From 12e28b10592d32314b6cfcf6d5a11d78ea270b88 Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Thu, 8 Jan 2026 23:47:07 -0800
Subject: [PATCH 1/9] Configure Harbor registry for Docker builds and
 self-hosted runners

---
 .github/HARBOR_SETUP.md      | 72 ++++++++++++++++++++++++++++++++++++
 .github/workflows/docker.yml | 55 +++++++++++++++++++++------
 Makefile                     | 25 +++++++++++++
 docker-compose.yml           |  2 +-
 4 files changed, 141 insertions(+), 13 deletions(-)
 create mode 100644 .github/HARBOR_SETUP.md

diff --git a/.github/HARBOR_SETUP.md b/.github/HARBOR_SETUP.md
new file mode 100644
index 0000000..aa0b64b
--- /dev/null
+++ b/.github/HARBOR_SETUP.md
@@ -0,0 +1,72 @@
+# Harbor Registry Setup
+
+This project uses Harbor registry at `harbor.dataknife.net` for Docker image storage.
+
+## GitHub Secrets Configuration
+
+To enable automated builds and pushes to Harbor, you need to configure the following secrets in your GitHub repository:
+
+### Required Secrets
+
+1. **HARBOR_USERNAME**: Harbor robot account username
+
+2. **HARBOR_PASSWORD**: Harbor robot account password/token
+
+### Setting up GitHub Secrets
+
+You can set secrets using the GitHub CLI:
+
+```bash
+gh secret set HARBOR_USERNAME --repo <owner>/<repo> --body "your-harbor-username"
+gh secret set HARBOR_PASSWORD --repo <owner>/<repo> --body "your-harbor-password"
+```
+
+Or via the web UI:
+1. Go to your GitHub repository
+2. Navigate to **Settings** → **Secrets and variables** → **Actions**
+3. Click **New repository secret**
+4. Add the secrets (values should be obtained from your Harbor administrator)
+
+## Local Development
+
+For local development, you can set environment variables:
+
+```bash
+export HARBOR_USERNAME='your-harbor-username'
+export HARBOR_PASSWORD='your-harbor-password'
+```
+
+Then use the Makefile targets:
+
+```bash
+# Login to Harbor
+make docker-login
+
+# Build and push images
+make docker-push
+
+# Pull images
+make docker-pull
+```
+
+## Docker Image Location
+
+The image is stored in the Harbor registry:
+- `harbor.dataknife.net/library/high-command-api:latest`
+
+## Using Docker Compose
+
+Docker Compose is configured to pull images from Harbor automatically. Just run:
+
+```bash
+docker-compose pull
+docker-compose up -d
+```
+
+Make sure you're logged into Harbor first:
+
+```bash
+docker login harbor.dataknife.net \
+  -u 'your-harbor-username' \
+  -p 'your-harbor-password'
+```
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 05bf51e..c63e6a8 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,25 +1,56 @@
-name: Build Docker Image
+name: Build and Push Docker Image
 
 on:
   push:
-    branches: [main, develop]
+    branches:
+      - main
+      - master
   pull_request:
-    branches: [main, develop]
+    branches:
+      - main
+      - master
+  workflow_dispatch:
 
-jobs:
-  build:
-    runs-on: ubuntu-latest
+env:
+  HARBOR_REGISTRY: harbor.dataknife.net
+  IMAGE_NAME: library/high-command-api
 
+jobs:
+  build-and-push:
+    runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v5
+      - name: Checkout code
+        uses: actions/checkout@v6
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build Docker image
-        uses: docker/build-push-action@v6
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
         with:
           context: .
-          push: false
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          file: ./Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
diff --git a/Makefile b/Makefile
index e916412..a0bce2d 100644
--- a/Makefile
+++ b/Makefile
@@ -29,6 +29,9 @@ help:
 	@echo "  format         Format code with black and ruff"
 	@echo "  clean          Remove build artifacts and cache files"
 	@echo "  docker-build   Build Docker image"
+	@echo "  docker-login   Login to Harbor registry (requires HARBOR_USERNAME and HARBOR_PASSWORD)"
+	@echo "  docker-push    Build and push image to Harbor registry"
+	@echo "  docker-pull    Pull image from Harbor registry"
 	@echo "  docker-run     Run Docker container"
 	@echo "  check          Run linters and tests"
 	@echo "  check-all      Format, lint, and test (quality gate)"
@@ -70,8 +73,30 @@ clean:
 	find . -type d -name "*.egg-info" -exec rm -rf {} + 2>/dev/null || true
 	rm -rf build dist .pytest_cache .mypy_cache htmlcov .ruff_cache .coverage
 
+HARBOR_REGISTRY := harbor.dataknife.net
+HARBOR_IMAGE := $(HARBOR_REGISTRY)/library/$(APP_NAME)
+IMAGE_TAG ?= latest
+
+docker-login:
+	@echo "Logging into Harbor registry..."
+	@if [ -z "$$HARBOR_USERNAME" ] || [ -z "$$HARBOR_PASSWORD" ]; then \
+		echo "Error: HARBOR_USERNAME and HARBOR_PASSWORD must be set"; \
+		exit 1; \
+	fi
+	docker login $(HARBOR_REGISTRY) \
+		-u "$$HARBOR_USERNAME" \
+		-p "$$HARBOR_PASSWORD"
+
 docker-build:
 	docker build -t $(APP_NAME):latest .
+	docker tag $(APP_NAME):latest $(HARBOR_IMAGE):$(IMAGE_TAG)
+
+docker-push: docker-build docker-login
+	docker push $(HARBOR_IMAGE):$(IMAGE_TAG)
+
+docker-pull:
+	docker pull $(HARBOR_IMAGE):$(IMAGE_TAG)
+	docker tag $(HARBOR_IMAGE):$(IMAGE_TAG) $(APP_NAME):latest
 
 docker-run: docker-build
 	docker run -it --rm -p $(PORT):5000 $(APP_NAME):latest
diff --git a/docker-compose.yml b/docker-compose.yml
index b78d4b4..2bddb0c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,7 +2,7 @@ version: '3.8'
 
 services:
   api:
-    build: .
+    image: harbor.dataknife.net/library/high-command-api:latest
     ports:
       - "5000:5000"
     environment:

From 8e9e0b4a9efc525804be920d0120b97384e1dc01 Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 13:20:52 -0800
Subject: [PATCH 2/9] feat: add GitLab push job as separate stage

---
 .github/workflows/tests.yml | 117 ++++++++++++++++++++++--------------
 1 file changed, 72 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2d3a530..00b2e4e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,65 +1,92 @@
 name: Tests
-
-on:
+true:
+  workflow_dispatch: null
   push:
-    branches: [main, develop]
+    branches:
+    - main
+    - develop
   pull_request:
-    branches: [main, develop]
-
+    branches:
+    - main
+    - develop
 jobs:
   test:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ['3.13', '3.14']
-
+        os:
+        - ubuntu-latest
+        - macos-latest
+        - windows-latest
+        python-version:
+        - '3.13'
+        - '3.14'
     steps:
-      - uses: actions/checkout@v5
+    - uses: actions/checkout@v5
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v6
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install dependencies
+      run: 'python -m pip install --upgrade pip
 
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ matrix.python-version }}
+        pip install -e ".[dev]"
 
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -e ".[dev]"
+        '
+    - name: Run linters
+      run: 'ruff check src tests
 
-      - name: Run linters
-        run: |
-          ruff check src tests
-          mypy src --ignore-missing-imports
+        mypy src --ignore-missing-imports
 
-      - name: Run tests with coverage
-        run: |
-          pytest --cov=src --cov-report=xml --cov-report=term --cov-fail-under=80
-
-      - name: Upload coverage reports
-        uses: codecov/codecov-action@v5
-        with:
-          files: ./coverage.xml
-          flags: unittests
-          name: codecov-umbrella
-          fail_ci_if_error: false
+        '
+    - name: Run tests with coverage
+      run: 'pytest --cov=src --cov-report=xml --cov-report=term --cov-fail-under=80
 
+        '
+    - name: Upload coverage reports
+      uses: codecov/codecov-action@v5
+      with:
+        files: ./coverage.xml
+        flags: unittests
+        name: codecov-umbrella
+        fail_ci_if_error: false
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+    - uses: actions/checkout@v5
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.14'
+    - name: Install dependencies
+      run: 'python -m pip install --upgrade pip
+
+        pip install bandit safety
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.14'
+        '
+    - name: Run security checks
+      run: 'bandit -r src -f json -o bandit-report.json || true
+
+        safety check --json || true
+
+        '
+  push-to-gitlab:
+    name: Push to GitLab
+    runs-on: ubuntu-latest
+    needs:
+    - test
+    if: always() && needs.test.result == "success"
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Push to GitLab
+      env:
+        GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
+      run: 'git config user.name "GitHub Actions"
 
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install bandit safety
+        git config user.email "actions@github.com"
 
-      - name: Run security checks
-        run: |
-          bandit -r src -f json -o bandit-report.json || true
-          safety check --json || true
+        git push https://oauth2:${GITLAB_TOKEN}@gitlab.com/dk-raas/dkai/high-command/high-command-api.git HEAD:main --force
+        || echo "GitLab push failed"'

From 0b9c56ffa1735bc8adb758c6c56325393a38d361 Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 13:21:58 -0800
Subject: [PATCH 3/9] feat: add GitLab push job as separate stage

---
 .github/workflows/tests.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 00b2e4e..bfadae6 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,6 +1,6 @@
 name: Tests
-true:
-  workflow_dispatch: null
+on:
+  workflow_dispatch:
   push:
     branches:
     - main

From f7a8e33da82f9857045f91e05eec65dce2e3deab Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 13:50:54 -0800
Subject: [PATCH 4/9] fix: update workflow syntax and add security job to push
 dependencies

---
 .github/workflows/tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index bfadae6..f69e25d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-latest
     needs:
     - test
-    if: always() && needs.test.result == "success"
+    if: always() && needs.test.result == 'success'
     steps:
     - name: Checkout code
       uses: actions/checkout@v4

From e8f07db725d464165815aa5bb4160464ca79af6d Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 13:59:36 -0800
Subject: [PATCH 5/9] ci: add GitLab CI for Docker builds only (tests run on
 GitHub)

---
 .gitlab-ci.yml | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 .gitlab-ci.yml

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..197714b
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,36 @@
+stages:
+  - build
+
+variables:
+  HARBOR_REGISTRY: harbor.dataknife.net
+  HARBOR_PROJECT: library
+  IMAGE_NAME: high-command-api
+
+docker-build:
+  stage: build
+  image: docker:latest
+  services:
+    - docker:dind
+  before_script:
+    - docker login -u "$HARBOR_USERNAME" -p "$HARBOR_PASSWORD" $HARBOR_REGISTRY
+  script:
+    - |
+      # Build image
+      docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest .
+      docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA .
+      
+      # Push images
+      docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest
+      docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA
+      
+      # Tag with version if tag exists
+      if [ -n "$CI_COMMIT_TAG" ]; then
+        docker tag $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest \
+          $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG
+        docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG
+      fi
+  only:
+    - main
+    - tags
+  tags:
+    - docker

From a95bff935efc1bd0c24702a13bee76cc4425fa19 Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 14:03:45 -0800
Subject: [PATCH 6/9] chore: remove Docker workflow from auto-approve (moved to
 GitLab)

---
 .github/workflows/auto-approve.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index e95b6f3..64d6ffc 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -2,7 +2,7 @@ name: Auto Approve
 
 on:
   workflow_run:
-    workflows: [Tests, Build Docker Image]
+        workflows: [Tests]
     types: [completed]
 
 jobs:

From 58f1ec63af4548e93103eae9b19d7834de033bb8 Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 14:08:20 -0800
Subject: [PATCH 7/9] chore: remove Docker workflow files (moved to GitLab CI)

---
 .github/workflows/docker.yml | 56 ------------------------------------
 1 file changed, 56 deletions(-)
 delete mode 100644 .github/workflows/docker.yml

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
deleted file mode 100644
index c63e6a8..0000000
--- a/.github/workflows/docker.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: Build and Push Docker Image
-
-on:
-  push:
-    branches:
-      - main
-      - master
-  pull_request:
-    branches:
-      - main
-      - master
-  workflow_dispatch:
-
-env:
-  HARBOR_REGISTRY: harbor.dataknife.net
-  IMAGE_NAME: library/high-command-api
-
-jobs:
-  build-and-push:
-    runs-on: self-hosted
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Harbor
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.HARBOR_REGISTRY }}
-          username: ${{ secrets.HARBOR_USERNAME }}
-          password: ${{ secrets.HARBOR_PASSWORD }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable={{is_default_branch}}
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./Dockerfile
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
-          cache-to: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max

From eae285ad62b1363cad4debb13749e01408cfd1fa Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 14:18:20 -0800
Subject: [PATCH 8/9] docs: remove Harbor setup documentation (moved to GitLab
 CI)

---
 .github/HARBOR_SETUP.md | 72 -----------------------------------------
 1 file changed, 72 deletions(-)
 delete mode 100644 .github/HARBOR_SETUP.md

diff --git a/.github/HARBOR_SETUP.md b/.github/HARBOR_SETUP.md
deleted file mode 100644
index aa0b64b..0000000
--- a/.github/HARBOR_SETUP.md
+++ /dev/null
@@ -1,72 +0,0 @@
-# Harbor Registry Setup
-
-This project uses Harbor registry at `harbor.dataknife.net` for Docker image storage.
-
-## GitHub Secrets Configuration
-
-To enable automated builds and pushes to Harbor, you need to configure the following secrets in your GitHub repository:
-
-### Required Secrets
-
-1. **HARBOR_USERNAME**: Harbor robot account username
-
-2. **HARBOR_PASSWORD**: Harbor robot account password/token
-
-### Setting up GitHub Secrets
-
-You can set secrets using the GitHub CLI:
-
-```bash
-gh secret set HARBOR_USERNAME --repo <owner>/<repo> --body "your-harbor-username"
-gh secret set HARBOR_PASSWORD --repo <owner>/<repo> --body "your-harbor-password"
-```
-
-Or via the web UI:
-1. Go to your GitHub repository
-2. Navigate to **Settings** → **Secrets and variables** → **Actions**
-3. Click **New repository secret**
-4. Add the secrets (values should be obtained from your Harbor administrator)
-
-## Local Development
-
-For local development, you can set environment variables:
-
-```bash
-export HARBOR_USERNAME='your-harbor-username'
-export HARBOR_PASSWORD='your-harbor-password'
-```
-
-Then use the Makefile targets:
-
-```bash
-# Login to Harbor
-make docker-login
-
-# Build and push images
-make docker-push
-
-# Pull images
-make docker-pull
-```
-
-## Docker Image Location
-
-The image is stored in the Harbor registry:
-- `harbor.dataknife.net/library/high-command-api:latest`
-
-## Using Docker Compose
-
-Docker Compose is configured to pull images from Harbor automatically. Just run:
-
-```bash
-docker-compose pull
-docker-compose up -d
-```
-
-Make sure you're logged into Harbor first:
-
-```bash
-docker login harbor.dataknife.net \
-  -u 'your-harbor-username' \
-  -p 'your-harbor-password'
-```

From b5adee300a3479f0c7daa37b390913f61fdcb6ce Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 14:21:22 -0800
Subject: [PATCH 9/9] fix: apply Copilot review suggestions

- GitLab CI: Use --password-stdin for secure Harbor login
- GitLab CI: Build once and tag instead of building twice
- GitLab CI: Replace deprecated 'only' with 'rules'
- Makefile: Use --password-stdin for docker-login (security)
- Makefile: Add .PHONY declarations for new targets
- Makefile: Reorder docker-push dependencies for clarity
- GitHub Actions: Standardize checkout action to v5
- GitHub Actions: Remove --force flag, use credential helper for git push
- GitHub Actions: Fix multiline command formatting
---
 .github/workflows/tests.yml | 41 +++++++++++++++----------------------
 .gitlab-ci.yml              | 15 ++++++++------
 Makefile                    |  9 ++++----
 3 files changed, 30 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f69e25d..36ccbc2 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -28,21 +28,15 @@ jobs:
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
-      run: 'python -m pip install --upgrade pip
-
+      run: |
+        python -m pip install --upgrade pip
         pip install -e ".[dev]"
-
-        '
     - name: Run linters
-      run: 'ruff check src tests
-
+      run: |
+        ruff check src tests
         mypy src --ignore-missing-imports
-
-        '
     - name: Run tests with coverage
-      run: 'pytest --cov=src --cov-report=xml --cov-report=term --cov-fail-under=80
-
-        '
+      run: pytest --cov=src --cov-report=xml --cov-report=term --cov-fail-under=80
     - name: Upload coverage reports
       uses: codecov/codecov-action@v5
       with:
@@ -59,17 +53,13 @@ jobs:
       with:
         python-version: '3.14'
     - name: Install dependencies
-      run: 'python -m pip install --upgrade pip
-
+      run: |
+        python -m pip install --upgrade pip
         pip install bandit safety
-
-        '
     - name: Run security checks
-      run: 'bandit -r src -f json -o bandit-report.json || true
-
+      run: |
+        bandit -r src -f json -o bandit-report.json || true
         safety check --json || true
-
-        '
   push-to-gitlab:
     name: Push to GitLab
     runs-on: ubuntu-latest
@@ -78,15 +68,16 @@ jobs:
     if: always() && needs.test.result == 'success'
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         fetch-depth: 0
     - name: Push to GitLab
       env:
         GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
-      run: 'git config user.name "GitHub Actions"
-
+      run: |
+        git config user.name "GitHub Actions"
         git config user.email "actions@github.com"
-
-        git push https://oauth2:${GITLAB_TOKEN}@gitlab.com/dk-raas/dkai/high-command/high-command-api.git HEAD:main --force
-        || echo "GitLab push failed"'
+        git remote add gitlab https://gitlab.com/dk-raas/dkai/high-command/high-command-api.git || true
+        git config credential.helper '!f() { echo "username=oauth2"; echo "password=${GITLAB_TOKEN}"; }; f'
+        git fetch gitlab main || true
+        git push gitlab HEAD:main || echo "GitLab push failed"
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 197714b..673ffaf 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -12,12 +12,15 @@ docker-build:
   services:
     - docker:dind
   before_script:
-    - docker login -u "$HARBOR_USERNAME" -p "$HARBOR_PASSWORD" $HARBOR_REGISTRY
+    - echo "$HARBOR_PASSWORD" | docker login -u "$HARBOR_USERNAME" --password-stdin $HARBOR_REGISTRY
   script:
     - |
-      # Build image
+      # Build image once
       docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest .
-      docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA .
+      
+      # Tag with commit SHA
+      docker tag $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest \
+        $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA
       
       # Push images
       docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest
@@ -29,8 +32,8 @@ docker-build:
           $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG
         docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG
       fi
-  only:
-    - main
-    - tags
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_TAG'
   tags:
     - docker
diff --git a/Makefile b/Makefile
index a0bce2d..cfd1d07 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: help install dev test lint format clean docker-build docker-run run check check-all commit-changes release venv
+.PHONY: help install dev test lint format clean docker-build docker-login docker-push docker-pull docker-run run check check-all commit-changes release venv
 
 # Force use of bash shell (required for make to work properly with line continuations)
 SHELL := /bin/bash
@@ -83,15 +83,16 @@ docker-login:
 		echo "Error: HARBOR_USERNAME and HARBOR_PASSWORD must be set"; \
 		exit 1; \
 	fi
-	docker login $(HARBOR_REGISTRY) \
+	@echo "$$HARBOR_PASSWORD" | docker login $(HARBOR_REGISTRY) \
 		-u "$$HARBOR_USERNAME" \
-		-p "$$HARBOR_PASSWORD"
+		--password-stdin
 
 docker-build:
 	docker build -t $(APP_NAME):latest .
 	docker tag $(APP_NAME):latest $(HARBOR_IMAGE):$(IMAGE_TAG)
 
-docker-push: docker-build docker-login
+# Ensure we are logged into Harbor before building/tagging and pushing the image.
+docker-push: docker-login docker-build
 	docker push $(HARBOR_IMAGE):$(IMAGE_TAG)
 
 docker-pull: