feat: add GitHub Action and Docker support

[pixincreate]

Summary

Adds the infrastructure for running KeyWatch in CI/CD environments.

Changes

GitHub Action (.github/actions/keywatch-scan/action.yml)

Composite action that installs and runs key-watch with configurable inputs:

• paths - files or directories to scan (default: .)
• exit-mode - strict (default), critical, or always
• output - path for JSON report
• verbose - detailed console output
• Downloads binary from GitHub releases if not pre-installed
• Exposes findings-count and exit-code outputs
• Writes summary step to $GITHUB_STEP_SUMMARY

Dockerfile

Multi-stage build:

• Build: rust:1.85-alpine with musl target
• Runtime: alpine:3.21 with ca-certificates
• Bundles detectors.toml at /etc/keywatch/detectors.toml
• Respects KEYWATCH_CONFIG_PATH env var

Docker Publish Workflow

• Triggered on `v*' version tags or manual dispatch
• Builds and pushes to ghcr.io/pixincreate/keywatch
• Tags: semver (1.2.0, 1.2), short SHA

Usage

- uses: pixincreate/KeyWatch/.github/actions/keywatch-scan@master
  with:
    paths: './src'
    exit-mode: 'critical'

docker run ghcr.io/pixincreate/keywatch:latest scan /workspace

Closes the Action and Docker items from #71.

[Copilot]

🟡 Not ready to approve

The new composite action and Docker publish workflow contain functional issues (verbose flag always enabled, platform/asset resolution and install assumptions, and an unused workflow_dispatch input) that can break CI/CD usage.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Adds CI/CD infrastructure for KeyWatch by introducing a composite GitHub Action for scanning, a multi-stage Docker image build, and a GHCR publish workflow, plus workflow/version updates and documentation entries.

Changes:

• Added a composite GitHub Action (.github/actions/keywatch-scan/action.yml) to install and run key-watch with configurable inputs and outputs.
• Added container support via a multi-stage Dockerfile and a new .dockerignore.
• Added a Docker publish workflow to push images to GHCR; updated existing CI/release workflows to newer action versions.

File summaries

File	Description
Dockerfile	Adds multi-stage build/runtime containerization for key-watch and bundles detectors.toml.
CHANGELOG.md	Documents the new GitHub Action and Docker-related additions/changes.
.github/workflows/release.yml	Updates action versions used in the release pipeline.
.github/workflows/docker-publish.yml	Introduces GHCR Docker image build/publish workflow on tags/manual dispatch.
.github/workflows/ci.yml	Updates action versions used in CI (checkout, typos, rust-cache).
.github/actions/keywatch-scan/action.yml	Introduces a composite Action to download/install key-watch and run scans with outputs/summary.
.dockerignore	Optimizes Docker build context by excluding git metadata, build output, and misc files.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 6
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.