fix(v0.4.0): state schemaVersion + Docker HEALTHCHECK / multi-arch / SHA-pin

[VirusAlex]

Summary

Closes audit findings HIGH H5/H6/H7/H8 + medium Docker SHA-pin and gosu-binary verification. Fourth of ~5 PRs gating v0.4.0.

Changes

State schemaVersion (H8)

Pre-v0.4.0 the on-disk JSON formats had no version field — a future format change would silently misinterpret older files (or vice-versa).

• JobState: new int schemaVersion (last component to keep the diff small at the 9 construction sites). CURRENT_SCHEMA_VERSION = 1.
• SidecarMeta: same.
• Both readers (JsonJobStore.loadFile/load, FileSidecarStore MetaJson) refuse files whose schemaVersion exceeds the supported version — log + skip, never destroy.
• Legacy v0.3.x files (no field) → Jackson defaults to 0 → treated as schema 1 on read. Existing transfers resume normally.

Bumping the constant in either record now signals an intentional break, the precondition for the v1.0.0 compatibility story.

Docker HEALTHCHECK (H5)

HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
    CMD curl -fsS http://127.0.0.1:7777/api/health > /dev/null

UBI 10 minimal doesn't ship curl; the Dockerfile installs curl-minimal (~6 MiB) right before the gosu COPY. Compose depends_on: condition: service_healthy and similar primitives now work.

Multi-arch image (H7)

release.yml docker/build-push-action: platforms: linux/amd64,linux/arm64. The Dockerfile already SHA-pins the per-arch gosu binary, so cross-build is straightforward. ARM users (RPi 4+, Apple Silicon, AWS Graviton) get a working docker pull.

:latest only for non-0.x (H6)

release.yml: while VERSION matches ^0., push only :<version>, NOT :latest. Matches the README claim and make_latest flag on the GitHub Release. Pre-v0.4.0 every 0.x tag silently overwrote :latest.

SHA-pinned base images + gosu binary

• alpine:3.20 → @sha256:d9e853e87e...
• eclipse-temurin:25-jre-ubi10-minimal → @sha256:c897ce903faf...
• gosu-amd64 / gosu-arm64 SHA-256 from upstream SHA256SUMS is verified after curl via sha256sum -c. Closes the "compromised GitHub release / MITM" supply-chain hole.

Test plan

• mvn test -Dtest=JsonJobStoreTest → 10 tests pass.
• mvn test -Dtest=FileSidecarStoreTest → 12 tests pass.
• mvn test -Dtest=ChunkBitmapTest → 11 tests pass.
• mvn test -Dtest=ArchitectureTest → 8 tests pass.
• CI green on Linux.
• Manual: pull a v0.3.x sidecar / job state from disk, run v0.4.0 against it, confirm transfers resume normally.
• Manual: bump CURRENT_SCHEMA_VERSION to 2 locally, write a job, downgrade pom to schemaVersion 1, confirm reader refuses with a clear log message.
• Manual: docker build -t test . succeeds on amd64 Linux; docker buildx build --platform linux/arm64 -t test . also succeeds (gosu SHA verification passes for both arches).

🤖 Generated with Claude Code