Prepare spoold for public alpha launch

.dockerignore

@@ -1,6 +1,7 @@
 .git
 .github
 bin
+dist
 data/*
 !data/.keep
 *.out

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,44 @@
+name: Bug report
+description: Report incorrect delivery, persistence, installation, or operational behavior
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: Do not include secrets, authorization headers, or sensitive payloads.
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Output from `spoold -version` and `spoolctl version`.
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Platform
+      description: Operating system, architecture, and installation method.
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: What happened?
+      description: Include expected behavior and a minimal reproduction.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant sanitized logs
+      render: shell
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I removed secrets and sensitive payload data.
+          required: true
+        - label: I searched existing issues for this problem.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/Rionlyu/spoold/security/advisories/new
+    about: Report vulnerabilities privately

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,27 @@
+name: Feature request
+description: Propose an improvement to the focused local HTTP spool
+title: "proposal: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What real workflow or failure mode is not handled today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Describe the smallest useful contract, including failure semantics.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Explain why a script, existing HTTP client, or external queue is insufficient.
+    validations:
+      required: true

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly

.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## What changed
+
+Describe the user-visible behavior or failure mode this addresses.
+
+## Verification
+
+List the checks and failure scenarios you exercised.
+
+## Durability checklist
+
+- [ ] I ran `make verify`.
+- [ ] Persistence or state-transition changes include replay coverage.
+- [ ] Crash-sensitive changes include a process-level test where practical.
+- [ ] Documentation describes any changed delivery or retention semantics.
+- [ ] This change does not introduce secrets or sensitive payloads into tests,
+      logs, or fixtures.

.github/workflows/ci.yml

@@ -12,9 +12,94 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "1.26.x"
           cache: false
       - run: make verify
+
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+          cache: false
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: v2.17.0
+          args: release --snapshot --clean --skip=sbom,sign
+      - name: Verify release archives
+        run: |
+          test "$(find dist -maxdepth 1 -name '*.tar.gz' | wc -l)" -eq 5
+          archive="$(find dist -maxdepth 1 -name '*_linux_amd64.tar.gz')"
+          tar -tzf "$archive" | grep -q '/spoold$'
+          tar -tzf "$archive" | grep -q '/spoolctl$'
+          (cd dist && sha256sum --check checksums.txt)
+          unpacked="$(mktemp -d)"
+          tar -xzf "$archive" -C "$unpacked"
+          "$(find "$unpacked" -type f -name spoold)" -version | grep -q 'spoold 0.0.0-SNAPSHOT'
+          "$(find "$unpacked" -type f -name spoolctl)" version | grep -q 'spoolctl 0.0.0-SNAPSHOT'
+      - name: Verify installer
+        run: |
+          installed="$(mktemp -d)"
+          version="$(jq -r .version dist/metadata.json)"
+          SPOOLD_INSTALL_DIR="$installed" \
+            SPOOLD_VERSION="$version" \
+            SPOOLD_RELEASE_BASE_URL="file://${GITHUB_WORKSPACE}/dist" \
+            sh scripts/install.sh
+          "$installed/spoold" -version | grep -q "spoold ${version}"
+          "$installed/spoolctl" version | grep -q "spoolctl ${version}"
+      - name: Verify release container
+        run: |
+          image="$(docker image ls ghcr.io/rionlyu/spoold --format '{{.Repository}}:{{.Tag}}' | grep -- '-amd64$' | head -n 1)"
+          test -n "$image"
+          docker run --rm "$image" -version | grep -q 'spoold 0.0.0-SNAPSHOT'
+          docker volume create spoold-ci-data
+          trap 'docker rm -f spoold-release-ci >/dev/null 2>&1 || true; docker volume rm spoold-ci-data >/dev/null 2>&1 || true' EXIT
+          docker run -d \
+            --name spoold-release-ci \
+            --publish 127.0.0.1:18080:8080 \
+            --volume spoold-ci-data:/var/lib/spoold \
+            "$image"
+          for _ in {1..50}; do
+            curl -fsS http://127.0.0.1:18080/readyz && break
+            sleep 0.1
+          done
+          response="$(curl -fsS \
+            --header 'Content-Type: application/json' \
+            --data '{"targetUrl":"http://127.0.0.1:1/events","body":{"container":"replay"}}' \
+            http://127.0.0.1:18080/v1/deliveries)"
+          id="$(jq -r .id <<<"$response")"
+          test -n "$id"
+          test "$id" != null
+          docker kill --signal KILL spoold-release-ci
+          docker rm spoold-release-ci
+          docker run -d \
+            --name spoold-release-ci \
+            --publish 127.0.0.1:18080:8080 \
+            --volume spoold-ci-data:/var/lib/spoold \
+            "$image"
+          for _ in {1..50}; do
+            curl -fsS http://127.0.0.1:18080/readyz && break
+            sleep 0.1
+          done
+          curl -fsS "http://127.0.0.1:18080/v1/deliveries/${id}" |
+            jq -e --arg id "$id" '.id == $id'
+      - name: Build container
+        run: |
+          docker build \
+            --build-arg VERSION=ci \
+            --build-arg COMMIT="${GITHUB_SHA}" \
+            --build-arg DATE=1970-01-01T00:00:00Z \
+            --tag spoold:ci .
+          docker run --rm spoold:ci -version | grep -q 'spoold ci'

.github/workflows/release.yml

@@ -0,0 +1,50 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+  id-token: write
+  packages: write
+  attestations: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Require a commit merged to main
+        run: |
+          git fetch --no-tags origin main
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+          cache: false
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: v2.17.0
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-checksums: ./dist/checksums.txt
+      - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-checksums: ./dist/digests.txt

.gitignore

@@ -1,4 +1,5 @@
 /bin/
+/dist/
 /data/*
 !/data/.keep
 *.out

.goreleaser.Dockerfile

@@ -0,0 +1,14 @@
+FROM alpine:3.23
+
+ARG TARGETPLATFORM
+
+RUN apk add --no-cache ca-certificates \
+    && mkdir -p /var/lib/spoold \
+    && chown 65532:65532 /var/lib/spoold
+
+COPY $TARGETPLATFORM/spoold /usr/local/bin/spoold
+
+USER 65532:65532
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/spoold"]
+CMD ["-listen", "0.0.0.0:8080", "-journal", "/var/lib/spoold/spoold.journal"]