feat: initial commit

.docker/node/Dockerfile

@@ -0,0 +1,31 @@
+# Dockerfile
+
+# Step 1: Read the Node.js version from .nvmrc (or default)
+ARG NODE_VERSION
+FROM node:${NODE_VERSION}-alpine
+
+RUN apk add --no-cache shadow
+
+ARG UID
+ARG GID
+
+RUN groupmod -g ${GID} node \
+    && usermod -u ${UID} -g ${GID} node \
+    && chown -R node:node /home/node
+
+ARG PNPM_VERSION=${PNPM_VERSION}
+RUN npm install -g pnpm@${PNPM_VERSION}
+
+USER node
+
+WORKDIR /home/node/app
+
+# Step 4: Ensure pnpm store directory exists and set proper permissions
+RUN mkdir -p /home/node/app/.pnpm-store && chown -R node:node /home/node/app/.pnpm-store
+
+RUN mkdir -p /home/node/app/build && chown -R node:node /home/node/app/build
+
+# Step 5: Set environment variable for pnpm store
+ENV PNPM_STORE_PATH=/home/node/app/.pnpm-store
+
+COPY --chown=node:node . .

.env.build

@@ -0,0 +1,16 @@
+# .env
+
+# Node.js version to be used by Docker
+NODE_VERSION=20.17.0
+
+# pnpm version to be used by Docker
+PNPM_VERSION=9.10.0
+
+# Environment mode (development or production)
+VITE_MODE=development
+
+# External port for Vite (port 80 on the outside, internally it will still run on 5173)
+EXTERNAL_PORT_DEV=80
+
+# External port for Vite preview (port 8080 on the outside, internally it will still run on 4173)
+EXTERNAL_PORT=8080

.env.dist

@@ -0,0 +1,19 @@
+# .env
+
+# Node.js version to be used by Docker
+NODE_VERSION=20.17.0
+
+# pnpm version to be used by Docker
+PNPM_VERSION=9.10.0
+
+# Environment mode (development or production)
+VITE_MODE=development
+
+# External port for Vite (port 80 on the outside, internally it will still run on 5173)
+EXTERNAL_PORT_DEV=80
+
+# External port for Vite preview (port 8080 on the outside, internally it will still run on 4173)
+EXTERNAL_PORT=8080
+
+UID=1000
+GID=1000

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/actions/docker-prepare-workspace/action.yaml

@@ -0,0 +1,88 @@
+name: Prepare Docker Workspace
+description: "Prepares environment and caches to run workflows utilizing Docker"
+
+inputs:
+  docker-compose-excludes:
+    required: false
+    default: ""
+    description: "Docker Compose services to exclude (empty string for none)"
+  docker-compose-services:
+    required: false
+    default: ""
+    description: "Docker Compose services to start (empty string for all)"
+  docker-image-tag:
+    required: false
+    default: "latest"
+    description: "Value to export as DOCKER_IMAGE_TAG"
+  make-init-targets:
+    required: true
+    description: "Make targets to execute to finish initialization"
+  github_token:
+    description: 'GitHub token to authenticate API requests.'
+    required: true
+
+outputs:
+  docker-compose-services:
+    description: "Services started after docker-compose-excludes was applied"
+    value: ${{ steps.compose-services.outputs.services }}
+
+runs:
+  using: composite
+  steps:
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.github_token }}
+
+    - name: Concatenate Dotenv File
+      shell: bash
+      run: cat .env.build >> .env
+
+    - name: Dump UID & GID
+      id: docker-workspace-user
+      shell: bash
+      run: |
+        echo "uid=$(id -u)" >> $GITHUB_OUTPUT
+        echo "gid=$(id -g)" >> $GITHUB_OUTPUT
+
+    - name: Change env uid and gid
+      shell: bash
+      run: |
+        echo "UID=${{ steps.docker-workspace-user.outputs.uid }}" >> .env
+        echo "GID=${{ steps.docker-workspace-user.outputs.gid }}" >> .env    
+
+    - name: Determine Docker Compose Services to Start
+      id: compose-services
+      shell: bash
+      run: |
+        services=(${{ inputs.docker-compose-services }})
+
+        if [[ "${services[*]}" = "" ]]; then
+            services=($(docker compose config --services | sort))
+        fi
+
+        excludes=(${{ inputs.docker-compose-excludes }})
+
+        for exclude in "${excludes[@]}"; do
+          services=("${services[@]/$exclude}")
+        done
+
+        services=$(echo "${services[@]}" | tr -s ' ' | xargs | sort)
+        echo "services=$services" >> $GITHUB_OUTPUT
+
+    - name: Start Docker Compose Services
+      shell: bash
+      run: |
+        docker compose up -d --no-build --no-deps --quiet-pull --wait ${{ steps.compose-services.outputs.services }}
+
+    - name: Run Make Initialization Targets
+      if: inputs.make-init-targets != ''
+      shell: bash
+      run: make ${{ inputs.make-init-targets }}
+
+    - name: Output Used Docker Images
+      if: ${{ success() }}
+      shell: bash
+      run: docker compose images

.github/dependabot.yaml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    commit-message:
+      prefix: "build(deps-node): "
+    labels: [ ]
+    directory: "/"
+    versioning-strategy: increase-if-necessary
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+
+  - package-ecosystem: "github-actions"
+    commit-message:
+      prefix: "build(deps-github): "
+    labels: [ ]
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "docker"
+    commit-message:
+      prefix: "build(deps-docker): "
+    labels: [ ]
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/ci.yaml

@@ -0,0 +1,86 @@
+name: CI
+on:
+  workflow_dispatch:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+    paths-ignore:
+      - ".git-hooks/*"
+      - ".github/**"
+      - "!.github/workflows/ci.yaml"
+      - "!.github/workflows/docker-bake.yaml"
+      - ".gitignore"
+      - "**.md"
+      - "Makefile*"
+
+  push:
+    branches:
+      - master
+    paths-ignore:
+      - ".git-hooks/*"
+      - ".github/**"
+      - "!.github/workflows/ci.yaml"
+      - "!.github/workflows/docker-bake.yaml"
+      - ".gitignore"
+      - "**.md"
+      - "Makefile*"
+
+concurrency:
+  # Documentation suggests ${{ github.head_ref }}, but that's only available on pull_request/pull_request_target triggers, so using ${{ github.ref }}.
+  # On master, we want all builds to complete even if merging happens faster to make it easier to discover at which point something broke.
+  group: ci-${{ github.ref_name == 'master' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  docker-bake:
+    uses: ./.github/workflows/docker-bake.yaml
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: read
+      packages: write
+
+  code-style:
+    runs-on: ubuntu-latest
+    needs: docker-bake
+    timeout-minutes: 15
+    steps:
+      - name: Check Out
+        uses: actions/checkout@v4
+
+      - name: Prepare Docker Workspace
+        id: docker-prepare-workspace
+        uses: ./.github/actions/docker-prepare-workspace
+        with:
+          docker-image-tag: ${{ needs.docker-bake.outputs.docker-image-tag }}
+          docker-compose-services: "app"
+          make-init-targets: "install"
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run Svelte Check
+        run: docker compose exec app pnpm run check
+
+  tests:
+    runs-on: ubuntu-latest
+    needs: docker-bake
+    timeout-minutes: 25
+    steps:
+      - name: Check Out
+        uses: actions/checkout@v4
+
+      - name: Prepare Docker Workspace
+        id: docker-prepare-workspace
+        uses: ./.github/actions/docker-prepare-workspace
+        with:
+          docker-image-tag: ${{ needs.docker-bake.outputs.docker-image-tag }}
+          make-init-targets: "install build-schema"
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run Test Suite
+        run: docker compose exec app pnpm run test

.github/workflows/docker-bake.yaml

@@ -0,0 +1,117 @@
+name: Docker Build and Push
+on:
+  workflow_call:
+    outputs:
+      docker-image-tag:
+        description: "The Docker Image Tag a calling workflow should use"
+        value: ${{ jobs.check.outputs.docker-files-changed == 'true' && jobs.bake.outputs.tag || 'latest' }}
+  workflow_dispatch:
+  schedule:
+    - cron: "0 2 * * 6" # At 02:00 on Saturday
+
+concurrency:
+  # Documentation suggests ${{ github.head_ref }}, but that's only available on pull_request/pull_request_target triggers, so using ${{ github.ref }}.
+  # On master, we want all builds to complete even if merging happens faster to make it easier to discover at which point something broke.
+  group: docker-bake-${{ github.ref_name == 'master' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      docker-files-changed: ${{ steps.filter.outputs.docker }}
+    steps:
+      - name: Check Out
+        uses: actions/checkout@v4
+
+      - name: Detect Changes to Docker Files
+        uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            docker:
+              - '.docker/node/**'
+              - '.github/workflows/docker-bake.yaml'
+              - '.env'
+              - 'docker-compose.yaml'
+
+  bake:
+    runs-on: ubuntu-latest
+    needs: check
+    if: needs.check.outputs.docker-files-changed == 'true'
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    outputs:
+      tag: ${{ steps.docker-image-tag.outputs.tag }}
+
+    timeout-minutes: 30
+    steps:
+      - name: Check Out
+        uses: actions/checkout@v4
+
+      - name: Determine Docker Image Tag
+        id: docker-image-tag
+        run: |
+          REF_TAG=$(echo "${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" | sed 's/[^[:alnum:]\.\_\-]/-/g')
+          [ "$REF_TAG" = "master" ] && REF_TAG=latest
+
+          echo "DOCKER_IMAGE_TAG=$REF_TAG" >> $GITHUB_ENV
+          echo "tag=$REF_TAG" >> $GITHUB_OUTPUT
+
+      - name: Set Up QEMU for additional Platform Support
+        if: steps.docker-image-tag.outputs.tag == 'latest'
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set Up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver-opts: network=host
+
+      - name: Copy Dist Dotenv File
+        run: cp .env.build .env
+
+      - name: Dump UID & GID
+        id: docker-workspace-user
+        shell: bash
+        run: |
+          echo "uid=$(id -u)" >> $GITHUB_OUTPUT
+          echo "gid=$(id -g)" >> $GITHUB_OUTPUT
+
+      - name: Change env uid and gid
+        shell: bash
+        run: |
+          echo "UID=${{ steps.docker-workspace-user.outputs.uid }}" >> .env
+          echo "GID=${{ steps.docker-workspace-user.outputs.gid }}" >> .env            
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Bake and Push Docker Images (PR)
+        if: steps.docker-image-tag.outputs.tag != 'latest'
+        uses: docker/[email protected]
+        with:
+          source: .
+          push: true
+          set: |
+            *.platform=linux/amd64
+            app.tags=ghcr.io/${{ github.repository }}:${{ steps.docker-image-tag.outputs.tag }}
+
+      - name: Bake and Push Docker Images (Master)
+        if: steps.docker-image-tag.outputs.tag == 'latest'
+        uses: docker/[email protected]
+        with:
+          source: .
+          push: true
+          set: |
+            *.platform=linux/amd64,linux/arm64
+            app.tags=ghcr.io/${{ github.repository }}:${{ steps.docker-image-tag.outputs.tag }}