ONC-XXXX - Create Docker image on branch push

[tmy1313]

Summary

Adds automated Docker image builds and publishing to GitHub Container Registry (GHCR), along with all supporting Docker/Tomcat configuration needed to run the API in a container.

Changes

GitHub Actions Workflow (.github/workflows/docker-publish.yml)

• New workflow that builds and pushes a Docker image to GHCR on every push to development, qa, staging, or production branches, as well as on manual workflow_dispatch
• Images are tagged with three tags per build:
  • build-<run_number> — immutable, sequential build identifier
  • sha-<short-sha> — immutable, traces back to the exact commit
  • latest-<branch> — floating pointer to the most recent build from that branch (e.g. latest-development)

Dockerfile (docker/Dockerfile)

• Two-stage build: Stage 1 uses maven:3.9-eclipse-temurin-21-alpine to compile and package the WAR, leveraging Docker layer caching for Maven dependencies; Stage 2 deploys to tomcat:11.0.23-jdk21
• The image is secret-free — no credentials or sensitive values are baked in at build time; all secrets are supplied as environment variables at docker run time

Entrypoint (docker/entrypoint.sh)

• Materializes the JWK signing key from the JWK_KEY environment variable into the file path that chpl-api expects, then starts Tomcat

Tomcat Configuration (docker/tomcat-conf/)

• server.xml — configures the jdbc/openchpl JNDI datasource using EnvironmentPropertySource so DB connection details are resolved from container environment variables at startup (no secrets in the file)
• catalina.properties — enables EnvironmentPropertySource so ${ENV_VAR} placeholders in server.xml are resolved from the environment
• context.xml — links the global jdbc/openchpl JNDI resource into the webapp

Documentation (docker/README.md)

• Documents every environment variable the image requires or accepts, with a quick-start docker run example

.gitattributes

• Marks docker/entrypoint.sh with eol=lf to ensure the shell script retains LF line endings on all platforms (a CRLF shebang breaks docker build/docker run on Windows checkouts)

Testing

• Build the image locally: docker build -t chpl-api:local .
• Run with required environment variables (see docker/README.md for the full list)

[Copilot]

Pull request overview

Adds containerization support for chpl-api and automates building/publishing a Tomcat-based Docker image to GHCR on pushes to environment branches.

Changes:

• Added a GitHub Actions workflow to build and push a Docker image to GHCR on pushes to development, qa, staging, and production.
• Added a multi-stage Docker build that packages the WAR and runs it on Tomcat, plus Tomcat config files that resolve DB settings from environment variables.
• Added Docker runtime documentation, a .dockerignore, and a .gitattributes rule intended to enforce LF line endings for a container entrypoint script.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
docker/tomcat-conf/server.xml	Defines Tomcat server configuration and a JNDI DataSource wired via env var substitution.
docker/tomcat-conf/context.xml	Links the global JNDI resource into the webapp context.
docker/tomcat-conf/catalina.properties	Enables EnvironmentPropertySource for ${ENV_VAR} placeholder resolution.
docker/README.md	Documents required/optional environment variables for running the image.
docker/Dockerfile	Builds the WAR with Maven and deploys it into a Tomcat runtime image.
.github/workflows/docker-publish.yml	Builds/pushes the image to GHCR with branch/build/SHA tagging.
.gitattributes	Adds an LF-ending rule intended for a Docker entrypoint script.
.dockerignore	Excludes git metadata, build outputs, and local tooling directories from the Docker build context.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[andlar]

While I think we want to get to PROD eventually, I'd like to make sure we don't touch PROD at all until we're comfortable with the lower environments, so can we take this branch out of the list for now?