fix(release): publish immutable image tags only

.gitea/workflows/release.yml

@@ -130,10 +130,21 @@ jobs:
             --target runner \
             --build-arg VERSION="$VERSION" \
             -t "git.garvis.dev/dmg/minecraft-account-manager:${VERSION}" \
-            -t git.garvis.dev/dmg/minecraft-account-manager:latest \
             .
           docker push "git.garvis.dev/dmg/minecraft-account-manager:${VERSION}"
-          docker push git.garvis.dev/dmg/minecraft-account-manager:latest
+
+      - name: Build and push Discord bot image
+        if: steps.release.outputs.created == 'true'
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          docker build \
+            --platform linux/amd64 \
+            --target bot \
+            --build-arg VERSION="$VERSION" \
+            -t "git.garvis.dev/dmg/minecraft-account-manager-bot:${VERSION}" \
+            .
+          docker push "git.garvis.dev/dmg/minecraft-account-manager-bot:${VERSION}"
 
       - name: Build and push migration image
         if: steps.release.outputs.created == 'true'
@@ -145,10 +156,8 @@ jobs:
             --target migrate \
             --build-arg VERSION="$VERSION" \
             -t "git.garvis.dev/dmg/minecraft-account-manager-migrate:${VERSION}" \
-            -t git.garvis.dev/dmg/minecraft-account-manager-migrate:latest \
             .
           docker push "git.garvis.dev/dmg/minecraft-account-manager-migrate:${VERSION}"
-          docker push git.garvis.dev/dmg/minecraft-account-manager-migrate:latest
 
       - name: Create Gitea release and upload Velocity JAR
         if: steps.release.outputs.created == 'true'

Dockerfile

@@ -34,6 +34,20 @@ USER app
 EXPOSE 3000
 CMD ["node", "apps/web/server.js"]
 
+FROM dependencies AS bot
+ARG VERSION=development
+LABEL org.opencontainers.image.title="Minecraft Account Manager Discord Bot" \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.source="https://git.garvis.dev/dmg/minecraft-account-manager"
+WORKDIR /app
+ENV NODE_ENV=production
+RUN addgroup --system app && adduser --system --ingroup app app
+COPY --chown=app:app package.json package-lock.json tsconfig.base.json ./
+COPY --chown=app:app apps/discord-bot ./apps/discord-bot
+COPY --chown=app:app packages ./packages
+USER app
+CMD ["npm", "run", "start", "--workspace", "@minecraft-account-manager/discord-bot"]
+
 FROM dependencies AS migrate
 ARG VERSION=development
 LABEL org.opencontainers.image.title="Minecraft Account Manager Migrations" \

apps/web/src/app/healthz/route.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vitest";
+import { GET } from "./route";
+
+describe("health endpoint", () => {
+  it("reports process readiness without requiring external services", async () => {
+    const response = GET();
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("cache-control")).toBe("no-store");
+    expect(await response.json()).toEqual({ status: "ok" });
+  });
+});

apps/web/src/app/healthz/route.ts

@@ -0,0 +1,10 @@
+export function GET(): Response {
+  return Response.json(
+    { status: "ok" },
+    {
+      headers: {
+        "Cache-Control": "no-store",
+      },
+    },
+  );
+}

design/log.md

@@ -2,6 +2,10 @@
 
 ## 2026-08-01
 
+* **Refine**: Removed mutable `latest` publication so all deployable artifacts use explicit semantic versions.
+* **Verify**: Confirmed the `v1.1.0` Discord bot image and matching web, migration, and Velocity artifacts.
+* **Extend**: Added a releasable Discord bot image and a dependency-free web health endpoint for Kubernetes deployment.
+* **Verify**: Confirmed the initial `v1.0.0` release, public Velocity JAR, and versioned and `latest` web and migration image manifests.
 * **Create**: Added Gitea CI and semantic-release pipelines for downloadable Velocity JARs and versioned web and migration images.
 * **Document**: Added container deployment order, artifact names, and required repository secrets.
 * **Refine**: Corrected the Velocity Java and Gradle namespace to the repository owner's `games.dmg` reverse domain.

design/us-015-platform-operations.md

@@ -3,7 +3,7 @@ type: User Story
 title: Deploy and operate the platform securely
 description: Operators have repeatable builds, migrations, credential provisioning, configuration, and security checks.
 tags: [operations, security, database, deployment]
-timestamp: 2026-08-01T19:01:47Z
+timestamp: 2026-08-01T19:46:09Z
 story_id: US-015
 status: verified
 ---
@@ -21,6 +21,7 @@ As a platform operator, I want reproducible deployment and security controls, so
 - [x] The Velocity Gradle wrapper produces a tested shaded JAR.
 - [x] Environment examples document database, Keycloak, Discord, trusted proxy, and ProxyCheck settings without secrets.
 - [x] The web application sets CSP, framing, MIME, referrer, and permissions headers.
+- [x] The web runtime provides a dependency-free health endpoint for orchestration probes.
 - [x] npm dependency audit and Semgrep security review complete without findings at the last verified change.
 - [x] Architecture, Keycloak, API error, security, bot, and Velocity operating documentation is available.
 

design/us-016-automated-releases.md

@@ -3,7 +3,7 @@ type: User Story
 title: Build and publish versioned releases
 description: Gitea Actions validate every change and publish semantically versioned Velocity and container artifacts.
 tags: [operations, ci, release, velocity, docker]
-timestamp: 2026-08-01T19:01:47Z
+timestamp: 2026-08-01T19:56:39Z
 story_id: US-016
 status: implemented
 ---
@@ -14,14 +14,16 @@ As a platform operator, I want automated validation and semantic releases, so th
 
 # Acceptance Criteria
 
-- [ ] Pushes and pull requests run OKF validation, linting, type checks, tests, the web build, and the Velocity build.
-- [ ] Pull requests validate conventional commit messages.
-- [ ] CI uploads the development Velocity JAR as a workflow artifact.
-- [ ] Main-branch conventional commits determine the next semantic version and create a `vMAJOR.MINOR.PATCH` tag.
+- [x] Pushes and pull requests run OKF validation, linting, type checks, tests, the web build, and the Velocity build.
+- [x] Pull requests validate conventional commit messages.
+- [x] CI uploads the development Velocity JAR as a workflow artifact.
+- [x] Main-branch conventional commits determine the next semantic version and create a `vMAJOR.MINOR.PATCH` tag.
 - [x] A release build embeds the semantic version in the Velocity plugin and JAR filename.
-- [ ] A public Gitea release exposes the versioned Velocity JAR as a downloadable asset.
-- [ ] Releases publish versioned and `latest` web runtime images to the Gitea registry.
-- [ ] Releases publish versioned and `latest` migration images that run versioned Drizzle migrations.
+- [x] A public Gitea release exposes the versioned Velocity JAR as a downloadable asset.
+- [x] Releases publish semantically versioned web runtime images to the Gitea registry.
+- [x] Releases publish semantically versioned Discord bot images to the Gitea registry.
+- [x] Releases publish semantically versioned migration images that run versioned Drizzle migrations.
+- [ ] Releases do not publish mutable container tags such as `latest`.
 - [x] Runtime containers use unprivileged users and exclude development source and secrets where practical.
 - [x] Operators are told which repository secrets must be configured before the first push.
 
@@ -36,7 +38,7 @@ As a platform operator, I want automated validation and semantic releases, so th
 
 # Validation
 
-Local OKF, lint, typecheck, test, Next.js build, and versioned Velocity JAR checks pass. A test `1.2.3` JAR was generated with matching Velocity metadata. Workflow YAML parses successfully. Container builds and remote publication remain pending because the local Docker daemon is unavailable and the first push is intentionally paused until repository secrets are configured.
+Local OKF, lint, typecheck, test, Next.js build, and versioned Velocity JAR checks pass. Initial Gitea CI and release runs succeeded. Release `v1.0.0` provides a publicly downloadable JAR whose Velocity metadata reports `1.0.0`. Registry manifests were resolved for the published semantic-version tags. Release `v1.1.0` also publishes resolvable versioned web, Discord bot, and migration manifests and a public Velocity JAR whose metadata reports `1.1.0`. Pull-request commitlint configuration is present; its conditional execution will be exercised by the first pull request.
 
 # Related Stories
 

docs/releases.md

@@ -32,11 +32,14 @@ Each release creates:
 
 - Gitea release asset `minecraft-account-manager-velocity-VERSION.jar`
 - `git.garvis.dev/dmg/minecraft-account-manager:VERSION`
-- `git.garvis.dev/dmg/minecraft-account-manager:latest`
+- `git.garvis.dev/dmg/minecraft-account-manager-bot:VERSION`
 - `git.garvis.dev/dmg/minecraft-account-manager-migrate:VERSION`
-- `git.garvis.dev/dmg/minecraft-account-manager-migrate:latest`
 
-Use immutable version tags for deployments. `latest` is a convenience pointer to the newest release.
+Only immutable semantic-version tags are published. Mutable tags such as `latest` must never be used in deployments or release-asset URLs.
+
+## Discord bot
+
+Run exactly one bot replica with the same immutable release version as the web application. It requires `DATABASE_URL`, `APP_URL`, `DISCORD_BOT_TOKEN`, and `DISCORD_GUILD_ID`. Deploy slash commands separately with the release image when command definitions change.
 
 ## Database migration