fix(security): rate limiting, forbidNonWhitelisted, Prisma migrations en startup y CI para GHCR

- ThrottlerGuard global: 20 req/min por IP en todos los endpoints - forbidNonWhitelisted: true en ValidationPipe - Dockerfile API: prisma migrate deploy antes de arrancar el proceso - coolify-compose: depends_on api (service_healthy) en web - GitHub Actions: build y push de imágenes api/web a GHCR en cada push a main Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-18 17:06:35 -05:00
parent 1b49e3fc0e
commit db19f3e1ca
5 changed files with 69 additions and 2 deletions
@@ -0,0 +1,59 @@
+name: Build & Push Docker images
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_PREFIX: ghcr.io/${{ github.repository_owner }}/moraworld-imports
+
+jobs:
+  build-api:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build & push API
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: apps/api/Dockerfile
+          push: true
+          tags: ${{ env.IMAGE_PREFIX }}/api:latest
+
+  build-web:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build & push Web
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: apps/web/Dockerfile
+          push: true
+          build-args: |
+            NEXT_PUBLIC_API_URL=${{ vars.NEXT_PUBLIC_API_URL }}
+          tags: ${{ env.IMAGE_PREFIX }}/web:latest