consolidate CI and production into one multi-stage Dockerfile

Replace the separate .github/Dockerfile with a multi-stage build in
dist/docker/Dockerfile: `base` stage has all deps (CI stops here with
--target base), `production` stage adds source and entrypoint.

Also fix GHCR tag: lowercase $GITHUB_REPOSITORY (NicTool → nictool)
since OCI tags must be all lowercase.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: aberoham

.github/Dockerfile

@@ -4,7 +4,7 @@ on:
   push:
     branches: [master]
     paths:
-      - '.github/Dockerfile'
+      - 'dist/docker/Dockerfile'
       - '.github/workflows/ci-image.yml'
       - 'server/Makefile.PL'
       - 'client/Makefile.PL'
@@ -20,6 +20,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Compute image tag
+        id: meta
+        run: echo "tag=ghcr.io/${GITHUB_REPOSITORY,,}/ci:latest" >> "$GITHUB_OUTPUT"
+
       - uses: docker/setup-buildx-action@v4
 
       - uses: docker/login-action@v3
@@ -31,8 +35,9 @@ jobs:
       - uses: docker/build-push-action@v7
         with:
           context: .
-          file: .github/Dockerfile
+          file: dist/docker/Dockerfile
+          target: base
           push: true
-          tags: ghcr.io/${{ github.repository }}/ci:latest
+          tags: ${{ steps.meta.outputs.tag }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/ci-image.yml

@@ -5,7 +5,6 @@ on:
     types: [opened, synchronize, reopened]
     paths:
       - '.github/workflows/ci.yml'
-      - '.github/Dockerfile'
       - '.test/**'
       - 'client/**'
       - 'server/**'
@@ -17,10 +16,19 @@ permissions:
   packages: read
 
 jobs:
+  image-name:
+    runs-on: ubuntu-24.04
+    outputs:
+      ci: ${{ steps.set.outputs.ci }}
+    steps:
+      - id: set
+        run: echo "ci=ghcr.io/${GITHUB_REPOSITORY,,}/ci:latest" >> "$GITHUB_OUTPUT"
+
   test:
+    needs: image-name
     runs-on: ubuntu-24.04
     container:
-      image: ghcr.io/${{ github.repository }}/ci:latest
+      image: ${{ needs.image-name.outputs.ci }}
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml

@@ -1,4 +1,6 @@
-FROM debian:bookworm
+# ---- base: all system + CPAN deps, Apache configured, no app source ----
+# CI builds stop here (--target base).  Production builds continue below.
+FROM debian:bookworm AS base
 
 ENV DEBIAN_FRONTEND=noninteractive LANG=en_US.UTF-8 LC_ALL=C.UTF-8
 
@@ -16,7 +18,7 @@ RUN apt-get -q update && apt-get install -qy \
       libexpat-dev \
       gettext \
       bind9utils \
-      mariadb-client \
+      default-mysql-client \
       openssl \
       libdbix-simple-perl \
       libdbd-mysql-perl \
@@ -49,13 +51,14 @@ RUN apt-get -q update && apt-get install -qy \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
-# Copy only Makefile.PL files first for dependency caching
-COPY server/Makefile.PL /usr/local/nictool/server/Makefile.PL
-COPY client/Makefile.PL /usr/local/nictool/client/Makefile.PL
+# Copy only Makefile.PL files for dependency caching
+COPY server/Makefile.PL /tmp/nictool/server/Makefile.PL
+COPY client/Makefile.PL /tmp/nictool/client/Makefile.PL
 
 # Install Perl dependencies (cached unless Makefile.PL changes)
-RUN cd /usr/local/nictool/server && perl Makefile.PL && cpanm -n . \
-    && cd /usr/local/nictool/client && perl Makefile.PL && cpanm -n .
+RUN cd /tmp/nictool/server && perl Makefile.PL && cpanm -n . \
+    && cd /tmp/nictool/client && perl Makefile.PL && cpanm -n . \
+    && rm -rf /tmp/nictool
 
 # Additional Perl modules not in Makefile.PL
 RUN cpanm --notest \
@@ -67,12 +70,15 @@ RUN cpanm --notest \
 RUN a2dismod mpm_event && a2enmod mpm_prefork && a2enmod ssl \
     && rm -rf /etc/apache2/sites-enabled/* /etc/apache2/sites-available/*
 
+# ---- production: install app source and entrypoint ----
+FROM base AS production
+
 # Now copy the full source (only this layer invalidates on code changes)
 COPY server/ /usr/local/nictool/server/
 COPY client/ /usr/local/nictool/client/
 COPY dist/   /usr/local/nictool/dist/
 
-# Install the actual NicTool modules (deps are cached above)
+# Install the actual NicTool modules (deps are cached in base)
 RUN cd /usr/local/nictool/server && perl Makefile.PL && make install \
     && cd /usr/local/nictool/client && perl Makefile.PL && make install