ci: test gate, cargo-deny, Trivy scan, multi-arch, reproducible build, releases

.dockerignore

@@ -2,11 +2,9 @@
 .git
 .gitignore
 
-# Rust build output (Exclude debug artifacts, keep release binary for CI COPY)
-target/debug
-target/doc
-target/package
-target/test
+# Rust build output: the image now compiles from source in a builder
+# stage, so none of the host's target/ is needed in the build context.
+target
 
 # IDE settings
 .vscode

.github/workflows/ci.yml

@@ -0,0 +1,144 @@
+name: CI
+
+on:
+  push:
+    branches: [ "main" ]
+    tags: [ 'v*.*.*' ]
+  pull_request:
+    branches: [ "main" ]
+
+env:
+  REGISTRY_GHCR: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Cache Cargo Registry
+        uses: Swatinem/rust-cache@v2
+
+      - name: Check formatting
+        run: cargo fmt --check
+
+      - name: Clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Test
+        run: cargo test --locked
+
+      - name: Dependency advisories, licenses, and bans
+        uses: EmbarkStudios/cargo-deny-action@v2
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      # Every push/PR builds and scans a single-arch image for fast
+      # feedback. Nothing here is pushed, so no registry login, no QEMU,
+      # no multi-arch build for a manifest list that gets thrown away.
+      - name: Build image for vulnerability scan
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64
+          load: true
+          tags: auditbridge:scan
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # ignore-unfixed: debian:bookworm-slim carries HIGH/CRITICAL CVEs with
+      # no upstream fix (will_not_fix/fix_deferred). A fixable one still
+      # fails the build; an unfixable base-image gap would leave CI red
+      # forever for nothing this project can act on.
+      - name: Scan image for vulnerabilities
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: 'auditbridge:scan'
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          severity: 'HIGH,CRITICAL'
+
+      # Everything below only runs on a vX.Y.Z tag, the only event that
+      # actually publishes. main-branch pushes build and scan above but
+      # ship nothing, so `latest` only ever points at a real tagged release.
+      - name: Log into Docker Hub
+        if: startsWith(github.ref, 'refs/tags/v') && env.DOCKER_USERNAME != ''
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Log into GHCR
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY_GHCR }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        if: startsWith(github.ref, 'refs/tags/v')
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.REGISTRY_GHCR }}/${{ env.IMAGE_NAME }}
+            ${{ secrets.DOCKERHUB_USERNAME != '' && env.IMAGE_NAME || '' }}
+          tags: |
+            type=raw,value=latest
+            type=semver,pattern={{version}}
+
+      - name: Set up QEMU (for arm64 builds)
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: docker/setup-qemu-action@v4
+
+      - name: Build and push multi-arch image
+        if: startsWith(github.ref, 'refs/tags/v')
+        id: build-and-push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  release:
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          generate_release_notes: true

Dockerfile

@@ -1,5 +1,28 @@
+# syntax=docker/dockerfile:1
+
+# Builder stage: compiles the release binary inside the image, so `docker
+# build .` works standalone with no separate CI pre-build step.
+FROM rust:1-slim-bookworm@sha256:96c0af8cf054fd006435089f0076729716784ec9be485bd655de59c55df105ce AS builder
+
+# native-tls links against system OpenSSL at build time.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends pkg-config libssl-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+# Cache dependency compilation separately from source changes: this layer
+# only invalidates when Cargo.toml/Cargo.lock change, not on every edit.
+COPY Cargo.toml Cargo.lock ./
+RUN mkdir src && echo "fn main() {}" > src/main.rs && \
+    cargo build --release --locked && \
+    rm -rf src
+
+COPY src ./src
+RUN touch src/main.rs && cargo build --release --locked
+
 # Runtime stage (Debian Bookworm slim - provides glibc 2.36+ and openssl 3)
-FROM debian:bookworm-slim
+FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241
 
 # Install only runtime dependencies
 RUN apt-get update && \
@@ -14,9 +37,7 @@ RUN groupadd -g 1000 exporter && \
 
 WORKDIR /app
 
-# Copy binary directly from CI workspace (target/release)
-# Note: CI must run `cargo build --release` before this
-COPY target/release/signal /app/exporter
+COPY --from=builder /build/target/release/signal /app/exporter
 
 # Verify binary
 RUN chmod +x /app/exporter

README.md

@@ -1,6 +1,6 @@
 # Signal
 
-[![Build Status](https://img.shields.io/github/actions/workflow/status/onelrian/signal/docker.yml?branch=main)](https://github.com/onelrian/signal/actions)
+[![Build Status](https://img.shields.io/github/actions/workflow/status/onelrian/signal/ci.yml?branch=main)](https://github.com/onelrian/signal/actions)
 [![Docker Pulls](https://img.shields.io/docker/pulls/onelrian/signal)](https://hub.docker.com/r/onelrian/signal)
 [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 

deny.toml

@@ -0,0 +1,30 @@
+[graph]
+all-features = false
+
+[advisories]
+version = 2
+yanked = "deny"
+
+[licenses]
+version = 2
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Unicode-3.0",
+    "Zlib",
+    "CDLA-Permissive-2.0",
+    "MPL-2.0",
+]
+confidence-threshold = 0.8
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"