[tonygermano]

Summary

This PR replaces the hand-maintained deploy/ Dockerfile, .env and compose file with the gomplate templates
from BrightCodeCompany/engine-docker (as of 450d8c0).
releases.yaml lists every supported release. render_docker_templates.sh renders a dockerfiles/<version>/
directory for each one, and the build workflow builds and pushes every rendered version as its own matrix job.

It also adds the 4.6.0 images and makes them latest.

Most of the work is Kaur Palang's, from the BCC repo. The commits keep Kaur as the author. The BCC code is
MPL-2.0, so each ported commit message lists the BCC source commits and every change from the BCC version.

Commits

1. Generate Dockerfiles and compose files from gomplate templates (Kaur Palang)
   • Adds releases.yaml, templates/ (Dockerfile.tpl, compose.yaml.tpl, entrypoint.sh),
     render_docker_templates.sh, and the rendered dockerfiles/4.5.2/.
   • Replaces deploy-image.yaml with build-and-deploy-images.yaml.
   • Labels, the image repository and the issue links point at OIE, not BCC.
   • The <version>-<distro> tag is only on the JRE images. On main today the Alpine JDK service also tags
     itself <version>-alpine-jre, so the JDK push can overwrite the JRE tag. BCC's template had the same
     problem.
   • The render script deletes dockerfiles/ before rendering, so a version removed from releases.yaml doesn't leave stale output. It also copies entrypoint.sh into each version directory.
2. Add 4.6.0 images and make them latest (Kaur Palang)
   • 4.6.0 is built on eclipse-temurin 21.0.11_10 (Ubuntu resolute and Alpine).
   • The README lists the tags for each version and what each floating tag points to.
3. Reflow and copy-edit README (Kaur Palang)
   • Wraps paragraphs at about 120 columns and fixes grammar and punctuation.
   • Explains where to file engine issues and where to file Docker image issues.
4. Build the image matrix from releases.yaml
   • A new list-versions job reads the version slugs from releases.yaml with yq. Adding a release no longer
     means editing the workflow too.
5. Remove the engine user's inherited groups on Ubuntu
   • On Ubuntu the base image's ubuntu user is renamed to engine. That user was still in adm, sudo,
     dialout and six other groups. usermod -G '' now removes all of them, leaving only the engine group.
     The Alpine images already had no extra groups.

Changes to the published images

	Before	After
Versions built	One, from deploy/.env	Every version in releases.yaml (4.5.2 and 4.6.0)
latest tags	4.5.2	4.6.0
4.5.2 base image	eclipse-temurin 17.0.15_6	eclipse-temurin 17.0.20.1_1 (still Ubuntu noble and Alpine)
Architectures	linux/amd64	linux/amd64 and linux/arm64
Engine user	UID/GID 14285 in deploy/Dockerfile	UID/GID 1000 (the base image's ubuntu user on Ubuntu)
Ubuntu engine user's groups	engine plus the ubuntu user's groups	engine only
File ownership	Separate chown layer	Set in the COPY layer

About the UID: UID/GID 1000 matches every image published to openintegrationengine/engine so far, even
though the deploy/Dockerfile it replaces says 14285. Existing volumes don't need their ownership changed.

Changes to the workflow

• It runs on pushes to main that change dockerfiles/**, or by hand.
• It builds and pushes in one step with docker compose build --push.
• It uses a concurrency group and the dockerhub environment.
• fail-fast is off, so a failure in one version doesn't cancel another version's job halfway through a push.
• Actions are updated to their current major versions (checkout@v6, setup-qemu-action@v4,
  setup-buildx-action@v4, setup-compose-action@v2, login-action@v4).
  The dockerhub environment must exist in the repo settings, with the DOCKERHUB_USERNAME variable and the DOCKERHUB_TOKEN secret, before this is merged. Otherwise the first build after the merge fails.

Making changes after this PR

Edit releases.yaml or templates/, then run ./render_docker_templates.sh (needs
gomplate) and commit the rendered dockerfiles/ with the change. Don't edit
dockerfiles/ by hand, because the next render overwrites it.

Follow-ups

These are stacked on this branch and will be opened as separate PRs:

• tony/ci-tooling: a workflow that checks the rendered dockerfiles/ are up to date, vulnerability report
  generation, and a workflow that updates the Docker Hub description from README.md.
• oie-4.7.0: the 4.7.0 images, and an update of the 4.6.0 base images to eclipse-temurin 21.0.12.1_1.

---

🤖 Generated with Claude Code