Harden Apache runtime, CI and release pipeline

.dockerignore

@@ -1,28 +1,28 @@
-# Ignore version control files
+# Version control / CI
 .git
 .gitignore
 .github
 
-# Ignore documentation and metadata files
+# Documentation and repository-only validation
+docs/
+tests/
 LICENSE
+README.md
 *.md
 
-# Ignore environment files
+# Environment / local state
 .env
 .env.*
 
-# Ignore Node.js modules
-node_modules
+# Dependency/build artifacts
+node_modules/
 npm-debug.log
-
-# Ignore temporary and cache files
+vendor/
 tmp/
 cache/
-
-# Ignore build artifacts and archives
 *.tar
 *.zip
 
-# Ignore Docker Compose files
+# Local compose files
 docker-compose.yml
 docker-compose*.yaml

.github/workflows/check.yml

@@ -0,0 +1,137 @@
+name: Check
+
+on:
+  push:
+    branches: [ "main", "plan/**" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '23 3 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: check-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  static:
+    name: Static and contract checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Install ShellCheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends shellcheck
+
+      - name: Static checks
+        run: bash tests/static.sh
+
+      - name: Install actionlint
+        env:
+          GOBIN: ${{ runner.temp }}/bin
+        run: |
+          mkdir -p "$GOBIN"
+          go install github.com/rhysd/actionlint/cmd/actionlint@latest
+
+      - name: Lint workflows
+        run: "${{ runner.temp }}/bin/actionlint"
+
+  runtime:
+    name: amd64 build and release gate
+    needs: static
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Dockerfile/BuildKit check
+        run: docker buildx build --check .
+
+      - name: Build amd64 image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64
+          load: true
+          pull: true
+          push: false
+          tags: infocyph/apache:ci
+          cache-from: type=gha,scope=apache-check-amd64
+          cache-to: type=gha,scope=apache-check-amd64,mode=max
+
+      - name: Final amd64 release gate
+        run: bash tests/release-gate.sh infocyph/apache:ci
+
+      - name: Image inventory
+        run: |
+          set -euo pipefail
+          docker image inspect infocyph/apache:ci --format 'Image size: {{.Size}} bytes'
+          docker run --rm --entrypoint sh infocyph/apache:ci -ec 'httpd -v; cat /etc/alpine-release; apk info | sort'
+
+      - name: Vulnerability scan
+        uses: aquasecurity/[email protected]
+        with:
+          image-ref: infocyph/apache:ci
+          format: table
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+
+  arm64:
+    name: arm64 build and startup smoke
+    needs: static
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          platforms: arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build arm64 image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/arm64
+          load: true
+          pull: true
+          push: false
+          tags: infocyph/apache:ci-arm64
+          cache-from: type=gha,scope=apache-check-arm64
+          cache-to: type=gha,scope=apache-check-arm64,mode=max
+
+      - name: arm64 command smoke
+        run: |
+          set -euo pipefail
+          docker run --rm --platform linux/arm64 --entrypoint sh infocyph/apache:ci-arm64 -ec '
+            test "$(uname -m)" = aarch64
+            httpd -t
+            httpd -v
+            command -v ab >/dev/null
+            command -v htpasswd >/dev/null
+            chromacat --version
+          '