build: align Dockerfile with packer build and add docker-compose dev mounts

- Rebase Dockerfile onto almalinux9-base, install via uv tool install
- Remove dev artifacts (remotes.yaml, ca-bundle.pem) from image
- Mount gitignored dev files via docker-compose volumes instead
- Add .dockerignore to keep secrets out of build context
- Add pre-commit hook to validate docker build on Dockerfile changes
- Track docker-compose.yml in git (no secrets; dev files mounted as volumes)

.pre-commit-config.yaml

@@ -5,3 +5,13 @@ repos:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
+
+  - repo: local
+    hooks:
+      - id: docker-build
+        name: docker build
+        language: system
+        entry: buildah bud -t artifactapi:pre-commit-test .
+        pass_filenames: false
+        files: ^(Dockerfile|\.dockerignore|pyproject\.toml|src/)
+        stages: [pre-commit]

.woodpecker/build.yaml

@@ -1,9 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: docker-build
-    image: woodpeckerci/plugin-docker-buildx
-    settings:
-      repo: git.unkin.net/unkin/artifactapi
-      dry_run: true

.woodpecker/pre-commit.yaml

@@ -4,6 +4,8 @@ when:
 steps:
   - name: pre-commit
     image: git.unkin.net/unkin/almalinux9-base:20260308
+    environment:
+      BUILDAH_STORAGE_DRIVER: vfs
     commands:
+      - dnf install -y buildah
       - uvx pre-commit run --all-files
-

Makefile

@@ -1,7 +1,7 @@
 .PHONY: build install dev clean test lint format pre-commit tox docker-build docker-up docker-down docker-logs docker-rebuild docker-clean docker-restart
 
 build:
-	docker build -t artifactapi:dev .
+	docker build --no-cache -t artifactapi:latest .
 
 install: build