ci: migrate Docker build from CircleCI to GitHub Actions (#14)

[Xavier Fournet (xfournet)]

Proposed changes

• Add .github/workflows/docker-build-push.yml, which builds and publishes filigran/python-fips and filigran/python-nodejs-fips on every push to main, on a daily 0 0 * * * schedule, and on manual workflow_dispatch. Same tags as before (python-fips:python3.12 / latest and python-nodejs-fips:python3.12-nodejs22 / latest), same linux/amd64 platform, with pull: true and no-cache: true.
• Build both images in parallel through a matrix (fail-fast: false) instead of sequentially in a single job, and replace CircleCI's no_output_timeout: 30m with timeout-minutes: 120.
• Drop the MS Teams reporting entirely — the cloudradar-monitoring/ms-teams orb is not carried over and there is no replacement notification job. Build results are visible in the Actions tab and through the README badge.
• Delete .circleci/config.yml and point the README build badge at the new workflow.

The Dockerfiles are intentionally untouched — see Further comments.

Related issues

• Closes ci: migrate Docker build from CircleCI to GitHub Actions #14

How to test this PR

The workflow only runs on main, on the schedule, or via manual dispatch, so it cannot be exercised from this branch. After merge:

1. Run the workflow manually from the Actions tab (Build and publish Docker images → Run workflow), or wait for the nightly run.
2. Check that both matrix jobs succeed and that the two repositories on Docker Hub receive new tags.

FIPS smoke test on the published image:

docker run --rm -it filigran/python-nodejs-fips:latest /bin/sh -c \
  'openssl version && node --enable-fips -p "crypto.getFips()" && python3 -c "import ssl; print(ssl.OPENSSL_VERSION)"'

Checklist

• The PR title follows the Conventional Commits convention type(scope?): description (#issue)
• I signed my commits
• This PR is linked to an issue
• I consider the submitted work as finished
• I tested the code for its functionality
• I added/updated the relevant documentation
• Where necessary, I refactored code to improve the overall quality

The functionality box is unchecked because the workflow cannot run before it lands on main. The workflow YAML was validated locally.

Further comments

Required secrets. The Docker Hub credential secret is now DOCKERHUB_TOKEN, whereas CircleCI used DOCKERHUB_PASS. DOCKERHUB_USERNAME and DOCKERHUB_TOKEN must be available to this repository (organization or repository level) before the first run. MS_TEAMS_WORKFLOW_WEBHOOK_URL is no longer used by this repository and can be revoked if nothing else depends on it.

Runner choice. CircleCI used resource_class: large; this workflow uses ubuntu-latest, which is 4 vCPU / 16 GB on public repositories and therefore comparable, while avoiding a dependency on the organization's large-runner label being granted to this repository. Happy to switch to large-runner if preferred.

Scope. Issue #14 also suggested using the Python FIPS image as the base for the Python + Node.js image and pinning a fixed Node.js version managed by Renovate. Those two items were explicitly deferred, so this PR is a pure CI migration and leaves both Dockerfiles unchanged.

Two follow-ups worth considering, deliberately left out of this PR:

1. There is still no build validation on pull requests (CircleCI had none either), yet Renovate automerges OpenSSL patch and CPython bumps here — so a broken bump can land on main unverified. A build-only pull_request trigger would close that gap, at the cost of roughly doubling CI time per bump PR.
2. The nodejs22 tag is now inaccurate: apk add nodejs on alpine:3.23 currently resolves to Node.js 24.18.1. Fixing this properly overlaps with the deferred Renovate pinning work.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Migrates the Docker image build-and-publish pipeline from CircleCI to GitHub Actions, keeping the same image tags/platform and adding an MS Teams notification step, while removing the legacy CircleCI configuration and updating the README badge accordingly.

Changes:

• Added a GitHub Actions workflow to build/push filigran/python-fips and filigran/python-nodejs-fips via a matrix on main, nightly schedule, and manual dispatch.
• Added an always-running MS Teams notification job that posts an Adaptive Card (and safely no-ops if the webhook secret is missing).
• Removed CircleCI config and updated the README build badge to point at the new workflow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/docker-build-push.yml	New GitHub Actions workflow to build/push both Docker images and notify MS Teams.
.circleci/config.yml	Removed legacy CircleCI pipeline configuration.
README.md	Updated CI badge from CircleCI to the new GitHub Actions workflow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Eloise Faure (efaure)]

lgtm for the migration to github action.
Maybe it's worth creating another issue to follow up on nodejs version mismatch. And maybe on pinning some other version to avoid breaking changes in base image.

[Xavier Fournet (xfournet)]

lgtm for the migration to github action. Maybe it's worth creating another issue to follow up on nodejs version mismatch. And maybe on pinning some other version to avoid breaking changes in base image.

Eloise Faure (@efaure) yes, this is completly refactor in #46