[1.0.x → main] Prepare branch for the pinned-commit release builder (#5273)

.github/actions/run-integration-tests/action.yml

@@ -1,3 +1,5 @@
+# Callers check out the test sources. The action must never check out a ref of its own.
+# A checkout here would replace the workspace mid-job and test a different commit than the build.
 name: Run Integration Tests
 description: Runs integration tests against a specific database type (sqlite, postgres, or redis)
 inputs:
@@ -16,15 +18,31 @@ inputs:
 runs:
   using: "composite"
   steps:
+<<<<<<< HEAD
     - name: 📥 Checkout Code
       uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         ref: ${{ inputs.ref }}
 
+=======
+>>>>>>> 34a1360ee (Prepare branch for the pinned-commit release builder)
     - name: ⚙️ Set up Go Environment
       uses: ./.github/actions/setup-go
 
+    # Some callers stage the distribution themselves. Skip the download instead of refetching.
+    - name: 🔍 Check for a Staged Distribution
+      id: staged_distribution
+      shell: bash
+      run: |
+        if ls target/dist/*.zip >/dev/null 2>&1; then
+          echo "✅ Using the distribution already staged in target/dist"
+          echo "present=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "present=false" >> "$GITHUB_OUTPUT"
+        fi
+
     - name: 📥 Download Built Distribution
+      if: steps.staged_distribution.outputs.present != 'true'
       uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: product-distribution

.github/docker/Dockerfile.release

@@ -0,0 +1,63 @@
+# Copyright 2026 The ThunderID Authors
+# SPDX-License-Identifier: Apache-2.0
+
+# Built by .github/workflows/release-builder.yml from the published distribution
+# instead of from source. The build context is a directory of Linux archives.
+# Keep the runtime stage in sync with ./Dockerfile.
+
+# Unpack the target architecture's archive, on the build platform to avoid emulation.
+FROM --platform=$BUILDPLATFORM alpine:3.19 AS dist
+
+ARG TARGETARCH
+
+RUN apk add --no-cache unzip
+
+WORKDIR /dist
+
+COPY thunderid-*-linux-*.zip ./
+
+RUN set -eux; \
+    case "$TARGETARCH" in \
+      amd64) archive_arch=x64 ;; \
+      arm64) archive_arch=arm64 ;; \
+      *) echo "unsupported target architecture: $TARGETARCH" >&2; exit 1 ;; \
+    esac; \
+    archive="$(ls thunderid-*-linux-"$archive_arch".zip)"; \
+    unzip -q "$archive" -d /extracted; \
+    mkdir -p /opt/thunderid; \
+    cp -r /extracted/thunderid-*/. /opt/thunderid/
+
+# ./Dockerfile edits these before compiling; here the archive is already packaged.
+RUN sed -i 's/hostname: "localhost"/hostname: "0.0.0.0"/' /opt/thunderid/deployment.yaml && \
+    sed -i '/hostname: "0.0.0.0"/a\  public_url: "https://localhost:8090"' /opt/thunderid/deployment.yaml
+
+# Security material (TLS/JWT/AES keys) is not baked into the image; the setup step generates it per deployment.
+
+# Runtime stage
+FROM alpine:3.19
+
+RUN apk add --no-cache \
+    ca-certificates \
+    lsof \
+    sqlite \
+    bash \
+    curl \
+    openssl \
+    unzip
+
+RUN addgroup -S thunderid -g 10001 && adduser -S thunderid -u 10001 -G thunderid
+
+WORKDIR /opt/thunderid
+
+COPY --from=dist --chown=thunderid:thunderid /opt/thunderid /opt/thunderid
+
+RUN chmod +x thunderid start.sh setup.sh scripts/init_script.sh && \
+    (find bootstrap -name "*.sh" -type f -exec chmod +x {} \; 2>/dev/null || true)
+
+EXPOSE 8090
+
+USER thunderid
+
+ENV BACKEND_PORT=8090
+
+CMD ["./start.sh"]

Dockerfile

@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Product Docker Image
+# Built from source for `make docker-build*`. The release pipeline uses
+# .github/docker/Dockerfile.release. Keep the runtime stages in sync.
 # Build stage - compile the Go binary and build frontend for the target architecture
 FROM golang:1.26-alpine3.23 AS builder