
+
+    steps:
+      - name: Check out the repo
+        uses: actions/[email protected]
+
+      # Install the cosign tool (except on PR)
+      # https://github.com/sigstore/cosign-installer
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/[email protected]
+        with:
+          cosign-release: 'v2.2.4'
+
+      # Set up BuildKit Docker container builder to be able to build multi-platform images and export cache
+      # https://github.com/docker/setup-buildx-action
+      - name: Set up Docker Buildx
+        uses: docker/[email protected]
+
+      # Log in to Docker Hub (except on PR)
+      - name: Log in to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/[email protected]
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      # Log in to GitHub Container Registry (except on PR)
+      - name: Log in to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/[email protected]
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Combined metadata extraction for both registries
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/[email protected]
+        with:
+          images: |
+            ${{ env.DOCKERHUB_IMAGE_NAME }}
+            ${{ env.GITHUB_REGISTRY }}/${{ env.GITHUB_IMAGE_NAME }}
+          tags: |
+            # Tag branches as type=ref,event=branch
+            # For Alpine variant, add suffix
+            type=ref,event=branch,suffix=-${{ matrix.variant }},enable=${{ matrix.variant == 'alpine' }}
+            type=ref,event=branch,enable=${{ matrix.variant == 'debian' }}
+            # Tag matrix.variant (Alpine) releases as version (1.0.0), major.minor (1.0), major (1), and matrix.variant (alpine)
+            type=semver,pattern={{version}},suffix=-${{ matrix.variant }},enable=${{ matrix.variant == 'alpine' }}
+            type=semver,pattern={{major}}.{{minor}},suffix=-${{ matrix.variant }},enable=${{ matrix.variant == 'alpine' }}
+            type=semver,pattern={{major}},suffix=-${{ matrix.variant }},enable=${{ matrix.variant == 'alpine' }}
+            type=raw,value=${{ matrix.variant }},enable=${{ matrix.variant == 'alpine' && github.ref == 'refs/heads/main' }}
+            # Tag default (Debian) releases as version (1.0.0), major.minor (1.0), major (1), and latest
+            type=semver,pattern={{version}},enable=${{ matrix.variant == 'debian' }}
+            type=semver,pattern={{major}}.{{minor}},enable=${{ matrix.variant == 'debian' }}
+            type=semver,pattern={{major}},enable=${{ matrix.variant == 'debian' }}
+            type=raw,value=latest,enable=${{ matrix.variant == 'debian' && github.ref == 'refs/heads/main' }}
+
+      - name: Set up QEMU
+        uses: docker/[email protected]
+
+      # Build and push Docker image with Buildx to both registries (don't push on PR)
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/[email protected]
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VARIANT=${{ matrix.variant }}
+            ALPINE_VERSION=${{ env.ALPINE_VERSION }}
+            DEBIAN_VERSION=${{ env.DEBIAN_VERSION }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # Sign the resulting Docker image digests
+      - name: Sign the published Docker images
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        run: |
+          echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
+
+  generate_readme:
+    needs: build_and_push_to_registries  # Runs only after build_and_push_to_registries completes successfully
+    name: Generate README from template
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/[email protected]
+
+      - name: Extract Release Versions
+        id: meta
+        uses: docker/[email protected]
+        with:
+          images: rajnandan1/kener
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+
+      - name: Setup Node.js
+        uses: actions/[email protected]
+        with:
+          node-version: "20"
+
+      - name: Install Dependencies
+        run: npm install mustache dotenv
+
+      - name: Generate README.md
+        env:
+          KENER_BUILD_FULL_VERSION: ${{ steps.meta.outputs.tags[0] }}  # e.g., 1.2.3
+          KENER_BUILD_MAJOR_MINOR_VERSION: ${{ steps.meta.outputs.tags[1] }}  # e.g., 1.2
+          KENER_BUILD_MAJOR_VERSION: ${{ steps.meta.outputs.tags[2] }}  # e.g., 1
+        run: node scripts/generate-readme.js
+
+      - name: Commit and Push Changes
+        run: |
+          git config --global user.name 'github-actions'
+          git config --global user.email '[email protected]'
+          git add README.md
+          git commit -m "Auto-generate README.md with release versions" || echo "No changes to commit"
+          git push