HH-439: harden production artifact pipeline (#86)

* HH-439: harden production artifact pipeline * fix(HH-439): address production compose review * fix(HH-439): preserve previous JWT secrets in production --------- Co-authored-by: Rogee <rogee@ipao.vip>
2026-08-21 20:20:00 +08:00
parent 7e3872170f
commit 7a9fec33c5
11 changed files with 436 additions and 153 deletions
@@ -53,6 +53,13 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
 # ========== Production Stage ==========
 FROM alpine:3.21

+ARG VERSION=dev
+ARG COMMIT_SHA=unknown
+ARG BUILD_DATE=unknown
+LABEL org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.revision="${COMMIT_SHA}" \
+      org.opencontainers.image.created="${BUILD_DATE}"
+
 # Install runtime dependencies
 RUN apk --no-cache add ca-certificates tzdata curl &&     addgroup -S gochat && adduser -S gochat -G gochat