release: 0.1.0: Phases 0-11: panel, Postfix/DKIM, milter, backup, Docker image

Initial feature-complete implementation of the v1.0 specification (phases 0-11 of `docs/implementation-plan.md`).
Added:
  - Panel (Go, single static binary) with SQLite persistence, one-time
  - Domain management with per-domain DKIM (RSA-2048, generated in pure Go) and
  - Application (sender identity) management: SASL credentials via `sasldb2`,
  - Full Postfix relay config generated from env at container start: SMTPS 465,
  - Journal milter (pure Go, `go-milter`) recording every send to `send_log`;
  … (6 more in CHANGELOG)

Full detail: CHANGELOG.md (0.1.0).

.github/workflows/release.yml

@@ -0,0 +1,104 @@
+name: release
+
+# Publishes an immutable, version-tagged image on ghcr.io (spec 10.1).
+# Ordinary commits do not publish anything — only a pushed tag matching
+# vX.Y.Z does. That tag is the single source the version comes from: it goes
+# into both the image tag and the panel binary's -ldflags version, so the two
+# can never drift apart (the invariant restore's version check in spec 7.5.A
+# depends on).
+#
+# Native per-architecture builds (plan implementation-plan.md C.4), not qemu:
+# running the full Postfix/OpenDKIM stack under emulation for the e2e gate
+# below is impractically slow. Each arch builds, e2e-gates and pushes its own
+# tag on its own native runner; a merge job then combines them into the one
+# manifest tag documented in deploy/docker-compose.yml. "test, then push" (not
+# push-by-digest then test) is deliberate: it means the bytes that get tagged
+# are exactly the bytes that passed e2e, at the cost of per-arch tags lingering
+# in the registry as a side effect (harmless — the version tag's immutability,
+# spec 10.1, is about that tag, not these).
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Derive version from tag
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            arch: amd64
+          - runner: ubuntu-24.04-arm
+            arch: arm64
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Build image (native, loaded locally for the e2e gate)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: build/Dockerfile
+          load: true
+          provenance: false
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+          tags: selfpost:e2e
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.26"
+          cache-dependency-path: test/e2e/go.sum
+
+      - name: e2e (gates publishing — see docs/implementation-plan.md C.4)
+        run: cd test/e2e && go test -v -timeout 20m ./...
+
+      - name: Log in to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push per-arch tag
+        run: |
+          docker tag selfpost:e2e "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-${{ matrix.arch }}"
+          docker push "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-${{ matrix.arch }}"
+
+  merge:
+    needs: [prepare, build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Merge per-arch tags into the version manifest
+        run: |
+          docker buildx imagetools create \
+            -t "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}" \
+            "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-amd64" \
+            "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-arm64"

.github/workflows/test.yml

@@ -0,0 +1,23 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.26"
+          cache: true
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...