Build and publish the container image on push to main

[theNEXlevel]

Summary

Same setup as C4G/template#8: move the production image build off the shared Coolify host and into GitHub Actions.

• .github/workflows/publish.yaml (new) — on push to main / workflow_dispatch: builds the image, pushes ghcr.io/c4g/va-stats:latest and :<sha>, then triggers a Coolify deploy of va-stats-test.
• docker-compose.yml — references the published image, no build: key. That absence is what stops Coolify from compiling on the server; a deploy becomes a pull-and-restart.
• docker-compose.build.yml (new) — restores the build: key for local builds.
• .github/workflows/ci.yaml — PR runs overlay the build file so they still verify an image built from the branch.
• Dockerfile — stops baking in NEXT_PUBLIC_BASE_URL (see below).
• README.md — documents the deploy flow, environments, and promotion. Replaces the stale "Deploy on Vercel" section.

One image, two origins

NEXT_PUBLIC_BASE_URL differs per environment (https://va-stats.c4g.dev vs https://va-stats-test.c4g.dev) and was passed as a build arg, so a single published image could not have served both.

The Dockerfile now leaves it unset at build time. Next.js only substitutes NEXT_PUBLIC_* variables that are present in the environment during the build (next/dist/build/webpack/plugins/define-env-plugin.js → getNextPublicEnvironmentVariables), so with it unset the expression survives as a real runtime lookup and each environment supplies its own value through Coolify — which docker-compose.yml already passed at runtime.

Verified empirically: built the app with the variable unset and inspected the compiled server output.

$ grep -o "process\.env\.NEXT_PUBLIC_BASE_URL" .next/server/pages/api/updateusers.js
process.env.NEXT_PUBLIC_BASE_URL

The expression is intact rather than replaced with a literal, so no Docker entrypoint or code change is needed. This holds because the value is read server-side only — utils/auditLogger.js:3, imported solely by pages/api/*, and guarded by typeof window === "undefined". The Dockerfile carries a comment recording that constraint, since reading it from client code would return undefined in the browser.

Environments

Environment	Coolify app	Image tag
va-stats-test.c4g.dev	va-stats-test (v1084st0j09gwuxnapqkr9xk)	latest, deployed automatically on push to main
va-stats.c4g.dev	va-stats (gwggx3pjadr1unl07bo471dk)	IMAGE_TAG pinned to a commit SHA, deployed manually

Production promotion is explicit: set IMAGE_TAG to a SHA already verified on va-stats-test, then redeploy. Production runs the exact image that was tested rather than a rebuild.

Already applied outside this PR

• Coolify git auto-deploy disabled on va-stats-test (it was on). Otherwise Coolify's webhook would race the workflow and pull the previous :latest. The workflow's API call is now the single trigger. Production already had auto-deploy off.
• COOLIFY_APP_UUID repository variable set to v1084st0j09gwuxnapqkr9xk (va-stats-test).

Follow-up required after the first run

The new GHCR package is created private. The Coolify host pulls anonymously (no ~/.docker/config.json on the server), so ghcr.io/c4g/va-stats must be set to public — matching the existing ghcr.io/c4g/metro-atlanta-saves-* and ghcr.io/c4g/va-dat packages — or the first deploy will fail to pull.

🤖 Generated with Claude Code