Add signed runtime distribution pipeline

tools/release/runtime/Dockerfile.api

@@ -0,0 +1,36 @@
+# syntax=docker/dockerfile:1.7
+ARG PYTHON_IMAGE
+FROM ${PYTHON_IMAGE}
+
+ARG GOVOPLAN_RELEASE_VERSION
+ARG GOVOPLAN_COMPOSITION_SHA256
+LABEL org.opencontainers.image.title="GovOPlaN API runtime" \
+      org.opencontainers.image.version="${GOVOPLAN_RELEASE_VERSION}" \
+      org.govoplan.composition.sha256="${GOVOPLAN_COMPOSITION_SHA256}"
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONPATH=/opt/govoplan/runtime \
+    PATH=/opt/govoplan/runtime/bin:${PATH} \
+    HOME=/var/lib/govoplan
+
+COPY wheelhouse/ /opt/govoplan/wheels/
+COPY requirements-runtime.txt composition.json /opt/govoplan/
+RUN python -m pip install --disable-pip-version-check --no-cache-dir \
+      --no-index --find-links=/opt/govoplan/wheels \
+      --target=/opt/govoplan/runtime \
+      --requirement=/opt/govoplan/requirements-runtime.txt \
+    && rm -rf /opt/govoplan/wheels \
+    && groupadd --gid 10001 govoplan \
+    && useradd --uid 10001 --gid 10001 --home-dir /var/lib/govoplan \
+      --create-home --shell /usr/sbin/nologin govoplan \
+    && mkdir -p /var/lib/govoplan /tmp/govoplan \
+    && chown -R 10001:10001 /var/lib/govoplan /tmp/govoplan \
+    && chmod -R a-w /opt/govoplan
+
+USER 10001:10001
+WORKDIR /var/lib/govoplan
+EXPOSE 8000
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=12 \
+  CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/ready', timeout=3)"]
+CMD ["python", "-m", "uvicorn", "govoplan_core.server.app:app", "--host", "0.0.0.0", "--port", "8000", "--proxy-headers"]

tools/release/runtime/Dockerfile.web

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1.7
+ARG NGINX_IMAGE
+FROM ${NGINX_IMAGE}
+
+ARG GOVOPLAN_RELEASE_VERSION
+ARG GOVOPLAN_COMPOSITION_SHA256
+LABEL org.opencontainers.image.title="GovOPlaN WebUI runtime" \
+      org.opencontainers.image.version="${GOVOPLAN_RELEASE_VERSION}" \
+      org.govoplan.composition.sha256="${GOVOPLAN_COMPOSITION_SHA256}"
+
+USER 0
+RUN rm -rf /usr/share/nginx/html/* /etc/nginx/conf.d/*
+COPY web-dist/ /usr/share/nginx/html/
+COPY nginx.conf /etc/nginx/nginx.conf
+RUN chown -R 101:101 /usr/share/nginx/html \
+    && chmod -R a-w /usr/share/nginx/html /etc/nginx/nginx.conf
+
+USER 101:101
+EXPOSE 8080
+ENTRYPOINT []
+CMD ["nginx", "-g", "daemon off;"]

tools/release/runtime/nginx.conf

@@ -0,0 +1,41 @@
+pid /tmp/nginx.pid;
+worker_processes auto;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    access_log /dev/stdout;
+    error_log /dev/stderr warn;
+    sendfile on;
+    server_tokens off;
+    client_body_temp_path /tmp/client_temp;
+    proxy_temp_path /tmp/proxy_temp;
+
+    server {
+        listen 8080;
+        root /usr/share/nginx/html;
+
+        location = /health {
+            access_log off;
+            default_type text/plain;
+            return 200 "ok\n";
+        }
+
+        location /api/ {
+            proxy_pass http://load-balancer:8000;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        location / {
+            try_files $uri $uri/ /index.html;
+        }
+    }
+}