ci: publish governance backend images to ghcr

[steebchen]

Summary

• add GHCR publishing for governance db, api, and indexer images
• add a deploy-oriented compose file that consumes the published images
• tighten runtime Dockerfiles and document Sepolia image usage

Validation

• docker build -f db/Dockerfile -t governance-db:test .
• docker build -f api/Dockerfile -t governance-api:test api
• docker build -f indexer/Dockerfile -t governance-indexer:test indexer
• docker build -f ui/Dockerfile -t governance-ui:test ui
• docker compose -f docker-compose.ghcr.yml config

[Copilot]

Pull request overview

This PR adds CI publishing of the governance backend Docker images to GitHub Container Registry (GHCR) and introduces a deploy-focused compose file that pulls those published images, along with runtime Dockerfile tightening and updated documentation for running Sepolia.

Changes:

• Add a GitHub Actions workflow to build & push governance-db, governance-api, and governance-indexer images to GHCR.
• Add docker-compose.ghcr.yml to run the stack from published images.
• Update API/Indexer Dockerfiles and .dockerignore files; document GHCR usage in the root README.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
indexer/Dockerfile	Tightens indexer runtime image (prod deps, non-root user), but currently hard-codes Sepolia startup.
indexer/.dockerignore	Updates ignored files, but still allows .env.* into build context.
docker-compose.ghcr.yml	New compose file consuming GHCR images for db/api/indexer.
db/Dockerfile	New minimal Postgres-based image for the db service.
api/Dockerfile	Splits builder/runner stages and runs as non-root with prod deps only.
api/.dockerignore	New ignore file to keep build contexts clean and avoid env leakage.
README.md	Documents GHCR images and example Sepolia run commands.
.github/workflows/publish-images.yml	New workflow to publish backend images to GHCR.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

CMD ["npm", "run", "start:sepolia"] hard-codes Sepolia (the script sets NETWORK=sepolia), so any NETWORK value provided at runtime (e.g. via docker-compose) is ignored. Consider changing the container entrypoint to a script that honors NETWORK from the environment (or update the npm scripts so they don't override NETWORK).

Suggested change

	CMD ["npm", "run", "start:sepolia"]
	CMD ["sh", "-c", "npm run start:${NETWORK:-sepolia}"]

[Copilot]

This compose file sets NETWORK: ${NETWORK:-sepolia}, but the published indexer image currently runs start:sepolia which overrides NETWORK internally. Either adjust the image entrypoint to honor the env var, or remove/rename this setting to avoid misleading configuration.

Suggested change

NETWORK: ${NETWORK:-sepolia}

[Copilot]

The indexer build context still includes .env.* files (e.g. .env.mainnet) because only .env and .env.local are ignored. This can accidentally send secrets into the Docker build context on developer machines/CI. Consider ignoring .env.* (and optionally .env.local.example) similar to api/.dockerignore.

Suggested change

	.env.local
	.env.local
	.env.*
	.env.local.example

[Copilot]

The db image build uses context: ., which sends the entire repository as build context even though db/Dockerfile doesn't copy any files. Switching the context to ./db (and updating the file path accordingly) will make builds faster and reduce CI bandwidth.