v0.3.0 - React static SPA support

What's Changed

React support

distroless-setup now supports static/client-rendered React applications as a first-class stack.

Run it with: npx distroless-setup react

• React + Vite support, including real container integration coverage
• React Router Framework SPA mode (ssr: false)
• Create React App compatibility for existing projects
• Generic static React build fallback
• Detection of VITE_* and REACT_APP_* build-time variables
• Base-path detection and migration guidance
• Existing nginx configuration analysis and security-header carry-over

Shared static SPA runtime

Angular and React now share the hardened static SPA runtime:

• distroless/static-debian13:nonroot
• Tiny Go static server
• SPA route fallback
• /healthz
• Gzip pre-compression
• Security headers
• Graceful shutdown
• Read-only-root compatibility
• No shell or package manager in the runtime image

Cache-policy fix

Static assets now receive long-lived immutable caching only when their filenames appear content-hashed.

Unversioned assets such as favicon.ico, logo.svg, app.js, and styles.css are revalidated instead of being cached for a year.

This correction also applies to generated Angular images.

Verification

• React + Vite: container integration tested
• React Router SPA: detection and generation tested
• Create React App: detection and generation tested
• 37 unit tests passing, with 1 intentional Windows symlink skip
• 18/18 Docker integration tests passing
• npm package provenance published through GitHub Actions Trusted Publishing / OIDC

Notes

React SSR deployments are not handled by the static React stack. Next.js and server-side React applications continue to use the Node.js stack.

React runtime-config source rewriting and sub-path serving are not included in this release.

Full Changelog: v0.2.0...v0.3.0