[BEEEP] feat: Containerize the DB Seeder utility

[mimartin12]

🎟️ Tracking

BEEEP

📔 Objective

Packages the SeederUtility CLI as a portable container image so it can run under container orchestration (for example, as a Kubernetes Job). Adds a Dockerfile and entrypoint: a multi-stage .NET + Rust build that produces a self-contained single-file binary and runs as a non-root user.

Two small supporting changes make the image work:

• RustSdk now links libsdk.so for linux-arm64 as well as linux-x64, so the native library is bundled on arm64.
• The SeederUtility persists DataProtection keys to globalSettings.DataProtection.Directory when that path is set (and does nothing when it isn't), so the keys can be shared with other components.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the containerization of the SeederUtility CLI: a new multi-stage Dockerfile, a gosu-based non-root entrypoint, the linux-arm64 native-library mapping in RustSdk.csproj, and the conditional DataProtection key persistence in ServiceCollectionExtension.cs. The Dockerfile and entrypoint closely mirror the already-merged SeederApi container pattern, and the DataProtection change correctly no-ops in cloud (where DataProtection.Directory resolves to null) while persisting keys under /etc/bitwarden for self-host, which the entrypoint chowns to the non-root user. No security, correctness, or breaking-change concerns were identified.

Code Review Details

No findings at or above the reporting threshold.

Notes considered and dismissed during review:

• RustSdk.csproj maps the same libsdk*.so glob to both linux-x64 and linux-arm64 runtime folders. RID-scoped publish (-r ${RID}) selects only the matching folder, so the arm64 image gets the arm64 build and the x64 image gets the x64 build; the mislabeled copy is never resolved at runtime. Not a functional issue.
• The SeederUtility Dockerfile omits CARGO_TARGET_DIR=/tmp/cargo_target (present in SeederApi). Cargo falls back to the writable default rust/target/, so the build still succeeds.
• The persistence guard (!string.IsNullOrWhiteSpace(...)) differs from the app's SelfHosted && SettingHasValue(...) guard, but the computed Directory getter returns null in non-self-hosted cloud, producing equivalent behavior.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.48%. Comparing base (4544404) to head (972199f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7965      +/-   ##
==========================================
- Coverage   66.03%   61.48%   -4.55%     
==========================================
  Files        2253     2253              
  Lines       99103    99103              
  Branches     8960     8960              
==========================================
- Hits        65445    60938    -4507     
- Misses      31411    36012    +4601     
+ Partials     2247     2153      -94     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.