feat: scratch-based image with input validation and output customization (Closes #16)

- Multi-stage build: Alpine builder + scratch runtime (31.5 MB, -46%)
- Input validation for SIZE, RUNTIME, WARMUP, LOOPS, TARGET
- EMOJI/COLOR env vars with auto-detection and fallbacks
- Graceful job skipping when test size < block size
- Non-root execution (user 65534:65534)
- Remove Docker Scout recommendations (incompatible with scratch)

Author: e7d

.github/workflows/codeql.yml

@@ -0,0 +1,44 @@
+name: "CodeQL"
+
+on:
+  push:
+    tags:
+      - "*"
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - actions
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/docker-image.yml

@@ -10,7 +10,7 @@ on:
     branches:
       - main
   schedule:
-    - cron: '0 0 * * *'
+    - cron: "0 6 * * 1"
   workflow_dispatch:
 
 permissions:
@@ -24,6 +24,8 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      HAS_DOCKERHUB_SECRETS: ${{ github.event_name != 'pull_request' || github.repository == github.event.pull_request.head.repo.full_name }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -32,6 +34,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Login to Docker Hub
+        if: ${{ env.HAS_DOCKERHUB_SECRETS }}
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -64,6 +67,7 @@ jobs:
         with:
           context: .
           platforms: ${{ env.PLATFORMS }}
+          pull: true
           cache-from: type=gha
           cache-to: type=gha
           push: true
@@ -74,17 +78,15 @@ jobs:
         if: ${{ github.event_name == 'pull_request' }}
         uses: docker/scout-action@v1
         with:
-          command: cves,recommendations,compare
+          command: cves,compare
           image: ${{ steps.meta.outputs.tags }}
           to: ${{ vars.GHCR_IMAGE }}:latest
-          ignore-base: true
           ignore-unchanged: true
           only-fixed: true
-          # only-severities: critical,high
           write-comment: true
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Update repo description
-        if: ${{ github.ref == 'refs/heads/main' }}
+        if: ${{ github.ref == 'refs/heads/main' && env.HAS_DOCKERHUB_SECRETS }}
         uses: peter-evans/dockerhub-description@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}