Build and push images from GitHub Actions

[grahamgilbert]

Why

CircleCI is not building anything. The org shows LAST RUN: Not yet! on every project, 0 workflow runs over 30 days, and GET /api/v2/project/gh/grahamgilbert/Crypt-Server/pipeline returns an empty list. The most recent tag on Docker Hub is 3.4.1 from November 2022; latest last moved 2025-01-29, almost certainly by hand.

So pushing the 3.4.2 tag built nothing. This moves image builds to GitHub Actions.

What changed

• .github/workflows/docker.yml — on a tag push, build and publish macadmins/crypt-server:<tag>; on a master push, move :latest. Then dispatch the crypt-server-saml build, which layers on top of this image.
• Deleted .circleci/config.yml and remote_build.py. Both are dead, and if the CircleCI org were ever reconnected its build_latest/build_tag jobs would race this workflow pushing the same tags.
• Dropped the now-stale .circleci/ and remote_build.py entries from .dockerignore.

set_build_no.py is deliberately kept — docs/Development.md documents it as a pre-commit hook, and version.plist is read by fvserver/context_processors.py and server/views.py.

Migration gate

The build uses load: true and pushes only after manage.py migrate succeeds inside the built image. docker/run.sh applies migrations at container startup, so a migration that imports cleanly but fails to apply would otherwise be published and break on deploy. With no DB_* env set, docker/settings.py falls back to sqlite, which is what run.sh sees.

This is a stronger check than the CircleCI job it replaces: that one tested a fresh pip install on a different base image, this tests the artifact that actually ships.

Required secrets

Nothing will run until these exist:

Secret	What
DOCKERHUB_USER / DOCKERHUB_TOKEN	Docker Hub token with push rights to macadmins
SAML_DISPATCH_TOKEN	Fine-grained PAT, contents: write on crypt-server-saml (GITHUB_TOKEN cannot dispatch cross-repo)

Not done here

• No lint gate. black --check already fails on docker/settings.py on master, so adding the gate would block the release on a pre-existing failure. Worth a follow-up: fix the formatting, then add the gate.
• version.plist is stale at 3.4.1.378, so the UI reports the old version. Pre-existing, unrelated to this change.
• amd64 only, matching what shipped before. arm64 via QEMU would roughly double build time.

Testing

None of this has executed — the YAML and step structure are validated, and the sqlite fallback verified by reading docker/settings.py against docker/run.sh, but the first real run will be in CI. Pairs with grahamgilbert/crypt-server-saml PR.

🤖 Generated with Claude Code