ci: publish Docker images to GHCR and Docker Hub (#237)

* feat(ci): add node/python/full runtime variants to Docker publish

Add runtime image variants alongside existing build-tag variants:
- :node (pre-installed Node.js)
- :python (pre-installed Python)
- :full (Node.js + Python + all skill deps)

* feat(ci): add install scripts, release binaries, and Discord notifications

- scripts/install.sh: one-liner binary installer from GitHub Releases
- scripts/setup-docker.sh: interactive Docker setup with variant selection
  (alpine/node/python/full), auto-generates .env + docker-compose.yaml
  with persistent volumes for data, skills, workspace, storage
- release.yaml: build cross-platform binaries (linux/darwin × amd64/arm64)
  and attach to GitHub Release, notify Discord on new releases
- .gitignore: ignore Apple Double (._*) files from external volumes

* docs(docker): add pre-built image references and update docker-compose workflows

- Add `image:` directives to docker-compose.yml, docker-compose.selfservice.yml, and docker-compose.upgrade.yml pointing to ghcr.io/nextlevelbuilder/goclaw pre-built images
- Add Docker Hub mirror references (digitop/goclaw) for public access
- Document available image tags (latest, node, python, full, otel, tsnet, redis) with descriptions
- Update README with pre-built image pull instructions and semver tag examples
- Clarify deployment workflows: use pre-built images by default (no --build), add --build only when building from source
- Update upgrade workflow to pull pre-built images instead of rebuild
- Add note about build args requirement for otel/tsnet/redis overlays
- Update .dockerignore to exclude macOS temp files (._*)

* fix(ci): use claude_code_oauth_token instead of anthropic_api_key

.github/workflows/claude-code-review.yml

@@ -35,7 +35,7 @@ jobs:
         id: claude-review
         uses: anthropics/claude-code-action@v1
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
           plugins: 'code-review@claude-code-plugins'
           prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'

.github/workflows/claude.yml

@@ -34,7 +34,7 @@ jobs:
         id: claude
         uses: anthropics/claude-code-action@v1
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
           # This is an optional setting that allows Claude to read CI results on PRs
           additional_permissions: |

.github/workflows/docker-publish.yaml

@@ -19,31 +19,64 @@ jobs:
     strategy:
       matrix:
         include:
+          # ── Runtime variants ──
           - variant: latest
-            enable_otel: "false"
-            enable_tsnet: "false"
-            enable_redis: "false"
             suffix: ""
-          - variant: otel
-            enable_otel: "true"
-            enable_tsnet: "false"
-            enable_redis: "false"
-            suffix: "-otel"
-          - variant: tsnet
-            enable_otel: "false"
-            enable_tsnet: "true"
-            enable_redis: "false"
-            suffix: "-tsnet"
-          - variant: redis
             enable_otel: "false"
             enable_tsnet: "false"
-            enable_redis: "true"
-            suffix: "-redis"
+            enable_redis: "false"
+            enable_node: "false"
+            enable_python: "false"
+            enable_full_skills: "false"
+          - variant: node
+            suffix: "-node"
+            enable_otel: "false"
+            enable_tsnet: "false"
+            enable_redis: "false"
+            enable_node: "true"
+            enable_python: "false"
+            enable_full_skills: "false"
+          - variant: python
+            suffix: "-python"
+            enable_otel: "false"
+            enable_tsnet: "false"
+            enable_redis: "false"
+            enable_node: "false"
+            enable_python: "true"
+            enable_full_skills: "false"
           - variant: full
-            enable_otel: "true"
-            enable_tsnet: "true"
-            enable_redis: "true"
             suffix: "-full"
+            enable_otel: "false"
+            enable_tsnet: "false"
+            enable_redis: "false"
+            enable_node: "true"
+            enable_python: "true"
+            enable_full_skills: "true"
+          # ── Build-tag variants ──
+          - variant: otel
+            suffix: "-otel"
+            enable_otel: "true"
+            enable_tsnet: "false"
+            enable_redis: "false"
+            enable_node: "false"
+            enable_python: "false"
+            enable_full_skills: "false"
+          - variant: tsnet
+            suffix: "-tsnet"
+            enable_otel: "false"
+            enable_tsnet: "true"
+            enable_redis: "false"
+            enable_node: "false"
+            enable_python: "false"
+            enable_full_skills: "false"
+          - variant: redis
+            suffix: "-redis"
+            enable_otel: "false"
+            enable_tsnet: "false"
+            enable_redis: "true"
+            enable_node: "false"
+            enable_python: "false"
+            enable_full_skills: "false"
 
     steps:
       - name: Checkout
@@ -93,6 +126,9 @@ jobs:
             ENABLE_OTEL=${{ matrix.enable_otel }}
             ENABLE_TSNET=${{ matrix.enable_tsnet }}
             ENABLE_REDIS=${{ matrix.enable_redis }}
+            ENABLE_NODE=${{ matrix.enable_node }}
+            ENABLE_PYTHON=${{ matrix.enable_python }}
+            ENABLE_FULL_SKILLS=${{ matrix.enable_full_skills }}
             VERSION=${{ github.ref_name }}
           cache-from: type=gha,scope=${{ matrix.variant }}
           cache-to: type=gha,mode=max,scope=${{ matrix.variant }}

.github/workflows/release.yaml

@@ -10,12 +10,86 @@ permissions:
 jobs:
   release:
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.semrel.outputs.version }}
+      released: ${{ steps.semrel.outputs.version != '' }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - uses: go-semantic-release/action@v1
+      - id: semrel
+        uses: go-semantic-release/action@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           allow-initial-development-versions: true
+
+  # Build cross-platform binaries and attach to release
+  build-binaries:
+    needs: release
+    if: needs.release.outputs.released == 'true'
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+          - goos: linux
+            goarch: arm64
+          - goos: darwin
+            goarch: amd64
+          - goos: darwin
+            goarch: arm64
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Build binary
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          VERSION: v${{ needs.release.outputs.version }}
+        run: |
+          CGO_ENABLED=0 go build \
+            -ldflags="-s -w -X github.com/nextlevelbuilder/goclaw/cmd.Version=${VERSION}" \
+            -o goclaw .
+          tar -czf "goclaw-${{ needs.release.outputs.version }}-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz" goclaw
+
+      - name: Upload to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "v${{ needs.release.outputs.version }}" \
+            "goclaw-${{ needs.release.outputs.version }}-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz" \
+            --clobber
+
+  # Notify Discord on new release
+  notify-discord:
+    needs: [release, build-binaries]
+    if: needs.release.outputs.released == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Discord notification
+        env:
+          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          VERSION: v${{ needs.release.outputs.version }}
+        run: |
+          curl -fsSL -H "Content-Type: application/json" \
+            -d "{
+              \"embeds\": [{
+                \"title\": \"GoClaw ${VERSION} Released\",
+                \"url\": \"https://github.com/${{ github.repository }}/releases/tag/${VERSION}\",
+                \"color\": 5814783,
+                \"fields\": [
+                  {\"name\": \"Docker\", \"value\": \"\`docker pull digitop/goclaw:latest\`\", \"inline\": false},
+                  {\"name\": \"Install\", \"value\": \"\`curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/main/scripts/install.sh | bash\`\", \"inline\": false}
+                ],
+                \"footer\": {\"text\": \"${{ github.repository }}\"},
+                \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
+              }]
+            }" \
+            "$DISCORD_WEBHOOK_URL"