From c34fc27c7a4b9674ba4e10e7d67c99cc17d77cab Mon Sep 17 00:00:00 2001
From: Osara-B <osara922@gmail.com>
Date: Thu, 3 Sep 2026 17:47:27 +0530
Subject: [PATCH] Prepare branch for the pinned-commit release builder

Signed-off-by: Osara-B <osara922@gmail.com>
---
 .../actions/run-integration-tests/action.yml  | 18 ++++++
 .github/docker/Dockerfile.release             | 63 +++++++++++++++++++
 Dockerfile                                    |  2 +
 3 files changed, 83 insertions(+)
 create mode 100644 .github/docker/Dockerfile.release

diff --git a/.github/actions/run-integration-tests/action.yml b/.github/actions/run-integration-tests/action.yml
index f358e01bc9..1bb709f7d9 100644
--- a/.github/actions/run-integration-tests/action.yml
+++ b/.github/actions/run-integration-tests/action.yml
@@ -1,3 +1,5 @@
+# Callers check out the test sources. The action must never check out a ref of its own.
+# A checkout here would replace the workspace mid-job and test a different commit than the build.
 name: Run Integration Tests
 description: Runs integration tests against a specific database type (sqlite, postgres, or redis)
 inputs:
@@ -16,15 +18,31 @@ inputs:
 runs:
   using: "composite"
   steps:
+<<<<<<< HEAD
     - name: 📥 Checkout Code
       uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         ref: ${{ inputs.ref }}
 
+=======
+>>>>>>> 34a1360ee (Prepare branch for the pinned-commit release builder)
     - name: ⚙️ Set up Go Environment
       uses: ./.github/actions/setup-go
 
+    # Some callers stage the distribution themselves. Skip the download instead of refetching.
+    - name: 🔍 Check for a Staged Distribution
+      id: staged_distribution
+      shell: bash
+      run: |
+        if ls target/dist/*.zip >/dev/null 2>&1; then
+          echo "✅ Using the distribution already staged in target/dist"
+          echo "present=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "present=false" >> "$GITHUB_OUTPUT"
+        fi
+
     - name: 📥 Download Built Distribution
+      if: steps.staged_distribution.outputs.present != 'true'
       uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: product-distribution
diff --git a/.github/docker/Dockerfile.release b/.github/docker/Dockerfile.release
new file mode 100644
index 0000000000..19380cec1d
--- /dev/null
+++ b/.github/docker/Dockerfile.release
@@ -0,0 +1,63 @@
+# Copyright 2026 The ThunderID Authors
+# SPDX-License-Identifier: Apache-2.0
+
+# Built by .github/workflows/release-builder.yml from the published distribution
+# instead of from source. The build context is a directory of Linux archives.
+# Keep the runtime stage in sync with ./Dockerfile.
+
+# Unpack the target architecture's archive, on the build platform to avoid emulation.
+FROM --platform=$BUILDPLATFORM alpine:3.19 AS dist
+
+ARG TARGETARCH
+
+RUN apk add --no-cache unzip
+
+WORKDIR /dist
+
+COPY thunderid-*-linux-*.zip ./
+
+RUN set -eux; \
+    case "$TARGETARCH" in \
+      amd64) archive_arch=x64 ;; \
+      arm64) archive_arch=arm64 ;; \
+      *) echo "unsupported target architecture: $TARGETARCH" >&2; exit 1 ;; \
+    esac; \
+    archive="$(ls thunderid-*-linux-"$archive_arch".zip)"; \
+    unzip -q "$archive" -d /extracted; \
+    mkdir -p /opt/thunderid; \
+    cp -r /extracted/thunderid-*/. /opt/thunderid/
+
+# ./Dockerfile edits these before compiling; here the archive is already packaged.
+RUN sed -i 's/hostname: "localhost"/hostname: "0.0.0.0"/' /opt/thunderid/deployment.yaml && \
+    sed -i '/hostname: "0.0.0.0"/a\  public_url: "https://localhost:8090"' /opt/thunderid/deployment.yaml
+
+# Security material (TLS/JWT/AES keys) is not baked into the image; the setup step generates it per deployment.
+
+# Runtime stage
+FROM alpine:3.19
+
+RUN apk add --no-cache \
+    ca-certificates \
+    lsof \
+    sqlite \
+    bash \
+    curl \
+    openssl \
+    unzip
+
+RUN addgroup -S thunderid -g 10001 && adduser -S thunderid -u 10001 -G thunderid
+
+WORKDIR /opt/thunderid
+
+COPY --from=dist --chown=thunderid:thunderid /opt/thunderid /opt/thunderid
+
+RUN chmod +x thunderid start.sh setup.sh scripts/init_script.sh && \
+    (find bootstrap -name "*.sh" -type f -exec chmod +x {} \; 2>/dev/null || true)
+
+EXPOSE 8090
+
+USER thunderid
+
+ENV BACKEND_PORT=8090
+
+CMD ["./start.sh"]
diff --git a/Dockerfile b/Dockerfile
index c11497d09b..8eb1147c36 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Product Docker Image
+# Built from source for `make docker-build*`. The release pipeline uses
+# .github/docker/Dockerfile.release. Keep the runtime stages in sync.
 # Build stage - compile the Go binary and build frontend for the target architecture
 FROM golang:1.26-alpine3.23 AS builder