feat(release): M5 — config doctor, Docker assets, self-hosting smoke

[BunsDev]

What

The M5 release-ops slice — everything needed to self-host coven-github cleanly. Rebased onto current main so it's purely additive (779+/16−); no overlap with the headless-contract/worker work from #27.

Config doctor

• coven-github doctor --config <path> validates config before you serve: catches placeholder secrets, missing PEM / coven-code binary, malformed [[familiars]], etc. (crates/config +416, wired into crates/server/src/main.rs).

Container + self-hosting

• Multi-stage Dockerfile + compose.yaml + .dockerignore
• RELEASE.md release runbook
• Expanded docs/self-hosting.md

Smoke test

• scripts/smoke-webhook.sh — end-to-end webhook smoke against a running instance.

Verification (local, matches CI)

• cargo check --all-targets → clean
• cargo clippy --all-targets -- -D warnings → clean

Context

This is the last of the three in-flight coven-github branches. With #27 (contract + worker resilience) already merged and feat/github-correctness-issues-8-9-4 subsumed by it, landing this leaves main as the single source of truth ahead of accepting external PRs tomorrow.

[Copilot]

Pull request overview

Adds a release-ops “M5” slice to support clean self-hosting: a config “doctor” validator (also enforced at server startup), container assets (Dockerfile/Compose/.dockerignore), and an end-to-end webhook signature smoke script, plus documentation/runbook updates.

Changes:

• Introduce coven-github doctor --config <path> and wire semantic config validation into serve startup.
• Add production-shaped Docker/Compose assets for self-hosting and document the workflow.
• Add a webhook signature smoke test script and incorporate it into docs/release gates.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
scripts/smoke-webhook.sh	Adds a local script to smoke-test webhook signature enforcement end-to-end.
RELEASE.md	Adds a release gate checklist including doctor + webhook smoke validation.
README.md	Documents running doctor before serving and points to container assets.
docs/self-hosting.md	Expands self-hosting docs: doctor usage, smoke test, and updated Docker guidance.
Dockerfile	Adds a multi-stage container build and unprivileged runtime image for the server.
crates/server/src/main.rs	Adds doctor CLI subcommand and runs config validation on serve startup.
crates/config/src/lib.rs	Implements config loading + semantic validation diagnostics and tests.
crates/config/Cargo.toml	Adds toml dependency for config parsing in the config crate.
compose.yaml	Adds a Compose service definition for running the server and mounting config/keys.
Cargo.lock	Locks new dependency additions (toml).
.dockerignore	Excludes build outputs and sensitive files (keys, local config, PEMs) from build context.

Comments suppressed due to low confidence (1)

compose.yaml:33

• The container runs as an unprivileged user (uid 10001), but the named volume mounted at /tmp/coven-github-tasks will typically be owned by root inside the container. The worker creates per-task directories under workspace_root, so this can fail with EACCES at runtime. Prefer a tmpfs mount for truly-ephemeral workspaces, or document/chown a writable path for uid 10001.

    volumes:
      # Config and secrets are mounted read-only — never baked into the image.
      - ./config:/config:ro
      - ./keys:/keys:ro
      # Ephemeral per-task workspaces. Keep worker.workspace_root pointed here.
      - coven-workspaces:/tmp/coven-github-tasks
    environment:
      # Adjust log verbosity, e.g. RUST_LOG=coven_github=debug
      RUST_LOG: "coven_github=info"
    restart: unless-stopped

volumes:
  coven-workspaces:

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.