chore: publish the backend image to GitHub Container Registry (#85)

[dthinkr]

Ref #85

Why

The backend image was published to a registry account outside lobx-platform, so deployment depended on an account the organisation does not control. Since the org already owns this repository, the image can live in its own registry instead.

What changed

File	Change
.github/workflows/docker-build-push.yml	Build and push to ghcr.io/lobx-platform/trading_platform; the deploy job authenticates with the workflow's own token and logs out afterwards
docker-compose.server.yml	Image reference updated
deploy.sh	A failed image pull is now fatal instead of ignored
back/.dockerignore	Aligned with the repo-root ignore rules

Before / after

Registry ownership

	before	after
Image source	a registry account outside the org	ghcr.io/lobx-platform/trading_platform
Registry credential used at deploy	a long-lived token held as a repository secret	the workflow's own GITHUB_TOKEN, valid only for that run
Left behind after the deploy	persists	removed by an explicit logout

A failed pull

before:

Pulling backend image...
Backend image pull failed; continuing with any existing local image
Starting services...

Exit code 0. The run reports success even though nothing new was deployed.

after:

Pulling backend image...
ERROR: could not pull the backend image from the registry.
Refusing to continue, because doing so would silently redeploy the previous version.

Exit code 1. The deploy fails visibly.

Build context ignore rules

The image is built with ./back as its context, so the repo-root .dockerignore never applied to it and the two files had drifted apart. Verified by building from a local working copy that contains files matching the root file's credential patterns: none of them appear in the resulting image, and a scan of the image tree finds no key material. CI was already unaffected, since those files are gitignored and a fresh checkout does not contain them.

Credential handling at deploy time

secrets.GITHUB_TOKEN is scoped to the run and expires when the job ends, and the job logs out explicitly. Containers use restart: unless-stopped, so a restart reuses the local image rather than pulling; a pull only happens during a deploy, while that token is present.

Before merging

The package is created by the first push. Once the first run on main completes, check the package's visibility and repository link under the organisation's package settings and set them as intended.

DOCKERHUB_USERNAME and DOCKERHUB_TOKEN are no longer referenced and can be removed from the repository secrets.

Note

Merging triggers a real deployment.

🤖 Generated with Claude Code