From 9727974b5e877dfccdd8cae49ff02ca936cf80c1 Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Thu, 8 Jan 2026 23:47:17 -0800
Subject: [PATCH 1/8] Configure Harbor registry for Docker builds and
 self-hosted runners

---
 .github/HARBOR_SETUP.md            | 72 ++++++++++++++++++++++++++++++
 .github/workflows/docker-build.yml | 28 ++++++++----
 .github/workflows/docker.yml       | 56 +++++++++++++++++++++++
 Makefile                           | 26 +++++++++++
 docker-compose.yml                 |  6 +--
 5 files changed, 175 insertions(+), 13 deletions(-)
 create mode 100644 .github/HARBOR_SETUP.md
 create mode 100644 .github/workflows/docker.yml

diff --git a/.github/HARBOR_SETUP.md b/.github/HARBOR_SETUP.md
new file mode 100644
index 0000000..2de4454
--- /dev/null
+++ b/.github/HARBOR_SETUP.md
@@ -0,0 +1,72 @@
+# Harbor Registry Setup
+
+This project uses Harbor registry at `harbor.dataknife.net` for Docker image storage.
+
+## GitHub Secrets Configuration
+
+To enable automated builds and pushes to Harbor, you need to configure the following secrets in your GitHub repository:
+
+### Required Secrets
+
+1. **HARBOR_USERNAME**: Harbor robot account username
+
+2. **HARBOR_PASSWORD**: Harbor robot account password/token
+
+### Setting up GitHub Secrets
+
+You can set secrets using the GitHub CLI:
+
+```bash
+gh secret set HARBOR_USERNAME --repo <owner>/<repo> --body "your-harbor-username"
+gh secret set HARBOR_PASSWORD --repo <owner>/<repo> --body "your-harbor-password"
+```
+
+Or via the web UI:
+1. Go to your GitHub repository
+2. Navigate to **Settings** → **Secrets and variables** → **Actions**
+3. Click **New repository secret**
+4. Add the secrets (values should be obtained from your Harbor administrator)
+
+## Local Development
+
+For local development, you can set environment variables:
+
+```bash
+export HARBOR_USERNAME='your-harbor-username'
+export HARBOR_PASSWORD='your-harbor-password'
+```
+
+Then use the Makefile targets:
+
+```bash
+# Login to Harbor
+make docker-login
+
+# Build and push images
+make docker-push
+
+# Pull images
+make docker-pull
+```
+
+## Docker Image Location
+
+The image is stored in the Harbor registry:
+- `harbor.dataknife.net/library/high-command-ui:latest`
+
+## Using Docker Compose
+
+Docker Compose is configured to pull images from Harbor automatically. Just run:
+
+```bash
+docker-compose pull
+docker-compose up -d
+```
+
+Make sure you're logged into Harbor first:
+
+```bash
+docker login harbor.dataknife.net \
+  -u 'your-harbor-username' \
+  -p 'your-harbor-password'
+```
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index e306d12..84a8a93 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -6,9 +6,13 @@ on:
   pull_request:
     branches: [main, develop]
 
+env:
+  HARBOR_REGISTRY: harbor.dataknife.net
+  IMAGE_NAME: library/high-command-ui
+
 jobs:
   docker-build:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     
     permissions:
       contents: read
@@ -21,21 +25,27 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+      
       - name: Build Docker image
         uses: docker/build-push-action@v5
         with:
           context: .
           file: ./Dockerfile
-          push: false
-          load: true
-          tags: high-command-ui:${{ github.sha }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }},${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          cache-from: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
       
       - name: Verify Docker build
         run: |
-          docker image ls | grep high-command-ui
-          echo "Docker image built successfully: high-command-ui:${{ github.sha }}"
+          docker image ls | grep ${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}
+          echo "Docker image built successfully: ${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}"
       
       - name: Report Docker build status
         run: |
@@ -43,5 +53,5 @@ jobs:
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "✓ Docker image built successfully" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Image:** \`high-command-ui:${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Image:** \`${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Commit:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000..60f9038
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,56 @@
+name: Build and Push Docker Image
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches:
+      - main
+      - master
+  workflow_dispatch:
+
+env:
+  HARBOR_REGISTRY: harbor.dataknife.net
+  IMAGE_NAME: library/high-command-ui
+
+jobs:
+  build-and-push:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
diff --git a/Makefile b/Makefile
index 135bbfb..c26618b 100644
--- a/Makefile
+++ b/Makefile
@@ -31,6 +31,9 @@ help:
 	@echo ""
 	@echo "Docker Targets:"
 	@echo "  make docker-build   - Build Docker image"
+	@echo "  make docker-login   - Login to Harbor registry (requires HARBOR_USERNAME and HARBOR_PASSWORD)"
+	@echo "  make docker-push    - Build and push image to Harbor registry"
+	@echo "  make docker-pull    - Pull image from Harbor registry"
 	@echo "  make docker-run     - Run Docker container (port 3000)"
 	@echo "  make docker-dev     - Run development container with hot reload"
 	@echo "  make docker-stop    - Stop Docker container"
@@ -104,8 +107,31 @@ clean:
 	npm cache clean --force
 
 # Docker commands
+HARBOR_REGISTRY := harbor.dataknife.net
+APP_NAME := high-command-ui
+HARBOR_IMAGE := $(HARBOR_REGISTRY)/library/$(APP_NAME)
+IMAGE_TAG ?= latest
+
+docker-login:
+	@echo "Logging into Harbor registry..."
+	@if [ -z "$$HARBOR_USERNAME" ] || [ -z "$$HARBOR_PASSWORD" ]; then \
+		echo "Error: HARBOR_USERNAME and HARBOR_PASSWORD must be set"; \
+		exit 1; \
+	fi
+	docker login $(HARBOR_REGISTRY) \
+		-u "$$HARBOR_USERNAME" \
+		-p "$$HARBOR_PASSWORD"
+
 docker-build:
 	docker build -t high-command-ui:latest .
+	docker tag high-command-ui:latest $(HARBOR_IMAGE):$(IMAGE_TAG)
+
+docker-push: docker-build docker-login
+	docker push $(HARBOR_IMAGE):$(IMAGE_TAG)
+
+docker-pull:
+	docker pull $(HARBOR_IMAGE):$(IMAGE_TAG)
+	docker tag $(HARBOR_IMAGE):$(IMAGE_TAG) high-command-ui:latest
 
 docker-run: docker-build
 	docker run -d --name high-command-ui -p 3000:3000 \
diff --git a/docker-compose.yml b/docker-compose.yml
index 1cba53e..42029a7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,9 +2,7 @@ version: '3.8'
 
 services:
   high-command-ui:
-    build:
-      context: .
-      dockerfile: Dockerfile
+    image: harbor.dataknife.net/library/high-command-ui:latest
     container_name: high-command-ui
     ports:
       - "3000:3000"
@@ -22,7 +20,7 @@ services:
       start_period: 10s
 
   high-command-api:
-    image: high-command-api:latest
+    image: harbor.dataknife.net/library/high-command-api:latest
     container_name: high-command-api
     ports:
       - "3001:3001"

From 73a0e2a1e8c9cc8ec4b48a14f06f14d00c830ebf Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 13:22:08 -0800
Subject: [PATCH 2/8] feat: add GitLab push job as separate stage

---
 .github/workflows/ci.yml | 127 +++++++++++++++++++++++----------------
 1 file changed, 74 insertions(+), 53 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bbe1222..cd038f7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,63 +1,84 @@
 name: CI - Test and Build
-
 on:
+  workflow_dispatch:
   push:
-    branches: [main, develop]
+    branches:
+    - main
+    - develop
   pull_request:
-    branches: [main, develop]
-
+    branches:
+    - main
+    - develop
 jobs:
   test-and-build:
     runs-on: ubuntu-latest
-    
     strategy:
       matrix:
-        node-version: [18.x, 20.x]
-    
+        node-version:
+        - 18.x
+        - 20.x
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      
-      - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: 'npm'
-      
-      - name: Install dependencies
-        run: npm ci
-      
-      - name: Run ESLint
-        run: npm run lint
-        continue-on-error: true
-      
-      - name: Run type checking
-        run: npm run build -- --mode lib
-        continue-on-error: true
-      
-      - name: Check TypeScript compilation
-        run: tsc --noEmit
-      
-      - name: Run tests
-        run: npm test -- --run
-        continue-on-error: true
-      
-      - name: Build production bundle
-        run: npm run build
-      
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist-node-${{ matrix.node-version }}
-          path: dist/
-          retention-days: 5
-      
-      - name: Report build summary
-        run: |
-          echo "## Build Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "✓ TypeScript type checking passed" >> $GITHUB_STEP_SUMMARY
-          echo "✓ Production build successful" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Artifacts:**" >> $GITHUB_STEP_SUMMARY
-          echo "- dist/ directory built with Node ${{ matrix.node-version }}" >> $GITHUB_STEP_SUMMARY
+    - name: Checkout code
+      uses: actions/checkout@v4
+    - name: Setup Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ matrix.node-version }}
+        cache: npm
+    - name: Install dependencies
+      run: npm ci
+    - name: Run ESLint
+      run: npm run lint
+      continue-on-error: true
+    - name: Run type checking
+      run: npm run build -- --mode lib
+      continue-on-error: true
+    - name: Check TypeScript compilation
+      run: tsc --noEmit
+    - name: Run tests
+      run: npm test -- --run
+      continue-on-error: true
+    - name: Build production bundle
+      run: npm run build
+    - name: Upload build artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: dist-node-${{ matrix.node-version }}
+        path: dist/
+        retention-days: 5
+    - name: Report build summary
+      run: 'echo "## Build Summary" >> $GITHUB_STEP_SUMMARY
+
+        echo "" >> $GITHUB_STEP_SUMMARY
+
+        echo "✓ TypeScript type checking passed" >> $GITHUB_STEP_SUMMARY
+
+        echo "✓ Production build successful" >> $GITHUB_STEP_SUMMARY
+
+        echo "" >> $GITHUB_STEP_SUMMARY
+
+        echo "**Artifacts:**" >> $GITHUB_STEP_SUMMARY
+
+        echo "- dist/ directory built with Node ${{ matrix.node-version }}" >> $GITHUB_STEP_SUMMARY
+
+        '
+  push-to-gitlab:
+    name: Push to GitLab
+    runs-on: ubuntu-latest
+    needs:
+    - test-and-build
+    if: always() && needs.test-and-build.result == "success"
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Push to GitLab
+      env:
+        GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
+      run: 'git config user.name "GitHub Actions"
+
+        git config user.email "actions@github.com"
+
+        git push https://oauth2:${GITLAB_TOKEN}@gitlab.com/dk-raas/dkai/high-command/high-command-ui.git HEAD:main --force
+        || echo "GitLab push failed"'

From cb7f02b15274b385366edf030c1a04532464ccd4 Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 13:50:54 -0800
Subject: [PATCH 3/8] fix: update workflow syntax and add security job to push
 dependencies

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd038f7..2ff3d3e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,7 +67,7 @@ jobs:
     runs-on: ubuntu-latest
     needs:
     - test-and-build
-    if: always() && needs.test-and-build.result == "success"
+    if: always() && needs.test-and-build.result == 'success'
     steps:
     - name: Checkout code
       uses: actions/checkout@v4

From 624cf3e48504413bcc47c2991302b1d9f3b655be Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 13:59:37 -0800
Subject: [PATCH 4/8] ci: add GitLab CI for Docker builds only (tests run on
 GitHub)

---
 .gitlab-ci.yml | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 .gitlab-ci.yml

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..b528ee8
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,36 @@
+stages:
+  - build
+
+variables:
+  HARBOR_REGISTRY: harbor.dataknife.net
+  HARBOR_PROJECT: library
+  IMAGE_NAME: high-command-ui
+
+docker-build:
+  stage: build
+  image: docker:latest
+  services:
+    - docker:dind
+  before_script:
+    - docker login -u "$HARBOR_USERNAME" -p "$HARBOR_PASSWORD" $HARBOR_REGISTRY
+  script:
+    - |
+      # Build image
+      docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest .
+      docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA .
+      
+      # Push images
+      docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest
+      docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA
+      
+      # Tag with version if tag exists
+      if [ -n "$CI_COMMIT_TAG" ]; then
+        docker tag $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest \
+          $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG
+        docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG
+      fi
+  only:
+    - main
+    - tags
+  tags:
+    - docker

From 52aa6cd23024ef61e5c61c9378eb63d49b0225be Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 14:08:17 -0800
Subject: [PATCH 5/8] chore: remove Docker workflow files (moved to GitLab CI)

---
 .github/workflows/docker-build.yml | 57 ------------------------------
 .github/workflows/docker.yml       | 56 -----------------------------
 2 files changed, 113 deletions(-)
 delete mode 100644 .github/workflows/docker-build.yml
 delete mode 100644 .github/workflows/docker.yml

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
deleted file mode 100644
index 84a8a93..0000000
--- a/.github/workflows/docker-build.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Docker Build
-
-on:
-  push:
-    branches: [main, develop]
-  pull_request:
-    branches: [main, develop]
-
-env:
-  HARBOR_REGISTRY: harbor.dataknife.net
-  IMAGE_NAME: library/high-command-ui
-
-jobs:
-  docker-build:
-    runs-on: self-hosted
-    
-    permissions:
-      contents: read
-      packages: write
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      
-      - name: Login to Harbor
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.HARBOR_REGISTRY }}
-          username: ${{ secrets.HARBOR_USERNAME }}
-          password: ${{ secrets.HARBOR_PASSWORD }}
-      
-      - name: Build Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./Dockerfile
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }},${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-          cache-from: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
-          cache-to: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
-      
-      - name: Verify Docker build
-        run: |
-          docker image ls | grep ${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}
-          echo "Docker image built successfully: ${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}"
-      
-      - name: Report Docker build status
-        run: |
-          echo "## Docker Build Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "✓ Docker image built successfully" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Image:** \`${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "**Commit:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
deleted file mode 100644
index 60f9038..0000000
--- a/.github/workflows/docker.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: Build and Push Docker Image
-
-on:
-  push:
-    branches:
-      - main
-      - master
-  pull_request:
-    branches:
-      - main
-      - master
-  workflow_dispatch:
-
-env:
-  HARBOR_REGISTRY: harbor.dataknife.net
-  IMAGE_NAME: library/high-command-ui
-
-jobs:
-  build-and-push:
-    runs-on: self-hosted
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Harbor
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.HARBOR_REGISTRY }}
-          username: ${{ secrets.HARBOR_USERNAME }}
-          password: ${{ secrets.HARBOR_PASSWORD }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable={{is_default_branch}}
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./Dockerfile
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
-          cache-to: type=registry,ref=${{ env.HARBOR_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max

From a1c8f947bea8dafad8b23406cd6a57c08988b088 Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 14:10:43 -0800
Subject: [PATCH 6/8] refactor: rename ci.yml to tests.yml

---
 .github/workflows/{ci.yml => tests.yml} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename .github/workflows/{ci.yml => tests.yml} (98%)

diff --git a/.github/workflows/ci.yml b/.github/workflows/tests.yml
similarity index 98%
rename from .github/workflows/ci.yml
rename to .github/workflows/tests.yml
index 2ff3d3e..184e107 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/tests.yml
@@ -1,4 +1,4 @@
-name: CI - Test and Build
+name: Tests
 on:
   workflow_dispatch:
   push:

From d1c5e5bd812c58b4fd59dda5fd3611de1d0c025a Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 14:18:23 -0800
Subject: [PATCH 7/8] docs: remove Harbor setup documentation (moved to GitLab
 CI)

---
 .github/HARBOR_SETUP.md | 72 -----------------------------------------
 1 file changed, 72 deletions(-)
 delete mode 100644 .github/HARBOR_SETUP.md

diff --git a/.github/HARBOR_SETUP.md b/.github/HARBOR_SETUP.md
deleted file mode 100644
index 2de4454..0000000
--- a/.github/HARBOR_SETUP.md
+++ /dev/null
@@ -1,72 +0,0 @@
-# Harbor Registry Setup
-
-This project uses Harbor registry at `harbor.dataknife.net` for Docker image storage.
-
-## GitHub Secrets Configuration
-
-To enable automated builds and pushes to Harbor, you need to configure the following secrets in your GitHub repository:
-
-### Required Secrets
-
-1. **HARBOR_USERNAME**: Harbor robot account username
-
-2. **HARBOR_PASSWORD**: Harbor robot account password/token
-
-### Setting up GitHub Secrets
-
-You can set secrets using the GitHub CLI:
-
-```bash
-gh secret set HARBOR_USERNAME --repo <owner>/<repo> --body "your-harbor-username"
-gh secret set HARBOR_PASSWORD --repo <owner>/<repo> --body "your-harbor-password"
-```
-
-Or via the web UI:
-1. Go to your GitHub repository
-2. Navigate to **Settings** → **Secrets and variables** → **Actions**
-3. Click **New repository secret**
-4. Add the secrets (values should be obtained from your Harbor administrator)
-
-## Local Development
-
-For local development, you can set environment variables:
-
-```bash
-export HARBOR_USERNAME='your-harbor-username'
-export HARBOR_PASSWORD='your-harbor-password'
-```
-
-Then use the Makefile targets:
-
-```bash
-# Login to Harbor
-make docker-login
-
-# Build and push images
-make docker-push
-
-# Pull images
-make docker-pull
-```
-
-## Docker Image Location
-
-The image is stored in the Harbor registry:
-- `harbor.dataknife.net/library/high-command-ui:latest`
-
-## Using Docker Compose
-
-Docker Compose is configured to pull images from Harbor automatically. Just run:
-
-```bash
-docker-compose pull
-docker-compose up -d
-```
-
-Make sure you're logged into Harbor first:
-
-```bash
-docker login harbor.dataknife.net \
-  -u 'your-harbor-username' \
-  -p 'your-harbor-password'
-```

From 8f664e36a99cce309ef3b44b34b5bf48c1ae246c Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 14:21:36 -0800
Subject: [PATCH 8/8] fix: apply Copilot review suggestions

- GitLab CI: Use --password-stdin for secure Harbor login
- GitLab CI: Build once and tag instead of building twice
- GitLab CI: Replace deprecated 'only' with 'rules'
- Makefile: Use --password-stdin for docker-login (security)
- GitHub Actions: Standardize checkout action to v5
- GitHub Actions: Remove --force flag, use credential helper for git push
- GitHub Actions: Quote cache value ('npm')
- GitHub Actions: Fix multiline command formatting
---
 .github/workflows/tests.yml | 26 ++++++++++----------------
 .gitlab-ci.yml              | 15 +++++++++------
 Makefile                    |  4 ++--
 3 files changed, 21 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 184e107..a35034e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -24,7 +24,7 @@ jobs:
       uses: actions/setup-node@v4
       with:
         node-version: ${{ matrix.node-version }}
-        cache: npm
+        cache: 'npm'
     - name: Install dependencies
       run: npm ci
     - name: Run ESLint
@@ -47,21 +47,14 @@ jobs:
         path: dist/
         retention-days: 5
     - name: Report build summary
-      run: 'echo "## Build Summary" >> $GITHUB_STEP_SUMMARY
-
+      run: |
+        echo "## Build Summary" >> $GITHUB_STEP_SUMMARY
         echo "" >> $GITHUB_STEP_SUMMARY
-
         echo "✓ TypeScript type checking passed" >> $GITHUB_STEP_SUMMARY
-
         echo "✓ Production build successful" >> $GITHUB_STEP_SUMMARY
-
         echo "" >> $GITHUB_STEP_SUMMARY
-
         echo "**Artifacts:**" >> $GITHUB_STEP_SUMMARY
-
         echo "- dist/ directory built with Node ${{ matrix.node-version }}" >> $GITHUB_STEP_SUMMARY
-
-        '
   push-to-gitlab:
     name: Push to GitLab
     runs-on: ubuntu-latest
@@ -70,15 +63,16 @@ jobs:
     if: always() && needs.test-and-build.result == 'success'
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         fetch-depth: 0
     - name: Push to GitLab
       env:
         GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
-      run: 'git config user.name "GitHub Actions"
-
+      run: |
+        git config user.name "GitHub Actions"
         git config user.email "actions@github.com"
-
-        git push https://oauth2:${GITLAB_TOKEN}@gitlab.com/dk-raas/dkai/high-command/high-command-ui.git HEAD:main --force
-        || echo "GitLab push failed"'
+        git remote add gitlab https://gitlab.com/dk-raas/dkai/high-command/high-command-ui.git || true
+        git config credential.helper '!f() { echo "username=oauth2"; echo "password=${GITLAB_TOKEN}"; }; f'
+        git fetch gitlab main || true
+        git push gitlab HEAD:main || echo "GitLab push failed"
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b528ee8..d9a6420 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -12,12 +12,15 @@ docker-build:
   services:
     - docker:dind
   before_script:
-    - docker login -u "$HARBOR_USERNAME" -p "$HARBOR_PASSWORD" $HARBOR_REGISTRY
+    - echo "$HARBOR_PASSWORD" | docker login -u "$HARBOR_USERNAME" --password-stdin $HARBOR_REGISTRY
   script:
     - |
-      # Build image
+      # Build image once
       docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest .
-      docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA .
+      
+      # Tag with commit SHA
+      docker tag $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest \
+        $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA
       
       # Push images
       docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest
@@ -29,8 +32,8 @@ docker-build:
           $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG
         docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG
       fi
-  only:
-    - main
-    - tags
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_TAG'
   tags:
     - docker
diff --git a/Makefile b/Makefile
index c26618b..36792d7 100644
--- a/Makefile
+++ b/Makefile
@@ -118,9 +118,9 @@ docker-login:
 		echo "Error: HARBOR_USERNAME and HARBOR_PASSWORD must be set"; \
 		exit 1; \
 	fi
-	docker login $(HARBOR_REGISTRY) \
+	@printf '%s\n' "$$HARBOR_PASSWORD" | docker login $(HARBOR_REGISTRY) \
 		-u "$$HARBOR_USERNAME" \
-		-p "$$HARBOR_PASSWORD"
+		--password-stdin
 
 docker-build:
 	docker build -t high-command-ui:latest .