Harden release artifacts and deployment

[lupppig]

Summary by CodeRabbit

• New Features

  • Added a production-ready Docker Compose deployment with separate migration, storage, daemon, scheduler, and worker services.
  • Added configurable release-profile environment settings and safer secret handling guidance.
  • Added control-plane health checks and expanded smoke validation.

• Security & Reliability

  • Production containers now run as non-root with read-only and restricted capabilities.
  • Added vulnerability scanning, dependency audits, SBOMs, and provenance to release workflows.
  • Improved deployment consistency with pinned images and tooling.

• Documentation

  • Expanded Docker, control-plane, and installation guidance for hardened deployments, profiles, TLS proxies, and persistence.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 049f9380-5996-401c-b3db-70473f3e3ac8

📥 Commits

Reviewing files that changed from the base of the PR and between 1fa03f9 and d0a1054.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (18)

• .dockerignore
• .env.example
• .github/workflows/ci.yml
• .github/workflows/deploy-web.yml
• .github/workflows/docker.yml
• .github/workflows/publish.yml
• CHANGELOG.md
• README.md
• docker/Dockerfile
• docker/docker-compose.yml
• examples/README.md
• scripts/smoke_test.sh
• scripts/smoke_wheel.sh
• tests/unit/test_packaging.py
• web/public/search-index.json
• web/src/content/docs/control-plane.mdx
• web/src/content/docs/docker.mdx
• web/src/content/docs/installation.mdx

---

📝 Walkthrough

Walkthrough

The change hardens the production image and Compose deployment, adds control-plane smoke and packaging checks, pins CI and release tooling, enables vulnerability scanning and attestations, and updates deployment documentation and examples.

Changes

Production deployment hardening

Layer / File(s)	Summary
Locked production image and wheel validation .dockerignore, docker/Dockerfile, scripts/smoke_wheel.sh	The image uses digest-pinned inputs, locked production dependencies, a non-root runtime, and constrained wheel installation.
Hardened Compose deployment .env.example, docker/docker-compose.yml	Compose adds immutable-image settings, migration and storage initialization, profiled services, restricted networking, and non-root runtime controls.
Control-plane smoke and packaging tests scripts/smoke_test.sh, tests/unit/test_packaging.py	Smoke and regression checks validate loaferd, migrations, health responses, image locking, Compose ordering, profiles, and security settings.
Pinned CI and release automation .github/workflows/*	Workflows add timeouts, pinned actions and tools, dependency and image vulnerability audits, SBOM/provenance publication, and trusted PyPI publishing.
Deployment guidance and release notes README.md, CHANGELOG.md, web/src/content/docs/*, web/public/search-index.json, examples/README.md	Documentation describes the production image, Compose profiles, initialization, networking, credential handling, and release gates.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PostgreSQL
  participant metadata-migrate
  participant storage-init
  participant loaferd
  participant scheduler
  participant worker
  PostgreSQL-->>metadata-migrate: report healthy
  metadata-migrate->>metadata-migrate: run migrations
  storage-init->>storage-init: initialize shared storage
  metadata-migrate-->>loaferd: allow startup
  metadata-migrate-->>scheduler: allow startup
  metadata-migrate-->>worker: allow startup
  storage-init-->>scheduler: allow startup
  storage-init-->>worker: allow startup
  loaferd-->>loaferd: serve health endpoint

Loading

Possibly related PRs

• lupppig/loafer#20: Adds the authenticated HTTPS control plane that this change deploys and validates.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}