Optional varighet with start–end display, edge-case tests, CI bumps

.env.example

@@ -3,6 +3,10 @@
 # In production these are injected by docker-compose via env_file; the .env
 # loader only runs outside production and never overrides an already-set
 # variable.
+#
+# ENV and NODE_ENV cannot be set here. Whether this file is read at all depends
+# on the environment name, so it is resolved before the file is opened — set
+# them in the real environment instead (docker-compose sets ENV).
 
 # ── FusionAuth (identity) ──────────────────────────────────────────────────
 FUSION_AUTH_HOST=https://auth.itemize.no
@@ -40,7 +44,17 @@ DISCORD_SERVER_MEMBER_ROLE_ID=
 
 # ── HTTP ───────────────────────────────────────────────────────────────────
 # Port to bind. PORT wins if both are set; LISTEN is kept for compatibility
-# with the old deployment and with docker-compose.
+# with the old deployment and with docker-compose. A bare port, :port or
+# host:port are all accepted; the port must be between 1 and 65535, and 0 is
+# refused because the kernel would pick a port the health check cannot find.
+#
+# Under docker-compose, keep this a bare port. The compose file spends LISTEN
+# twice — as the host side of '${LISTEN:-3000}:3000', and, via env_file, as the
+# port the process inside the container binds. The container side of that
+# mapping is hardcoded to 3000, so the two only agree when LISTEN is 3000.
+# Anything else publishes a port nothing is listening on, and :port or
+# host:port is not a shape the ports: mapping accepts at all. Running the
+# binary directly, every form above works.
 LISTEN=3000
 # No trailing slash — OAuth redirect URIs are built by concatenation.
 BASE_URL=https://itemize.no

.github/dependabot.yml

@@ -8,11 +8,17 @@
 # the repository's history is otherwise dominated by one-at-a-time
 # "Bump X from A to B". Major versions still arrive on their own, so somebody
 # actually reads them.
+#
+# Updates open against dev rather than main, so they land where the rest of the
+# work does and reach main through the usual pull request. Dependabot reads this
+# file from the default branch regardless, so target-branch has to be set here
+# on main to take effect. Security updates are exempt and still arrive on main.
 version: 2
 
 updates:
   - package-ecosystem: gomod
     directory: /
+    target-branch: dev
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
@@ -24,11 +30,13 @@ updates:
 
   - package-ecosystem: docker
     directory: /
+    target-branch: dev
     schedule:
       interval: weekly
 
   - package-ecosystem: github-actions
     directory: /
+    target-branch: dev
     schedule:
       interval: weekly
     groups:

.github/workflows/ci.yml

@@ -29,9 +29,9 @@ jobs:
           --health-retries 10
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -65,18 +65,18 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - id: meta
-        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ghcr.io/${{ github.repository }}
           # latest on main, dev on dev — unchanged from the previous pipeline,
@@ -88,7 +88,7 @@ jobs:
             type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
             type=sha,prefix=sha-,format=short
 
-      - uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: true