Audit CI/CD workflows and GitHub Actions for optimization opportunities

[webbpinner]

Summary

Audit the repo's CI/CD setup (currently a single GitHub Actions workflow, .github/workflows/docker-build-and-test.yml) and look for ways to make it more thorough, faster, and lower-maintenance. This is a scoping/audit issue - not a mandate to implement everything below, just a punch list to work through and prioritize.

What exists today

• One workflow, docker-build-and-test.yml, triggered on push/PR to 2.x and dev. It copies the .dist config templates into place, builds the image via docker-compose up -d --build, runs docker-compose ps, then tears down. No other workflows exist (no lint/test job, no CodeQL, no Dependabot config, no release automation).
• Linting (eslint) and the full test suite (@hapi/lab, 143 tests) currently only run locally via the Husky pre-commit hook (lint-staged + npm run start-test) - they are not run in CI at all.
• Neither dev nor 2.x has any branch protection rules configured (confirmed via gh api repos/.../branches/{dev,2.x}/protection -> 404 "Branch not protected"), so CI passing isn't actually required before merge.

Specific things worth checking during the audit

• No CI test/lint gate. npm run lint and npm run start-test never run in GitHub Actions - only via the local pre-commit hook, which can be skipped (--no-verify) or simply isn't installed on a contributor's machine. Consider adding a test.yml workflow that runs lint + the lab suite against a real mongodb service container on every push/PR.
• Outdated actions. actions/checkout@v3 and docker/setup-buildx-action@v2 are behind current major versions (v4/v5), which matters as GitHub deprecates older Node-based action runtimes.
• Legacy docker-compose install. The workflow does sudo apt-get install -y docker-compose, which pulls Ubuntu's docker-compose package - the unmaintained Python-based v1 (currently 1.29.2 via apt on ubuntu-latest/noble). GitHub-hosted runners already ship the docker compose v2 plugin; the apt-get step is unnecessary and installs stale software with different quirks than what most deployers will actually run.
• No real health check. The "Build and Run Docker Compose" step only checks docker-compose ps right after starting the containers - it doesn't verify the server actually came up (e.g. curl -f http://localhost:8000/sealog-server/documentation). A crash-looping container could still pass this job. The "Run tests or validation" step is present but fully commented out.
• Dead/leftover steps. sudo mkdir -p /data/sealog-files is now unused now that docker-compose.yml.dist stores files in a named volume rather than a host bind mount (see Add .env.dist template for environment-based configuration #92/Add .env.dist and wire up automatic .env loading #93) - worth pruning along with other commented-out scaffolding (# services: block).
• No dependency caching. Neither npm (actions/setup-node with cache: npm) nor Docker layer caching (actions/cache or docker/build-push-action with a GHA cache backend) is used, so every run reinstalls/rebuilds from scratch.
• No dependency-update automation. No Dependabot (or Renovate) config exists; Node/Python dependency bumps are currently manual commits (see recent history: "Update Node.js and Python dependencies").
• No image publishing. The Docker image is built and discarded every run. If there's an intent to publish versioned images (e.g. to GHCR or Docker Hub) on tag/release, that pipeline doesn't exist yet - worth deciding if it's in scope for this project.
• No branch protection. Neither dev nor 2.x requires the existing check to pass, so a red CI run doesn't actually block a merge. Worth deciding whether to turn this on now that there's a working PR-based flow (see [[feedback_pr_base_branch]] convention of PRs targeting dev).
• Python side (misc/) has no CI at all. misc/python_sealog and the aux-data-manager framework have no lint (flake8/pylint, though these are referenced in package.json's lint-staged for pre-commit) or test coverage in Actions.

Non-goals

This issue is for the audit and recommendations, not a single PR that does everything above - expect follow-up issues/PRs per finding once prioritized.

[webbpinner]

Priority items 1 & 2 done:

1. CI test/lint gate - Add CI workflow to run lint and tests #95 added `.github/workflows/test.yml` (`lint` + `test` jobs, the latter against a `mongo:7` service container). Merged into `dev`.
2. Branch protection - both `dev` and `2.x` now require the `lint` and `test` checks plus 1 approving review before merge, with `enforce_admins: false` so direct admin pushes/merges (e.g. the existing `Merge branch 'dev' into 2.x` pattern) still work.

Remaining backlog from the original audit is still open: outdated actions and legacy `docker-compose` v1 install in the existing `docker-build-and-test.yml`, no real health check there, no Dependabot, no image publishing/CD, and no CI for the Python `misc/` tooling.