alpine-packages/docs/project-review.md

Project Review and Development Roadmap

Current State

This repository packages four upstream services for Alpine 3.24, with source builds, binary repackages, OpenRC integration, Docker-based local builds, and CI publication to the Gitea Alpine registry. Package selection avoids rebuilding unchanged versions already present in the registry.

The main release risks are missing retained build artifacts, permissive duplicate publish handling, rolling toolchain inputs, and limited end-to-end service validation. Documentation and test defaults must remain synchronized with each APKBUILD version.

Prioritized Goals

1. Reproducible, auditable releases. Split build and publish work so publish consumes a retained APK artifact plus a checksum manifest; verify registry contents after upload and reject mismatched duplicate versions.
2. Build security visibility. Generate an installed-rootfs CycloneDX SBOM and advisory Trivy report for every package and architecture selected by CI. Retain reports as Gitea workflow artifacts.
3. Service-level confidence. Add bounded readiness checks for Gitea, LavinMQ, and GreptimeDB; retain SeaweedFS role startup coverage.
4. Automation correctness. Add fixture-based tests for package selection, APKINDEX parsing, metadata/version drift, and registry error paths.
5. Developer feedback and cost. Record build durations/cache outcomes, keep package-scoped validation, and add a scheduled update-report workflow.

Security Reports

mise run apk:security-report scans the installed root filesystem for each selected local package. It writes advisory reports under:

packages/security-reports/<package>/<architecture>/
├── trivy.json
├── sbom.cdx.json
└── summary.md

The scan includes the package, its selected subpackages, and resolved runtime dependencies from the signed local repository. Findings do not block a build yet; report generation, package installation, and report validation do.