v2026.5.29

.dockerignore

@@ -0,0 +1,3 @@
+.git
+.zig-cache
+zig-out

.github/workflows/release.yml

@@ -6,13 +6,15 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write
+  packages: write
 
 jobs:
   release:
     uses: nullclaw/nullbuilder/.github/workflows/zig-release.yml@v1
     permissions:
       contents: write
+      packages: write
     secrets: inherit
     with:
       binary_name: nullwatch
@@ -33,3 +35,4 @@ jobs:
         .git
         .zig-cache
         zig-out
+      publish_docker: true

Dockerfile

@@ -0,0 +1,65 @@
+# syntax=docker/dockerfile:1
+
+# -- Stage 1: Build ---------------------------------------------------------
+FROM --platform=$BUILDPLATFORM alpine:3.23 AS builder
+
+ARG ZIG_VERSION=0.16.0
+ARG VERSION=dev
+
+RUN apk add --no-cache curl musl-dev xz
+RUN set -eu; \
+    case "$(uname -m)" in \
+      x86_64) zig_pkg="zig-x86_64-linux-${ZIG_VERSION}.tar.xz" ;; \
+      aarch64|arm64) zig_pkg="zig-aarch64-linux-${ZIG_VERSION}.tar.xz" ;; \
+      *) echo "Unsupported build arch: $(uname -m)" >&2; exit 1 ;; \
+    esac; \
+    curl -fL "https://ziglang.org/download/${ZIG_VERSION}/${zig_pkg}" -o /tmp/zig.tar.xz; \
+    mkdir -p /opt/zig; \
+    tar -xJf /tmp/zig.tar.xz -C /opt/zig --strip-components=1; \
+    ln -s /opt/zig/zig /usr/local/bin/zig; \
+    rm -f /tmp/zig.tar.xz
+
+WORKDIR /app
+COPY build.zig build.zig.zon ./
+COPY src/ src/
+
+ARG TARGETARCH
+RUN --mount=type=cache,target=/root/.cache/zig \
+    --mount=type=cache,target=/app/.zig-cache \
+    set -eu; \
+    arch="${TARGETARCH:-}"; \
+    if [ -z "${arch}" ]; then \
+      case "$(uname -m)" in \
+        x86_64) arch="amd64" ;; \
+        aarch64|arm64) arch="arm64" ;; \
+        *) echo "Unsupported host arch: $(uname -m)" >&2; exit 1 ;; \
+      esac; \
+    fi; \
+    case "${arch}" in \
+      amd64) zig_target="x86_64-linux-musl" ;; \
+      arm64) zig_target="aarch64-linux-musl" ;; \
+      *) echo "Unsupported TARGETARCH: ${arch}" >&2; exit 1 ;; \
+    esac; \
+    zig build -Dtarget="${zig_target}" -Doptimize=ReleaseSmall -Dversion="${VERSION}"
+
+# -- Stage 2: Runtime -------------------------------------------------------
+FROM alpine:3.23 AS release-base
+
+LABEL org.opencontainers.image.source=https://github.com/nullclaw/nullwatch
+
+RUN apk add --no-cache ca-certificates tzdata
+RUN mkdir -p /nullwatch-data/data && chown -R 65534:65534 /nullwatch-data
+
+COPY --from=builder /app/zig-out/bin/nullwatch /usr/local/bin/nullwatch
+
+ENV NULLWATCH_HOME=/nullwatch-data
+WORKDIR /nullwatch-data
+EXPOSE 7710
+ENTRYPOINT ["nullwatch"]
+CMD ["serve", "--host", "0.0.0.0", "--port", "7710", "--data-dir", "/nullwatch-data/data"]
+
+FROM release-base AS release-root
+USER 0:0
+
+FROM release-base AS release
+USER 65534:65534

RELEASING.md

@@ -0,0 +1,61 @@
+# Releasing
+
+NullWatch uses [CalVer](https://calver.org/) with the format `YYYY.M.D` (for example, `v2026.5.29`).
+
+Pushing a tag matching `v*` triggers the [Release workflow](.github/workflows/release.yml), which calls the shared `nullclaw/nullbuilder` Zig release workflow. It builds binaries for supported platforms and publishes a GitHub Release.
+
+## Steps
+
+1. **Checkout and update `main`**
+
+   ```bash
+   git checkout main
+   git pull origin main
+   ```
+
+2. **Create a release branch**
+
+   ```bash
+   git checkout -b release/vYYYY.M.D
+   ```
+
+3. **Bump the version in `build.zig.zon`**
+
+   Update the `.version` field to match today's date:
+
+   ```diff
+   - .version = "2026.3.16",
+   + .version = "2026.5.29",
+   ```
+
+4. **Commit the version bump**
+
+   ```bash
+   git add build.zig.zon
+   git commit -m "vYYYY.M.D"
+   ```
+
+5. **Push the branch and create a PR**
+
+   ```bash
+   git push origin release/vYYYY.M.D
+   gh pr create --title "vYYYY.M.D" --body "Version bump for vYYYY.M.D release."
+   ```
+
+6. **Merge the PR** or get it reviewed and merged.
+
+7. **Tag the release on `main`**
+
+   ```bash
+   git checkout main
+   git pull origin main
+   git tag vYYYY.M.D
+   git push origin vYYYY.M.D
+   ```
+
+   The tag push triggers the release build and GitHub Release publishing.
+
+## Notes
+
+- Pull requests to `main` run the CI workflow through `nullclaw/nullbuilder`.
+- If multiple releases happen on the same day, append a patch number, for example `v2026.5.29.1`.

build.zig.zon

@@ -1,6 +1,6 @@
 .{
     .name = .nullwatch,
-    .version = "2026.3.16",
+    .version = "2026.5.29",
     .fingerprint = 0x331185e774b4ae7a,
     .minimum_zig_version = "0.16.0",
     .paths = .{