ci: compose boot smoke + GHCR image publish

Adds a smoke job that boots postgres/redis/backend/frontend/traefik via
docker compose, polls the backend /health endpoint, verifies the
frontend responds, and tears down. Adds a tag-gated images job that
builds and pushes backend/frontend images to GHCR on v* tags.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -75,3 +75,64 @@ jobs:
 
       - name: Test
         run: npm test
+
+  smoke:
+    name: Compose boot smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Boot stack
+        run: |
+          docker compose -f infra/docker-compose.yml up -d --build postgres redis backend frontend traefik
+
+      - name: Wait for backend health
+        run: |
+          for i in $(seq 1 60); do
+            if curl -sf http://localhost:8082/health; then exit 0; fi
+            sleep 5
+          done
+          docker compose -f infra/docker-compose.yml logs --tail 50 backend
+          exit 1
+
+      - name: Check frontend responds
+        run: curl -sf http://localhost:3000/ -o /dev/null
+
+      - name: Teardown
+        if: always()
+        run: docker compose -f infra/docker-compose.yml down -v
+
+  images:
+    name: Publish images to GHCR
+    runs-on: ubuntu-latest
+    needs: [backend, frontend, smoke]
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      packages: write
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push backend
+        uses: docker/build-push-action@v6
+        with:
+          context: app/backend
+          push: true
+          tags: ghcr.io/${{ github.repository }}-backend:${{ github.ref_name }},ghcr.io/${{ github.repository }}-backend:latest
+
+      - name: Build and push frontend
+        uses: docker/build-push-action@v6
+        with:
+          context: app/frontend
+          push: true
+          tags: ghcr.io/${{ github.repository }}-frontend:${{ github.ref_name }},ghcr.io/${{ github.repository }}-frontend:latest

ROADMAP.md

@@ -450,8 +450,12 @@ security scans produce real reports, not empty tables.
       the service Cron tab (worker + api demo services). Scaling, Previews,
       HA and Security sections still show empty in demo mode — acceptable:
       those are interaction surfaces, not dashboards.
-- [ ] **CI**: GitHub Actions — build, lint, typecheck, tests, compose boot
-      smoke; publish container images to GHCR with semver tags.
+- [x] **CI**: existing workflow already covered Go tests, frontend
+      lint/typecheck/build, compose config validation, and startup
+      preflight. Added: compose **boot** smoke (postgres + redis + backend
+      + frontend + traefik up, `/health` poll, frontend check, teardown)
+      and a tag-gated GHCR publish job (backend + frontend images on
+      `v*` tags). Not yet observed green on GitHub — first run pending.
 - [ ] **Release**: `v1.0.0` tag, changelog, release notes, screenshots refresh
       in README.
 - [ ] Post-build workflow per repo rules: codebase-to-course, desloppify,