release workflow

Dockerfile

@@ -0,0 +1,57 @@
+# ---- Stage 1: Install dependencies ----
+FROM oven/bun:1 AS deps
+
+WORKDIR /app
+
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile --production
+
+# ---- Stage 2: Build ----
+FROM oven/bun:1 AS build
+
+WORKDIR /app
+
+# Copy dependency manifests and install all deps (including dev)
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+
+# Copy source code and supporting files
+COPY src/ src/
+COPY generated/ generated/
+COPY prisma/ prisma/
+COPY public-keys/ public-keys/
+COPY prisma.config.ts tsconfig.json ./
+
+# Compile to a standalone executable
+RUN bun build src/index.ts \
+  --compile \
+  --minify \
+  --target=bun-linux-x64 \
+  --outfile=server
+
+# ---- Stage 3: Production image ----
+FROM ubuntu:22.04 AS runtime
+
+WORKDIR /app
+
+# Install minimal runtime dependencies (CA certs for HTTPS calls)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# Copy the compiled binary from the build stage
+COPY --from=build /app/server ./server
+
+# Copy Prisma artifacts needed at runtime
+COPY --from=build /app/generated/ ./generated/
+COPY --from=build /app/prisma/ ./prisma/
+COPY --from=build /app/prisma.config.ts ./prisma.config.ts
+COPY --from=build /app/public-keys/ ./public-keys/
+
+# Copy production node_modules (Prisma adapter needs native bindings)
+COPY --from=deps /app/node_modules/ ./node_modules/
+
+ENV NODE_ENV=production
+EXPOSE 3000
+
+CMD ["./server"]