ci: harden CI/CD pipeline and fix configuration gaps

.dockerignore

@@ -1,6 +1,12 @@
 .git
 .idea
+.github
 .env
+.gitignore
 Dockerfile
 docker-compose.yml
-**/*.md
+render.yaml
+sample.env
+*.exe
+bot
+tg-githubbot

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/workflows/ci.yml

@@ -6,12 +6,13 @@ on:
     branches:
       - master
       - main
+      - dev
 
 permissions:
   contents: read
 
 jobs:
-  test:
+  build-and-test:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
@@ -28,11 +29,29 @@ jobs:
           unformatted="$(gofmt -l ./cmd ./internal)"
           test -z "$unformatted" || (echo "$unformatted" && exit 1)
 
+      - name: Build
+        run: go build ./...
+
       - name: Vet
         run: go vet ./...
 
       - name: Test
         run: go test ./... -count=1
 
+  # Advisory only: a govulncheck/network hiccup must not block the deploy gate.
+  vulnerability-scan:
+    runs-on: ubuntu-latest
+    needs: build-and-test
+    continue-on-error: true
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
       - name: Vulnerability scan
         run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

.gitignore

@@ -1,2 +1,5 @@
 .idea
 .env
+*.exe
+bot
+tg-githubbot

Dockerfile

@@ -28,6 +28,9 @@ RUN addgroup -S app && adduser -S -G app app
 # Copy the CA certificates from builder
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 
+# Copy timezone data so time formatting/local times are correct outside UTC
+COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
+
 # Copy the built binary
 COPY --from=builder /app/tg-githubbot .
 

docker-compose.yml

@@ -16,7 +16,7 @@ services:
       - MONGODB_URI=mongodb://mongo:27017
       - DATABASE_NAME=${DATABASE_NAME:-github_bot}
       - ENCRYPTION_KEY=${ENCRYPTION_KEY}
-      - USE_POLLING=${USE_POLLING:-false}
+      - USE_POLLING=${USE_POLLING:-true}
       - PORT=8080
     depends_on:
       - mongo

render.yaml

@@ -6,7 +6,7 @@ services:
     dockerfilePath: ./Dockerfile
     dockerContext: .
     autoDeploy: true
-    healthCheckPath: /
+    healthCheckPath: /healthz
     envVars:
       - key: PORT
         value: 10000