feat: implement container build strategy with dev tags and automated releases

- Modified build.py to detect local vs CI environment
- Local builds now use 'dev' tags instead of production tags
- CI workflow no longer builds containers, only runs tests
- Release workflow triggers on git tags (v*) with:
  - Multi-platform container builds
  - Automatic changelog generation from commit history
  - GitHub release creation with SBOM and signatures
- Added BUILD_STRATEGY.md documentation

This separates development, CI testing, and production releases into
distinct workflows for better control and clarity.

Author: aronchick

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: CI/CD Pipeline
+name: CI Pipeline
 
 on:
   push:
@@ -9,7 +9,6 @@ on:
 
 env:
   PYTHON_VERSION: "3.11"
-  DOCKER_BUILDKIT: 1
 
 jobs:
   lint-and-typecheck:
@@ -76,258 +75,34 @@ jobs:
           name: codecov-umbrella
         continue-on-error: true
 
-  build-container:
-    name: Build Docker Container
+  validate-docker:
+    name: Validate Dockerfile
     runs-on: ubuntu-latest
-    needs: lint-and-typecheck
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build with build.py (test mode)
-        run: |
-          # Install Python dependencies for build script
-          pip install rich
-          
-          # Run build.py in skip-push mode for testing
-          python build.py --skip-push --version-tag test-${{ github.sha }}
-          
-          # Export the test image for artifact upload
-          docker save ghcr.io/${{ github.repository }}:test-${{ github.sha }} > /tmp/sensor-simulator.tar
-
-      - name: Upload Docker image artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: docker-image
-          path: /tmp/sensor-simulator.tar
-          retention-days: 1
-
-  test-container:
-    name: Test Docker Container
-    runs-on: ubuntu-latest
-    needs: build-container
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Download Docker image artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: docker-image
-          path: /tmp
-
-      - name: Load Docker image
-        run: |
-          docker load --input /tmp/sensor-simulator.tar
-          # Retag for simpler testing
-          docker tag ghcr.io/${{ github.repository }}:test-${{ github.sha }} sensor-simulator:test
-
-      - name: Test container startup
-        run: |
-          # Create necessary directories
-          mkdir -p data logs config
-          
-          # Create test config
-          cat > config/test-config.yaml << EOF
-          sensor:
-            type: "environmental"
-            location: "CI Test"
-            manufacturer: "SensorTech"
-            model: "EnvMonitor-3000"
-            firmware_version: "1.4"
-          
-          simulation:
-            readings_per_second: 10
-            run_time_seconds: 5
-          
-          anomalies:
-            enabled: true
-            probability: 0.1
-          
-          database:
-            path: "/app/data/test.db"
-          
-          logging:
-            level: "INFO"
-            console_output: true
-          EOF
-
-      - name: Run container with default settings
+      - name: Validate Dockerfile exists
         run: |
-          docker run -d --name sensor-default \
-            -v $(pwd)/data:/app/data \
-            -v $(pwd)/logs:/app/logs \
-            sensor-simulator:test
-          
-          # Wait for container to generate some data
-          sleep 10
-          
-          # Check if container is still running
-          docker ps | grep sensor-default
-          
-          # Check logs for errors
-          docker logs sensor-default 2>&1 | grep -i error && exit 1 || true
-          
-          # Stop container
-          docker stop sensor-default
-
-      - name: Run container with custom config
-        run: |
-          docker run -d --name sensor-custom \
-            -v $(pwd)/data:/app/data \
-            -v $(pwd)/config:/app/config \
-            -e CONFIG_FILE=/app/config/test-config.yaml \
-            sensor-simulator:test
-          
-          # Wait for simulation to complete
-          sleep 7
-          
-          # Check if data was generated
-          if [ ! -f "data/test.db" ]; then
-            echo "Database file not created!"
-            exit 1
-          fi
-          
-          # Verify data was written
-          apt-get update && apt-get install -y sqlite3
-          count=$(sqlite3 data/test.db "SELECT COUNT(*) FROM sensor_data;" 2>/dev/null || echo "0")
-          echo "Generated $count readings"
-          
-          if [ "$count" -eq "0" ]; then
-            echo "No data generated!"
-            docker logs sensor-custom
+          if [ ! -f "Dockerfile" ]; then
+            echo "Dockerfile not found!"
             exit 1
           fi
-          
-          # Stop container
-          docker stop sensor-custom || true
 
-      - name: Test container with monitoring
-        run: |
-          docker run -d --name sensor-monitor \
-            -v $(pwd)/data:/app/data \
-            -e MONITORING_ENABLED=true \
-            -e MONITORING_PORT=8080 \
-            -p 8080:8080 \
-            sensor-simulator:test
-          
-          # Wait for monitoring to start
-          sleep 5
-          
-          # Test health endpoint
-          curl -f http://localhost:8080/healthz || exit 1
-          
-          # Test metrics endpoint
-          curl -f http://localhost:8080/metricz || exit 1
-          
-          # Stop container
-          docker stop sensor-monitor
-
-      - name: Test container resilience
-        run: |
-          # Test with missing directories
-          docker run -d --name sensor-resilient \
-            sensor-simulator:test
-          
-          sleep 5
-          
-          # Container should still be running
-          docker ps | grep sensor-resilient
-          
-          # Check for graceful handling
-          docker logs sensor-resilient 2>&1 | grep -E "(ERROR|CRITICAL)" | grep -v "recoverable" && exit 1 || true
-          
-          docker stop sensor-resilient
-
-  security-scan:
-    name: Security Scan
-    runs-on: ubuntu-latest
-    needs: build-container
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Download Docker image artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: docker-image
-          path: /tmp
-
-      - name: Load Docker image
-        run: |
-          docker load --input /tmp/sensor-simulator.tar
-          # Retag for simpler testing
-          docker tag ghcr.io/${{ github.repository }}:test-${{ github.sha }} sensor-simulator:test
-
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: sensor-simulator:test
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Upload Trivy results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v3
+      - name: Lint Dockerfile
+        uses: hadolint/hadolint-action@v3.1.0
         with:
-          sarif_file: 'trivy-results.sarif'
+          dockerfile: Dockerfile
         continue-on-error: true
 
-  publish:
-    name: Publish Docker Image
-    runs-on: ubuntu-latest
-    needs: [test, test-container, security-scan]
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Test Dockerfile build (single platform)
+        run: |
+          # Test that the Dockerfile can build successfully
+          # We only test a single platform build here for speed
+          docker build -t test-build:ci .
 
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          # Verify the image was created
+          docker images | grep test-build
 
-      - name: Build and push with build.py
-        run: |
-          # Install Python dependencies for build script
-          pip install rich
-          
-          # Get the current version from the latest tag or use default
-          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
-          VERSION_NUMBER=${LATEST_TAG#v}
-          
-          # Build and push with auto version bump
-          python build.py --version-bump minor
-          
-          # Also tag as latest for main branch
-          docker tag ghcr.io/${{ github.repository }}:$(cat .latest-semver) ghcr.io/${{ github.repository }}:latest
-          docker push ghcr.io/${{ github.repository }}:latest
-          
-          # Tag with branch name
-          docker tag ghcr.io/${{ github.repository }}:$(cat .latest-semver) ghcr.io/${{ github.repository }}:main
-          docker push ghcr.io/${{ github.repository }}:main
+          # Clean up
+          docker rmi test-build:ci || true