feat(repo): make xread standalone and self-hostable

Replace private shared dependencies with local implementations, keep the standalone crawl/search/serp build working, and add CI, GHCR image publishing, Dependabot updates, and green-only auto-merge automation.

Dockerfile

@@ -1,41 +1,43 @@
 # syntax=docker/dockerfile:1
-FROM lwthiker/curl-impersonate:0.6-chrome-slim-bullseye
+FROM node:22-bookworm-slim
 
-FROM node:22
+ENV PUPPETEER_SKIP_DOWNLOAD=true
 
 RUN apt-get update \
-    && apt-get install -y wget gnupg \
-    && wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
-    && sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' \
+    && apt-get install -y --no-install-recommends wget gnupg ca-certificates \
+    && mkdir -p /etc/apt/keyrings \
+    && wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | gpg --dearmor -o /etc/apt/keyrings/google-chrome.gpg \
+    && echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/google-chrome.gpg] https://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list \
     && apt-get update \
-    && apt-get install -y google-chrome-stable fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-freefont-ttf libxss1 zstd \
-    --no-install-recommends \
+    && apt-get install -y --no-install-recommends google-chrome-stable fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-freefont-ttf libxss1 zstd \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=0 /usr/local/lib/libcurl-impersonate.so /usr/local/lib/libcurl-impersonate.so
-
-RUN groupadd -r jina
-RUN useradd -g jina  -G audio,video -m jina
-USER jina
-
 WORKDIR /app
 
 COPY package.json package-lock.json ./
 RUN npm ci
 
-COPY build ./build
+COPY integrity-check.cjs tsconfig.json ./
+COPY scripts ./scripts
+COPY src ./src
 COPY public ./public
 COPY licensed ./licensed
 
-RUN rm -rf ~/.config/chromium && mkdir -p ~/.config/chromium
+RUN npm run build
+RUN NODE_ENV=dry-run node ./build/stand-alone/crawl.js \
+    && NODE_ENV=dry-run node ./build/stand-alone/search.js \
+    && NODE_ENV=dry-run node ./build/stand-alone/serp.js
 
-RUN NODE_COMPILE_CACHE=node_modules npm run dry-run
+RUN groupadd -r xread \
+    && useradd -g xread -G audio,video -m xread \
+    && chown -R xread:xread /app
+
+USER xread
 
 ENV OVERRIDE_CHROME_EXECUTABLE_PATH=/usr/bin/google-chrome-stable
-ENV LD_PRELOAD=/usr/local/lib/libcurl-impersonate.so CURL_IMPERSONATE=chrome116 CURL_IMPERSONATE_HEADERS=no
 ENV NODE_COMPILE_CACHE=node_modules
 ENV PORT=8080
 
 EXPOSE 3000 3001 8080 8081
 ENTRYPOINT ["node"]
-CMD [ "build/stand-alone/crawl.js" ]
+CMD ["build/stand-alone/crawl.js"]