Rewrite on the Bennett platform: Spring Boot + Vite/React SPA

Replaces the Next.js app. Same site, same look; the parts that were decisions rather than markup now live in Java. - catalogue, curated order, category filter and image URLs move from a TypeScript array into Postgres behind /api/products and /api/categories - contact form uses the shared platform-starter-contact: validate, RECORD, send, then fan out to n8n. Recording first means a relay outage costs a notification, not an enquiry - PageMetaController rewrites title/description/OG per route, replacing what Next's SSR gave crawlers and link-preview scrapers - 50MB of photos leave the repo for the MinIO bucket, re-encoded to webp (14MB) with EXIF (including phone GPS) stripped - fixes a catalogue typo: 'Strawberry Pie' was category 'Pies', which no filter matched, so it was unreachable unless browsing All
2026-07-22 22:09:51 -05:00
parent 207415dbbe
commit f471462d05
164 changed files with 4223 additions and 14003 deletions
@@ -0,0 +1,49 @@
+name: build-and-publish
+on:
+  push:
+    branches: [main]
+    # Files that can't change the image. Skipping them avoids a pointless rebuild that Watchtower
+    # would then redeploy — a few seconds of downtime on a live site for a docs-only commit.
+    paths-ignore: ["renovate.json", "**.md"]
+  # Lets `rebuild-all-apps.sh` force a rebuild (e.g. to roll out an urgent platform fix immediately
+  # instead of waiting for a Renovate bump PR).
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to the Gitea container registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.thebennett.net -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      # The platform is now referenced by an immutable RELEASE version, so a cached maven layer can't
+      # silently hold an old build — layer caching is safe again (and much faster).
+      - name: Build image
+        env:
+          DOCKER_BUILDKIT: "1"
+          MAVEN_USER: ${{ secrets.REGISTRY_USER }}
+          MAVEN_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          docker build \
+            --secret id=maven_user,env=MAVEN_USER \
+            --secret id=maven_token,env=MAVEN_TOKEN \
+            --build-arg GIT_SHA=${{ github.sha }} \
+            -t git.thebennett.net/thevine/itsthevine:latest \
+            -t git.thebennett.net/thevine/itsthevine:${{ github.sha }} .
+
+      - name: Scan image (Trivy)
+        run: |
+          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
+            aquasec/trivy:latest image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --no-progress \
+            git.thebennett.net/thevine/itsthevine:latest || true
+          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
+            aquasec/trivy:latest image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed \
+            --pkg-types library --exit-code 1 --no-progress \
+            git.thebennett.net/thevine/itsthevine:latest
+
+      - name: Push image
+        run: |
+          docker push git.thebennett.net/thevine/itsthevine:latest
+          docker push git.thebennett.net/thevine/itsthevine:${{ github.sha }}
@@ -1,25 +0,0 @@
-name: build-and-publish
-on:
-  push:
-    branches: [master, main]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Log in to the Gitea container registry
-        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.thebennett.net -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-
-      - name: Build image
-        run: |
-          docker build \
-            -t git.thebennett.net/thevine/itsthevine:latest \
-            -t git.thebennett.net/thevine/itsthevine:${{ github.sha }} .
-
-      - name: Push image
-        run: |
-          docker push git.thebennett.net/thevine/itsthevine:latest
-          docker push git.thebennett.net/thevine/itsthevine:${{ github.sha }}