ci: split build into development and production jobs, scan production image with trivy

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -134,12 +134,9 @@ jobs:
             core.setOutput('databases', JSON.stringify(databaseChanged ? allDatabases : defaultDatabases));
             core.setOutput('modes', JSON.stringify(databaseChanged ? allModes : defaultModes));
 
-  build:
-    name: Build
+  build_development:
+    name: Build / Development
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -178,10 +175,40 @@ jobs:
           path: /tmp/${{ env.IMAGE }}.tar
           retention-days: 1
 
+  build_production:
+    name: Build / Production
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build Appwrite
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          tags: appwrite:${{ github.sha }}
+          target: production
+
       - name: Run Trivy vulnerability scanner on image
         uses: aquasecurity/trivy-action@0.35.0
         with:
-          image-ref: ${{ env.IMAGE }}
+          image-ref: appwrite:${{ github.sha }}
           format: 'sarif'
           output: 'trivy-image-results.sarif'
           severity: 'CRITICAL,HIGH'
@@ -196,7 +223,7 @@ jobs:
   unit:
     name: Tests / Unit
     runs-on: ubuntu-latest
-    needs: build
+    needs: build_development
     permissions:
       contents: read
       pull-requests: write
@@ -243,7 +270,7 @@ jobs:
   e2e_general:
     name: Tests / E2E / General
     runs-on: ubuntu-latest
-    needs: build
+    needs: build_development
     permissions:
       contents: read
       pull-requests: write
@@ -301,7 +328,7 @@ jobs:
   e2e_service:
     name: Tests / E2E / ${{ matrix.database }} (${{ matrix.mode }}) / ${{ matrix.service }}
     runs-on: ${{ matrix.runner || 'ubuntu-latest' }}
-    needs: [build, matrix]
+    needs: [build_development, matrix]
     permissions:
       contents: read
       pull-requests: write
@@ -438,7 +465,7 @@ jobs:
   e2e_abuse:
     name: Tests / E2E / Abuse (${{ matrix.mode }})
     runs-on: ubuntu-latest
-    needs: [build, matrix]
+    needs: [build_development, matrix]
     permissions:
       contents: read
       pull-requests: write
@@ -500,7 +527,7 @@ jobs:
   e2e_screenshots:
     name: Tests / E2E / Screenshots (${{ matrix.mode }})
     runs-on: ubuntu-latest
-    needs: [build, matrix]
+    needs: [build_development, matrix]
     permissions:
       contents: read
       pull-requests: write
@@ -569,7 +596,7 @@ jobs:
   benchmark:
     name: Benchmark
     runs-on: ubuntu-latest
-    needs: build
+    needs: build_development
     permissions:
       pull-requests: write
     steps: