ci: add semantic-release pipeline with GHCR release deploy

Releases are now driven by Conventional Commits via semantic-release:
version bump, GitHub release, changelog, and a semver-tagged Docker image
pushed to GHCR. docker-publish.yml is reduced to PR validation builds.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Disane87

.github/workflows/docker-publish.yml

@@ -1,9 +1,10 @@
-name: Build & publish Docker image
+name: Validate Docker build
+
+# Release images are published by release.yml (semantic-release driven).
+# This workflow only validates that the image still builds on pull requests,
+# and lets you build/push an ad-hoc image manually when needed.
 
 on:
-  push:
-    branches: [main, master]
-    tags: ['v*.*.*']
   pull_request:
     branches: [main, master]
   workflow_dispatch:
@@ -21,16 +22,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      # GHCR image names must be lowercase — derive from owner/repo.
+      # GHCR image names must be lowercase; derive from owner/repo.
       - name: Compute lowercase image name
         run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      # Only log in / push for real events, never for fork pull requests.
+      # Only log in for manual runs (which push); pull requests build only.
       - name: Log in to GHCR
-        if: github.event_name != 'pull_request'
+        if: github.event_name == 'workflow_dispatch'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -43,18 +44,15 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            type=ref,event=branch
             type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
             type=sha,format=short
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=edge,enable=${{ github.event_name == 'workflow_dispatch' }}
 
-      - name: Build and push
+      - name: Build (and push on manual run)
         uses: docker/build-push-action@v6
         with:
           context: .
-          push: ${{ github.event_name != 'pull_request' }}
+          push: ${{ github.event_name == 'workflow_dispatch' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha

.github/workflows/release.yml

@@ -0,0 +1,87 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+# Prevent overlapping releases from racing each other.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+env:
+  REGISTRY: ghcr.io
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write        # create tags, releases, push changelog commit
+      issues: write          # comment on released issues
+      pull-requests: write   # comment on released PRs
+      packages: write        # push the container image to GHCR
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: true
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      # Determines the next version from conventional commits, updates the
+      # changelog + package.json, creates the git tag and GitHub release, and
+      # exports the version via @semantic-release/exec -> $GITHUB_OUTPUT.
+      - name: Semantic release
+        id: semrel
+        run: npx semantic-release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # Everything below only runs when a new version was actually published.
+      - name: Compute image name & tags
+        if: steps.semrel.outputs.version != ''
+        run: |
+          echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
+          VER='${{ steps.semrel.outputs.version }}'
+          {
+            echo "TAG_VERSION=$VER"
+            echo "TAG_MAJOR_MINOR=${VER%.*}"
+          } >> "$GITHUB_ENV"
+
+      - name: Set up Docker Buildx
+        if: steps.semrel.outputs.version != ''
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        if: steps.semrel.outputs.version != ''
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build & push release image
+        if: steps.semrel.outputs.version != ''
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG_VERSION }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG_MAJOR_MINOR }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          labels: |
+            org.opencontainers.image.version=${{ env.TAG_VERSION }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.releaserc.json

@@ -0,0 +1,33 @@
+{
+  "branches": ["main"],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    [
+      "@semantic-release/changelog",
+      {
+        "changelogTitle": "# Changelog\n\nAll notable changes to hon.ey are documented here. This file is generated by semantic-release."
+      }
+    ],
+    [
+      "@semantic-release/npm",
+      {
+        "npmPublish": false
+      }
+    ],
+    [
+      "@semantic-release/exec",
+      {
+        "verifyReleaseCmd": "echo \"version=${nextRelease.version}\" >> $GITHUB_OUTPUT"
+      }
+    ],
+    "@semantic-release/github",
+    [
+      "@semantic-release/git",
+      {
+        "assets": ["package.json", "package-lock.json", "CHANGELOG.md"],
+        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      }
+    ]
+  ]
+}

README.md

@@ -4,6 +4,7 @@
 ![Vue](https://img.shields.io/badge/Vue-3-42b883?logo=vuedotjs&logoColor=white)
 ![GitHub license](https://img.shields.io/github/license/Disane87/honey)
 ![GitHub issues](https://img.shields.io/github/issues/Disane87/honey?color=red)
+[![semantic-release: conventionalcommits](https://img.shields.io/badge/semantic--release-conventionalcommits-e10079?logo=semantic-release)](https://github.com/semantic-release/semantic-release)
 
 
 # 🍯 hon.ey URL Honeypot
@@ -172,6 +173,26 @@ the `custom` trap renders operator-authored HTML verbatim. Don't use any of this
 impersonate third parties, because that crosses into phishing and is illegal in most places. 🙏
 
 
+# 🚀 Releases
+
+Versioning is fully automated with [semantic-release](https://semantic-release.gitbook.io/). Every
+push to `main` is analyzed, and your [Conventional Commits](https://www.conventionalcommits.org/)
+decide what happens next:
+
+- 🐛 `fix:` → patch release (1.0.**1**)
+- ✨ `feat:` → minor release (1.**1**.0)
+- 💥 `feat!:` or a `BREAKING CHANGE:` footer → major release (**2**.0.0)
+- 🧹 `chore:`, `docs:`, `refactor:`, `test:` and friends → no release
+
+When a release is cut, the pipeline automatically:
+
+1. 🏷️ Tags the commit and creates a **GitHub Release** with generated notes
+2. 📝 Updates [`CHANGELOG.md`](CHANGELOG.md) and the version in `package.json`
+3. 🐳 Builds and pushes the Docker image to GHCR as `:x.y.z`, `:x.y`, and `:latest`
+
+So just write good commit messages and let the robots do the boring part! 🤖✨
+
+
 # 📄 License
 
 [MIT](LICENSE). Do good things with it.

app/assets/css/main.css

@@ -237,6 +237,14 @@ tr.clickable:hover td { background: var(--surface-2); }
 .kv dd { margin: 0; font-family: var(--mono); font-size: 12.5px; word-break: break-word; color: var(--ink); }
 .headers-box { background: var(--surface-2); border: 1px solid var(--border); border-radius: var(--r-sm); padding: 14px 16px; font-family: var(--mono); font-size: 12px; max-height: 320px; overflow: auto; white-space: pre-wrap; word-break: break-all; color: var(--ink-soft); }
 
+/* ---------- geo / flag + map ---------- */
+.geo-cell { display: inline-flex; align-items: center; gap: 7px; }
+.flag { font-size: 16px; border-radius: 999px; flex-shrink: 0; }
+.hit-map { position: relative; border: 1px solid var(--border); border-radius: var(--r-sm); overflow: hidden; margin: 8px 4px 16px; }
+.hit-map iframe { width: 100%; height: 200px; border: 0; display: block; }
+.hit-map-pill { position: absolute; left: 12px; bottom: 12px; display: inline-flex; align-items: center; gap: 8px; background: rgba(46, 36, 21, .88); color: #fff; padding: 7px 13px; border-radius: 999px; font-size: 12.5px; font-weight: 600; -webkit-backdrop-filter: blur(4px); backdrop-filter: blur(4px); }
+.hit-map-pill .flag { font-size: 16px; }
+
 /* ---------- cloned OG preview card ---------- */
 .og-card { display: flex; flex-direction: column; max-width: 540px; border: 1px solid var(--border); border-radius: var(--r); overflow: hidden; background: var(--surface-2); box-shadow: var(--shadow-sm); }
 .og-img { width: 100%; max-height: 260px; object-fit: cover; display: block; background: var(--bg-tint); }

app/composables/useFormat.ts

@@ -22,14 +22,44 @@ export function useFormat() {
     return [hit.geo.city, hit.geo.country].filter(Boolean).join(', ') || '—'
   }
 
+  /**
+   * Iconify name for a hit's country flag from the locally-bundled
+   * `circle-flags` collection. Falls back to a neutral globe when the
+   * geo lookup yielded no country code.
+   */
+  function flagIcon(hit: Hit): string {
+    const cc = hit.geo?.countryCode?.toLowerCase()
+    return cc ? `circle-flags:${cc}` : 'lucide:globe'
+  }
+
+  function hasCoords(hit: Hit): boolean {
+    return typeof hit.geo?.lat === 'number' && typeof hit.geo?.lon === 'number'
+  }
+
+  /**
+   * OpenStreetMap embed URL framing a hit's coordinates, with a marker.
+   * Returns '' when the hit has no usable coordinates.
+   */
+  function mapUrl(hit: Hit): string {
+    if (!hasCoords(hit)) return ''
+    const lat = hit.geo!.lat as number
+    const lon = hit.geo!.lon as number
+    const dx = 3.2
+    const dy = 1.7
+    const bbox = [lon - dx, lat - dy, lon + dx, lat + dy]
+      .map((n) => n.toFixed(4))
+      .join('%2C')
+    return `https://www.openstreetmap.org/export/embed.html?bbox=${bbox}&layer=mapnik&marker=${lat.toFixed(4)}%2C${lon.toFixed(4)}`
+  }
+
   function uaLabel(hit: Hit): string {
     const u = hit.ua
     const browser = [u.browser, u.browserVersion?.split('.')[0]].filter(Boolean).join(' ')
     const os = [u.os, u.osVersion].filter(Boolean).join(' ')
     return [browser, os].filter(Boolean).join(' · ') || (hit.userAgent ? 'Unknown client' : 'No UA')
   }
 
-  return { relTime, absTime, geoLabel, uaLabel }
+  return { relTime, absTime, geoLabel, uaLabel, flagIcon, hasCoords, mapUrl }
 }
 
 export function trapUrls(slug: string, type: string, origin: string) {

app/pages/feed.vue

@@ -3,7 +3,7 @@ import type { Hit, Trap } from '~~/server/utils/types'
 
 const { data: hits, refresh } = await useFetch<Hit[]>('/api/hits')
 const { data: traps } = await useFetch<Trap[]>('/api/traps')
-const { relTime, absTime, geoLabel, uaLabel } = useFormat()
+const { relTime, absTime, geoLabel, uaLabel, flagIcon } = useFormat()
 
 const trapName = (id: string) => traps.value?.find(t => t.id === id)?.name || 'unknown trap'
 
@@ -40,7 +40,7 @@ onBeforeUnmount(() => clearInterval(poll))
             <td :title="absTime(h.ts)" data-allow-mismatch>{{ relTime(h.ts) }}</td>
             <td><span style="font-weight:600">{{ trapName(h.trapId) }}</span></td>
             <td class="code">{{ h.ip }}</td>
-            <td>{{ geoLabel(h) }}</td>
+            <td><span class="geo-cell"><Icon :name="flagIcon(h)" class="flag" /> {{ geoLabel(h) }}</span></td>
             <td>{{ uaLabel(h) }}</td>
             <td>
               <span class="badge" :class="h.isBot ? 'bot' : 'human'">

app/pages/traps/[id].vue

@@ -5,7 +5,7 @@ import { trapUrls, usePublicOrigin } from '~/composables/useFormat'
 const route = useRoute()
 const id = route.params.id as string
 const { data, refresh, pending } = await useFetch<{ trap: Trap; hits: Hit[] }>(`/api/traps/${id}`)
-const { relTime, absTime, geoLabel, uaLabel } = useFormat()
+const { relTime, absTime, geoLabel, uaLabel, flagIcon, hasCoords, mapUrl } = useFormat()
 
 const origin = usePublicOrigin()
 const expanded = ref<string | null>(null)
@@ -174,7 +174,7 @@ onBeforeUnmount(() => clearInterval(poll))
             <tr class="clickable" @click="toggle(h.id)">
               <td :title="absTime(h.ts)" data-allow-mismatch>{{ relTime(h.ts) }}</td>
               <td class="code">{{ h.ip }}</td>
-              <td>{{ geoLabel(h) }}</td>
+              <td><span class="geo-cell"><Icon :name="flagIcon(h)" class="flag" /> {{ geoLabel(h) }}</span></td>
               <td>{{ uaLabel(h) }}</td>
               <td>
                 <span class="badge" :class="h.isBot ? 'bot' : 'human'">
@@ -184,6 +184,13 @@ onBeforeUnmount(() => clearInterval(poll))
             </tr>
             <tr v-if="expanded === h.id">
               <td colspan="5" style="background: var(--surface-2);">
+                <div v-if="hasCoords(h)" class="hit-map">
+                  <iframe :src="mapUrl(h)" title="Hit location" loading="lazy"></iframe>
+                  <div class="hit-map-pill">
+                    <Icon :name="flagIcon(h)" class="flag" />
+                    {{ geoLabel(h) }}<template v-if="h.geo?.isp"> · {{ h.geo.isp }}</template>
+                  </div>
+                </div>
                 <div class="row" style="gap: 32px; padding: 8px 4px 16px;">
                   <dl class="kv" style="flex:1; min-width: 280px;">
                     <dt>Timestamp</dt><dd>{{ absTime(h.ts) }}</dd>

nuxt.config.ts

@@ -8,8 +8,8 @@ export default defineNuxtConfig({
   modules: ['@nuxt/icon'],
 
   icon: {
-    // Bundle the Lucide collection so icons resolve locally (no outbound CDN).
-    serverBundle: { collections: ['lucide'] }
+    // Bundle the Lucide + circle-flags collections so icons resolve locally (no outbound CDN).
+    serverBundle: { collections: ['lucide', 'circle-flags'] }
   },
 
   app: {