feat: align snowplow with service platform conventions

.github/workflows/chart-publish.yml

@@ -0,0 +1,81 @@
+name: publish-helm-chart
+
+on:
+  push:
+    tags: [ '[0-9]+.[0-9]+.[0-9]+' ]
+
+jobs:
+  publish-chart:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+
+      - name: Setup Helm
+        uses: azure/setup-helm@v3
+        with:
+          version: v3.12.0
+
+      - name: Ensure yq is available
+        run: |
+          if ! command -v yq >/dev/null 2>&1; then
+            sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+            sudo chmod +x /usr/local/bin/yq
+          fi
+
+      - name: Lint Helm chart
+        run: helm lint ./chart
+
+      - name: Get chart info
+        id: chart
+        run: |
+          CHART_NAME=$(yq e '.name' chart/Chart.yaml)
+          CHART_VERSION=${GITHUB_REF#refs/tags/}
+          echo "chart_name=$CHART_NAME" >> $GITHUB_OUTPUT
+          echo "chart_version=$CHART_VERSION" >> $GITHUB_OUTPUT
+
+      - name: Package Helm chart
+        run: |
+          mkdir -p ./charts
+          helm package ./chart \
+            --destination ./charts \
+            --version "${{ steps.chart.outputs.chart_version }}" \
+            --app-version "${{ steps.chart.outputs.chart_version }}"
+
+      - name: Authenticate with GitHub App
+        id: app-token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.PRIVATE_KEY }}
+
+      - name: Setup git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Clone gh-pages branch
+        run: |
+          git clone --branch gh-pages \
+            https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/krateoplatformops/helm-charts.git gh-pages
+
+      - name: Verify chart does not already exist
+        run: |
+          if [ -f "gh-pages/${{ steps.chart.outputs.chart_name }}-${{ steps.chart.outputs.chart_version }}.tgz" ]; then
+            echo "Chart already exists"
+            exit 1
+          fi
+
+      - name: Copy chart and update index
+        run: |
+          cp ./charts/${{ steps.chart.outputs.chart_name }}-${{ steps.chart.outputs.chart_version }}.tgz gh-pages/
+          cd gh-pages
+          helm repo index . --url https://krateoplatformops.github.io/helm-charts
+
+      - name: Commit & push to gh-pages
+        run: |
+          cd gh-pages
+          git add .
+          git commit -m "Publish ${{ steps.chart.outputs.chart_name }} v${{ steps.chart.outputs.chart_version }} [skip ci]"
+          git push origin gh-pages

.github/workflows/release-image.yml

@@ -0,0 +1,148 @@
+name: release-image
+
+on:
+  push:
+    tags: ['[0-9]+.[0-9]+.[0-9]+']
+
+env:
+  GHCR_REPO: ghcr.io/${{ github.repository }}
+
+jobs:
+  prepare:
+    name: Prepare image metadata
+    runs-on: ubuntu-24.04
+
+    outputs:
+      tags: ${{ steps.meta.outputs.tags }}
+      labels: ${{ steps.meta.outputs.labels }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Calcoliamo i tag una sola volta, cosi i job successivi restano allineati.
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.GHCR_REPO }}
+
+  build:
+    name: Build ${{ matrix.platform }}
+    needs: prepare
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            arch: amd64
+            runner: ubuntu-24.04
+          - platform: linux/arm64
+            arch: arm64
+            runner: ubuntu-24.04-arm
+
+    runs-on: ${{ matrix.runner }}
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      # Ogni job builda in modo nativo la propria architettura e pubblica solo il digest.
+      # I tag finali verranno associati tutti insieme nel job "publish".
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          labels: ${{ needs.prepare.outputs.labels }}
+          build-args: |
+            CACHEBUST=${{ github.sha }}
+            COMMIT_HASH=${{ github.sha }}
+          outputs: type=image,name=${{ env.GHCR_REPO }},push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=${{ matrix.arch }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
+
+      # Salviamo il digest come artifact per comporre poi il manifest multi-arch.
+      - name: Export digest
+        run: |
+          DIGEST="${{ steps.build.outputs.digest }}"
+          mkdir -p /tmp/digests
+          touch "/tmp/digests/${DIGEST#sha256:}"
+
+      - name: Upload digest artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: digest-${{ matrix.arch }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    name: Publish multi-arch image
+    needs:
+      - prepare
+      - build
+    runs-on: ubuntu-24.04
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v8
+        with:
+          path: /tmp/digests
+          pattern: digest-*
+          merge-multiple: true
+
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      # Qui assembliamo i digest pubblicati dai job precedenti in un'unica immagine multi-arch.
+      - name: Create and push manifest list
+        working-directory: /tmp/digests
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          TAG_ARGS=()
+          while IFS= read -r tag; do
+            [ -n "$tag" ] && TAG_ARGS+=(-t "$tag")
+          done <<'EOF'
+          ${{ needs.prepare.outputs.tags }}
+          EOF
+
+          DIGEST_ARGS=()
+          for digest_file in *; do
+            DIGEST_ARGS+=("${{ env.GHCR_REPO }}@sha256:${digest_file}")
+          done
+
+          docker buildx imagetools create "${TAG_ARGS[@]}" "${DIGEST_ARGS[@]}"
+
+      # Facoltativo ma utile: mostra in log il risultato finale con entrambe le architetture.
+      - name: Inspect published image
+        run: docker buildx imagetools inspect ${{ env.GHCR_REPO }}:${{ github.ref_name }}

Dockerfile

@@ -1,6 +1,6 @@
 # Build environment
 # -----------------
-FROM golang:1.25.4-trixie AS builder
+FROM golang:latest AS builder
 LABEL stage=builder
 
 ARG DEBIAN_FRONTEND=noninteractive
@@ -42,4 +42,4 @@ COPY --from=builder /bin/server /bin/server
 
 USER nonroot:nonroot
 
-ENTRYPOINT ["/bin/server"]
+ENTRYPOINT ["/bin/server"]