feat: harden Docker image builds and publishing

[knylbyte]

Summary

This replaces the legacy Docker publishing workflow with a hardened, multi-platform build pipeline for linux/amd64 and linux/arm64.

Changes

• build a small production image using node:24-trixie-slim
• install production dependencies only
• move linting, testing and TypeScript tooling to devDependencies
• run the container as the unprivileged node user
• add a container health check
• add a focused .dockerignore
• build platform images independently with scoped BuildKit caches
• assemble and publish the final multi-platform OCI index
• publish latest, branch and short-SHA tags
• generate and verify provenance for the final multi-platform digest
• restrict GitHub token permissions per job
• replace the legacy docker-publish.yml workflow

API snapshot

The workflow now resolves iptv-org/api:gh-pages to an immutable commit once per run.

It then:

• downloads the 13 required API files
• validates every file as a non-empty JSON array
• generates and verifies SHA-256 checksums
• shares the same snapshot with every platform build
• records the API revision and snapshot digest in the image metadata

This prevents architecture-specific images from containing different or stale API data.

An optional api_ref workflow input allows testing a specific commit, tag or branch.

Environment flags

CURL=false and DEBUG=false are now parsed as actual boolean values instead of enabling the corresponding options because the environment variable is present.

Both command-line flags remain usable without an explicit value:

--curl
--debug

Validation

• npm run lint
• npm test -- tests/commands/epg/grab.test.ts
• 14 parser/grabber tests passed
• GitHub workflows validated with actionlint
• local Docker build completed successfully
• named API build-context path completed successfully
• API checksums and runtime data loading verified
• container health check reached healthy

[Copilot]

Pull request overview

This PR replaces the legacy Docker publishing workflow with a hardened, multi-platform (amd64/arm64) build + publish pipeline, and introduces an immutable iptv-org/api:gh-pages snapshot mechanism so every platform build uses identical API data.

Changes:

• Add an API snapshot downloader/verifier (docker/api-snapshot.mjs) and wire it into the Docker build (local fallback + CI-provided snapshot build context).
• Replace the old Docker publishing workflow with a new pipeline that builds per-platform images with scoped caches, then assembles and publishes a multi-platform OCI index + provenance verification.
• Fix boolean flag/env parsing for --curl / --debug and add regression tests; adjust a couple of site configs/tests and tighten lint/docker ignore patterns.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/commands/epg/grab.test.ts	Adds coverage for enabling/disabling CURL and DEBUG via environment variables.
sites/tvpassport.com/tvpassport.com.test.js	Adds a test for empty channel list generation.
sites/tvpassport.com/tvpassport.com.config.js	Defers loading the French channel set to channels() execution.
sites/toonamiaftermath.com/toonamiaftermath.com.config.js	Switches HTTPS CA material to a dedicated CA chain file.
sites/toonamiaftermath.com/ca-chain.pem	Adds the CA chain used for TLS verification.
sites/toonamiaftermath.com/data/certificate.pem	Removes the previously embedded cert bundle.
scripts/commands/epg/grab.ts	Updates Commander options to correctly parse boolean env vars for curl/debug.
package.json	Moves dev tooling into devDependencies and expands lint scope/extensions.
Dockerfile	Replaces legacy alpine-based image build with snapshot-based, production-only install and non-root runtime.
docker/README.md	Documents the API snapshot approach for Docker builds.
docker/api-snapshot.mjs	Implements snapshot resolution, download, validation, checksums, and verification.
.husky/scripts_lint.sh	Extends staged-lint scope to include docker/**/*.mjs.
.github/workflows/docker-publish.yml	Removes the legacy publish workflow.
.github/workflows/docker-build.yml	Adds the new hardened multi-job build/publish/manifest/attestation workflow.
.github/workflows/check.yml	Includes docker/**/*.mjs in the “changed JS files” lint set and consolidates outputs.
.dockerignore	Adds a focused dockerignore for smaller build contexts/images.

[knylbyte]

Note: The Docker runtime image is intentionally limited to grab and serve. Files used exclusively by the maintainer command channels:parse are excluded because channel lists are generated outside the container and bundled as *.channels.xml.