fix #5: tests, docs, CI, and Docker CVEs

.github/workflows/ci.yml

@@ -21,17 +21,20 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y protobuf-compiler
-
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
           toolchain: "1.89.0"
           components: rustfmt, clippy
 
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y protobuf-compiler
+
       - name: Check Formatting
         run: cargo fmt --all -- --check
 
@@ -42,8 +45,6 @@ jobs:
     name: Test and Collect Coverage
     runs-on: ubuntu-latest
     needs: lint
-    permissions:
-      contents: read
     env:
       CI: 1
     steps:
@@ -57,7 +58,7 @@ jobs:
           toolchain: "1.89.0"
           components: llvm-tools-preview
 
-      - name: Cache using Swatinem/rust-cache
+      - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
 
       - name: Install system dependencies
@@ -66,9 +67,6 @@ jobs:
           sudo apt-get install -y protobuf-compiler
 
       - name: Install cargo tools
-        # Versions pinned to match Makefile's install-tools target — an
-        # unpinned `cargo install` grabs the latest release, which can
-        # require a newer rustc than the toolchain pinned above (1.89.0).
         run: |
           cargo install cargo-nextest --locked --version 0.9.114
           cargo install cargo-llvm-cov --locked --version 0.8.7
@@ -80,6 +78,7 @@ jobs:
         run: cargo test --doc --all-features
 
       - name: Upload coverage to Codecov
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/dependency-audit.yml

@@ -12,31 +12,21 @@ on:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    env:
-      RUSTUP_TOOLCHAIN: stable
     steps:
       - uses: actions/checkout@v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: "1.89.0"
 
       - name: Install protoc
         run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
 
       - name: Cache Cargo Dependencies
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+        uses: Swatinem/rust-cache@v2
 
       - name: Audit dependencies
-        # Version pinned to match Makefile's install-tools target — an
-        # unpinned `cargo install` picks up whatever cargo-deny last shipped,
-        # which can change license/advisory defaults and pass locally but
-        # fail here (or vice versa) with no code change involved.
         run: |
           cargo install cargo-deny --locked --version 0.20.2
           cargo deny check all

.github/workflows/docker-ci.yml

@@ -0,0 +1,59 @@
+name: Docker CI
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "Dockerfile"
+      - "compose/**"
+      - "d-lmdb/**"
+      - "d-lmdb-server/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "**/*.rs"
+      - ".github/workflows/docker-ci.yml"
+  pull_request:
+    paths:
+      - "Dockerfile"
+      - "compose/**"
+      - "d-lmdb/**"
+      - "d-lmdb-server/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "**/*.rs"
+      - ".github/workflows/docker-ci.yml"
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CI: 1
+
+jobs:
+  docker-smoke-test:
+    name: Build and Smoke Test Docker Image
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build image locally for smoke test
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64
+          tags: d-lmdb-server:compose
+          load: true
+
+      - name: Run 3-node smoke test
+        run: DLMDB_SKIP_BUILD=1 ./compose/smoke-test.sh

.github/workflows/docker-release.yml

@@ -1,9 +1,14 @@
 name: Docker Release
 
-# Triggered by creating a GitHub Release, not every push to main.
 on:
   release:
-    types: [created]
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version tag (e.g. 0.1.1-rc1, 0.1.1)"
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -12,56 +17,75 @@ env:
   IMAGE: deventlab/d-lmdb
 
 jobs:
-  # Build, smoke-test, then push by digest — per platform. arm64 runs
-  # under QEMU: verifies correctness, not real hardware timing.
   build-test-push:
     name: Build, test, push (${{ matrix.platform }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         platform: [linux/amd64, linux/arm64]
+
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Set platform tag for artifact naming
+        shell: bash
         run: |
-          platform=${{ matrix.platform }}
+          platform='${{ matrix.platform }}'
           echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"
 
-      - uses: actions/checkout@v4
-
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build image for this platform (local only, not pushed yet)
+      - name: Build image for this platform (local only)
         uses: docker/build-push-action@v6
         with:
           context: .
           platforms: ${{ matrix.platform }}
           tags: d-lmdb-server:compose
           load: true
 
-      - name: Run 3-node smoke test against the freshly built image
+      - name: Run 3-node smoke test
         run: DLMDB_SKIP_BUILD=1 ./compose/smoke-test.sh
 
+      - name: Scan for Medium+ CVEs (fail release if found)
+        shell: bash
+        run: |
+          OUT=$(docker scout cves d-lmdb-server:compose --platform ${{ matrix.platform }} 2>&1)
+          LINE=$(echo "$OUT" | grep 'vulnerabilities' || true)
+          [ -n "$LINE" ] || { echo "$OUT"; exit 1; }
+          C=$(echo "$LINE" | grep -o '[0-9]\+C' | grep -o '[0-9]\+' || echo 0)
+          H=$(echo "$LINE" | grep -o '[0-9]\+H' | grep -o '[0-9]\+' || echo 0)
+          M=$(echo "$LINE" | grep -o '[0-9]\+M' | grep -o '[0-9]\+' || echo 0)
+          echo "CVEs: ${C}C ${H}H ${M}M"
+          if [ "$C" -gt 0 ] || [ "$H" -gt 0 ] || [ "$M" -gt 0 ]; then
+            echo "FAIL: Release blocked — Medium+ CVEs found"
+            exit 1
+          fi
+          echo "PASS"
+
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
 
-      - name: Push tested image by digest (no rebuild)
+      - name: Push tested image by digest
         id: push
+        shell: bash
         run: |
-          TARGET="docker.io/${{ env.IMAGE }}:${{ github.sha }}"
+          TARGET="docker.io/${{ env.IMAGE }}:${{ github.sha }}-${{ matrix.platform }}"
           docker tag d-lmdb-server:compose "$TARGET"
           docker push "$TARGET"
           DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$TARGET" | grep -o 'sha256:[a-f0-9]\{64\}')
           echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
 
       - name: Export digest
+        shell: bash
         run: |
           mkdir -p /tmp/digests
           DIGEST="${{ steps.push.outputs.digest }}"
@@ -75,17 +99,20 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
-  # Only runs if every platform above succeeded.
   merge:
     name: Merge multi-platform manifest
     runs-on: ubuntu-latest
     needs: build-test-push
+
     steps:
-      - name: Strip 'v' prefix from release tag
+      - name: Resolve version
+        shell: bash
         env:
+          VERSION_INPUT: ${{ inputs.version }}
           RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          printf 'STRIPPED_VERSION=%s\n' "${RELEASE_TAG#v}" >> "$GITHUB_ENV"
+          VERSION="${VERSION_INPUT:-$RELEASE_TAG}"
+          printf 'STRIPPED_VERSION=%s\n' "${VERSION#v}" >> "$GITHUB_ENV"
 
       - name: Download digests
         uses: actions/download-artifact@v4
@@ -103,7 +130,19 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
 
+      - name: Reject if version tag already exists
+        shell: bash
+        env:
+          IMAGE: ${{ env.IMAGE }}
+        run: |
+          if docker buildx imagetools inspect "docker.io/${IMAGE}:${STRIPPED_VERSION}" >/dev/null 2>&1; then
+            echo "ERROR: ${STRIPPED_VERSION} already exists — will not overwrite"
+            exit 1
+          fi
+          echo "OK: ${STRIPPED_VERSION} is available"
+
       - name: Create and push manifest list
+        shell: bash
         working-directory: /tmp/digests
         env:
           IMAGE: ${{ env.IMAGE }}
@@ -114,6 +153,7 @@ jobs:
             $(printf 'docker.io/%s@sha256:%s ' "${IMAGE}" *)
 
       - name: Verify manifest
+        shell: bash
         env:
           IMAGE: ${{ env.IMAGE }}
         run: docker buildx imagetools inspect "docker.io/${IMAGE}:${STRIPPED_VERSION}"

Dockerfile

@@ -23,12 +23,12 @@ RUN cargo build --release -p d-lmdb-server
 
 FROM debian:bookworm-slim AS runtime
 
-# gosu: drop from root to appuser after the entrypoint fixes up mounted-volume
-# ownership — see docker-entrypoint.sh. ca-certificates: TLS roots, needed if
-# the Raft cluster ever talks over TLS.
+# setpriv (util-linux) replaces gosu — avoids 68 Go 1.19 stdlib CVEs.
+# perl-base + tar purged: not needed at runtime, bring CVEs.
 RUN apt-get update \
     && apt-get upgrade -y \
-    && apt-get install -y --no-install-recommends gosu ca-certificates \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && dpkg --force-remove-essential --force-depends --purge perl-base tar \
     && rm -rf /var/lib/apt/lists/*
 
 # Fixed UID/GID (not just UID) — docker-compose bind-mounts a host directory