build: harden CI, split docker workflow, update dependencies

.github/dependabot.yml

@@ -14,7 +14,7 @@ updates:
         patterns:
           - "*"
   - package-ecosystem: "gomod"
-    directory: "/backend"
+    directory: "/"
     schedule:
       interval: "monthly"
     groups:

.github/workflows/ci.yml

@@ -12,6 +12,11 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    services:
+      mongodb:
+        image: mongo:5.0
+        ports:
+          - 27017:27017
 
     steps:
       - name: checkout
@@ -25,11 +30,6 @@ jobs:
           go-version: "1.25"
         id: go
 
-      - name: launch mongodb
-        uses: wbari/start-mongoDB@v0.2
-        with:
-          mongoDBVersion: "5.0"
-
       - name: build and test
         run: |
           go test -timeout=60s -race -covermode=atomic -coverprofile=$GITHUB_WORKSPACE/profile.cov ./...
@@ -49,176 +49,3 @@ jobs:
           goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov
         env:
           COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  docker:
-    needs: build
-    if: github.event_name == 'push'
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-latest
-            artifact: linux-amd64
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-            artifact: linux-arm64
-    runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: checkout
-        uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: login to ghcr.io
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.PKG_TOKEN }}
-
-      - name: login to DockerHub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ github.actor }}
-          password: ${{ secrets.DOCKER_HUB_TOKEN }}
-
-      - name: build and push to ghcr.io by digest
-        id: build-ghcr
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: ${{ matrix.platform }}
-          build-args: |
-            CI=github
-            GITHUB_SHA=${{ github.sha }}
-            GIT_BRANCH=${{ github.ref_name }}
-          outputs: type=image,name=ghcr.io/ukeeper/ukeeper-readability,push-by-digest=true,name-canonical=true,push=true
-
-      - name: build and push to DockerHub by digest
-        id: build-dockerhub
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: ${{ matrix.platform }}
-          build-args: |
-            CI=github
-            GITHUB_SHA=${{ github.sha }}
-            GIT_BRANCH=${{ github.ref_name }}
-          outputs: type=image,name=umputun/ukeeper-readability,push-by-digest=true,name-canonical=true,push=true
-
-      - name: export digests
-        run: |
-          mkdir -p /tmp/digests/ghcr /tmp/digests/dockerhub
-          digest_ghcr="${{ steps.build-ghcr.outputs.digest }}"
-          digest_dockerhub="${{ steps.build-dockerhub.outputs.digest }}"
-          touch "/tmp/digests/ghcr/${digest_ghcr#sha256:}"
-          touch "/tmp/digests/dockerhub/${digest_dockerhub#sha256:}"
-
-      - name: upload ghcr digest
-        uses: actions/upload-artifact@v4
-        with:
-          name: digests-ghcr-${{ matrix.artifact }}
-          path: /tmp/digests/ghcr/*
-          retention-days: 1
-
-      - name: upload dockerhub digest
-        uses: actions/upload-artifact@v4
-        with:
-          name: digests-dockerhub-${{ matrix.artifact }}
-          path: /tmp/digests/dockerhub/*
-          retention-days: 1
-
-  docker-merge:
-    needs: docker
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: download ghcr digests
-        uses: actions/download-artifact@v4
-        with:
-          path: /tmp/digests/ghcr
-          pattern: digests-ghcr-*
-          merge-multiple: true
-
-      - name: download dockerhub digests
-        uses: actions/download-artifact@v4
-        with:
-          path: /tmp/digests/dockerhub
-          pattern: digests-dockerhub-*
-          merge-multiple: true
-
-      - name: verify all digests present
-        run: |
-          for registry in ghcr dockerhub; do
-            expected=2
-            actual=$(find /tmp/digests/$registry -maxdepth 1 -type f | wc -l)
-            if [ "$actual" -ne "$expected" ]; then
-              echo "Expected $expected digests for $registry, found $actual"
-              ls -la /tmp/digests/$registry
-              exit 1
-            fi
-          done
-          echo "All digests present"
-
-      - name: set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: login to ghcr.io
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.PKG_TOKEN }}
-
-      - name: login to DockerHub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ github.actor }}
-          password: ${{ secrets.DOCKER_HUB_TOKEN }}
-
-      - name: determine tags
-        id: tags
-        run: |
-          ref="${GITHUB_REF#refs/*/}"
-          ref="${ref//\//_}"
-          echo "ref=${ref}" >> $GITHUB_OUTPUT
-          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
-            echo "is_tag=true" >> $GITHUB_OUTPUT
-          else
-            echo "is_tag=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: create ghcr.io manifest and push
-        working-directory: /tmp/digests/ghcr
-        run: |
-          ref="${{ steps.tags.outputs.ref }}"
-          is_tag="${{ steps.tags.outputs.is_tag }}"
-          tags="-t ghcr.io/ukeeper/ukeeper-readability:${ref}"
-          if [[ "$is_tag" == "true" ]]; then
-            tags="${tags} -t ghcr.io/ukeeper/ukeeper-readability:latest"
-          fi
-          docker buildx imagetools create ${tags} \
-            $(printf 'ghcr.io/ukeeper/ukeeper-readability@sha256:%s ' *)
-
-      - name: create DockerHub manifest and push
-        working-directory: /tmp/digests/dockerhub
-        run: |
-          ref="${{ steps.tags.outputs.ref }}"
-          is_tag="${{ steps.tags.outputs.is_tag }}"
-          tags="-t umputun/ukeeper-readability:${ref}"
-          if [[ "$is_tag" == "true" ]]; then
-            tags="${tags} -t umputun/ukeeper-readability:latest"
-          fi
-          docker buildx imagetools create ${tags} \
-            $(printf 'umputun/ukeeper-readability@sha256:%s ' *)