fix: go1.25.12 to fix crypto/tls voulnerability (#99)

fix: always include edge tag on workflow_run to prevent empty tag bui…

…ld failure (#100)

When semantic-release completes without creating a new version
(e.g., chore commit), the version extraction step finds no tag,
resulting in no tags being generated. This causes buildx to fail
with 'tag is needed when pushing to registry'.

Enable the edge tag on workflow_run events to ensure at least one
tag is always available when the container image is built.

fix: use workflow_run trigger for container image tagging on release (#…

…98)

The release event trigger does not work because go-semantic-release
uses GITHUB_TOKEN, and GitHub Actions suppresses events triggered
by GITHUB_TOKEN to prevent recursive workflows.

Replace with workflow_run trigger on the 'Create Semantic Release'
workflow. When semantic-release completes successfully, the container
image workflow now:

1. Checks out the exact commit from the semantic-release run
2. Fetches tags and extracts the semver version from the tag
3. Uses type=raw to generate proper tags: vX.Y.Z, vX, vX.Y, latest
4. Only enables 'edge' tag on push to main (not on release builds)

fix: add release event trigger to container image workflow for semver…

… and latest tags (#97)

When a PR is merged to main, semantic-release creates a new tag and
GitHub Release, but the container image workflow only triggered on
push to main, resulting in only the 'edge' tag being pushed to quay.io.

Adding a 'release: [published]' trigger ensures the workflow runs
when semantic-release publishes a release, allowing the
docker/metadata-action to generate proper semver tags (vX.Y.Z, vX, vX.Y)
and the 'latest' tag via type=semver.

The 'edge' tag is conditionally disabled on release events to keep it
reserved for main branch builds.

fix: resolve production-readiness issues across code and deployments (#…

…96)

This commit addresses 15 issues identified during code review, covering
error handling, security, reliability, and Kubernetes best practices.

Application fixes:
- Exit immediately on env.Parse failure instead of continuing with zero Config
- Return error from toJSONString instead of calling log.Fatalf mid-request
- Add 128KB request body size limit via http.MaxBytesReader
- Add graceful shutdown with 5s timeout for SIGINT/SIGTERM
- Remove invalid validate:"number" tag from TruncatedAlerts (int type is sufficient)
- Change StartsAt/EndsAt from string to time.Time for type safety
- Add TLS MinVersion: tls.VersionTLS12 to server config
- Fix health check handler to not write after headers are already sent

Deployment fixes:
- Remove empty prometheusrule.yaml and its kustomization reference
- Fix secret-signalilo.yaml: stringData:: → stringData:
- Add pod securityContext (runAsNonRoot: true)
- Add container securityContext (allowPrivilegeEscalation: false,
  readOnlyRootFilesystem: true, capabilities.drop: [ALL])
- Remove unnecessary sessionAffinity: ClientIP from Service
- Add initialDelaySeconds: 15 to liveness probe

CI/CD fixes:
- Fix .releaserc plugin nesting: separate @semantic-release/exec and
  @semantic-release/git into top-level entries

Test improvements:
- Add TestWebhookHandlerUpstreamFailure for upstream 5xx scenarios
- Add TestRedactFieldsEmptyKeysToKeep for edge case coverage
- Add TestRedactFieldsNilMap for nil map safety
- Remove commented-out dead code

fix(deploy): update commands to not rely on $PATH (#83)

fix(deploy): v0.6.1 (#81)

chore: bump cicd versions (github actions, local dev) (#80)

* chore: bump cicd versions (github actions, local dev)

* chore: use implicit GITHUB_TOKEN

feat: bump ubi9/ubi-micro from 9.4 to 9.5 (#36)

Bumps ubi9/ubi-micro from 9.4 to 9.5.

---
updated-dependencies:
- dependency-name: ubi9/ubi-micro
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix(deploy): 0.4.1 (#35)