feat: package taskito-server as a multiarch distroless image

[pratyush618]

Closes #554. S8 of the executor-attach plan: the scheduler ships as one image
that carries no language runtime, so a Python, Node or Java app all deploy the
same tag alongside their own container.

The image

docker/scheduler.Dockerfile, three stages:

1. node:22-alpine builds the dashboard SPA — crates/taskito-server/build.rs
   embeds it at compile time, so it has to exist before cargo runs.
2. rust:1-alpine compiles -p taskito-server --features postgres,redis.
   Alpine is musl natively on both architectures, so nothing cross-compiles;
   the binary is static because libsqlite3-sys, pq-sys and openssl-sys are
   already bundled/vendored workspace-wide. Both backends are compiled in, so
   one image covers every DSN.
3. gcr.io/distroless/static-debian12:nonroot carries the binary and nothing
   else. The build fails itself if readelf -l finds a PT_INTERP, since that
   base has no dynamic loader — a dynamic binary would fail at docker run
   instead of at build time.

Result: 11.2 MB content, 43.7 MB on disk. glibc and musl variants would be
indistinguishable here, so there is only one. BuildKit reads the
docker/scheduler.Dockerfile.dockerignore sitting next to the Dockerfile, which
keeps the repo root free of a global ignore file.

Workflows

publish-server.yml (tag server-v*, or dispatch with a dry-run) builds each
architecture on its own native runner — a Rust build under QEMU takes the better
part of an hour — smoke-tests --version and the OCI label against
version.mjs before anything reaches the registry, pushes per-architecture
tags, and merges them into a manifest list with imagetools create. Pulls
resolve ghcr.io/byteveda/taskito-server:<version> and :latest.

ci-server-image.yml builds both architectures on PRs and asserts the binary
reports the declared version. Its path filter is deliberately not the shared
crates/** anchor: an engine-crate change that breaks the server already turns
the Rust suite red, and what only this suite covers is the Dockerfile and the
SPA it embeds.

Version

The binary's --version comes from [workspace.package] via Cargo. The OCI
label comes from --build-arg VERSION=$(node scripts/version.mjs --current),
and version.mjs --check now fails if ARG VERSION ever holds a semver
literal, the same way it guards the other manifests. The publish workflow
cross-checks the resolved tag against --current before it builds.

Verification

Built and run locally on amd64: taskito-server 0.21.0, label 0.21.0,
actionlint clean, version.mjs --check green. arm64 was not executed locally —
all three base images publish linux/arm64 and nothing in the build
cross-compiles, so the CI job on ubuntu-24.04-arm is the first real run.

Summary by CodeRabbit

• New Features

  • Added a multi-architecture taskito-server container image for AMD64 and ARM64.
  • Added automated image builds, validation, smoke tests, and publishing to GHCR.
  • Added release-tag and manual publishing workflows, including dry runs.
  • Added documented container usage, ports, and attach-listener behavior.

• Documentation

  • Added changelog and server container documentation.

• Chores

  • Expanded CI checks for server image changes and version consistency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2acb7b7b-a1b8-4d46-8605-338d62ec2679

📥 Commits

Reviewing files that changed from the base of the PR and between 58851ff and 8475d00.

📒 Files selected for processing (2)

• .github/workflows/ci-server-image.yml
• .github/workflows/publish-server.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• ByteVeda/taskito (manual)

🚧 Files skipped from review as they are similar to previous changes (2)

• .github/workflows/ci-server-image.yml
• .github/workflows/publish-server.yml

---

📝 Walkthrough

Walkthrough

The PR adds a multi-architecture distroless taskito-server image, native AMD64 and ARM64 CI builds, GHCR publication with manifest validation, release automation, version guards, and documentation.

Changes

Server image packaging

Layer / File(s)	Summary
Server image definition docker/scheduler.Dockerfile, docker/scheduler.Dockerfile.dockerignore, scripts/version.mjs	The Docker build creates a dashboard-enabled static Rust binary and packages it in a nonroot distroless image. Version guards require release versions to pass through --build-arg.
CI image validation .github/workflows/ci-server-image.yml, .github/workflows/ci.yml	CI detects server-related changes, builds native AMD64 and ARM64 images, checks their reported versions, and includes the server-image job in aggregate status checks.
Release image publication .github/workflows/publish-server.yml	The release workflow validates versions, builds and smoke-tests architecture-specific images, publishes GHCR manifests, and creates Git tags and GitHub releases.
Image and runtime documentation CHANGELOG.md, crates/taskito-server/README.md	The documentation describes the image, supported architectures, runtime configuration, release location, and attach-listener behavior.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseTrigger
  participant PublishWorkflow
  participant DockerBuild
  participant GHCR
  participant GitHubRelease
  ReleaseTrigger->>PublishWorkflow: start release or manual dispatch
  PublishWorkflow->>DockerBuild: build amd64 and arm64 images
  DockerBuild->>PublishWorkflow: return version and OCI label checks
  PublishWorkflow->>GHCR: push architecture images and multi-architecture manifests
  PublishWorkflow->>GitHubRelease: create server-vVERSION tag and release

Loading

Possibly related PRs

• ByteVeda/taskito#477: Both changes modify scripts/version.mjs for version validation. This PR extends the guard to the server Dockerfile.

Suggested labels: packaging

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary change: packaging taskito-server as a multiarchitecture distroless image.
Linked Issues check	✅ Passed	The changes satisfy issue #554 by adding the static distroless image, multiarchitecture CI and publishing, and version validation.
Out of Scope Changes check	✅ Passed	The workflows, Docker files, documentation, changelog, and version guard directly support the linked issue objectives.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci-server-image.yml:
- Line 28: Update the actions/checkout step in the CI workflow to set
persist-credentials to false, preventing GitHub token credentials from remaining
on the runner while preserving the existing checkout behavior.

In @.github/workflows/publish-server.yml:
- Line 113: Add persist-credentials: false to the actions/checkout step in the
publish job, matching the existing checkout configuration in the manifest job
while preserving the current build, test, and conditional image-push steps.
- Line 44: Update the actions/checkout step to set persist-credentials to false,
ensuring subsequent git ls-remote access uses anonymous HTTPS credentials.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fe94006b-ea45-4456-bb77-4f7f03f266b8

📥 Commits

Reviewing files that changed from the base of the PR and between ea93827 and 58851ff.

📒 Files selected for processing (8)

• .github/workflows/ci-server-image.yml
• .github/workflows/ci.yml
• .github/workflows/publish-server.yml
• CHANGELOG.md
• crates/taskito-server/README.md
• docker/scheduler.Dockerfile
• docker/scheduler.Dockerfile.dockerignore
• scripts/version.mjs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• ByteVeda/taskito (manual)