Build, CI/CD & Infrastructure

Relevant source files

• .github/workflows/gh_pr_label.yml
• .github/workflows/push_docker_image.yml
• .github/workflows/push_docker_image_next.yml
• .github/workflows/release.yml
• .github/workflows/release_sync_gitee.py
• .github/workflows/release_sync_gitee.yml
• .goreleaser.yml
• CHANGELOG.md
• Dockerfile
• Dockerfile_gh
• LICENSE
• Makefile
• docker/docker-compose.yml
• ui/eslint.config.mjs
• ui/index.html
• ui/scripts/eslint/rules/no-root-relative-url.mjs
• ui/scripts/vite/plugins/preserve-files-plugin.ts
• ui/src/pages/ConsoleLayout.tsx
• ui/src/pages/login/Login.tsx
• ui/src/pages/settings/SettingsAppearance.tsx
• ui/src/pages/workflows/WorkflowNew.tsx
• ui/src/repository/_pocketbase.ts
• ui/src/utils/url.ts
• ui/tsconfig.app.json
• ui/tsconfig.json
• ui/tsconfig.node.json
• ui/vite.config.ts

This section provides an overview of the Certimate build pipeline, release automation, and deployment infrastructure. The project utilizes a unified build process that integrates a React-based frontend with a Go-based backend, resulting in a single, cross-platform binary.

Build System Overview

Certimate uses a multi-stage build process to embed the compiled frontend assets directly into the Go binary. This allows for a "single-file" deployment model where the web UI is served by the backend's internal server.

Local Development and Manual Builds

The project provides a Makefile and Dockerfile to manage the build lifecycle.

• Makefile: Provides targets for multi-platform builds. The build target iterates through OS_ARCH combinations (Linux, Darwin, Windows for amd64/arm64) and executes go build with optimized flags Makefile6-24 A local.run target is also provided to build the UI and start the server in one command Makefile39-40
• Dockerfile: Encapsulates the entire build environment.
  • Frontend Stage: A webui-builder stage using node:24-alpine compiles the React source into static assets in ui/dist Dockerfile1-7
  • Backend Stage: A server-builder stage using golang:1.25-alpine copies the UI assets and compiles the Go binary with CGO_ENABLED=0 for maximum portability Dockerfile11-18
• Optimizations: The Go compiler is invoked with -ldflags="-s -w" to strip debug information and -trimpath to remove local file system paths from the binary Dockerfile17 Makefile24

Build Artifacts to Code Mapping

The following diagram illustrates how source entities from both the frontend and backend are synthesized into the final distribution artifacts.

Sources: Dockerfile1-18 .goreleaser.yml9-18 Makefile18-24

---

CI/CD Pipeline

The project relies on GitHub Actions for automated testing, building, and distribution.

Release Automation

When a version tag (e.g., v0.4.0) is pushed, the release.yml workflow is triggered .github/workflows/release.yml3-6

1. UI Preparation: Builds the frontend using npm run build with Node 24 and uploads it as an intermediate artifact ui-build .github/workflows/release.yml18-32
2. Multi-Platform Compilation: Parallel jobs compile the Go binary for Linux (amd64, arm64, armv7), macOS (amd64, arm64), and Windows (amd64, arm64, 386) .github/workflows/release.yml35-152
3. Asset Packaging: Binaries are bundled with LICENSE, README.md, and CHANGELOG.md into .zip archives, and sha256sum checksums are generated .github/workflows/release.yml176-211
4. GitHub Release: Creates a draft release on GitHub using softprops/action-gh-release@v3 .github/workflows/release.yml213-221

Docker Image Distribution

Certimate provides official Docker images via push_docker_image.yml .github/workflows/push_docker_image.yml1-107

• Stable Images: Triggered by standard version tags .github/workflows/push_docker_image.yml4-10
• Preview Images: Automated builds for alpha, beta, and rc versions via push_docker_image_next.yml .github/workflows/push_docker_image_next.yml1-106
• Architecture Support: Images are built for multiple architectures including linux/amd64, linux/arm64, and linux/arm/v7 using docker/build-push-action@v7 .github/workflows/push_docker_image.yml100-104

Gitee Synchronization

A specialized Python script release_sync_gitee.py and workflow mirror GitHub releases to Gitee to support users in regions with limited GitHub access .github/workflows/release_sync_gitee.yml9-28 It handles metadata synchronization and asset re-uploading via Gitee's API using the GITEE_TOKEN .github/workflows/release_sync_gitee.py140-207

For details, see Release Pipeline & Docker.

---

Infrastructure & Deployment

Certimate is designed to be infrastructure-agnostic, requiring only a persistent volume for its SQLite database managed by PocketBase.

Containerization

The project provides a Dockerfile using a multi-stage approach Dockerfile1-25

1. WebUI Builder: Compiles the frontend assets Dockerfile1-7
2. Server Builder: Compiles the Go code with CGO_ENABLED=0 and embeds the UI assets Dockerfile11-18
3. Runtime: Uses alpine:latest as the base, executing the binary with the serve command on port 8090 Dockerfile21-24

Deployment Orchestration

A standard docker-compose.yml is provided for quick deployment, mapping port 8090 and persisting data in a local volume ./data to /app/pb_data docker/docker-compose.yml1-13

CI/CD Workflow Entity Map

This diagram maps the GitHub Action workflows to the specific configuration files and scripts they utilize.

Sources: .github/workflows/release.yml1 .goreleaser.yml1 Makefile1 Dockerfile1 Dockerfile_gh1 .github/workflows/release_sync_gitee.py1

---

Frontend Toolchain

The frontend is built using Vite and Tailwind CSS. Key features of the toolchain include:

• Asset Management: The UI build produces static assets in the ui/dist directory which are then embedded into the Go binary Dockerfile7-15
• CI/CD Integration: UI builds are performed as a prerequisite step (prepare-ui) in both binary release and Docker image workflows to ensure consistency .github/workflows/release.yml9-34 .github/workflows/push_docker_image.yml19-44
• Version Injection: The vite.config.ts script reads the AppVersion constant from the Go source to inject it into the frontend build ui/vite.config.ts12-32
• Compatibility: The project ensures browser compatibility through the legacyPlugin and a runtime check isBrowserHappy ui/vite.config.ts47-54 ui/src/pages/ConsoleLayout.tsx59-61

For details, see Frontend Build Toolchain.

---

Sources:

• .github/workflows/release.yml1-221
• Dockerfile1-25
• Dockerfile_gh1-17
• .goreleaser.yml1-61
• Makefile1-40
• .github/workflows/push_docker_image.yml1-107
• .github/workflows/push_docker_image_next.yml1-106
• .github/workflows/release_sync_gitee.yml1-29
• .github/workflows/release_sync_gitee.py1-209
• docker/docker-compose.yml1-13
• ui/vite.config.ts1-71
• ui/src/pages/ConsoleLayout.tsx27-61