feat: include zentinel binary in Docker image for bundle validation

Download and SHA256-verify the zentinel binary during the Docker build
so bundle compilation works out-of-the-box in containerized deployments.

Author: raffaelschneider

Dockerfile

@@ -7,10 +7,25 @@ ARG RUNNER_IMAGE="debian:${DEBIAN_VERSION}"
 
 FROM ${BUILDER_IMAGE} AS builder
 
+ARG ZENTINEL_VERSION=26.02_13
+ARG TARGETARCH
+
 RUN apt-get update -y && \
     apt-get install -y build-essential git curl && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
 
+# Download and verify the zentinel binary (used for bundle validation)
+RUN ARCH=$(case "${TARGETARCH}" in arm64) echo "aarch64";; *) echo "x86_64";; esac) && \
+    TARBALL="zentinel-${ZENTINEL_VERSION}-linux-${ARCH}.tar.gz" && \
+    URL="https://github.com/zentinelproxy/zentinel/releases/download/${ZENTINEL_VERSION}/${TARBALL}" && \
+    curl -fSL "${URL}" -o "/tmp/${TARBALL}" && \
+    curl -fSL "${URL}.sha256" -o "/tmp/${TARBALL}.sha256" && \
+    cd /tmp && sha256sum -c "${TARBALL}.sha256" && \
+    tar -xzf "/tmp/${TARBALL}" -C /tmp && \
+    mv /tmp/zentinel /usr/local/bin/zentinel && \
+    chmod +x /usr/local/bin/zentinel && \
+    rm -f "/tmp/${TARBALL}" "/tmp/${TARBALL}.sha256"
+
 WORKDIR /app
 
 # Install hex + rebar
@@ -65,6 +80,10 @@ ENV PHX_SERVER=true
 # Copy the release from the build stage
 COPY --from=builder /app/_build/prod/rel/zentinel_cp ./
 
+# Copy the zentinel binary for bundle validation
+COPY --from=builder /usr/local/bin/zentinel /usr/local/bin/zentinel
+ENV ZENTINEL_BINARY=/usr/local/bin/zentinel
+
 # Copy entrypoint script
 COPY entrypoint.sh /app/entrypoint.sh
 

docs/CONFIGURATION.md

@@ -198,6 +198,7 @@ Supported providers: GitHub, GitLab, Bitbucket, Gitea, generic (HMAC-verified).
 | `S3_SECRET_ACCESS_KEY` | Yes | — | S3 secret key |
 | `S3_REGION` | No | `us-east-1` | S3 region |
 | `ZENTINEL_BINARY` | No | `zentinel` | Path to zentinel CLI |
+| `ZENTINEL_VERSION` | No | `26.02_13` | Zentinel binary version (Docker build arg) |
 | `GITHUB_WEBHOOK_SECRET` | No | — | GitHub webhook HMAC secret |
 | `OTEL_EXPORTER_OTLP_ENDPOINT` | No | — | OpenTelemetry endpoint |
 | `FORCE_SSL` | No | `false` | Redirect HTTP → HTTPS |

docs/DEVELOPMENT.md

@@ -4,7 +4,7 @@
 
 - Elixir 1.16+ / Erlang OTP 26+ (managed via [mise](https://mise.jdx.dev/))
 - Docker — for MinIO (bundle storage)
-- `zentinel` CLI binary — for configuration validation during bundle compilation
+- `zentinel` CLI binary — for configuration validation during bundle compilation (Docker deployment includes this automatically)
 
 ## Setup
 

docs/GETTING-STARTED.md

@@ -22,12 +22,13 @@ docker compose up
 What happens:
 
 1. Multi-stage Dockerfile builds the Elixir release (base: `hexpm/elixir:1.19.5-erlang-28.3.1-debian-bookworm`)
-2. PostgreSQL 17 starts (port 5432, user: `zentinel`, password: `zentinel`)
-3. MinIO starts (port 9000 API, port 9001 console)
-4. `minio-init` container creates the `zentinel-bundles` bucket
-5. App waits for PostgreSQL readiness (`pg_isready`), runs Ecto migrations
-6. Database seeded with default org and admin user
-7. Control plane available at **http://localhost:4000**
+2. The `zentinel` binary is downloaded and verified during image build — bundle validation works out-of-the-box
+3. PostgreSQL 17 starts (port 5432, user: `zentinel`, password: `zentinel`)
+4. MinIO starts (port 9000 API, port 9001 console)
+5. `minio-init` container creates the `zentinel-bundles` bucket
+6. App waits for PostgreSQL readiness (`pg_isready`), runs Ecto migrations
+7. Database seeded with default org and admin user
+8. Control plane available at **http://localhost:4000**
 
 MinIO console: **http://localhost:9001** (credentials: `minioadmin` / `minioadmin`)
 
@@ -58,6 +59,7 @@ docker compose down -v
 | `S3_SECRET_ACCESS_KEY` | `minioadmin` | MinIO secret key |
 | `S3_REGION` | `us-east-1` | S3 region |
 | `PORT` | `4000` | HTTP listen port |
+| `ZENTINEL_VERSION` | `26.02_13` | Zentinel binary version (Docker build arg) |
 
 ## Local Development