Automate multi-arch Docker releases for Ubuntu 24.04 and 26.04

.github/workflows/ci.yml

@@ -5,13 +5,18 @@ on:
     branches:
       - main
       - 'fix/**'
+      - 'feat/**'
     tags-ignore:
       - 'v*'
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-check:
+    name: Lint and check
     runs-on: ubuntu-latest
 
     steps:
@@ -21,11 +26,131 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24.19.0
           cache: npm
 
-      - name: Install dependencies
-        run: npm ci
+      - name: Install dependencies without lifecycle scripts
+        run: npm ci --ignore-scripts
 
       - name: Lint and validate
         run: npm run check
+
+  npm-audit:
+    name: Audit production dependencies
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.19.0
+          cache: npm
+
+      - name: Install dependencies without lifecycle scripts
+        run: npm ci --ignore-scripts
+
+      - name: Check production dependency vulnerabilities
+        run: npm audit --omit=dev --audit-level=high
+
+  node-compatibility:
+    name: Node.js runtime compatibility
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - '18.19.1'
+          - '24.19.0'
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      - name: Install dependencies without lifecycle scripts
+        run: npm ci --ignore-scripts
+
+      - name: Check runtime compatibility
+        run: npm run check
+
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+
+      - name: Analyze with CodeQL
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: /language:javascript-typescript
+
+  dependency-review:
+    name: Dependency review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+
+  container-build:
+    name: Build and smoke-test Ubuntu 26.04 ${{ matrix.platform }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build container
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: false
+          load: true
+          tags: bzo:ci-ubuntu26.04-${{ strategy.job-index }}
+          provenance: false
+          sbom: false
+
+      - name: Smoke-test container
+        shell: bash
+        run: |
+          set -euo pipefail
+          image="bzo:ci-ubuntu26.04-${{ strategy.job-index }}"
+          actual_node="$(docker run --rm --platform "${{ matrix.platform }}" "$image" node --version)"
+          test "$actual_node" = "v24.19.0"
+          docker run --rm --platform "${{ matrix.platform }}" "$image" node --check server.js