ci: Various Linux container and PyPi release improvements (#16)

* ci: release workflow fixes

* docs: Fix env var names

* docs: Improve Docker network configuration

* ci: Improve error checking in Docker release workflow

* ci: improve release workflow and container security

* ci: badges and better container scanning

* ci: Addition fixes

* ci: fix pypi release logic

.github/workflows/docker.yaml

@@ -113,13 +113,42 @@ jobs:
               ${{ env.IMAGE_NAME }}:test 2>&1 | \
             grep -q '"result"' && echo "Container test passed" || echo "Container test completed"
 
-      - name: Scan for vulnerabilities
-        if: github.event_name != 'pull_request'
-        uses: aquasecurity/trivy-action@master
+      - name: Cache Trivy vulnerability database
+        uses: actions/cache@v4
         with:
-          image-ref: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}
+          path: .trivy-cache
+          # Cache key based on OS and workflow file hash; refreshes when workflow changes
+          key: trivy-db-${{ runner.os }}-${{ hashFiles('.github/workflows/docker.yaml') }}
+          restore-keys: |
+            trivy-db-${{ runner.os }}-
+
+      - name: Scan for HIGH/CRITICAL vulnerabilities (fail build)
+        uses: aquasecurity/trivy-action@0.33.1
+        with:
+          image-ref: ${{ env.IMAGE_NAME }}:test
+          severity: "HIGH,CRITICAL"
+          exit-code: "1"
+          format: "table"
+          cache-dir: .trivy-cache
+
+      - name: Scan for MEDIUM/LOW vulnerabilities (warning only)
+        uses: aquasecurity/trivy-action@0.33.1
+        with:
+          image-ref: ${{ env.IMAGE_NAME }}:test
+          severity: "MEDIUM,LOW"
+          exit-code: "0"
+          format: "table"
+          cache-dir: .trivy-cache
+        continue-on-error: true
+
+      - name: Generate SARIF report for GitHub Security
+        if: github.event_name != 'pull_request'
+        uses: aquasecurity/trivy-action@0.33.1
+        with:
+          image-ref: ${{ env.IMAGE_NAME }}:test
           format: "sarif"
           output: "trivy-results.sarif"
+          cache-dir: .trivy-cache
         continue-on-error: true
 
       - name: Upload Trivy scan results

.github/workflows/pypi-release.yaml

@@ -164,8 +164,10 @@ jobs:
     name: Publish to TestPyPI
     needs: [build, test-install]
     runs-on: ubuntu-latest
-    # Only publish prereleases to TestPyPI
-    if: contains(github.ref, '-')
+    # Only publish alpha releases to TestPyPI for early testing.
+    # Beta and RC releases go to PyPI since they are closer to stable.
+    # This is intentional - do not change to contains(github.ref, '-').
+    if: contains(github.ref, '-alpha')
     environment:
       name: testpypi
       url: https://test.pypi.org/p/freecad-robust-mcp
@@ -188,8 +190,10 @@ jobs:
     name: Publish to PyPI
     needs: [build, test-install]
     runs-on: ubuntu-latest
-    # Only publish stable releases to PyPI
-    if: ${{ !contains(github.ref, '-') }}
+    # Publish beta, rc, and stable releases to PyPI (not alpha).
+    # Alpha releases are too experimental for PyPI - they go to TestPyPI only.
+    # This is intentional - do not change to !contains(github.ref, '-').
+    if: ${{ !contains(github.ref, '-alpha') }}
     environment:
       name: pypi
       url: https://pypi.org/p/freecad-robust-mcp
@@ -245,9 +249,10 @@ jobs:
             echo ""
           } >> "$GITHUB_STEP_SUMMARY"
 
-          if [[ "$REF_NAME" == *"-"* ]]; then
+          # Alpha releases go to TestPyPI only; beta, rc, and stable go to PyPI
+          if [[ "$REF_NAME" == *"-alpha"* ]]; then
               {
-                echo "**Type:** Prerelease (published to TestPyPI)"
+                echo "**Type:** Alpha prerelease (published to TestPyPI only)"
                 echo ""
                 echo "### Install from TestPyPI"
                 echo ""
@@ -255,6 +260,38 @@ jobs:
                 echo "pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ freecad-robust-mcp"
                 echo "\`\`\`"
               } >> "$GITHUB_STEP_SUMMARY"
+          elif [[ "$REF_NAME" == *"-beta"* ]]; then
+              {
+                echo "**Type:** Beta prerelease (published to PyPI)"
+                echo ""
+                echo "### Install from PyPI"
+                echo ""
+                echo "\`\`\`bash"
+                echo "pip install freecad-robust-mcp"
+                echo "\`\`\`"
+                echo ""
+                echo "Or with uv:"
+                echo ""
+                echo "\`\`\`bash"
+                echo "uv pip install freecad-robust-mcp"
+                echo "\`\`\`"
+              } >> "$GITHUB_STEP_SUMMARY"
+          elif [[ "$REF_NAME" == *"-rc"* ]]; then
+              {
+                echo "**Type:** Release candidate (published to PyPI)"
+                echo ""
+                echo "### Install from PyPI"
+                echo ""
+                echo "\`\`\`bash"
+                echo "pip install freecad-robust-mcp"
+                echo "\`\`\`"
+                echo ""
+                echo "Or with uv:"
+                echo ""
+                echo "\`\`\`bash"
+                echo "uv pip install freecad-robust-mcp"
+                echo "\`\`\`"
+              } >> "$GITHUB_STEP_SUMMARY"
           else
               {
                 echo "**Type:** Stable release (published to PyPI)"