feat: v0

.envrc

@@ -0,0 +1 @@
+use flake

.github/workflows/on-push.yaml

@@ -0,0 +1,28 @@
+name: On Push
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches:
+      - main
+      - master
+
+jobs:
+  build-and-push:
+    permissions:
+      contents: read
+      packages: write
+    uses: builderhub/actions-internal/.github/workflows/build-push-image.yaml@main
+    with:
+      build-type: dockerfile
+      image-name: build-api
+      dockerfile: Dockerfile
+      context: .
+      buildx-args: --secret id=netrc,env=SECRET_SLOT_0
+    secrets:
+      registry-password: ${{ secrets.GITHUB_TOKEN }}
+      secret-slot-0: |
+        machine github.com login x-access-token password ${{ secrets.ORG_REPO_READ_ONLY }}

.gitignore

@@ -1,6 +1,6 @@
-# If you prefer the allow list template instead of the deny list, see community template:
-# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
-#
+# Binaries and build output
+bin/
+
 # Binaries for programs and plugins
 *.exe
 *.exe~
@@ -24,9 +24,16 @@ profile.cov
 go.work
 go.work.sum
 
-# env file
+# Env files
 .env
+.env.local
+.env.*.local
+
+# Nix
+result
+result-*
+.direnv
 
 # Editor/IDE
-# .idea/
-# .vscode/
+.idea/
+.vscode/

Dockerfile

@@ -0,0 +1,24 @@
+# BuilderHub Build API - multi-stage, distroless, multi-arch
+# Requires netrc for go mod download (private build-operator): --secret id=netrc,env=SECRET_SLOT_0
+# Build from build-api repo: docker buildx build --secret id=netrc,env=SECRET_SLOT_0 .
+
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS builder
+WORKDIR /workspace
+
+RUN apk add --no-cache git ca-certificates tzdata
+
+COPY go.mod go.sum ./
+COPY . .
+
+# go mod download fetches build-operator from github.com/builderhub/build-operator (netrc for private repo auth)
+ENV GOPRIVATE=github.com/builderhub/*
+RUN --mount=type=secret,id=netrc,target=/root/.netrc go mod download
+
+ARG TARGETARCH
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -ldflags="-w -s" -o build-api ./cmd/server
+
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
+COPY --from=builder /workspace/build-api .
+USER nonroot:nonroot
+ENTRYPOINT ["/build-api"]

Makefile

@@ -0,0 +1,24 @@
+GO ?= go
+BUF ?= buf
+BIN_DIR ?= bin
+
+.PHONY: generate
+generate:
+	$(BUF) dep update
+	$(BUF) generate
+
+.PHONY: build
+build: generate
+	$(GO) build -o $(BIN_DIR)/build-api ./cmd/server
+
+.PHONY: run
+run: build
+	./$(BIN_DIR)/build-api --grpc-addr=:9090 --http-addr=:8080
+
+.PHONY: migrate-up
+migrate-up:
+	migrate -path migrations -database "$${DATABASE_URL}" up
+
+.PHONY: migrate-down
+migrate-down:
+	migrate -path migrations -database "$${DATABASE_URL}" down

Tiltfile

@@ -0,0 +1,9 @@
+# BuilderHub Build API - local dev
+allow_k8s_contexts('kind-kind', 'docker-desktop', 'minikube')
+
+local_resource(
+    'build-api',
+    cmd='make build',
+    deps=['cmd/', 'internal/', 'api/', 'go.mod', 'go.sum', 'Makefile'],
+    serve_cmd='bin/build-api --grpc-addr=:9090 --http-addr=:8080',
+)