feat: scaffold temporal worker with DBBackup and OutboxPurge workflows

.dockerignore

@@ -0,0 +1,14 @@
+.git
+.gitignore
+.github
+.vscode
+.editorconfig
+.releaserc.json
+.renovaterc.json
+# .golangci.yaml is needed for the lint stage, so it is not excluded here
+bin
+dist
+*.md
+CODEOWNERS
+.env
+.env.local

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.go]
+indent_style = tab
+tab_width = 4
+
+[*.{yaml,yml}]
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: [dargmuesli]

.github/semantic.yml

@@ -0,0 +1,5 @@
+# Always validate the PR title AND all the commits
+titleAndCommits: true
+# Allows use of Merge commits (eg on github: "Merge branch 'master' into feature/ride-unicorns")
+# this is only relevant when using commitsOnly: true (or titleAndCommits: true)
+allowMergeCommits: true

.github/workflows/ci.yaml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - alpha
+      - beta
+      - main
+      - renovate/**
+
+permissions: {}
+
+jobs:
+  ci-optimization:
+    name: CI optimization
+    uses: dargmuesli/github-actions/.github/workflows/ci-optimization.yml@e9c9cf391baeb261cf62c0af6c4af2245bae0662 # 5.9.2
+    permissions:
+      pull-requests: read
+  release_semantic_dry:
+    needs: ci-optimization
+    if: needs.ci-optimization.outputs.continue == 'true'
+    name: Release (semantic, dry)
+    uses: dargmuesli/github-actions/.github/workflows/release-semantic.yml@e9c9cf391baeb261cf62c0af6c4af2245bae0662 # 5.9.2
+    permissions:
+      contents: write
+      id-token: write
+    secrets:
+      PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+    with:
+      DRY_RUN: true
+  build:
+    name: Build
+    uses: dargmuesli/github-actions/.github/workflows/docker.yml@e9c9cf391baeb261cf62c0af6c4af2245bae0662 # 5.9.2
+    needs: release_semantic_dry
+    permissions:
+      packages: write
+    with:
+      TAG: ${{ (needs.release_semantic_dry.outputs.new_release_version != null) && needs.release_semantic_dry.outputs.new_release_version || '' }}
+  release_semantic:
+    needs: build
+    name: Release (semantic)
+    uses: dargmuesli/github-actions/.github/workflows/release-semantic.yml@e9c9cf391baeb261cf62c0af6c4af2245bae0662 # 5.9.2
+    permissions:
+      contents: write
+      id-token: write
+    secrets:
+      PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}

.gitignore

@@ -0,0 +1,11 @@
+# Build output.
+/bin/
+/dist/
+
+# Local environment, which carries the Postgres/S3/Sentry credentials this worker reads.
+.env
+.env.local
+
+# Go test and coverage artifacts.
+*.test
+*.out

.golangci.yaml

@@ -0,0 +1,36 @@
+version: "2"
+
+run:
+  timeout: 5m
+
+linters:
+  enable:
+    - errcheck
+    - govet
+    - staticcheck
+    - unused
+    - ineffassign
+    - misspell
+    - unconvert
+    - gocritic
+    - nolintlint
+  settings:
+    gocritic:
+      enabled-tags:
+        - diagnostic
+        - style
+        - performance
+    errcheck:
+      exclude-functions:
+        - (io.Closer).Close
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/maevsi/temporal
+
+issues: {}

.releaserc.json

@@ -0,0 +1,21 @@
+{
+  "plugins": [
+    [
+      "@semantic-release/commit-analyzer",
+      {
+        "preset": "conventionalcommits",
+        "presetConfig": {}
+      }
+    ],
+    [
+      "@semantic-release/release-notes-generator",
+      {
+        "preset": "conventionalcommits",
+        "presetConfig": {}
+      }
+    ],
+    "@semantic-release/changelog",
+    "@semantic-release/git",
+    "@semantic-release/github"
+  ]
+}

.renovaterc.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>dargmuesli/renovate-config"]
+}

.vscode/extensions.json

@@ -0,0 +1,7 @@
+{
+  "recommendations": [
+    "esbenp.prettier-vscode",
+    "github.vscode-github-actions",
+    "golang.go"
+  ]
+}

.vscode/settings.json

@@ -0,0 +1,6 @@
+{
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
+  "[go]": {
+    "editor.defaultFormatter": "golang.go"
+  }
+}

CODEOWNERS

@@ -0,0 +1 @@
+* @dargmuesli

CONTRIBUTING.md

@@ -0,0 +1,25 @@
+# Contributing
+
+## Prerequisites
+
+- Go (see `go.mod` for the minimum version)
+- Git
+- [golangci-lint](https://golangci-lint.run/) v2, for local linting matching CI (`docker build --target lint .` runs the same check without a local install)
+
+See the [README's Development section](README.md#development) for running the worker locally, and its [Tests section](README.md#tests) for the test suite.
+
+## Local checks
+
+```sh
+go build ./...
+go test -race ./...
+golangci-lint run ./...
+```
+
+CI (`.github/workflows/ci.yaml`) runs the same three checks via the Docker `lint`, `test`, and `build` stages, gating the image build on all three passing.
+The `test` stage runs the race detector too, so a data race fails CI rather than only showing up locally.
+Lint is enforced at zero issues.
+
+## Commits
+
+Commits and PR titles must follow [Conventional Commits](https://www.conventionalcommits.org/) (enforced by the Semantic Pull Requests check, see `.github/semantic.yml`); releases and `CHANGELOG.md` entries are generated from them automatically.

Dockerfile

@@ -0,0 +1,122 @@
+# syntax=docker/dockerfile:1
+
+########################
+# Create base.
+
+FROM golang:1.26.6-alpine AS base
+
+RUN apk add --no-cache ca-certificates
+
+ARG GROUP_ID=1000
+ARG USER_ID=1000
+ARG USER_NAME=go
+
+RUN addgroup -g $GROUP_ID -S $USER_NAME \
+    && adduser -u $USER_ID -S -G $USER_NAME -h /home/$USER_NAME $USER_NAME
+
+WORKDIR /srv/app/
+
+
+########################
+# Serve development.
+
+FROM base AS development
+
+ENV CGO_ENABLED=0
+
+RUN mkdir -p /home/$USER_NAME/go/pkg/mod \
+    && chown -R $USER_NAME:$USER_NAME /home/$USER_NAME /srv/app
+
+VOLUME /home/$USER_NAME/go/pkg/mod
+VOLUME /srv/app
+
+USER $USER_NAME
+CMD ["go", "run", "./cmd/worker"]
+EXPOSE 9090
+# Unlike production, this stage has a shell and busybox wget, so the probe is a plain HTTP request rather than the binary's own -healthcheck flag.
+# Running that flag through "go run" would have to compile and link the whole worker, Temporal and AWS SDKs included, before the probe's own timeout, which a cold build cache cannot do; it would also re-link on every interval.
+# Shortcut: this hardcodes the default metrics port from config.Metrics.Addr, so a dev container that moves the metrics server has to update this line too.
+HEALTHCHECK --interval=30s --start-period=30s --timeout=5s CMD wget --quiet --spider http://127.0.0.1:9090/healthz || exit 1
+
+
+########################
+# Prepare environment.
+
+FROM base AS prepare
+
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    go mod download
+
+COPY ./ ./
+
+
+########################
+# Lint code.
+
+FROM golangci/golangci-lint:v2.12.2-alpine AS lint
+
+WORKDIR /srv/app/
+COPY --from=prepare /srv/app/ ./
+RUN golangci-lint run ./...
+
+
+########################
+# Test code.
+
+FROM prepare AS test
+
+# The race detector needs cgo, which on Alpine means a C toolchain.
+# This is a leaf stage, so nothing it installs reaches the production image.
+RUN apk add --no-cache gcc musl-dev
+
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    CGO_ENABLED=1 go test -race -count=1 ./...
+
+
+########################
+# Build for production.
+
+FROM prepare AS build
+
+ENV CGO_ENABLED=0
+
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    go build -trimpath -ldflags="-s -w" -o /srv/app/bin/worker ./cmd/worker
+
+
+########################
+# Collect results.
+
+FROM base AS collect
+
+RUN chown $USER_NAME:$USER_NAME .
+
+COPY --from=build --chown=$USER_NAME /srv/app/bin/worker ./worker
+COPY --from=lint /srv/app/go.mod /dev/null
+COPY --from=test /srv/app/go.mod /dev/null
+
+
+########################
+# Serve production.
+#
+# The final image is FROM scratch: a statically linked Go binary needs nothing else at runtime, which keeps the attack surface and image size minimal.
+# There is deliberately no shell, so HEALTHCHECK execs the binary itself with -healthcheck instead of curl/wget (see cmd/worker/main.go).
+
+FROM scratch AS production
+
+COPY --from=collect /etc/passwd /etc/passwd
+COPY --from=collect /etc/group /etc/group
+COPY --from=base /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=collect --chown=go /srv/app/worker /srv/app/worker
+
+WORKDIR /srv/app/
+USER go
+ENTRYPOINT ["/srv/app/worker"]
+EXPOSE 9090
+HEALTHCHECK --interval=30s --start-period=30s --timeout=5s CMD ["/srv/app/worker", "-healthcheck"]
+LABEL org.opencontainers.image.source="https://github.com/maevsi/temporal"
+LABEL org.opencontainers.image.description="Temporal worker (Go) running jobs for the Vibetype platform."