Node 26, release on v* tags, one shared release build

.github/workflows/release.yml

@@ -0,0 +1,95 @@
+name: Release
+
+# Releases only: push a v* tag. Merging to main publishes nothing.
+#
+# One job installs once and builds on the runner — twice, because Vite bakes the base path in:
+#   default base (/brushlog/) → GitHub Pages    BASE_PATH=/ → the container image
+# The image copies that prebuilt dist/ into nginx (Dockerfile target `prebuilt`), so the
+# arm64 variant needs no emulated Node build. Pull requests run the same build and
+# smoke-test the image without publishing; workflow_dispatch on main redeploys Pages.
+on:
+  push:
+    tags: ['v*']
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+  pages: write
+  id-token: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 26
+          cache: npm
+      - run: npm ci
+      - name: Build for GitHub Pages
+        run: npm run build && mv dist pages-dist
+      - name: Build for the container image
+        run: BASE_PATH=/ npm run build
+
+      - if: github.event_name != 'pull_request'
+        uses: actions/configure-pages@v6
+      - if: github.event_name != 'pull_request'
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: pages-dist
+
+      # ghcr.io/libreble/brushlog (linux/amd64 + linux/arm64) via the built-in GITHUB_TOKEN.
+      - uses: docker/setup-buildx-action@v3
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: prebuilt
+          build-contexts: dist=dist
+          load: true
+          tags: smoke:test
+      - run: docker run -d --name smoke -p 8080:8080 smoke:test
+      - run: ./docker/smoke.sh http://localhost:8080/
+      - if: failure()
+        run: docker logs smoke
+      - if: startsWith(github.ref, 'refs/tags/v')
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - if: startsWith(github.ref, 'refs/tags/v')
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: prebuilt
+          build-contexts: dist=dist
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          annotations: ${{ steps.meta.outputs.annotations }}
+
+  deploy:
+    if: github.event_name != 'pull_request'
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v5

Dockerfile

@@ -3,18 +3,26 @@
 #   docker build -t brushlog .                               # served at /
 #   docker build --build-arg BASE_PATH=/brushlog/ -t brushlog .   # served at /brushlog/
 
-FROM node:22-alpine AS build
+FROM node:26-alpine AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
 COPY . .
 ARG BASE_PATH=/
 RUN BASE_PATH="$BASE_PATH" npm run build
 
-FROM nginxinc/nginx-unprivileged:1.29-alpine
+FROM nginxinc/nginx-unprivileged:1.29-alpine AS serve
 ARG BASE_PATH=/
 ENV BASE_PATH=$BASE_PATH
 COPY docker/nginx.conf.template /etc/nginx/templates/default.conf.template
-COPY --from=build /app/dist /usr/share/nginx/html${BASE_PATH}
 EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=3s CMD wget -qO /dev/null http://127.0.0.1:8080/healthz || exit 1
+
+# Release CI: serve a dist/ already built on the runner (.github/workflows/release.yml):
+#   docker buildx build --target prebuilt --build-context dist=dist .
+FROM serve AS prebuilt
+COPY --from=dist . /usr/share/nginx/html${BASE_PATH}
+
+# Default: build from source.
+FROM serve
+COPY --from=build /app/dist /usr/share/nginx/html${BASE_PATH}

package.json

@@ -17,7 +17,7 @@
   },
   "devDependencies": {
     "@tailwindcss/vite": "^4.0.0",
-    "@types/node": "^24.13.6",
+    "@types/node": "^26.6.2",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@types/web-bluetooth": "^0.0.21",