Adapted from adguard-cidre's pipeline: build, syntax smoke-test, bats
unit tests, shellcheck lint, Trivy critical/high scans, then on push to
main a versioned publish (VERSION auto-bump, :latest/:X.Y/:X.Y.Z tags
retagged from the already-scanned image, and a categorized Gitea
Release). Requires the REGISTRY_TOKEN and CI_PUSH_TOKEN repo secrets
and branch protection on main (not yet configured on the Gitea side).
Pin alpine:latest to the full patch-level tag alpine:3.22.1 so Renovate
can classify patch/minor/major bumps on it. Add a `test` stage (bats)
and a `lint` stage (shellcheck, severity=error) that build from `base`
before ENTRYPOINT is set, so CI can run them without an --entrypoint
override. A trailing `FROM base` keeps the lean prod image as the
default `docker build .` target despite the extra stages.
Covers env-var validation, socket path preparation, target connectivity
messaging, DEBUG_LEVEL to socat-flag mapping, and graceful shutdown vs.
crash detection — run against the real socat/nc binaries rather than
mocks, since UNIX-LISTEN binds without needing the TCP target reachable.
Djeex
Djeex